锘??xml version="1.0" encoding="utf-8" standalone="yes"?>
鍒涘緩鏃墮棿錛?005-03-09
鏂囩珷灞炴э細杞澆
鏂囩珷鎻愪氦錛?a >cisocker (cisocker_at_163.com)
by sunwear [E.S.T]
2004/10/02
shellcoder@163.com
姝ゆ枃鍙兘璇存槸涓綃囩瑪璁幫紝鏄叧浜庢湰鏈篈PI鐨?鏈満API鏄櫎浜哤in32 API錛孨T騫沖彴寮鏀句簡鍙︿竴涓熀鏈帴鍙c傛湰鏈篈PI涔熻寰堝浜烘墍鐔熸倝錛屽洜涓哄唴鏍告ā寮忔ā鍧椾綅浜庢洿浣庣殑緋葷粺綰у埆錛屽湪閭d釜綰у埆涓婄幆澧冨瓙緋葷粺鏄笉鍙鐨勩傚敖綆″姝わ紝騫朵笉闇瑕侀┍鍔ㄧ駭鍒幓璁塊棶榪欎釜鎺ュ彛錛屾櫘閫氱殑Win32紼嬪簭鍙互鍦ㄤ換浣曟椂鍊欏悜涓嬭皟鐢ㄦ湰鏈篈PI銆傚茍娌℃湁浠諱綍鎶鏈笂鐨勯檺鍒訛紝鍙笉榪囧井杞笉鏀寔榪欑搴旂敤寮鍙戞柟娉曘?nbsp;
User32.dll,kernel32.dll,shell32.dll,gdi32.dll,rpcrt4.dll,comctl32.dll,advapi32.dll,version.dll絳塪ll浠h〃浜哤in32 API鐨勫熀鏈彁渚涜呫俉in32 API涓殑鎵鏈夎皟鐢ㄦ渶緇堥兘杞悜浜唍tdll.dll錛屽啀鐢卞畠杞彂鑷硁toskrnl.exe銆俷tdll.dll鏄湰鏈?API鐢ㄦ埛妯″紡鐨勭粓绔傜湡姝g殑鎺ュ彛鍦╪toskrnl.exe閲屽畬鎴愩備簨瀹炰笂錛屽唴鏍告ā寮忕殑椹卞姩澶ч儴鍒嗘椂闂磋皟鐢ㄨ繖涓ā鍧楋紝濡傛灉瀹冧滑璇鋒眰緋葷粺鏈嶅姟銆侼tdll.dll鐨勪富瑕佷綔鐢ㄥ氨鏄鍐呮牳鍑芥暟鐨勭壒瀹氬瓙闆嗗彲浠ヨ鐢ㄦ埛妯″紡涓嬭繍琛岀殑紼嬪簭璋冪敤銆侼tdll.dll閫氳繃杞歡涓柇int 2Eh榪涘叆ntoskrnl.exe錛屽氨鏄氳繃涓柇闂ㄥ垏鎹PU鐗規潈綰с傛瘮濡俴ernel32.dll瀵煎嚭鐨勫嚱鏁癉eviceIoControl()瀹為檯涓婅皟鐢╪tdll.dll涓鍑虹殑NtDeviceIoControlFile()錛屽弽姹囩紪涓涓嬭繖涓嚱鏁板彲浠ョ湅鍒幫紝EAX杞藉叆magic鏁?x38錛屽疄闄呬笂鏄郴緇熻皟鐢ㄥ彿錛岀劧鍚嶦DX鎸囧悜鍫嗘爤銆傜洰鏍囧湴鍧鏄綋鍓嶅爢鏍堟寚閽圗SP+4錛屾墍浠DX鎸囧悜榪斿洖鍦板潃鍚庨潰涓涓紝涔熷氨鏄寚鍚戝湪榪涘叆NtDeviceIoControlFile()涔嬪墠瀛樺叆鍫嗘爤鐨勪笢瑗褲備簨瀹炰笂灝辨槸鍑芥暟鐨勫弬鏁般備笅涓涓寚浠ゆ槸int 2Eh錛岃漿鍒頒腑鏂弿榪扮琛↖DT浣嶇疆0x2E澶勭殑涓柇澶勭悊紼嬪簭銆?br>
鍙嶇紪姹囪繖涓嚱鏁板緱鍒幫細
mov eax, 38h
lea edx, [esp+4]
int 2Eh
ret 28h
褰撶劧int 2E鎺ュ彛涓嶄粎浠呮槸綆鍗曠殑API璋冪敤璋冨害鍛橈紝浠栨槸浠庣敤鎴鋒ā寮忚繘鍏ュ唴鏍告ā寮忕殑main gate銆?br>
W2k Native API鐢?48涓繖涔堝鐞嗙殑鍑芥暟緇勬垚錛屾瘮NT 4.0澶氫簡37涓傚彲浠ヤ粠ntdll.dll鐨勫鍑哄垪琛ㄤ腑寰堝鏄撹鍑烘潵錛氬墠緙Nt銆侼tdll.dll涓鍑轟簡249涓紝鍘熷洜鍦ㄤ簬NtCurrentTeb()涓轟竴涓函鐢ㄦ埛妯″紡鍑芥暟錛屾墍浠ヤ笉闇瑕佷紶緇欏唴鏍搞備護浜烘儕濂囩殑鏄紝浠呬粎Native API鐨勪竴涓瓙闆嗚兘澶熶粠鍐呮牳妯″紡璋冪敤銆傝屽彟涓鏂歸潰錛宯toskrnl.exe瀵煎嚭浜嗕袱涓狽t*絎﹀彿錛屽畠浠笉瀛樺湪浜巒tdll.dll涓? NtBuildNumber, NtGlobalFlag銆傚畠浠笉鎸囧悜鍑芥暟錛屼簨瀹炰笂錛屾槸鎸囧悜ntoskrnl.exe鐨勫彉閲忥紝鍙互琚嬌鐢–緙栬瘧鍣╡xtern鍏抽敭瀛楃殑椹卞姩妯″潡瀵煎叆銆侼tdll.dll鍜宯toskrnl.exe涓兘鏈変袱縐嶅墠緙Nt*,Zw*銆備簨瀹炰笂ntdll.dll涓弽姹囩紪緇撴灉涓よ呮槸涓鏍風殑銆傝屽湪ntoskrnl.exe涓紝nt鍓嶇紑鎸囧悜鐪熸鐨勪唬鐮侊紝鑰寊w榪樻槸涓涓猧nt 2Eh鐨剆tub銆備篃灝辨槸璇磟w*鍑芥暟闆嗛氳繃鐢ㄦ埛妯″紡鍒板唴鏍告ā寮忛棬浼犻掔殑錛岃孨t*絎﹀彿鐩存帴鎸囧悜妯″紡鍒囨崲浠ュ悗鐨勪唬鐮併侼tdll.dll涓殑NtCurrentTeb()娌℃湁鐩稿搴旂殑zw鍑芥暟銆侼toskrnl騫朵笉瀵煎嚭閰嶅鐨凬t/zw鍑芥暟銆傛湁浜涘嚱鏁板彧浠ヤ竴縐嶆柟寮忓嚭鐜般?br>
