留几个脱壳笔记

小生我怕怕

今天帮朋友脱了三个壳做了点笔记,难得我也会做笔记啦,哈哈,所以发出来留个记念,有兴趣的朋友可以下去练下手,只限于新手,高手就不要啦,都是些不长用的壳

首先是eXpressor v1.4.5

首先忽略所有异常

00406881 >55push ebp //OD载入程序停在了这里
004068828BECmov ebp,esp//在这里开始ESP定律
0040688483EC 58 sub esp,58
0040688753push ebx
0040688856push esi
0040688957push edi
0040688A8365 DC 00and dword ptr ss:[ebp-24],0
0040688EF3: prefix rep:
0040688FEB 0C jmp short 测试2.0040689D

此时停在了这里，距离OEP只有一步，可是不能单步也不能F4所以我们要接着用我们的硬件断点，宝贵啊

00401066- FF25 24104000jmp dword ptr ds:[401024]; MSVBVM60.ThunRTMain
0040106C68 10184000push 测试2.00401810//在这里下硬件执行断点，然后从新加载程序; ASCII "VB5!6&vb6chs.dll"
00401071E8 F0FFFFFFcall 测试2.00401066; jmp to MSVBVM60.ThunRTMain
004010760000 add byte ptr ds:[eax],al
004010780000 add byte ptr ds:[eax],al
0040107A0000 add byte ptr ds:[eax],al

从新加载后我们直接运行就停在了我们的OEP，接下来自然就是DUMP程序啦

0040106C68 10184000push 测试2.00401810; ASCII "VB5!6&vb6chs.dll"
00401071E8 F0FFFFFFcall 测试2.00401066; jmp to MSVBVM60.ThunRTMain
004010760000 add byte ptr ds:[eax],al
004010780000 add byte ptr ds:[eax],al
0040107A0000 add byte ptr ds:[eax],al
0040107C3000 xor byte ptr ds:[eax],al
0040107E0000 add byte ptr ds:[eax],al

小生我怕怕

首先忽略除内存访问外的所有异常

004066ED >E8 03000000 call 测试.004066F5//OD载入
004066F2EB 01 jmp short 测试.004066F5 //F9运行
004066F4E9 BB550000 jmp 测试.0040BCB4
004066F900E8add al,ch
004066FB0300add eax,dword ptr ds:[eax]
004066FD0000add byte ptr ds:[eax],al
004066FFEB 01 jmp short 测试.00406702
00406701C2 E88E retn 8EE8
004067040000add byte ptr ds:[eax],al
0040670600E8add al,ch
004067080300add eax,dword ptr ds:[eax]
0040670A0000add byte ptr ds:[eax],al
0040670CEB 01 jmp short 测试.0040670F
0040670EE8 E8810000 call 测试.0040E8FB

此时注意堆栈窗口

0012EBE0 0012EC70指针到下一个 SEH 记录
0012EBE4 00408A2CSE 句柄//记住这个SE句柄
0012EBE8 00406FD2测试.00406FD2//Ctrl+G搜索00408A2C
0012EBEC 00406FBF测试.00406FBF
0012EBF0 00406FAC测试.00406FAC
0012EBF4 00406F9F测试.00406F9F
0012EBF8 00406EF6测试.00406EF6

接着来到这里

00408A2C55push ebp //F2下断，接着运行
00408A2D8BECmov ebp,esp//开始单步F8走起
00408A2F57push edi
00408A3036:8B45 10mov eax,dword ptr ss:[ebp+10]
00408A343E:8BB8 C400000>mov edi,dword ptr ds:[eax+C4]
00408A3B3E:FF37 push dword ptr ds:[edi]
00408A3E33FFxor edi,edi
00408A4064:8F07 pop dword ptr fs:[edi]
00408A433E:8380 C400000>add dword ptr ds:[eax+C4],8
00408A4B3E:8BB8 A400000>mov edi,dword ptr ds:[eax+A4]

