分享 脱壳教程第1-4篇

admin

0040D250 0F84 0F010000 JE chap703.0040D365
0040D256 8D85 D1504400 LEA EAX,DWORD PTR SS:[EBP+4450D1]
0040D25C 50 PUSH EAX
0040D25D FF95 94514400 CALL DWORD PTR SS:[EBP+445194]

到这里我们看到信息框中写有 GetModuleHandleA

0040D25D FF95 94514400 CALL DWORD PTR SS:[EBP+445194] ; kernel32.GetModuleHandleA
0040D263 8985 CD504400 MOV DWORD PTR SS:[EBP+4450CD],EAX
0040D269 8BF8 MOV EDI,EAX
0040D26B 8D9D DE504400 LEA EBX,DWORD PTR SS:[EBP+4450DE]
0040D271 53 PUSH EBX
0040D272 50 PUSH EAX
0040D273 FF95 90514400 CALL DWORD PTR SS:[EBP+445190]

到这里我们看到信息框中写有 GetProcAddress

0040D273 FF95 90514400 CALL DWORD PTR SS:[EBP+445190] ; kernel32.GetProcAddress
0040D279 8985 B9504400 MOV DWORD PTR SS:[EBP+4450B9],EAX
0040D27F 8D9D EB504400 LEA EBX,DWORD PTR SS:[EBP+4450EB]
0040D285 53 PUSH EBX
0040D286 57 PUSH EDI
0040D287 FF95 90514400 CALL DWORD PTR SS:[EBP+445190] ; kernel32.GetProcAddress
0040D28D 8985 BD504400 MOV DWORD PTR SS:[EBP+4450BD],EAX
0040D293 8DB5 F74A4400 LEA ESI,DWORD PTR SS:[EBP+444AF7]
0040D299 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
0040D29C 6A 04 PUSH 4
0040D29E 68 00100000 PUSH 1000
0040D2A3 50 PUSH EAX
0040D2A4 6A 00 PUSH 0
0040D2A6 FF95 B9504400 CALL DWORD PTR SS:[EBP+4450B9]

到这里我们看到信息框中写有 VirtualAllo

0040D2A6 FF95 B9504400 CALL DWORD PTR SS:[EBP+4450B9] ; kernel32.VirtualAlloc
0040D2AC 8985 B5504400 MOV DWORD PTR SS:[EBP+4450B5],EAX
0040D2B2 56 PUSH ESI
0040D2B3 8B1E MOV EBX,DWORD PTR DS:[ESI]
0040D2B5 039D AC504400 ADD EBX,DWORD PTR SS:[EBP+4450AC]
0040D2BB 50 PUSH EAX
0040D2BC 53 PUSH EBX
0040D2BD E8 A3020000 CALL chap703.0040D565
0040D2C2 3B46 04 CMP EAX,DWORD PTR DS:[ESI+4]
0040D2C5 74 0B JE SHORT chap703.0040D2D2 跳
0040D2C7 8D9D 5D514400 LEA EBX,DWORD PTR SS:[EBP+44515D]
0040D2CD E9 4F010000 JMP chap703.0040D421
0040D2D2 80BD B0504400 0>CMP BYTE PTR SS:[EBP+4450B0],0
............................................................

admin

0040D301 43 INC EBX
0040D302 49 DEC ECX
0040D303 ^ EB ED JMP SHORT chap703.0040D2F2 往回跳
0040D305 291E SUB DWORD PTR DS:[ESI],EBX F4到这里
0040D307 83C3 05 ADD EBX,5
0040D30A 83C6 04 ADD ESI,4
0040D30D 83E9 05 SUB ECX,5
0040D310 ^ EB E0 JMP SHORT chap703.0040D2F2 又往回跳
0040D312 5B POP EBX F4到这里
0040D313 5E POP ESI
0040D314 59 POP ECX
........................................................
0040D339 68 00800000 PUSH 8000
0040D33E 6A 00 PUSH 0
0040D340 50 PUSH EAX
0040D341 FF95 BD504400 CALL DWORD PTR SS:[EBP+4450BD]