2Eh涓柇澶勭悊紼嬪簭鎶奅AX閲岀殑鍊間綔涓烘煡鎵捐〃涓殑绱㈠紩錛屽幓鎵懼埌鏈緇堢殑鐩爣鍑芥暟銆傝繖涓〃灝辨槸緋葷粺鏈嶅姟琛⊿ST錛孋鐨勭粨鏋凷YSTEM_SERVICE_TABLE鐨勫畾涔夊涓?娓呭崟涔熷寘鍚簡緇撴瀯SERVICE_DESCRIPTOR_TABLE涓殑瀹氫箟錛屼負SST鏁扮粍絎洓涓垚鍛橈紝鍓嶄袱涓湁鐫鐗瑰埆鐨勭敤閫斻?br>
typedef NTSTATUS (NTAPI *NTPROC) ( ) 錛?br>
typedef NTPROC *PNTPROC錛?br>
#define NTPROC_ sizeof (NTPROC)
typedef struct _SYSTEM_SERVICE_TABLE
{ PNTPROC ServiceTable; // 榪欓噷鏄叆鍙f寚閽堟暟緇?br>
PDWORD CounterTable; // 姝ゅ鏄皟鐢ㄦ鏁拌鏁版暟緇?br>
DWORD ServiceLimit ; // 鏈嶅姟鍏ュ彛鐨勪釜鏁?br>
PBYTE ArgumentTable; // 鏈嶅姟鍙傛暟瀛楄妭鏁扮殑鏁扮粍
) SYSTEM_SERVICE_TABLE ,
* PSYSTEM_SERVICE_TABLE ,
* * PPSYSTEM_SERVICE_TABLE ;
/ / _ _ _ _ _ _ _ _ _ _ _ _
typedef struct _SERVICE_DESCRIPTOR_TABLE
{ SYSTEM_SERVICE_TABLE ntoskrnl ; // ntoskrnl鎵瀹炵幇鐨勭郴緇熸湇鍔★紝鏈満鐨凙PI}
SYSTEM_SERVICE_TABLE win32k; // win32k鎵瀹炵幇鐨勭郴緇熸湇鍔?br>
SYSTEM_SERVICE_TABLE Table3; // 鏈嬌鐢?br>
SYSTEM_SERVICE_TABLE Table4; // 鏈嬌鐢?br>
} SERVICE_DESCRIPTOR_TABLE ,
* PSERVICE_DESCRIPTOR_TABLE,
* PPSERVICE_DESCRIPTOR_TABLE 錛?br>
ntoskrnl閫氳繃KeServiceDescriptorTable絎﹀彿,瀵煎嚭浜嗕富瑕丼DT鐨勪竴涓寚閽堛傚唴鏍哥淮鎶ゅ彟澶栫殑涓涓猄DT錛屽氨鏄疜eServiceDescriptorTableShadow銆備絾榪欎釜絎﹀彿娌℃湁瀵煎嚭銆傝鎯沖湪鍐呮牳妯″紡緇勪歡涓瓨鍙栦富瑕丼DT寰堢畝鍗曪紝鍙渶涓よC璇█鐨勪唬鐮?
extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;
PSERVICE_DESCRIPTOR_TABLE psdt= KeServiceDescriptorTable;
NTPROC涓烘湰鏈?API鐨勬柟渚跨殑鍗犱綅絎︼紝浠栫被浼間簬Win32緙栫▼涓殑PROC銆侼ative API姝e父鐨勮繑鍥炲簲璇ユ槸涓涓狽TSTATUS浠g爜錛屼粬浣跨敤NTAPI璋冪敤綰﹀畾錛屽畠鍜宊stdcall涓鏍楓係erviceLimit鎴愬憳鏈夊湪ServiceTable鏁扮粍閲屾壘鍒扮殑鍏ュ彛鏁扮洰銆傚湪2000涓嬶紝榛樿鍊兼槸248銆侫rgumentTable涓築YTEs鐨勬暟緇勶紝姣忎竴涓搴斾簬ServiceTable鐨勪綅緗茍鏄劇ず浜嗗湪璋冪敤鑰呭爢鏍堥噷鐨勫弬鏁版瘮鐗規暟銆傝繖涓俊鎭笌EDX緇撳悎錛岃繖鏄唴鏍鎬粠璋冪敤鑰呭爢鏍坈opy鍙傛暟鍒拌嚜宸辯殑鍫嗘爤鎵闇鐨勩侰ounterTable鎴愬憳鍦╢ree buid鐨?000涓茍娌℃湁浣跨敤鍒幫紝鍦╠ebug build涓紝榪欎釜鎴愬憳鎸囧悜浠h〃鎵鏈夊嚱鏁頒嬌鐢ㄨ鏁扮殑DWORDS鏁扮粍錛岃繖涓俊鎭兘鐢ㄤ簬鎬ц兘鍒嗘瀽銆?br> 鍙互浣跨敤榪欎釜鍛戒護鏉ユ樉紺?dd KeServiceDescriptorTable錛岃皟璇曞櫒鎶婃絎﹀彿瑙f瀽涓?x8046e0c0銆傚彧鏈夊墠鍥涜鏄渶閲嶈鐨勶紝瀵瑰簲閭e洓涓猄DT鎴愬憳銆?br> 榪愯榪欎釜鍛戒護:ln 8046e100錛屾樉紺虹鍙鋒槸KeServiceDescriptorTableShadow錛岃鏄庣浜斾釜寮濮嬬‘瀹炰負鍐呮牳緇存姢鐨勭浜屼釜SDT銆備富瑕佺殑鍖哄埆鍦ㄤ簬鍚庝竴涓寘鍚簡win32k.sys鐨勫叆鍙o紝鍓嶄竴涓嵈娌℃湁銆傚湪榪欎袱涓〃涓紝Table3涓嶵able4閮芥槸絀虹殑銆侼toskrnl.exe鎻愪緵浜嗕竴涓柟渚跨殑API鍑芥暟銆傝繖涓嚱鏁扮殑鍚嶅瓧涓猴細