接着到这里

00408A4064:8F07 pop dword ptr fs:[edi]
00408A433E:8380 C400000>add dword ptr ds:[eax+C4],8
00408A4B3E:8BB8 A400000>mov edi,dword ptr ds:[eax+A4]
00408A52C1C7 07 rol edi,7
00408A553E:89B8 B800000>mov dword ptr ds:[eax+B8],edi//注意此时edi的值就是我们的OEP
━━━━━━━━━━━━━━━━━━━━━━━━━━
edi=0040106C (测试.0040106C) //此时edi为0040106C
堆栈 ds:[0012E9CC]=00408C99 (测试.00408C99)

━━━━━━━━━━━━━━━━━━━━━━━━━━

接着我们继续Ctrl+G来到0040106C

0040106C68 10184000 push 测试.00401810//很明显是VB写的程序，我们在这里F2下断，F9运行，程序停在了OEP，好啦DUMP程序吧 ; ASCII "VB5!6&vb6chs.dll"
00401071E8 F0FFFFFF call 测试.00401066 ; jmp to MSVBVM60.ThunRTMain
004010760000add byte ptr ds:[eax],al
004010780000add byte ptr ds:[eax],al
0040107A0000add byte ptr ds:[eax],al
0040107C3000xor byte ptr ds:[eax],al

小生我怕怕

设置除内存访问外的所有异常，在把OD隐藏插件隐藏一次

0041674DCD 01 int 1
0041674F40inc eax
0041675040inc eax
004167510BC0or eax,eax
0041675375 05 jnz short 测试11.0041675A
0041675590nop
0041675690nop
0041675790nop
0041675890nop
0041675961popad

注意堆栈窗口

0012FF78 0012FFE0指针到下一个 SEH 记录
0012FF7C 00416731SE 句柄选择右键数据窗口中跟随
0012FF80 0041BDA5测试11.0041BDA5
0012FF84 85027200
0012FF88 0D0F412C
0012FF8C 0012FFA0

然后内存访问断点

004167318B5C24 0C mov ebx,dword ptr ss:[esp+C]//来到这里，接着F2下断，SHIFT+F9运行
004167358383 B8000000 0>add dword ptr ds:[ebx+B8],2
0041673C33C0xor eax,eax
0041673EC3retn
0041673F64:67:FF36 0000 push dword ptr fs:[0]

然后来到这里接着F2下断，SHIFT+F9

004167818B048Emov eax,dword ptr ds:[esi+ecx*4]
004167848B5C8E 04 mov ebx,dword ptr ds:[esi+ecx*4+4]
0041678833C3xor eax,ebx
0041678AC1C0 09 rol eax,9
0041678D2BC2sub eax,edx
0041678F81C2 C90B344F add edx,4F340BC9
0041679589048Emov dword ptr ds:[esi+ecx*4],eax

记住现在要删除断点和内存断点

0041678F81C2 C90B344F add edx,4F340BC9
0041679589048Emov dword ptr ds:[esi+ecx*4],eax
0041679849dec ecx
00416799^ EB E1 jmp short 测试11.0041677C
0041679B61popad
0041679C61popad
0041679DC3retn//然后在这里F4运行到所选

打开内存镜象，在00401000下F2开关断点，接着SHIFT+F9
内存映射，项目 22
地址=00401000
大小=00002000 (8192.)
物主=测试11 00400000
区段=.text
包含=code
类型=Imag 01001002
访问=R
初始访问=RWE

接下来停在了我们的OEP，自然是DUMP程序

0040106C68 10184000 push 测试11.00401810 ; ASCII "VB5!6&vb6chs.dll"
00401071E8 F0FFFFFF call 测试11.00401066 ; jmp to MSVBVM60.ThunRTMain
004010760000add byte ptr ds:[eax],al
004010780000add byte ptr ds:[eax],al
0040107A0000add byte ptr ds:[eax],al
0040107C3000xor byte ptr ds:[eax],al
0040107E0000add byte ptr ds:[eax],al

sds520

强大，收下了！呵呵 [s:43][s:42]

hailand

谢谢楼主，学习一下！

mayl8822

学习了哦[s:43][s:43]

shsww

谢谢分享啊！！！到底在设置忽略异常时如何来把握！

gjdzwgl

感谢分享!!新手又学到东西了.呵呵

641214367

LZ 谢谢你了
[s:40][s:40]

zxc86491348

····························