到这里我们看到信息框中写有 VirtualFree

0040D341 FF95 BD504400 CALL DWORD PTR SS:[EBP+4450BD] ; kernel32.VirtualFree
0040D347 83C6 08 ADD ESI,8
0040D34A 833E 00 CMP DWORD PTR DS:[ESI],0
0040D34D ^ 0F85 46FFFFFF JNZ chap703.0040D299 又往回跳
0040D353 8B9D DF4A4400 MOV EBX,DWORD PTR SS:[EBP+444ADF] F4到这里
0040D359 0BDB OR EBX,EBX
0040D35B 74 08 JE SHORT chap703.0040D365
0040D35D 8B03 MOV EAX,DWORD PTR DS:[EBX]
..................................................
0040D3A9 74 0C JE SHORT chap703.0040D3B7
0040D3AB 83FB 02 CMP EBX,2
0040D3AE 74 16 JE SHORT chap703.0040D3C6
0040D3B0 83FB 03 CMP EBX,3
0040D3B3 74 20 JE SHORT chap703.0040D3D5
0040D3B5 EB 2C JMP SHORT chap703.0040D3E3
0040D3B7 66:8B1E MOV BX,WORD PTR DS:[ESI]
0040D3BA 81E3 FF0F0000 AND EBX,0FFF
0040D3C0 66:01041F ADD WORD PTR DS:[EDI+EBX],AX
0040D3C4 EB 1D JMP SHORT chap703.0040D3E3
0040D3C6 66:8B1E MOV BX,WORD PTR DS:[ESI]
0040D3C9 81E3 FF0F0000 AND EBX,0FFF
0040D3CF 66:01141F ADD WORD PTR DS:[EDI+EBX],DX
0040D3D3 EB 0E JMP SHORT chap703.0040D3E3
0040D3D5 66:8B1E MOV BX,WORD PTR DS:[ESI]
0040D3D8 81E3 FF0F0000 AND EBX,0FFF
0040D3DE 01141F ADD DWORD PTR DS:[EDI+EBX],EDX
0040D3E1 EB 00 JMP SHORT chap703.0040D3E3
0040D3E3 66:830E FF OR WORD PTR DS:[ESI],0FFFF
0040D3E7 83C6 02 ADD ESI,2
0040D3EA ^ E2 B4 LOOPD SHORT chap703.0040D3A0

admin

0040D3EC ^ EB 9A JMP SHORT chap703.0040D388
0040D3EE 8BB5 EB4A4400 MOV ESI,DWORD PTR SS:[EBP+444AEB]
0040D3F4 8B95 AC504400 MOV EDX,DWORD PTR SS:[EBP+4450AC]
0040D3FA 03F2 ADD ESI,EDX
0040D3FC 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
0040D3FF 85C0 TEST EAX,EAX
0040D401 0F84 3D010000 JE chap703.0040D544
0040D407 03C2 ADD EAX,EDX
0040D409 8BD8 MOV EBX,EAX
0040D40B 50 PUSH EAX
0040D40C FF95 94514400 CALL DWORD PTR SS:[EBP+445194]

到这里我们看到信息框中写有 GetModuleHandleA

0040D40C FF95 94514400 CALL DWORD PTR SS:[EBP+445194] ; kernel32.GetModuleHandleA
0040D412 85C0 TEST EAX,EAX
0040D414 75 67 JNZ SHORT chap703.0040D47D 跳
0040D416 53 PUSH EBX
0040D417 FF95 98514400 CALL DWORD PTR SS:[EBP+445198]
0040D41D 85C0 TEST EAX,EAX
0040D41F 75 5C JNZ SHORT chap703.0040D47D
0040D421 8D85 D1504400 LEA EAX,DWORD PTR SS:[EBP+4450D1]
0040D427 50 PUSH EAX
0040D428 FF95 98514400 CALL DWORD PTR SS:[EBP+445198]
...........................................................
0040D4C6 43 INC EBX
0040D4C7 53 PUSH EBX
0040D4C8 81E3 FFFFFF7F AND EBX,7FFFFFFF
0040D4CE 53 PUSH EBX
0040D4CF FFB5 6E514400 PUSH DWORD PTR SS:[EBP+44516E]
0040D4D5 FF95 90514400 CALL DWORD PTR SS:[EBP+445190]