KeAddSystemServiceTable
姝ゅ嚱鏁板幓濉厖榪欎簺浣嶇疆銆?br>
2Eh鐨勪腑鏂鐞嗘爣璁版槸KisystemService()銆傝繖涔熸槸ntoskrnl.exe娌℃湁瀵煎嚭鐨勫唴閮ㄧ殑絎﹀彿錛屼絾鍖呭惈鍦?k絎﹀彿鏂囦歡涓傚叧浜嶬isystemService鐨勬搷浣滃涓嬶細
1 浠庡綋鍓嶇殑綰跨▼鎺у埗鍧楁绱DT鎸囬拡
2 鍐沖畾浣跨敤SDT涓?涓猄ST鐨勫叾涓竴涓傞氳繃嫻嬭瘯EAX涓掗両D鐨勭12鍜?3浣嶆潵鍐沖畾銆侷D鍦?x0000-0x0fff鐨勬槧灝勮嚦ntoskrnl琛ㄦ牸錛孖D鍦?br>
0x1000涓?x1ffff鐨勫垎閰嶇粰win32k琛ㄦ牸銆傚墿涓嬬殑0x2000-0x2ffff涓?br>
0x3000-0x3ffff鍒欐槸Table3鍜孴able4淇濈暀銆?br>
3 閫氳繃閫夊畾SST涓殑ServiceLimit鎴愬憳媯鏌AX鐨?錛?1浣嶃傚鏋淚D瓚呰繃浜嗚寖鍥達紝榪斿洖閿欒浠g爜涓篠TATUS_INVALID_SYSTEM_SERVICE銆?br>
4 媯鏌AX涓殑鍙傛暟鍫嗘爤鎸囬拡涓嶮mUserProbeAddress銆傝繖鏄竴涓猲toskrnl瀵煎嚭鐨勫叏灞鍙橀噺銆傞氬父絳変簬0x7FFF0000錛屽鏋滃弬鏁版寚閽堜笉鍦ㄨ繖涓湴鍧涔嬩笅錛岃繑鍥濻TATUS_ACCESS_VIOLATION銆?br>
5 鏌ユ壘ArgumentTable涓殑鍙傛暟鍫嗘爤鐨勫瓧鑺傛暟錛屼粠璋冪敤鑰呯殑鍫嗘爤copy鎵鏈夌殑鍙傛暟鑷沖綋鍓嶅唴鏍告ā寮忓爢鏍堛?br>
6 鎼滅儲serviceTable涓殑鏈嶅姟鍑芥暟鎸囬拡錛屽茍璋冪敤榪欎釜鍑芥暟銆?br>
7 鎺у埗杞埌鍐呴儴鐨勫嚱鏁癒iserviceExit錛屽湪姝ゆ鏈嶅姟璋冪敤榪斿洖涔嬪悗銆?br>
浠庡SDT鐨勮璁哄彲浠ョ湅鍒頒笌鏈満API涓璧瘋繕鏈夌浜屼釜鍐呮牳妯″紡鎺ュ彛銆傝繖涓帴鍙f妸Win32瀛愮郴緇熺殑鍥懼艦璁懼鎺ュ彛鍜岀獥鍙g鐞嗗櫒鍜屽唴鏍告ā寮忕粍浠禬in32k榪炴帴璧鋒潵銆俉in32k鎺ュ彛涓鏍鋒槸鍩轟簬int 2eh銆傛湰鏈篈PI鐨勬湇鍔″彿鏄粠0x0000鍒?x0fff錛寃in32k鐨勬湇鍔″彿鏄粠0x1000鍒?x1fff銆?ddW32pServiceTable璁ゅ畾win32k.sys鐨勭鍙峰彲鐢ㄣ?win32k鎬誨叡鍖呭惈639涓郴緇熸湇鍔°?br>
2Eh鐨勫鐞嗚繃紼嬫病鏈変嬌鐢ㄥ叏灞SDT KeServiceDescriptorTable銆?br>
鑰屾槸涓涓笌綰跨▼鐩稿叧鐨勬寚閽堛傛樉鐒訛紝綰跨▼鍙互鏈変笉鍚屽緱SDT鐩稿叧鍒拌嚜韜傜嚎紼嬪垵璇曞寲鐨勬椂鍊?KeInitializeThread()鎶奒eServiceDescriptorTable鍐欏埌綰跨▼鐨勬帶鍒跺潡銆傚敖綆¤繖鏍鳳紝榪欎釜榛樿璁劇疆涔嬪悗鍙兘琚敼鍙樹負鍏跺畠鍊鹼紝渚嬪KeServiceDescriptorTableShadow銆?br>
Windows 2000榪愯鏃跺簱
Ntdll.dll鑷沖皯瀵煎嚭浜嗕笉灝戜簬1179涓鍙楓傚叾涓殑249/248鏄睘浜嶯t*/zw*闆嗗悎銆傛墍浠ヨ繕鏈?82涓嚱鏁頒笉鏄氳繃int 2eh闂ㄤ腑杞傚緢鏄劇劧錛岃繖涔堝鐨勫嚱鏁頒笉渚濋潬2k鐨勫唴鏍搞?br>
鍏朵腑涓浜涙槸鍜宑榪愯鏃跺簱鍑犱箮涓鏍風殑鍑芥暟銆傚叾瀹瀗toskrnl涔熷疄鐜頒簡涓浜涚被浼鹼跡榪愯鏃跺簱鐨勪竴浜涘嚱鏁般傚彲浠ラ氳繃ddk閲岀殑ntdll.lib鏉ラ摼鎺ュ拰浣跨敤榪欎簺鍑芥暟銆傚弽姹囩紪ntdll.dll涓巒toskrnl.exe鐨勶跡榪愯鏃跺嚱鏁拌兘鍙戠幇錛宯tdll.dll騫朵笉鏄緷璧杗toskrnl.exe銆傝繖涓や釜妯″潡鍚勮嚜瀹炵幇浜嗚繖浜涘嚱鏁般?br>
