360,傲游,诺顿最新版,网页溢出防护原理

360,傲游,诺顿最新版,网页溢出防护原理

2009-07-07 02:48

//360和傲游 kernel32!CreateProcessInternalA: 7c81d54e e950697e93      jmp     safemon+0x3ea3 (10003ea3)         <=    push 98h 7c81d553 6858d6817c      push    offset kernel32!`string'+0x24 (7c81d658) 7c81d558 e8794ffeff         call    kernel32!_SEH_prolog (7c8024d6) 7c81d55d 33db                 xor     ebx,ebx 7c81d55f 395d10              cmp     dword ptr [ebp+10h],ebx 7c81d562 0f84815f0200    je      kernel32!CreateProcessInternalA+0x2b (7c8434e9) 7c81d568 ff7510               push    dword ptr [ebp+10h] 7c81d56b 8d45cc             lea     eax,[ebp-34h] kernel32!CreateProcessInternalW: 7c8197b0 e964a77e93      jmp     safemon+0x3f19 (10003f19)           <=   push 0A08h 7c8197b5 68889a817c      push    offset kernel32!`string'+0xc (7c819a88) 7c8197ba e8178dfeff        call    kernel32!_SEH_prolog (7c8024d6) 7c8197bf a1cc56887c       mov     eax,dword ptr [kernel32!__security_cookie (7c8856cc)] 7c8197c4 8945e4             mov     dword ptr [ebp-1Ch],eax 7c8197c7 8b4508             mov     eax,dword ptr [ebp+8] 7c8197ca 8985c4f7ffff     mov     dword ptr [ebp-83Ch],eax 7c8197d0 8b450c            mov     eax,dword ptr [ebp+0Ch] --------------------------------------------------------------------------------------------------------------------------- //赛门铁克网页防护 //原始函数入口指令 8bff            mov     edi,edi 55              push    ebp 8bec            mov     ebp,esp //被赛门后 urlmon!URLDownloadToFileA: 75cb99f5 e9da684e8b      jmp     <Unloaded_px86.dll>+0x11a02d3 (011a02d4) 75cb99fa 81ec10010000   sub     esp,offset <Unloaded_px86.dll>+0x10f (00000110) 75cb9a00 a1f810cd75      mov     eax,dword ptr [urlmon!__security_cookie (75cd10f8)] 75cb9a05 53                     push    ebx 75cb9a06 8b5d10             mov     ebx,dword ptr [ebp+10h] 75cb9a09 8945fc             mov     dword ptr [ebp-4],eax 75cb9a0c 8b4508            mov     eax,dword ptr [ebp+8] 75cb9a0f 56                      push    esi urlmon!URLDownloadToFileW: 75cb9678 e9496b4e8b      jmp     <Unloaded_px86.dll>+0x11a01c5 (011a01c6) 75cb967d 56              push    esi 75cb967e 57              push    edi 75cb967f 6854010000      push    offset <Unloaded_px86.dll>+0x153 (00000154) 75cb9684 e88291faff      call    urlmon!operator new (75c6280b) 75cb9689 85c0            test    eax,eax 75cb968b 59              pop     ecx 75cb968c 7419            je      urlmon!URLDownloadToFileW+0x2f (75cb96a7)