今天在发个微狗4.0的狗壳.我用论坛现成的 GUnPacker通用脱壳辅助工具(更新到0.5版) 脱好的,不能运行,应该是代码解压不全.小弟技术太菜.还请论坛各大虾继续下去.
首先用GUnPacker
<C:\zMD\新建文件夹\新建文件夹\tp.EXE> ---- Opened Successful...
Create UnPacking Thread Successful...
Processing, Please Wait for a moment...
<C:\新建文件夹\新建文件夹\tp.EXE> ---- Is Packed Possibly...
<C:\新建文件夹\新建文件夹\tp.EXE> ---- Processing Successful...
Address : <0x0047C3AC> ---- Is OEP(FOEP) Possibly...
GUnPacker 显示 0047C3AC 是OEP.
并且自动生成脱壳后的文件 tp.EXE.GUnPacker.dump
试着运行没有反映.在用PEiD 深度扫描是ARJ Archive [Overlay] *
用OD载入
0047C3AC > 55 push ebp 停这里 ,当然拉
0047C3AD 8BEC mov ebp,esp
0047C3AF 81EC D4030000 sub esp,3D4
0047C3B5 53 push ebx
0047C3B6 56 push esi
0047C3B7 57 push edi
0047C3B8 56 push esi
0047C3B9 57 push edi
0047C3BA 52 push edx
0047C3BB 51 push ecx
0047C3BC 53 push ebx
0047C3BD 50 push eax
0047C3BE 833D 40E44900 0>cmp dword ptr ds:[49E440],1
0047C3C5 0F85 A7170000 jnz 11tp.0047DB72
0047C3CB 8325 7CE94900 0>and dword ptr ds:[49E97C],0
0047C3D2 8325 44E44900 0>and dword ptr ds:[49E444],0
0047C3D9 8325 48E44900 0>and dword ptr ds:[49E448],0
0047C3E0 8025 C0E44900 0>and byte ptr ds:[49E4C0],0
0047C3E7 E8 039FFFFF call 11tp.004762EF
0047C3EC FF35 08D94900 push dword ptr ds:[49D908]
0047C3F2 E8 22D2FFFF call 11tp.00479619
下面是两处"没有发现硬件狗"的代码地址
第一处"错误"
004A42D0 /$ 55 push ebp
004A42D1 |. 8BEC mov ebp,esp
004A42D3 |. 81EC D8000000 sub esp,0D8
004A42D9 |. 53 push ebx
004A42DA |. 56 push esi
004A42DB |. 57 push edi
004A42DC |. 68 C8000000 push 0C8
004A42E1 |. 6A 00 push 0
004A42E3 |. 8D85 38FFFFFF lea eax,[local.50]
004A42E9 |. 50 push eax
004A42EA |. E8 39080000 call ZDHW-5.004A4B28
004A42EF |. 83C4 0C add esp,0C
004A42F2 |. 837D 08 01 cmp [arg.1],1
004A42F6 0F85 52010000 jnz ZDHW-5.004A444E ; |跳到出错地址
004A42FC |. C685 30FFFFFF>mov byte ptr ss:[ebp-D0],6E
省略>>>>>>>>>>>>>>>>>>
004A4350 |. 8D85 28FFFFFF lea eax,[local.54]
004A4356 |. 50 push eax
004A4357 |. 8D85 38FFFFFF lea eax,[local.50]
004A435D |. 50 push eax
004A435E |. E8 7C070000 call ZDHW-5.004A4ADF
004A4363 |. 83C4 08 add esp,8
004A4366 |. 8B45 0C mov eax,[arg.2]
004A4369 |. 50 push eax
004A436A |. 8D85 38FFFFFF lea eax,[local.50]
004A4370 |. 50 push eax
004A4371 |. E8 3C070000 call ZDHW-5.004A4AB2
004A4376 |. 83C4 04 add esp,4
004A4379 |. 8D8428 38FFFF>lea eax,dword ptr ds:[eax+ebp-C8]
004A4380 |. 50 push eax