闄や簡錛h繍琛屾椂搴撳錛?000榪樻彁渚涗簡涓涓墿灞曠殑榪愯鏃跺嚱鏁伴泦鍚堛傚啀涓嬈★紝ntdll.dll涓巒toskrnl.exe鍚勮嚜瀹炵幇浜嗗畠浠傚悓鏍鳳紝瀹炵幇闆嗗悎鏈夐噸澶嶏紝浣嗘槸騫朵笉瀹屽叏鍖歸厤銆傝繖涓泦鍚堢殑鍑芥暟閮芥槸浠tl寮澶寸殑銆?000榪愯鏃跺簱鍖呮嫭涓浜涜緟鍔╁嚱鏁扮敤浜庯跡榪愯鏃跺欐棤娉曞畬鎴愮殑浠誨姟銆備緥濡傛湁浜涘鐞嗗畨鍏ㄤ簨鍔★紝鍙﹀鐨勬搷綰?000涓撶敤鐨勬暟鎹粨鏋勶紝榪樻湁浜涙敮鎸佸唴瀛樼鐞嗐傚井杞粎浠呭湪DDK涓褰曚簡寰堟湁鐢ㄧ殑406涓嚱鏁頒腑鐨?15涓嚱鏁般?br>
Ntdll.dll榪樻彁渚涗簡鍙﹀涓涓嚱鏁伴泦鍚堬紝浠_e鍓嶇紑寮澶淬傚疄闄呬笂瀹冧滑鐢ㄤ簬嫻偣鏁版ā鎷熷櫒銆?br>
榪樻湁寰堝鐨勫嚱鏁伴泦鍚堬紝鎵鏈夎繖浜涘嚱鏁扮殑鍓嶇紑濡備笅錛?br>
__e(嫻偣妯℃嫙),Cc(Cache綆$悊),Csr(c/s榪愯鏃跺簱),Dbg(璋冭瘯鏀寔)錛孍x(鎵ц鏀寔),FsRtl(鏂囦歡緋葷粺榪愯鏃?錛孒al(紜歡鎶借薄灞?,Inbv(緋葷粺鍒濊瘯鍖?vga鍚姩椹卞姩紼嬪簭bootvid.dll),Init(緋葷粺鍒濊瘯鍖?,Interlocked(綰跨▼瀹夊叏鍙橀噺鎿嶄綔),Io(IO綆$悊鍣?,Kd(鍐呮牳璋冭瘯鍣ㄦ敮鎸?,Ke(鍐呮牳渚嬬▼),Ki(鍐呮牳涓柇澶勭悊),Ldr(鏄犺薄瑁呰澆鍣?,Lpc(鏈湴榪囩▼璋冪敤),Lsa(鏈湴瀹夊叏鎺堟潈),Mm(鍐呭瓨綆$悊),Nls(鍥介檯鍖栬璦鏀寔),Nt(NT鏈満API)錛孫b(瀵硅薄綆$悊鍣?,Pfx(鍓嶇紑澶勭悊)錛孭o(鐢墊簮綆$悊),Ps(榪涚▼鏀寔),READ_REGISTER_(浠庡瘎瀛樺櫒鍦板潃璇?錛孯tl(2k榪愯鏃跺簱),Se(瀹夊叏澶勭悊),WRITE_REGISTER_錛堝啓瀵勫瓨鍣ㄥ湴鍧錛?Zw(鏈満API鐨勬浛鎹㈠彨娉?錛?lt;鍏跺畠>(杈呭姪鍑芥暟鍜岋跡榪愯鏃跺簱)銆?br>
褰撶紪鍐欎粠鐢ㄦ埛妯″紡閫氳繃ntdll.dll鎴栧唴鏍告ā寮忛氳繃ntoskrnl.exe鍜?000鍐呮牳浜や簰鐨勮蔣浠剁殑鏃跺欙紝闇瑕佸鐞嗗緢澶氬熀鏈殑鏁版嵁緇撴瀯錛岃繖浜涚粨鏋勫湪Win32涓栫晫涓緢灝戣鍒般?br>
甯哥敤鏁版嵁緇撴瀯
l 鏁存暟
ANSI瀛楃鏄湁絎﹀彿鐨勶紝鑰孶nicode WCHAR鏄棤絎﹀彿鐨?br>
MASM鐨凾BYTE鏄?0浣嶇殑嫻偣鏁幫紝鐢ㄤ簬楂樼簿搴︽誕鐐硅繍綆楀崟鍏冩搷浣滐紝娉ㄦ剰瀹冧笌Win32鐨凾BYTE錛坱ext byte錛夊畬鍏ㄤ笉鍚屻?br>
TABLE 2-3. Equivalent Integral Data Types
BITS MASM FUNDAMENTAL ALIAS #1 ALIAS #2 SIGNED
8 BYTE unsigned char UCHAR CHAR
16 WORD unsigned short USHORT WCHAR SHORT
32 DWORD unsigned long ULONG LONG
32 DWORD unsigned int UINT INT
64 QWORD unsigned _int64 ULONGLONG DWORDLONG LONGLONG
80 TBYTE N/A
typedef union _LARGE_INTEGER
{ struct{
ULONG LowPart;
LONG HighPart錛泒;
LONGLONG QuadPart;
}
LARGE_INTEGER , * PULARGE_INTEGER ;
typedef union _ULARGE_INTEGER{
struct{
ULONG LowPart;
ULONG HighPart;锝?br>
ULONGLONG QuadPart;
}ULARGE_INTEGER, *PULARGE_INTEGER;
l 瀛楃
Win32緙栫▼涓璓STR鐢ㄦ埛CHAR*錛孭WSTR鐢ㄤ簬WCHAR*銆傚彇鍐充簬鏄惁瀹氫箟浜哢NICODE錛孭TSTR瑙i噴涓篜STR鎴栬匬WSTR銆傚湪2k鍐呮牳妯″紡涓嬶紝甯哥敤鐨勬暟鎹被鍨嬫槸UNICODE_STRING錛岃孲TRING鐢ㄦ潵琛ㄧずANSI瀛楃涓?
