木马的调试与分析
我有兴趣使用 OllyDbg 之类的工具来检查可能具有类似特洛伊木马特征的程序。
有谁知道有关如何安全地执行此操作的任何好的教程？
基本上，该程序是视频游戏的“机器人”，但我怀疑它有后门和/或会将其收集的信息（例如密码）上传到远程服务器。
我想找到它尝试连接的 URL 或 IP，阻止它这样做，等等，所以我想这比典型的程序“破解”更具体一些；我最感兴趣的是找出它可能正在做的基于网络的事情，然后阻止它们，或者欺骗它认为它已经成功了。
另外，我很好奇如何窥探加密的网络流量。如何确定程序用于加密其通过网络发送的内容的加密密钥和算法？ （我问，因为我有兴趣创建一个第三方客户端来模拟与游戏服务器的通信，并且如果不知道如何发现正在使用的密钥，我就无法做到这一点）
I'm interested in using something like OllyDbg to examine a program that potentially has Trojan-like characteristics.
Does anyone know any good tutorials on how to do this safely?
Basically the program is a "bot" for a video game, but I suspect that it has back doors and/or will upload information it gathers (such as passwords) to a remote server.
I'd like to find the URLs or IPs it attempts to connect to, prevent it from doing so, etc, so I guess this is a little more specific than the typical "cracking" of a program; I'm mostly interested in ferreting out network-based things it might be doing and either preventing them, or fool it into thinking it was successful.
Also, I'm curious about how to snoop on encrypted network traffic. How can I determine the encryption keys and algorithms a program uses to encrypt what it sends across the network? (I ask, because I am interested in creating a 3rd party client to emulate communication with a game server, and I can't do that without knowing how to discover the keys being used)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以使用虚拟机（例如VirtualBox）安全地运行“恶意软件”。您可以使用 Process Explorer 来查看该进程的具体功能（注册表/磁盘访问等）。
虚拟机还允许您创建其中安装的操作系统的快照，因此您可以通过单击按钮轻松地将所有内容返回到已知状态（即运行恶意软件之前）。
至于窥探网络，我不知道该怎么做。我想现有的网络嗅探工具可以在虚拟机本身内部使用，但我从未这样做过，所以我不知道该使用什么——其他人将不得不填写......
You can use a virtual machine (such as VirtualBox) to run the "malware" safely. You can use Process Explorer to see exactly what the process does (registry/disk access, etc).
The virtual machine will also allow you to create snapshots of the OS installed within, so you can easily return everything to a known state (i.e. before running the malware) at the click of a button.
As for snooping the network, I don't know how to do that. I suppose existing network sniffing tools can be used inside the virtual machine itself, but I've never done this so I don't know what to use -- someone else will have to fill in...
可疑木马的名称是什么？
swiftarchitect.com 上有一篇文章介绍了允许远程控制服务器的特定木马的操作详细信息：
请参阅：受到攻击的服务器病毒
What's the name of the suspected trojan?
There is an article on swiftarchitect.com which goes into operation details of a specific trojan which allows to take control of a server remotely:
See: Server Virus under Attack