到这里我们看到信息框中写有 GetProcAddress

0040D4D5 FF95 90514400 CALL DWORD PTR SS:[EBP+445190] ; kernel32.GetProcAddress
0040D4DB 85C0 TEST EAX,EAX
0040D4DD 5B POP EBX
0040D4DE 75 3E JNZ SHORT chap703.0040D51E 跳走。

0040D51E 8907 MOV DWORD PTR DS:[EDI],EAX 到这里.
0040D520 8385 72514400 0>ADD DWORD PTR SS:[EBP+445172],4
0040D527 ^ E9 67FFFFFF JMP chap703.0040D493 往回跳。
0040D52C 33C0 XOR EAX,EAX F4到这里。
0040D52E 8906 MOV DWORD PTR DS:[ESI],EAX
0040D530 8946 0C MOV DWORD PTR DS:[ESI+C],EAX
0040D533 8946 10 MOV DWORD PTR DS:[ESI+10],EAX
0040D536 83C6 14 ADD ESI,14
0040D539 8B95 AC504400 MOV EDX,DWORD PTR SS:[EBP+4450AC]
0040D53F ^ E9 B8FEFFFF JMP chap703.0040D3FC 又往回跳

admin

0040D544 8B85 EF4A4400 MOV EAX,DWORD PTR SS:[EBP+444AEF]
0040D54A 50 PUSH EAX
0040D54B 0385 AC504400 ADD EAX,DWORD PTR SS:[EBP+4450AC]
0040D551 5B POP EBX
0040D552 0BDB OR EBX,EBX
0040D554 894424 1C MOV DWORD PTR SS:[ESP+1C],EAX
0040D558 61 POPAD 终于看到这个标志，入口就在附近。
0040D559 75 08 JNZ SHORT chap703.0040D563 跳走。
0040D55B B8 01000000 MOV EAX,1
0040D560 C2 0C00 RETN 0C
0040D563 50 PUSH EAX EAX=004010CC
0040D564 C3 RETN 返回入口。

004010CC 55 PUSH EBP 程序跨段，并且经过了PoPad关键字。我们再这里用Od的Dump插件直接脱壳。
004010CD 8BEC MOV EBP,ESP
004010CF 83EC 44 SUB ESP,44
004010D2 56 PUSH ESI
004010D3 FF15 E4634000 CALL DWORD PTR DS:[4063E4] ; kernel32.GetCommandLineA
004010D9 8BF0 MOV ESI,EAX
004010DB 8A00 MOV AL,BYTE PTR DS:[EAX]
004010DD 3C 22 CMP AL,22
004010DF 75 1B JNZ SHORT chap703.004010FC
004010E1 56 PUSH ESI

用Od插件脱壳时注意，看截图。
此主题相关图片如下：



Rubuild ImPort
Method1
Method2
重建输入表时，插件有两个选项。Method2重建输入表很快，脱壳后运行率高。Method1重建输入表慢，脱壳后运行率较低。不过本程序用Method2重建输入表无法运行，Method1重建输入表后程序可直接运行。

脱壳总结:
这个壳虽老，里面的循环还真多，新Aspack和它肯定不同，后话。
Aspack1.0803加壳

OneTime

学习了~:lol:lol:lol

树袋老妖

学习了，…………………………

亚历山大

树袋老妖 发表于 2015-1-22 09:38
学习了，…………………………

不错不错，很受启发。明白了脱壳的原理