刚才脱了一个UPX壳顺便就把过程简单记录了一下
查壳 UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo
OD载入.flyODBG,也就是对flyODBG脱壳,
00581ED0 > 60 pushad
00581ED1 BE 00304F00 mov esi,flyODBG.004F3000
00581ED6 8DBE 00E0F0FF lea edi,dword ptr ds:[esi+FFF0E>
00581EDC 57 push edi
00581EDD 83CD FF or ebp,FFFFFFFF
00581EE0 EB 10 jmp short flyODBG.00581EF2
00581EE2 90 nop
00581EE3 90 nop
用Esp定律.走到00581ED1,在命令行中输入hr 12ffa4
然后F9
00582048 - E9 B3EFE7FF jmp flyODBG.00401000 //OEP
0058204D 0000 add byte ptr ds:[eax],al
0058204F 0068 20 add byte ptr ds:[eax+20],ch
00582052 58 pop eax
00582053 000421 add byte ptr ds:[ecx],al
00582056 58 pop eax
00582057 001B add byte ptr ds:[ebx],bl
00582059 014B 00 add dword ptr ds:[ebx],ecx
0058205C 0000 add byte ptr ds:[eax],al
00401000这就是OEP.再F8 一次,到了,脱壳.
00401000 /EB 10 jmp short flyODBG.00401012 //在这脱壳
00401002 |66:623A bound di,dword ptr ds:[edx]
00401005 |43 inc ebx
00401006 |2B2B sub ebp,dword ptr ds:[ebx]
00401008 |48 dec eax
00401009 |4F dec edi
0040100A |4F dec edi
0040100B |4B dec ebx
0040100C |90 nop
0040100D -|E9 28014B00 jmp 008B113A
00401012 \A1 1B014B00 mov eax,dword ptr ds:[4B011B]
00401017 C1E0 02 shl eax,2
0040101A A3 1F014B00 mov dword ptr ds:[4B011F],eax
0040101F 52 push edx
00401020 6A 00 push 0
00401022 E8 4BE00A00 call flyODBG.004AF072 ; jmp to kernel32.GetModuleHandleA
00401027 8BD0 mov edx,eax
00401029 E8 DA240A00 call flyODBG.004A3508
脱壳之后休要修复的.用鼠标点到00401022 ,然后回车.
来到004AF072 - FF25 30D35000 jmp dword ptr ds:[50D330] ; kernel32.GetModuleHandleA
我们向上走.
找到所有的函数.
004AEF94 - FF25 E4D05000 jmp dword ptr ds:[50D0E4] ; ADVAPI32.RegCloseKey
004AEF9A - FF25 E8D05000 jmp dword ptr ds:[50D0E8] ; ADVAPI32.RegCreateKeyA
004AEFA0 - FF25 ECD05000 jmp dword ptr ds:[50D0EC] ; ADVAPI32.RegDeleteKeyA
004AEFA6 - FF25 F0D05000 jmp dword ptr ds:[50D0F0] ; ADVAPI32.RegOpenKeyA
004AEF94这是最上面的,我们记下 jmp dword ptr ds:[50D0E4] 这里面的地址50D0E4
add1=50D0E4-8=50D0DC
然后往下走,走到末尾.
004AF606 - FF25 9CD95000 jmp dword ptr ds:[50D99C] ; USER32.wsprintfA
004AF60C - FF25 A0D95000 jmp dword ptr ds:[50D9A0] ; USER32.wsprintfW
004AF612 CC int3
004AF613 CC int3
004AF614 - FF25 B8D95000 jmp dword ptr ds:[50D9B8] ; OLE32.CoCreateInstance
004AF61A - FF25 BCD95000 jmp dword ptr ds:[50D9BC] ; OLE32.CoInitialize
004AF620 - FF25 C0D95000 jmp dword ptr ds:[50D9C0] ; OLE32.CoUninitialize
走到004AF620,记下jmp dword ptr ds:[50D9C0] 中的地址50D9C0
add2=50D9C0+8=50D9C7
然后修复OEP填1000,RVA=add1-400000.也就是10D0DC
大小是add2-add1=8EB
然后获取输入表,抓取文件.OK,修复成功,文件也能用..
你就装B吧 随意找个 文章装B