typedef struct _UNICODE_STRING{
USHORT Length; //褰撳墠瀛楄妭闀垮害錛屼笉鏄瓧絎︼紒錛侊紒
USHORT MaximumLength; //Buffer鐨勬渶澶у瓧鑺傞暱搴?br>
PWSTR Buffer;}UNICODE_STRING , * PUNICODE_STRING ;
typedef struct _STRING{
USHORT Length;
USHORT MaximumLength;
PCHAR Buffer;}STRING, *PSTRING;
typedef STRING ANSI_STRING, *PANSI_STRING;
typedef STRING OEM_STRING, *POEM_STRING;
鎿嶇旱鍑芥暟:RtlCreatUnicodeString(),RtlInitUnicodeString(),
RtlCopyUnicodeString()絳夌瓑
l 緇撴瀯
璁稿鍐呮牳API鍑芥暟闇瑕佷竴涓浐瀹氬ぇ灝忕殑OBJECT_ATTRIBUTES緇撴瀯錛屾瘮濡侼tOpenFile()銆傚璞$殑灞炴ф槸OBJ_*鍊肩殑緇勫悎錛屽彲浠ヤ粠ntdef.h涓煡鍒般?br>
IO_STATUS_BLOCK緇撴瀯鎻愪緵浜嗘墍璇鋒眰鎿嶄綔緇撴灉鐨勪俊鎭紝寰堢畝鍗曪紝status鎴愬憳鍖呭惈涓涓狽TSTATUS浠g爜, 濡傛灉鎿嶄綔鎴愬姛 information鎴愬憳鎻愪緵鐗瑰畾璇鋒眰鐨勪俊鎭?br>
榪樻湁涓涓粨鏋勬槸LIST_ENTRY錛岃繖鏄竴涓弻鍚戠幆閾捐〃銆?br>
typedef struct _OBJECT_ATTRIBUTES
{
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBDTES, *POBJECT_ ATTRIBUTES;
typedef struct _IO_STATUS_BLOCK
{
NTSTATDS Status;
ULONG Information;
}IO_STATUS_BLOCK , * PIO_STATUS_BLOCK ;
typedef struct _LIST_ENTRY
{
Struct _LIST_ENTRY *Flink;
Struct _LIST_ENTRY *Blink;
}LIST_ENTRY, *PLIST_ENTRY;
鍙屽悜閾捐〃鐨勫吀鍨嬩緥瀛愬氨鏄繘紼嬪拰綰跨▼閾俱傚唴閮ㄥ彉閲廝sActiveProcessHead鏄竴涓狶IST_ENTRY緇撴瀯錛屽湪ntoskrnl.exe鐨勬暟鎹涓紝鎸囧畾浜嗙郴緇熻繘紼嬪垪琛ㄧ殑絎竴涓垚鍛樸?br>
CLIENT_ID緇撴瀯鐢辮繘紼嬪拰綰跨▼ID緇勬垚銆?br>
typedef struct _CLIENT_ID
{ HANDLE UniqueProcess;
HANDLE UniqueThread;
)CLIENT_ID, *PCLIENT_ID;
鎯寵浠庣敤鎴鋒ā寮忚皟鐢╪tdll.dll涓殑API鍑芥暟錛屽繀欏昏冭檻鍒頒互涓嬪洓鐐?
1 SDK澶存枃浠舵病鏈夊寘鎷繖浜涘嚱鏁扮殑鍘熷瀷
2 榪欎簺鍑芥暟浣跨敤鐨勮嫢騫插熀鏈暟鎹被鍨嬫病鏈夊寘鎷湪SDK鏂囦歡涓?br>
3 SDK鍜孌DK澶存枃浠朵笉鍏煎錛屼笉鑳藉湪win32鐨刢婧愭枃浠跺寘鍚玭tddk.h涓?br>
4 ntdll.lib娌℃湁鍖呮嫭鍦╒C鐨勯粯璁ゅ鍏ュ簱鍒楄〃涓?br>
絎?涓緢瀹規槗瑙e喅錛?progma comment(linker,“/defaultlib:ntdll.lib”)
緙哄け鐨勫畾涔夋瘮杈冮毦瑙e喅錛屾渶綆鍗曠殑鏂規硶鏄啓涓涓嚜瀹氫箟鐨勫ご鏂囦歡錛屽垰鍒氬寘鍚渶瑕佽皟鐢╪tdll.dll涓嚱鏁扮殑瀹氫箟銆傚垢榪愮殑鏄紝宸茬粡鍦ㄥ厜鐩樼殑w2k_def.h鏂囦歡涓仛浜嗚繖涓伐浣溿傚洜涓鴻繖涓ご鏂囦歡灝嗙敤浜庣敤鎴鋒ā寮忓拰鍐呮牳妯″紡紼嬪簭錛屾墍浠ュ繀欏誨湪鐢ㄦ埛妯″紡浠g爜涓紝#include<w2k_def.h>涔嬪墠#define _USER_MODE_錛屼嬌寰桪DK涓嚭鐜拌孲DK涓病鏈夌殑瀹氫箟鍙敤銆?br>
鏈枃閮ㄥ垎緲昏瘧浜庝竴綃囩數瀛愪功<win api about>.涔熸劅璋㈡湅鍙婫ameHunter榪欎綅鑻辮鏋佸ソ鐨勬湅鍙嬪府蹇?涓嶧ree鐨勬寚瀵?
