‫ﭘﺮوژﻩ درس ‪SSD‬‬
‫ﻣﻮﻋﺪ ﺗﺤﻮﻳﻞ‪ :‬ﺳﻪﺷﻨﺒﻪ ‪ ۸۹/۱۲/۱۰‬ﺑﻪ ﺻﻮﺭﺕ ﺣﻀﻮﺭﯼ‬
‫) ﺩﺭ ﺻﻮﺭﺕ ﻋﺪﻡ ﺍﻋﻼﻡ ﻧﺎﻡ ﺍﻋﻀﺎ ﺗﺎ ﺗﺎﺭﻳﺦ ‪ ۱۰‬ﺑﻬﻤﻦ‪ ،‬ﺑﻪ ﺍﺯﺍﯼ ﻫﺮ ﺭﻭﺯ ﺗﺄﺧﻴﺮ ‪ ٠.٢٥‬ﺍﺯ ﻧﻤﺮﮤ ﭘﺮﻭﮊﻩ ﮐﺎﺳﺘﻪ ﻣﯽﺷﻮﺩ‪(.‬‬
‫ﻧﻤﺮﻩ‪ ۶ :‬ﺍﻟﯽ ‪۸‬‬
‫ﺍﻳﻦ ﭘﺮﻭﮊﻩ ﺑﻪ ﻧﻮﻋﯽ ﮔﺴﺘﺮﺵ ﺗﻤﺮﻳﻦ ﺷﻤﺎﺭﮤ ‪ ٣‬ﺍﺳﺖ‪ .‬ﻫﺪﻑ ﺍﺻﻠﯽ ﭘﺮﻭﮊﻩ ﻧﻮﺷﺘﻦ ﻳـﮏ ‪ Packer‬ﻭ ‪ Protector‬ﺑـﺮﺍﯼ ﻓﺎﻳﻠﻬـﺎﯼ ‪ PE‬ﺍﺳـﺖ‪.‬‬
‫ﺑﺮﺍﯼ ﺍﻳﻦ ﻣﻨﻈﻮﺭ ﻓﺮﺿﻬﺎﯼ ﺯﻳﺮ ﺭﺍ ﺩﺭ ﻧﻈﺮ ﺑﮕﻴﺮﻳﺪ‪:‬‬
‫‪ (۱‬ﺑﺮﻧﺎﻣﻪ ﺷﻤﺎ ‪ Prog.exe‬ﻧﺎﻡ ﺩﺍﺭﺩ‪.‬‬
‫‪ (۲‬ﻭﺭﻭﺩﯼ ﺑﺮﻧﺎﻣﻪ ﻳﮏ ﻓﺎﻳﻞ ‪ PE‬ﺳﺎﺩﻩ ﺑﻪ ﻧﺎﻡ ‪ In.exe‬ﺍﺳﺖ‪.‬‬
‫‪ Prog.exe (۳‬ﭘﺲ ﺍﺯ ﭘﺮﺩﺍﺯﺵ ‪ ،In.exe‬ﻳﮏ ﻓﺎﻳﻞ ‪ PE‬ﺑﻪ ﻧﺎﻡ ‪ Out.exe‬ﺭﺍ ﺧﺮﻭﺟـﯽ ﻣـﯽ ﺩﻫـﺪ‪ .‬ﻓﺎﻳـﻞ ‪ Out.exe‬ﺑﺎﻳـﺪ ﻫﻤﺎﻧﻨـﺪ‬
‫‪ In.exe‬ﺍﺟﺮﺍ ﺷﺪﻩ ﻭ ﺍﺯ ﺩﻳﺪ ﮐﺎﺭﺑﺮﯼ ﮐﻪ ﺁﻥ ﺭﺍ ﺍﺟﺮﺍ ﻣﯽﮐﻨﺪ‪ ،‬ﺗﻔﺎﻭﺗﯽ ﺩﻳﺪﻩ ﻧﺸﻮﺩ‪.‬‬
