![\"\"](\"http:\/\/oguzkartal.net\/blog\/wp-content\/uploads\/2010\/08\/AP1.png\" "\\"AP1\\"")
<\/a><\/p>\n\u00d6rnek olarak inceledi\u011fimiz Task Manager (G\u00f6rev Y\u00f6neticisi) taskmgr.exe\u2019ye ba\u011flanm\u0131\u015f DLL\u2019leri g\u00f6r\u00fcyoruz. Misal bu uygulama advapi32.dll taraf\u0131ndan export edilmi\u015f bir ka\u00e7 API call yapm\u0131\u015f. Buraya kadar her\u015fey tamam. Ancak bakt\u0131\u011f\u0131m\u0131zda Advapi32.dll\u2019in de bir ka\u00e7 DLL\u2019den referans ald\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcyoruz. Bu DLL isimlerine bakarsak belli bir prefix (\u00f6n ek) al\u0131p s\u0131n\u0131fland\u0131r\u0131lm\u0131\u015f. Peki bu DLL\u2019ler ne i\u015fe yar\u0131yor. Esas\u0131nda hi\u00e7bir i\u015fe yaram\u0131yorlar. Bu DLL\u2019ler s\u0131n\u0131flara ayr\u0131lm\u0131\u015f birer taslak. Yani mant\u0131ksal Dll dosyalar\u0131. API Fonksiyonlar\u0131n\u0131 i\u00e7eriyorlar ancak hi\u00e7bir\u015fey yapm\u0131yorlar.<\/p>\n
\u00d6rne\u011fin taskmgr.exe\u2019nin Advapi32.dll\u2019inde kulland\u0131\u011f\u0131 bir API\u2019\u0131 ele alal\u0131m.<\/p>\n
Bu API fonksiyonu OpenSCManagerW<\/strong> olsun. Bu fonksiyon belirtilen bir makineye ait servis y\u00f6netici veritaban\u0131 ile bir ba\u011flant\u0131 kurar. Bunu taskmgr.exe Advapi32.dll\u2019inden referans alm\u0131\u015ft\u0131.\u00a0 Se\u00e7ti\u011fimiz API fonksiyonu bir servis y\u00f6netici fonksiyonu oldu\u011fu i\u00e7in Service Management kategorisine ayr\u0131lm\u0131\u015f taslak DLL\u2019de bulunmal\u0131.<\/p>\n G\u00f6rd\u00fc\u011f\u00fcn\u00fcz gibi API-MS-WIN-Service-Management-L1-1-0<\/span> taslak dll\u2019inde export edilmi\u015f. Peki taskmgr.exe b\u00fct\u00fcn bunlar\u0131 bilmeden sadece advapi32.dll\u2019ini ba\u011flam\u0131\u015f ve OpenSCManagerW<\/strong> API fonksiyonunu \u00e7a\u011f\u0131rm\u0131\u015ft\u0131. Peki bu \u00e7a\u011fr\u0131lan fonksiyon ne yap\u0131yor? Bu fonksiyon statik durumda iken bu referans ald\u0131\u011f\u0131 taslak dll\u2019deki ilgili fonksiyon implementasyonuna z\u0131pl\u0131yor.<\/p>\n G\u00f6r\u00fcld\u00fc\u011f\u00fc gibi Advapi32.dll\u2019<\/span>deki<\/span> OpenSCManagerW<\/strong> API koduna bakarsak g\u00f6rd\u00fc\u011f\u00fcm\u00fcz taslak k\u0131sma z\u0131playan bir koddan ibaret. Peki taslak k\u0131s\u0131mda durum nas\u0131l.<\/p>\n Taslak k\u0131sm\u0131ndaki API fonksiyonun yapt\u0131\u011f\u0131 \u015fey NULL d\u00f6ndermek. 3 adet parametre ald\u0131\u011f\u0131 i\u00e7in ret 0xc (12 byte) ile stack\u2019I dengeleyip NULL d\u00f6nderiyor. Bu fonksiyonun t\u00fcr\u00fcne g\u00f6re ufak farkl\u0131l\u0131k g\u00f6sterir ama pointer d\u00f6nderen fonksiyonlar i\u00e7in NULL, di\u011fer de\u011ferler i\u00e7in genel de 1 (TRUE) d\u00f6nderir.<\/p>\n NT 6.1 Kernel bir k\u00fct\u00fcphane y\u00fcklenece\u011fi zaman prosese ait adres alan\u0131na bu statik kod yerine ger\u00e7ek fonksiyona ait koda dallanacak \u015fekilde dinamik olarak de\u011fi\u015ftirilir.<\/p>\n Y\u00fckleyici k\u00fct\u00fcphaneleri y\u00fcklerken her zamanki gibi ntdll alt\u0131nda sa\u011flanm\u0131\u015f Loader fonksiyonlar\u0131n\u0131 \u00e7a\u011f\u0131r\u0131r. Windows 7 ile bu fonksiyonlara demin bahsetti\u011fimiz taslak dll\u2019leri \u00e7\u00f6zen rutinler eklenmi\u015f gerekli ise \u00e7\u00f6z\u00fcmlenerek e\u015flenmektedirler. \u00d6rne\u011fin bir k\u00fct\u00fcphane y\u00fcklemek istedi\u011fimiz (LoadLibraryEx<\/strong>) nas\u0131l bir i\u015flemden ge\u00e7mekedir?<\/p>\n Y\u00fckleyici API fonksiyonunu \u00e7a\u011f\u0131rd\u0131\u011f\u0131m\u0131zda ilk elden i\u015flemi devralan ntdll fonksiyonu i\u015flemeye ba\u015flayacakt\u0131r.<\/p>\n ntdll.dll<\/span>!_ApiSetResolveToHost<\/span>@20()\u00a0 + 0xf bytes Yukar\u0131da k\u00fct\u00fcphane y\u00fcklenmesi s\u0131ras\u0131nda bir callstack \u00e7\u0131kt\u0131s\u0131 g\u00f6r\u00fcyorsunuz. LdrpApplyFileNameRedirection<\/strong> ve sonraki k\u0131s\u0131m bahsetti\u011fimiz mekanizman\u0131n i\u015fletilmesi i\u00e7in gerekli rutinlerdir. LdrpApplyFileNameRedirection<\/strong> ile y\u00fcklenmek istenen Dll\u2019in taslak bir dll olup olmad\u0131\u011f\u0131 e\u011fer taslak bir dll ise o y\u00f6nde y\u00f6nlendirme yap\u0131lmas\u0131 i\u015flevlerini yapan ilk rutindir. Hemen sonras\u0131nda ise ger\u00e7ek anlamda bu kontrol ve \u00e7\u00f6z\u00fcmleme i\u015flemi ApiSetResolveToHost<\/strong> arac\u0131l\u0131\u011f\u0131 ile yap\u0131l\u0131yor.<\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n
\nntdll.dll<\/span>!_LdrpApplyFileNameRedirection<\/span>@28()\u00a0 + 0x35 bytes
\nntdll.dll<\/span>!_LdrpLoadDll<\/span>@24()\u00a0 + 0xae bytes
\nntdll.dll<\/span>!_LdrLoadDll<\/span>@16()\u00a0 + 0x74 bytes
\nKernelBase.dll<\/span>!_LoadLibraryExW<\/span>@12()\u00a0 + 0x120 bytes<\/p>\n