]]>
姘歌繙錛屾案榪滈兘鍙槸鎴戜竴涓漢鍦ㄥ敱鐙鎴忥紟娌℃湁瑙備紬錛屾病鏈夋帉澹般傚彧鏈夋垜涓涓富瑙掞紝瀛ゅ崟鐨勫獎瀛愬褰遍殢褰€備笉鍒嗘樇澶滐紝涓嶇煡鐤插︾殑婕旂粠鐫錛屽睘浜庢垜鑷繁鐨勭伩鐑傜璇濄傘銆鎴戞槑鐧斤紝浣犲琛ㄧ殑鍐鋒紶騫朵笉甯﹁〃浣犲唴蹇冪殑絀烘礊錛屼綘鎬繪槸涔犳儻鍚戜笘浜洪殣钘忎綘鑷繁錛屼綘娓存湜琚悊瑙o紝鍙堝鎬曡浜哄墫鏋愶紝鎴戠煡閬撲綘璁ㄥ帉璧よ8瑁哥殑鎰熻錛庛銆銆鎴戞槑鐧斤紝浣犳棤鍔╃殑鏃跺欎竴瀹氬儚涓笉鐭ユ墍鎺殑瀛╁瓙錛屼綘鍧氬己鐨勫琛ㄤ笅鏄煍杞屾晱鎰熺殑蹇冦傛垜鎰挎剰鍊熺粰浣犳垜闅愬艦鐨勮偐鑶錛岃櫧鐒朵笉瀹介様錛屼絾瓚充互鎴愪負浣犵殑渚濋潬銆傚鏋滀綘鎰挎剰銆傘銆浣犺鏄庣櫧錛屾垜鐨勭嫭瑙掓垙姘歌繙鍙湪榛戞殫涓喚鏀撅紝鎴戜笉鍋滅殑鍦ㄥ瘋瀵炰腑鏃嬭漿璺寵垶錛屼竴榪炶漿浜嗕節鍗佷節涓湀錛岃鎽嗙洓寮鍑鴻糠紱葷殑鑺辨湹錛屽鍗曠殑鎴戣繕鏄病鏈夋敼鍙樸傘銆 銆銆鎴戞槑鐧斤紝涓嶆槸鐖辯殑浜哄氨鍙互鍜屼粬鍦ㄤ竴璧楓傚鍛界粰鎴戠殑緇撳眬錛屽彧鏄鎴戞憡寮鎺屽績錛岄噷闈㈡槸絀烘礊鐨勶紝鎴戞墍鍋氱殑涓鍒囬兘鏄崟鎹夌殑椋庯紝鎵嬮噷娉ㄥ畾涓鏃犳墍鏈夈傛病鏈変粈涔堜笢瑗胯兘澶熷洜涓轟笉鑸嶈岃幏寰楁滄偗銆?鐖辨儏涓嶅簲褰撳彧鏄竴鍦烘儤鐒剁殑杞洖銆傘銆鎴戜笉鐩鎬俊姘歌繙錛屾垜涓嶆嫢鏈夋湡寰咃紝涔熶笉闇瑕佽璦銆傘銆鍙兘褰兼闄岀敓錛屾垨鑰呬笉鏄紱 銆銆鍙効浣犳浘璁拌寰椾竴涓敱鎴戝鐙紨緇庣殑錛岀埍鐨勮建榪圭敾涓嬬殑鐙鎴忋?
]]>
鍛婄櫧
銆銆“宀佹湀鐨勯噾榛勶紝涓騫翠竴嬈′緵浜哄垎浜紱鐢熷懡鐨勯噾榛勶紝涓鐢熶竴嬈¢敊榪囧氨涓嶅啀杈夌厡銆?#8221;鍦ㄨ繖鎴戞極婕殑鍓嶅崐鐢熶腑錛屼篃璁告垜榪樺緢騫村皯鏃犵煡錛屼篃璁告鏃跺彧鏄漢鐢熺殑涓涓皬灝忕殑寮绔傛墍浠ワ紝鎬繪槸寰堝姫鍔涳紝寰堢敤蹇冨湴鍘婚摵鍨繖孌墊梾紼嬬殑鍩虹煶錛屽笇鏈涗互鍚庤兘榪囧緱濂戒竴鐐癸紝涓嶈鍍忎粠鍓嶏紝鍍忕幇鍦ㄨ繖鏍楓傚綋鐒訛紝鎴戝茍涓嶅惁璁ゆ垜鏄釜騫歌繍鐨勪漢錛屽洜涓鴻搗鐮佽繖涓鍒囩殑涓鍒囧茍娌℃湁緋熷埌鏋佺偣錛屼竴璺篃綆楀鉤騫崇ǔ紼沖湴璧頒簡榪囨潵錛岀旱鐒朵笉寰堢簿褰╋紝涔熺畻鏄厖瀹炪傛垜瀹蟲曢敊榪囷紝鎵浠ユ垜渚濈劧寰堝姫鍔涘湴鍘誨鏇村鐨勪笢瑗匡紝鍘葷漢緇囬偅涓皢浼氭垚鐪熺殑姊︽兂銆?br>銆銆铏界劧璇?#8220;鐭ヨ凍甯鎬箰”錛屾垜鍗翠笉鏄繖鏍蜂竴涓漢銆傛垜寰堥毦鎰熷埌婊¤凍錛屾垜浠涔堥兘鎯寵錛屽彧瑕佹垜鎯寵錛屾垜灝變細灝芥渶澶у姫鍔涗簤鍙栥傛垜鎬繪槸“涓嶉ケ”錛?鎬諱篃涓嶄細“甯鎬箰”銆傝絀夸簡灝辨槸璐績涓庢鏈涘崰浜嗕笂椋庛備篃璁歌繖涓寮濮嬪氨鏄釜閿欒錛屼負浠涔堣閭d箞濂借儨錛熶負浠涔堣閭d箞绱у紶鍦拌繃鐫姣忎竴澶╋紵浜虹敓鑻︾煭錛岃榪囧氨榪囧幓浜嗐備笉璁烘垜鎬庝箞媧伙紝澶槼鎬繪槸浼氫粠瑗胯竟钀戒笅錛屾槑澶╀緷鐒朵細浠庝笢杈瑰崌璧楓傝屾瘡涓涓湪涓栫殑浜猴紝灝卞儚澶瑰湪榛庢槑涓庨粍鏄忎箣闂寸殑閭d竴鍫嗘槦鏄熴?