省略>>>>>>>>>>>>>>>>>>
004A43D7 |. 50 push eax004A4411 |. C685 2BFFFFFF>mov byte ptr ss:[ebp-D5],65
004A4418 |. C685 2CFFFFFF>mov byte ptr ss:[ebp-D4],20
004A441F |. C685 2DFFFFFF>mov byte ptr ss:[ebp-D3],6E
004A4426 |. C685 2EFFFFFF>mov byte ptr ss:[ebp-D2],6F
004A442D |. C685 2FFFFFFF>mov byte ptr ss:[ebp-D1],74
004A4434 |. C685 34FFFFFF>mov byte ptr ss:[ebp-CC],6E
004A443B |. C685 35FFFFFF>mov byte ptr ss:[ebp-CB],64
004A4442 |. C685 36FFFFFF>mov byte ptr ss:[ebp-CA],0
004A4449 |. E9 70010000 jmp ZDHW-5.004A45BE
004A444E |> C685 30FFFFFF>mov byte ptr ss:[ebp-D0],20
004A4455 |. C685 31FFFFFF>mov byte ptr ss:[ebp-CF],0
004A445C |. C685 28FFFFFF>mov byte ptr ss:[ebp-D8],54
004A4463 |. C685 29FFFFFF>mov byte ptr ss:[ebp-D7],68
004A446A |. C685 2AFFFFFF>mov byte ptr ss:[ebp-D6],65
省略>>>>>>>>>>>>>>>>>>
004A45BE |> \6A 10 push 10 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODALMB_OK|MB_ICONASTERISK|MB_APPLMODAL
MB_OK|MB_ICONHAND|MB_APPLMODAL
004A45C0 |. 8D85 28FFFFFF lea eax,[local.54] ; |
004A45C6 |. 50 push eax ; |Title = "错误"
004A45C7 |. 8D85 38FFFFFF lea eax,[local.50] ; |
004A45CD |. 50 push eax ; |Text= "没有发现硬件狗"
004A45CE |. 6A 00 push 0 ; |hOwner = NULL
004A45D0 |. FF15 5C804A00 call dword ptr ds:[<&USER32.MessageBo>; \MessageBoxA
004A45D6 |. 6A 01 push 1
004A45D8 |. E8 8DFCFFFF call ZDHW-5.004A426A
第二次应该是检测到调试器出错代吗
004A65C2 > \90 nop
004A65C3 . 83BD 18FEFFFF>cmp dword ptr ss:[ebp-1E8],0
004A65CA 74 38 je short ZDHW-5.004A6604 必须跳 JMP
004A65CC . 8B85 90FEFFFF mov eax,dword ptr ss:[ebp-170]
004A65D2 . 83B8 12060000>cmp dword ptr ds:[eax+612],0
004A65D9 74 22 je short ZDHW-5.004A65FD
004A65DB . 6A 40 push 40 ; /Style = MB_OK|MB_ICONASTERISK|MB_APPLMODALMB_OK|MB_ICONASTERISK|MB_APPLMODAL
004A65DD . 8B85 90FEFFFF mov eax,dword ptr ss:[ebp-170] ; |
004A65E3 . 05 16060000 add eax,616 ; |
004A65E8 . 50 push eax ; |Title = "错误"
004A65E9 . 8B85 90FEFFFF mov eax,dword ptr ss:[ebp-170] ; |
004A65EF . 05 54060000 add eax,654 ; |
004A65F4 . 50 push eax ; |Text= "没有发现硬件狗"
004A65F5 . 6A 00 push 0 ; |hOwner = NULL
004A65F7 . FF15 5C804A00 call dword ptr ds:[<&USER32.MessageBoxA>] ; \MessageBoxA
004A65FD > 6A 01 push 1
注释是太少了.
还有一些反调试代码没有贴上来 ,太乱了.本人技术时间有限,只能到这里了.
大虾们继续>>>>>>>>
,以上调试都是在脱壳后的文件进行的.
有时间还要分析下去
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