‫‪ Out.exe‬ﺩﺭ ﺣﻘﻴﻘﻴﺖ ﻓﺸﺮﺩﻩ ﺷﺪﮤ ‪ In.exe‬ﺍﺳﺖ‪ .‬ﺑﺮﺍﯼ ﺍﻳﻦ ﻣﻨﻈﻮﺭ‪Section Prog.exe ،‬ﻫﺎﯼ ﮐﺪ ﻭ ﺩﺍﺩﮤ ‪ In.exe‬ﺭﺍ ﻓﺸـﺮﺩﻩ ﮐـﺮﺩﻩ ﻭ‬
‫ﺑﻪ ‪Section‬ﻫﺎﯼ ﻣﺘﻨﺎﻇﺮ ﺩﺭ ‪ Out.exe‬ﻣﯽﻧﻮﻳﺴﺪ‪ .‬ﻓﺸﺮﺩﻩ ﺳﺎﺯﯼ ‪ IAT‬ﻧﻤﺮﮤ ﺍﺿﺎﻓﯽ ﺩﺍﺭﺩ‪.‬‬
‫‪Out.exe‬‬
‫‪In.exe‬‬
‫‪Header‬‬
‫‪Packed‬‬
‫‪Data‬‬
‫‪Packed IAT‬‬
‫)‪(Optional‬‬
‫‪Loader‬‬
‫)‪(Unpacker‬‬
‫‪Prog.exe‬‬
‫‪Packed‬‬
‫‪Code‬‬
‫‪Header‬‬
‫‪Code‬‬
‫‪Data‬‬
‫‪IAT‬‬
‫ﺑﺮﺍﯼ ﻓﺸﺮﺩﻩ ﺳﺎﺯﯼ ﻭ ﻏﻴﺮ ﻓﺸﺮﺩﻩﺳﺎﺯﯼ ﻣﯽﺗﻮﺍﻧﻴﺪ ﺍﺯ ﮐﺘﺎﺑﺨﺎﻧﻪﻫﺎﻳﯽ ﮐﻪ ﺑﺪﻳﻦ ﻣﻨﻈﻮﺭ ﻧﻮﺷﺘﻪ ﺷﺪﻩﺍﻧﺪ ﺍﺳﺘﻔﺎﺩﻩ ﮐﻨﻴﺪ )ﻣﺜﻼً ‪ .(zlib‬ﺍﻟﺒﺘﻪ ﺍﻳـﻦ‬
‫ﮐﺘﺎﺑﺨﺎﻧﻪ ﻧﺒﺎﻳﺪ ﻣﺨﺼﻮﺹ ‪ pack‬ﮐﺮﺩﻥ ﻓﺎﻳﻞ ‪ PE‬ﺑﺎﺷﺪ )ﻣﺜﻞ ‪.(UPX‬‬
‫ﻗﺴﻤﺖ دوم‪:‬‬
‫ﻣﺎﮊﻭﻝ ‪ loader‬ﺷﻤﺎ ﺑﺎﻳﺪ ﺳﻪ ﺳﺎﺯ ﻭ ﮐﺎﺭ ‪ Anti-Debugging‬ﺭﺍ ﻧﻴﺰ ﭘﻴﺎﺩﻩﺳﺎﺯﯼ ﮐﻨﺪ؛ ﺑﻪ ﮔﻮﻧـﻪﺍﯼ ﮐـﻪ ‪ debugging‬ﺗﻮﺳّـﻂ ‪OllyDbg‬‬
‫ﺍﻣﮑﺎﻥﭘﺬﻳﺮ ﻧﺒﺎﺷﺪ‪ .‬ﺑﺮﺧﯽ ﺍﺯ ﺳﺎﺯ ﻭ ﮐﺎﺭﻫﺎﯼ ‪ Anti-Debugging‬ﺩﺭ ﮔﺰﻳﻨﻪﻫـﺎﯼ ﺩﻭ ‪ Plugin‬ﻣﻌـﺮﻭﻑ ﺍﺯ ‪Olly Advanced) OllyDbg‬‬