鏄槦鏄熼兘浼氶棯鍏夛紝浣嗕負浣曚竴瀹氳鍘誨仛鍖楁瀬鏄燂紵鎴戜篃涓嶆竻妤氥備技涔庢湁涓縐嶅帇鍔涳紝鏈変竴縐嶈礋鎷咃紝鏈変竴縐嶈繃寰鐨勭粡鍘嗙‖瑕佹垜涓嶇敇騫沖嚒錛岀劧鑰屾垜鍗翠緷鐒跺緢騫沖嚒錛屽氨鍍忔矙婕犱腑鐨勪竴綺掑皬娌欏瓙銆?br>銆銆鍗佸嚑騫村瘨紿楄蛋浜嗚繃鏉ワ紝鍗村彂鐜拌嚜宸變粈涔堜篃涓嶆槸錛屼粈涔堜篃涓嶄細錛屼粈涔堜篃娌℃湁銆傛墍浠ユ繪槸鍛婅鑷繁錛氳鎶婃彙鐪煎墠錛屽湪鑼尗浜烘搗涓垎鏄庡湴杈ㄨ鍑鴻嚜宸憋紝鍦ㄤ笘鐣岀殑瑙掕惤鎵句竴涓綅緗粰鑷繁銆傛暣澶╀笢濂旇タ璧幫紝瀵誨瑙呰錛岃鑷繁蹇欏緱娌℃湁鏃墮棿鍘繪噴鎮旓紝鍘誨洖蹇嗭紝鏄洜涓哄鎬曞洖蹇嗛噷鐨勯吀妤氭鞏娌¤嚜宸便?br>銆銆鎯呯紭
銆銆鏇劇粡錛屾垜瀹蟲曟濆鐨勯仴榪滐紝涔熷鎬曢檶鐢熺殑澶╀笌鍦般備漢鎬昏瀛︾潃鑷繁闀垮ぇ錛屽鐫鏀涓婂瞾鏈堢殑鑲╄唨錛屽埌杈懼悇縐嶉檶鐢熺殑鍦版柟銆傝櫧鐒惰繖鍎夸笉鏄ぉ鍫傦紝浣嗘垜鍗存壘鍒頒簡涓嶅繀鎷呭績涓嬮洦鐨勬槦絀猴紝鎵懼埌浜嗗ぇ嫻蜂竴鏍風殑鍖呭銆備簬鏄粓浜庣浉淇′簡“鐕冭搗鏈ㄦ煷錛屽叧绱ч棬紿楋紝璁╂俯鏆栧拰浣犱竴璧鋒潵涓達紝 鍦ㄨ繖涓瘨鍐風殑鍐銆?#8221;榪欎竴鍙ユ浘琚仐蹇樿繃鐨勮瘽銆?br>銆銆鏈夊悓瀛︽浘瀵規垜璇達細“鎴戜滑鍙槸鍋剁劧鍑虹幇鍦ㄦ垜浠粓灝嗘秷澶辯殑鍦版柟銆?#8221;鐨勭‘濡傛錛屼絾鏃㈢劧鍐ュ啣涓敞瀹氳鐩擱紝鎴戜滑灝辮鐩歌瘑銆佺浉鐭ャ佺浉鎯滐紝瓚佺潃榪樻病娑堝け錛岃鎴戜滑涓璧風弽鎯滃彲浠ュ叡搴︾殑姣忎竴鍒伙紝鎵嶄笉鑷充簬鍦ㄥ垎鍒殑鏃跺欑獊鐒跺彂鐜?#8220;鎴戜滑鎬繪湁澶鐨勬潵涓嶅強錛屽緢澶氳瘽鏉ヤ笉鍙婅錛屾潵涓嶅強鍚紝鏉ヤ笉鍙婇棶錛屽緢澶氫簨鎯呮潵涓嶅強鍋氥傛垜浠敮涓鑳藉仛鐨勫彧涓嶈繃鏄湪榪樻潵寰楀強鐨勬椂鍊欙紝灝忓績鍛墊姢鐪煎墠鐨勬嫢鏈夈?#8221;鎴戜滑鍦ㄨ繖涓湴鏂圭浉閬囷紝鏄紭錛屽皢鏉ユ暎浜嗭紝涔熸槸緙橈紝鍙槸緙樻祬浜?#8230;…
銆銆宀佹湀嫻侀濆悗錛岃繖孌墊棩瀛愰噷鐨勭浉澶勬矇娣涓嬫潵鐨勶紝灝嗕細鏄竴浜涘埢婊″洖蹇嗗拰鍘嗗彶鐨勬矙綺掞紝閭i噷钘忕潃鐨勬湁蹇冮吀錛屼篃鏈夋鎰夛紝鏈夊寘瀹癸紝涔熸湁鍙規伅銆傛槑澶╃殑鏄庡ぉ錛屾垜浠潰涓寸殑灝嗕細鏈夎璁稿澶氭洿闄岀敓鐨勪漢鎴栫墿錛屾墍浠ヤ笉蹇呯姹傛垜浠兘鑳借浣忚繖浠借蹇嗭紝鍙笇鏈涘湪榪樻病鎴愪負璁板繂鏃訛紝濂藉ソ鐝嶆儨銆?br>銆銆鐩稿錛屽鎬曟矇榛橈紱鐩鎬氦錛屾渶蹇屾棤璇傛暈寮浣犵殑鑳告錛屽憡璇夋垜浣犳兂璇寸殑璇濓紝璁╂垜鍜屼綘涓璧峰垎鎷呬綘鐨勫枩涓庢偛銆傚鎴戣岃█錛屾垜瀹蟲曚竴涓漢鍦ㄩ檶鐢熺殑瑙掕惤閲屼綔姊︼紝鏇村鎬曞湪鍏呮弧鍥為煶鐨勭┖媧炰腑鍝常銆?br>銆銆“緇堟湁涓澶╋紝鎴戜滑瑕佽繙璧伴珮椋烇紝涓轟簡鍚勮嚜鐨勬ⅵ鎯籌紝灝卞儚椋樿惤鐨勫彾瀛愯蛋鍚戜笉鍚岀殑澶╂動銆?#8221;榪欏彞璇濆皢浼氬湪鏌愪竴澶╁疄鐜幫紝浣嗛偅鍙堟湁浠涔堟墍璋擄紝鎴戜滑鏇炬槸鏍戜笂鐨勫彾瀛愶紝椋庡0鍚瑰搷鐨勬槸浣犳垜鐨勮繃寰銆?br>銆銆鐖辨儏
