windows创建进程的3种方式下各API调用层次

今天对创建进程的3种方式进行了跟踪：

调用api，createprocess

createprocess-createprocessinternala-createprocessinternalw

调用api，shell：

shellexecute- createprocessw-createprocessinternalw，

创建com方式（脚本病毒常用手法）：

createobject("wscript.shell").run- createprocessw-createprocessinternalw

验证方式如下（createprocess，其它不再列举），以下内容来自OD：

kernel32位置：

73FD44B0 > 8BFF mov edi,edi

73FD44B2 . 55 push ebp

73FD44B3 . 8BEC mov ebp,esp

73FD44B5 . 5D pop ebp

73FD44B6 .- FF25 1C140374 jmp [dword ds:<&api-ms-win-core-processt>; KernelBa.CreateProcessA

进入kernelba位置：

76629010 > 8BFF mov edi,edi

76629012 55 push ebp

76629013 8BEC mov ebp,esp

76629015 6A 00 push 0x0

76629017 FF75 2C push [dword ss:ebp+0x2C]

7662901A FF75 28 push [dword ss:ebp+0x28]

7662901D FF75 24 push [dword ss:ebp+0x24]

76629020 FF75 20 push [dword ss:ebp+0x20]

76629023 FF75 1C push [dword ss:ebp+0x1C]

76629026 FF75 18 push [dword ss:ebp+0x18]

76629029 FF75 14 push [dword ss:ebp+0x14]

7662902C FF75 10 push [dword ss:ebp+0x10]

7662902F FF75 0C push [dword ss:ebp+0xC]

76629032 FF75 08 push [dword ss:ebp+0x8]

76629035 6A 00 push 0x0

76629037 E8 94000000 call KernelBa.CreateProcessInternalA

7662903C 5D pop ebp

7662903D C2 2800 retn 0x28

在OD中并不标注createprocessinternalW名称，但是到达这里之后，EIP可以看到标注，也可以在模块的name list中定位到，在KernelBa模块中，以下地址为createprocessinternalW

766290D0 > 68 90000000 push 0x90

766290D5 68 303A6376 push KernelBa.76633A30

766290DA E8 D56CF9FF call KernelBa.765BFDB4

766290DF 33DB xor ebx,ebx

766290E1 895D E0 mov [dword ss:ebp-0x20],ebx

766290E4 8B55 10 mov edx,[dword ss:ebp+0x10]

766290E7 85D2 test edx,edx

766290E9 74 11 je XKernelBa.766290FC

766290EB 8D4D BC lea ecx,[dword ss:ebp-0x44]

766290EE E8 B491F6FF call KernelBa.765922A7

766290F3 85C0 test eax,eax

766290F5 75 0D jnz XKernelBa.76629104

766290F7 E9 D5020000 jmp KernelBa.766293D1

766290FC 33C0 xor eax,eax

766290FE 8945 BC mov [dword ss:ebp-0x44],eax

76629101 895D C0 mov [dword ss:ebp-0x40],ebx

76629104 64:A1 30000000 mov eax,[dword fs:0x30]

7662910A 8B40 18 mov eax,[dword ds:eax+0x18]

7662910D 8945 E4 mov [dword ss:ebp-0x1C],eax

76629110 8945 C8 mov [dword ss:ebp-0x38],eax

76629113 33C0 xor eax,eax

76629115 8945 B4 mov [dword ss:ebp-0x4C],eax

76629118 895D B8 mov [dword ss:ebp-0x48],ebx

7662911B 8945 AC mov [dword ss:ebp-0x54],eax

7662911E 895D B0 mov [dword ss:ebp-0x50],ebx

76629121 6A 11 push 0x11

76629123 59 pop ecx

76629124 8B75 2C mov esi,[dword ss:ebp+0x2C]

76629127 8DBD 60FFFFFF lea edi,[dword ss:ebp-0xA0]

7662912D F3:A5 rep movs [dword es:edi],[dword ds:esi]

7662912F 8D85 60FFFFFF lea eax,[dword ss:ebp-0xA0]

76629135 8945 C4 mov [dword ss:ebp-0x3C],eax

76629138 C785 60FFFFFF 4>mov [dword ss:ebp-0xA0],0x48

76629142 899D 64FFFFFF mov [dword ss:ebp-0x9C],ebx

76629148 899D 68FFFFFF mov [dword ss:ebp-0x98],ebx

7662914E 899D 6CFFFFFF mov [dword ss:ebp-0x94],ebx

76629154 8B7D 2C mov edi,[dword ss:ebp+0x2C]

76629157 F745 20 0000080>test [dword ss:ebp+0x20],0x80000

7662915E 74 08 je XKernelBa.76629168

76629160 8B47 44 mov eax,[dword ds:edi+0x44]