‫ﻭ ‪ (PhantOm‬ﺫﮐﺮ ﺷﺪﻩﺍﻧﺪ )ﺩﺭ ﺣﻘﻴﻘﻴﺖ ﺍﻳﻦ ﺩﻭ ‪ Plugin‬ﺳﺎﺯ ﻭ ﮐﺎﺭﻫﺎﯼ ‪ Anti Anti-Debugging‬ﺭﺍ ﻓﺮﺍﻫﻢ ﻣﯽﮐﻨﻨﺪ(‪:‬‬
‫ﺗﺤﻮﯾﻞ‪:‬‬
‫ﻧﮑﺘﮥ ‪ :١‬ﺑﺮﻧﺎﻣﻪ ﺭﺍ ﺑﻪ ﺯﺑﺎﻥ ﺩﻟﺨﻮﺍﻩ ﺧﻮﺩ ﺑﻨﻮﻳﺴﺪ‪ .‬ﭘﻠﺘﻔﺮﻣﻬﺎﯼ ﻭﻳﻨﺪﻭﺯ ﻭ ﻟﻴﻨﻮﮐﺲ ﻣﻮﺭﺩ ﭘﺬﻳﺮﺵ ﺍﺳﺖ‪.‬‬
‫ﻧﮑﺘﮥ ‪ :۲‬ﻣﯽﺗﻮﺍﻧﻴﺪ ﺩﺭ ﻗﺎﻟﺐ ﺗﻴﻤﻬﺎﯼ ‪ ۵‬ﻳﺎ ‪ ۶‬ﻧﻔﺮﻩ ﭘﺮﻭﮊﻩ ﺭﺍ ﺑﻨﻮﻳﺴﻴﺪ‪.‬‬
‫ﻧﮑﺘﮥ ‪ :۳‬ﺗﺤﻮﻳﻞ ﭘﺮﻭﮊﻩ ﺑﻪ ﺻﻮﺭﺕ ﺣﻀﻮﺭﯼ ﺧﻮﺍﻫﺪ ﺑﻮﺩ‪ .‬ﻟﻄﻔًﺎ ﺗﺎ ﺗﺎﺭﻳﺦ ‪ ۱۰‬ﺑﻬﻤﻦ ﻧﺎﻡ ﺍﻋﻀﺎﯼ ﺗﻴﻢ ﺧﻮﺩ ﺭﺍ ﺑﻪ ﻣﻦ ﺍﻳﻤﻴﻞ ﮐﻨﻴﺪ ﺗﺎ ﺑﺘﻮﺍﻧﻢ ﺑﺮﺍﯼ‬
‫ﺷﻤﺎ ﺯﻣﺎﻥ ﺗﺤﻮﻳﻞ ﻣﻌﻴّﻦ ﮐﻨﻢ‪ .‬ﻫﺮ ﺗﻴﻤﯽ ﮐﻪ ﺯﻭﺩﺗﺮ ﻧﺎﻡ ﺍﻋﻀﺎﻳﺶ ﺭﺍ ﺑﻔﺮﺳﺘﺪ ﻣـﯽﺗﻮﺍﻧـﺪ ﺩﺭ ﺳـﺎﻋﺎﺕ ﭘﺎﻳـﺎﻥ ﺭﻭﺯ ﭘـﺮﻭﮊﻩ ﺭﺍ ﺗﺤﻮﻳـﻞ ﺩﻫـﺪ‪ ،‬ﻭ‬
‫ﺑﻨﺎﺑﺮﺍﻳﻦ ﻭﻗﺖ ﺑﻴﺸﺘﺮﯼ ﺧﻮﺍﻫﺪ ﺩﺍﺷﺖ‪ .‬ﺩﺭ ﺻﻮﺭﺕ ﻋﺪﻡ ﺍﻋﻼﻡ ﻧﺎﻡ ﺍﻋﻀﺎ ﺗﺎ ﺗﺎﺭﻳﺦ ‪ ۱۰‬ﺑﻬﻤﻦ‪ ،‬ﺑـﻪ ﺍﺯﺍﯼ ﻫـﺮ ﺭﻭﺯ ﺗـﺄﺧﻴﺮ ‪ ٠.٢٥‬ﺍﺯ ﻧﻤـﺮﮤ ﭘـﺮﻭﮊﻩ‬
‫ﮐﺎﺳﺘﻪ ﻣﯽﺷﻮﺩ‪.‬‬