銆銆鐖辨儏錛屽浜庢垜鑰岃█錛屼粛鐒舵槸涓涓緢閬ヨ繙鐨勪紶璇淬備篃璁歌繖涓紶璇村皢浼氱喚鏀劇潃寮傚父緹庝附鐨勫厜鐜紝涔熻浼氶ケ鍚潃蹇冮吀鐨勬唱姘達紝涔熸垨璁歌繖涓紶璇村彧鏄竴涓鉤騫蟲貳娣$殑椋庡拰褰辯殑鏁呬簨錛屼絾榪欓兘灝嗕細鏄緢涔呬互鍚庣殑浜嬫儏銆傞仴榪滃埌鏈涙柇闀跨┖涔熸棤娉曟瀬鐩殑鏌愪釜鍦版柟錛岄仴榪滃埌鏈涚┛縐嬫按涔熸棤娉曟湡寰呯殑鏌愪釜鏄ョ銆備篃璁告槸鍥犱負鎴戞墜瓚蟲棤鎺紝涔熻鏄垜瀹蟲曡屽張鏈熷緟鐨勬儏鎰殑緙樻晠錛屾墍浠ュ湪鎴戠殑蹇冭繕娌℃湁琚縺璧鋒稛婕殑鐜板湪錛屽湪鎴戣剳嫻瘋繕娌℃湁嫻幇嫻極鏅ㄦ槒鐨勬鍒伙紝鎴戜緷鐒跺浐鎵у湴璁や負錛氳繖涓鍒囧彧鏄竴涓紶璇達紝涓涓笉浼氬悜鎴戣蛋鏉ュ嵈鍙堣鎴戜富鍔ㄩ潬榪戠殑浼犺銆?br>銆銆鏈変漢鏇捐錛?#8220;鐖?#8221;鍜?#8220;姝?#8221;鏄漢鐢熶腑瑙e喅涓嶄簡鐨勪袱澶ч毦棰橈紝浜哄湪闈掑勾鏃朵負鐖辨墍鍥版儜錛屽湪鑰佸勾鏃惰姝繪墍鍥版儜錛屼竴鐢熼兘涓嶅緱瀹夊畞錛涚埍鎯呭儚涓鎶婃參鍒錛屼竴鐐逛竴鐐瑰湴鍒鴻繘浜虹殑鑲岃偆錛岃屾鍒欐槸涓鎶婂揩鍒錛屼竴涓嬪瓙灝辯粨鏉熶簡鎵鏈夌殑鐥涜嫤錛涙垜涓嶅鎬曟浜★紝鎴戝嵈瀹蟲曠埍鎯咃紱鎴戣兘澶熷繊鍙楀喅緇濈殑蹇垁錛屽嵈涓嶈兘蹇嶅彈寤跺畷鐨勬參鍒銆備笉綆′粬璇村緱瀵逛笌鍚︼紝鎴戦兘鐩鎬俊錛氳繖涓栦笂娌℃湁姘歌繙閮藉垢紱忔垨鐥涜嫤鐨勬椂鍒伙紝鑷劧涔熸病鏈夋案榪滈兘鐢滆湝鐨勭綏鏇煎彶銆傜旱鐒墮偅浜涢洩涓佺偔銆佺櫨鑸懙鎶ゃ佽姳鍓嶆湀涓嬬殑鏃跺欐繪槸閭d箞浠や漢紲炲線錛屼絾閭e績鐏典笂鐨勭厧鐔紝閭d袱澶勯棽鎰佺殑鐩告濓紝閭e鎬曞け鍘繪墍鎷ユ湁鐨勬媴蹇冿紝閭e喅瑁傜殑蹇冮吀鍙堜細鏈夊灝戜漢鑳藉鏄庣櫧錛熼偅涓嶈兘緇х畫鍐嶇埍鎴栬呬笉琚埍鐨勭棝鑻︼紝騫朵笉鏄瘡涓涓漢閮借兘澶熸壙鍙楃殑銆傛垜浠嶇浉淇$埍鎯咃紝浣嗘垜騫朵笉鍒繪剰榪藉錛屽彧鏄潤闈欏湴銆侀潤闈欏湴婕傛祦錛岀洿鍒版湁涓澶╋紝鍦ㄩ槼鍏変笌嫻鋒嘩鐨勫哺杈癸紝璁╂垜鐨勮埞闈欓潤鍦伴潬宀搞?br>銆銆騫村皯鐥寸媯錛屽灝戞儏姝岃鍞卞緱澶╃炕鍦拌銆備絾鎴戜緷鐒惰寰楁湁涓鍙ユ槸錛?#8220;鎴戣兘鎯沖埌鏈嫻極鐨勪簨錛屽氨鏄拰浣犱竴璧鋒參鎱㈠彉鑰併?#8221;涔熻錛屽ぇ鍗冧笘鐣屼腑錛岃繖鎵嶆槸鐪熸鐨勭埍鎯咃紝涓浠戒笉鎺烘潅璐ㄣ佷笉鍙楁薄鏌撶殑鎰熸儏銆備絾鎰匡紝褰撴垜鐨勮埞闈犲哺鐨勯偅涓鍓庯紝褰撲笜姣旂壒涔嬬灝勭┛鎴戝績鑴忕殑鏃跺欙紝鎴戜緷鐒剁浉淇¤繖縐嶇粷灝樼殑鎯呯紭銆?br>銆銆涔熻鐢變簬鎴戠姹傜殑鏄竴縐嶅畬緹庝漢鐢燂紝鎵浠ュ垁鍏夊墤褰辯殑灝忚鎴戞槸涓嶇湅鐨勶紝浣嗙惣鐟剁殑灝忚涔熺湅榪囦笉灝戯紝閮芥槸鍗冪瘒涓寰嬨備簬鏄垜鎬諱細璇達細“鐖辨儏涔熸棤闈炲氨鏄繖鏍楓?#8221;浠夸經鎴戞槸涓繃鏉ヤ漢涓鏍鳳紝鎵浠ユ昏寰楄嚜宸卞ソ鍍忓緢鑰併傛浘緇忔湁涓涓娉曟槸錛?#8220;娌℃湁緇忓巻鐖辨儏鐨勪漢鐢熸槸涓嶅畬鏁寸殑浜虹敓銆?#8221;鎴戣拷姹傚畬緹庯紝鎴戝嵈瀹蟲曠牬紕庛傛墍浠ワ紝鍦ㄦ儏鎰熸柟闈㈡垜寰堝悵鍟紝鎴戠殑蹇冭煩涔熶笉浼氫負浜嗘煇涓漢鑰屽姞閫熴傚氨鐩墠鑰岃█錛屽績濡傛姘村湴榪囩潃姣忎竴澶╀笉涔熷緢濂藉悧錛?璧風爜涓嶇敤鎷呭績椋庢毚鏉ヤ復鏃訛紝浼氬皢鎴戠殑鑸瑰効鍚圭炕銆?br>銆銆“澶╂動嫻佽惤鎬濇棤絀鳳紝鏃㈢浉閫紝鍙堝寙鍖嗐?#8221;闈㈠浠婃湞鏄庡錛屽洖棣栧線鏄斻傚湪椋庨洦鍏肩▼鐨勮礬涓婏紝鎴戣兘鍋氱殑鍙槸杈硅蛋杈規敹鎷撅紝鏀舵嬀鎴戠敓鍛戒腑鐨勬瘡涓涓灛闂淬?
]]>