ppoip / navy_public Goto Github PK

View Code? Open in Web Editor NEW

This project forked from stonedreamforest/navy_public

0.0 0.0 0.0 45 KB

轻量级自动分析病毒程序调用上下文、游戏反调试实现技术平台

navy_public's Introduction

Navy_public

轻量级自动分析病毒程序调用上下文、游戏反调试实现技术...

使用

启动Navy32/64.EXE 按alt+a选择要监控的进程

快捷键

ALT + A: 打开进程列表
CTRL + L: 清屏

json数据库

示例

{
    "supportedFunctions": ["NtCreateProcess", "NtQueryInformationProcess"],// 数据库已支持函数（数据库未支持的未显示在gui
    "NtCreateProcess": {
        "hasResult": true, // 函数是否有返回值
        "paraCount": 8, / 函数参数个数（不包括返回值）
        "paras": {
            "para0": { // 函数返回结果（若无也需要保留该字段
                "type": "NSTATUS", // 类型
                "name": "result", // 名称
                "hasPreValue": false // 是否有预定义值 可参考`DB/NTDLL.JSON -> NtQueryInformationProcess`
            },
            "para1": {// 第一个参数
                "type": "PHANDLE",
                "name": "ProcessHandle",
                "hasPreValue": false
            },
            "para2": { // 第二个参数
                "type": "ACCESS_MASK",
                "name": "DesiredAccess",
                "hasPreValue": false
            },
            "para3": {
                "type": "POBJECT_ATTRIBUTES",
                "name": "ObjectAttributes",
                "hasPreValue": false
            },
            "para4": {
                "type": "HANDLE",
                "name": "ParentProcess",
                "hasPreValue": false
            },
            "para5": {
                "type": "BOOLEAN",
                "name": "InheritObjectTable",
                "hasPreValue": false
            },
            "para6": {
                "type": "HANDLE",
                "name": "SectionHandle",
                "hasPreValue": false
            },
            "para7": {
                "type": "HANDLE",
                "name": "DebugPort",
                "hasPreValue": false
            },
            "para8": {
                "type": "HANDLE",
                "name": "ExceptionPort",
                "hasPreValue": false
            }
        }
    }
}

如果有数据显示类似以下结果

函数返回类型函数结果名称(原值/预定义值(若已设置)) 调用类型 (参数返回类型参数名称(原值/预定义值(若已设置))[预定义注释], ...)

3.1 调用前：未调用NtQueryInformationProcess时参数的内容

NSTATUS result(无返回值) __stdcall (HANDLE ProcessHandle(0xffffffff), PROCESSINFOCLASS ProcessInformationClass(ProcessBasicInformation)[there is any comments], PVOID ProcessInformation(0x695198), ULONG ProcessInformationLength(0x18), PULONG ReturnLength(0x6951b0))

3.2 调用后：调用NtQueryInformationProcess后参数的内容

NSTATUS result(0x0) __stdcall (HANDLE ProcessHandle(0xffffffff), PROCESSINFOCLASS ProcessInformationClass(ProcessBasicInformation)[there is any comments], PVOID ProcessInformation(0x695198), ULONG ProcessInformationLength(0x18), PULONG ReturnLength(0x6951b0))