76629163 8945 A4 mov [dword ss:ebp-0x5C],eax

76629166 EB 03 jmp XKernelBa.7662916B

76629168 895D A4 mov [dword ss:ebp-0x5C],ebx

7662916B 895D FC mov [dword ss:ebp-0x4],ebx

7662916E 33F6 xor esi,esi

76629170 46 inc esi

76629171 8975 FC mov [dword ss:ebp-0x4],esi

76629174 8B55 0C mov edx,[dword ss:ebp+0xC]

76629177 85D2 test edx,edx

76629179 74 1C je XKernelBa.76629197

7662917B 8D4D B4 lea ecx,[dword ss:ebp-0x4C]

7662917E E8 2491F6FF call KernelBa.765922A7

76629183 85C0 test eax,eax

76629185 75 10 jnz XKernelBa.76629197

76629187 8BF3 mov esi,ebx

76629189 8975 E0 mov [dword ss:ebp-0x20],esi

7662918C 895D FC mov [dword ss:ebp-0x4],ebx

7662918F 8B7D E4 mov edi,[dword ss:ebp-0x1C]

76629192 E9 2C020000 jmp KernelBa.766293C3

76629197 8B55 28 mov edx,[dword ss:ebp+0x28]

7662919A 85D2 test edx,edx

7662919C 74 0C je XKernelBa.766291AA

7662919E 8D4D AC lea ecx,[dword ss:ebp-0x54]

766291A1 E8 0191F6FF call KernelBa.765922A7

766291A6 85C0 test eax,eax

766291A8 ^ 74 DD je XKernelBa.76629187

766291AA 8B47 04 mov eax,[dword ds:edi+0x4]

766291AD 85C0 test eax,eax

766291AF 0F84 AF000000 je KernelBa.76629264

766291B5 C745 FC 0200000>mov [dword ss:ebp-0x4],0x2

766291BC 50 push eax

766291BD 8D45 D4 lea eax,[dword ss:ebp-0x2C]

766291C0 50 push eax

766291C1 FF15 18836476 call [dword ds:<&ntdll.RtlInitAnsiString>; ntdll.RtlInitAnsiStringEx

766291C7 8945 DC mov [dword ss:ebp-0x24],eax

766291CA 8975 FC mov [dword ss:ebp-0x4],esi

766291CD 85C0 test eax,eax

766291CF 79 09 jns XKernelBa.766291DA

766291D1 8BC8 mov ecx,eax

766291D3 E8 2887F6FF call KernelBa.76591900

766291D8 ^ EB AD jmp XKernelBa.76629187

766291DA A1 34806476 mov eax,[dword ds:<&ntdll.NlsMbCodePageT>

766291DF 8038 00 cmp [byte ds:eax],0x0

766291E2 74 0C je XKernelBa.766291F0

766291E4 8D45 D4 lea eax,[dword ss:ebp-0x2C]

766291E7 50 push eax

766291E8 FF15 54876476 call [dword ds:<&ntdll.RtlxAnsiStringToU>; ntdll.RtlxOemStringToUnicodeSize

766291EE EB 0B jmp XKernelBa.766291FB

766291F0 0FB745 D4 movzx eax,[word ss:ebp-0x2C]

766291F4 8D0445 02000000 lea eax,[dword ds:eax*2+0x2]

766291FB 66:8945 CE mov [word ss:ebp-0x32],ax

766291FF 0FB7C0 movzx eax,ax

76629202 50 push eax

76629203 53 push ebx

76629204 8B75 E4 mov esi,[dword ss:ebp-0x1C]

76629207 56 push esi

76629208 FF15 F4826476 call [dword ds:<&ntdll.RtlAllocateHeap>] ; ntdll.RtlAllocateHeap

7662920E 8985 64FFFFFF mov [dword ss:ebp-0x9C],eax

76629214 85C0 test eax,eax

76629216 75 07 jnz XKernelBa.7662921F

76629218 B9 170000C0 mov ecx,0xC0000017

7662921D ^ EB B4 jmp XKernelBa.766291D3

7662921F 8945 D0 mov [dword ss:ebp-0x30],eax

76629222 53 push ebx

76629223 8D45 D4 lea eax,[dword ss:ebp-0x2C]

76629226 50 push eax

76629227 8D45 CC lea eax,[dword ss:ebp-0x34]

7662922A 50 push eax

7662922B FF15 2C806476 call [dword ds:<&ntdll.RtlAnsiStringToUn>; ntdll.RtlAnsiStringToUnicodeString

76629231 8945 DC mov [dword ss:ebp-0x24],eax

76629234 85C0 test eax,eax

76629236 79 2F jns XKernelBa.76629267

76629238 ^ EB 97 jmp XKernelBa.766291D1

7662923A 8B45 EC mov eax,[dword ss:ebp-0x14]

7662923D 8B00 mov eax,[dword ds:eax]

7662923F 33C9 xor ecx,ecx

76629241 8138 050000C0 cmp [dword ds:eax],0xC0000005

76629247 0F94C1 sete cl

7662924A 8BC1 mov eax,ecx

7662924C C3 retn