花了点时间写了个VMP自动分析与还原,由于还原部分还未完善源码暂不上传。
有兴趣的朋友可以加我一起研究,Q:2237227000
虚拟机入口:
------------------------------------------
01105598 6898B3B812
push 12B8B398h
0110559D E88FCD0000
call 01112331h
01112331 E84BECFFFF
call 01110F81h
01110F81 E898200000
call 0111301Eh
0111301E 8D642408
lea esp ,
dword ptr [
esp +08h]
01113022 0F80D5DFFFFF
jo 01110FFDh
01113028 9C
pushfd
01113029 893424
mov dword ptr [
esp ],
esi
0111302C E9892BFFFF
jmp 01105BBAh
01105BBA 66F7D6
not si
01105BBD 60
pushad
01105BBE 874C241C
xchg dword ptr [
esp +1Ch],
ecx
01105BC2 660FB6C9
movzx cx ,
cl
01105BC6 FF742404
push dword ptr [
esp +04h]
01105BCA 668B742408
mov si ,
word ptr [
esp +08h]
01105BCF E883040000
call 01106057h
01106057 89542420
mov dword ptr [
esp +20h],
edx
0110605B 660FBEF3
movsx si ,
bl
0110605F 60
pushad
01106060 660FBECB
movsx cx ,
bl
01106064 895C243C
mov dword ptr [
esp +3Ch],
ebx
01106068 5B
pop ebx
01106069 660FBEF2
movsx si ,
dl
0110606D E98D710000
jmp 0110D1FFh
0110D1FF 8D3485EE5FBF0A
lea esi ,
dword ptr [0ABF5FEEh+
eax *4]
0110D206 896C2434
mov dword ptr [
esp +34h],
ebp
0110D20A E8272C0000
call 0110FE36h
0110FE36 8D34A51E30647C
lea esi ,
dword ptr [7C64301Eh]
0110FE3D 66F7D5
not bp
0110FE40 E83B2A0000
call 01112880h
01112880 89442438
mov dword ptr [
esp +38h],
eax
01112884 59
pop ecx
01112885 FF742404
push dword ptr [
esp +04h]
01112889 66F7D6
not si
0111288C 66F7D3
not bx
0111288F 9C
pushfd
01112890 8F442434
pop dword ptr [
esp +34h]
01112894 5B
pop ebx
01112895 E9E1EBFFFF
jmp 0111147Bh
0111147B E88A1B0000
call 0111300Ah
0111300A 9C
pushfd
0111300B 897C2434
mov dword ptr [
esp +34h],
edi
0111300F 0FB6F2
movzx esi ,
dl
01113012 0FBDEF
bsr ebp ,
edi
01113015 89542430
mov dword ptr [
esp +30h],
edx
01113019 E9E29FFFFF
jmp 0110D000h
0110D000 E9DC520000
jmp 011122E1h
011122E1 59
pop ecx
011122E2 C74424280000B
mov dword ptr [
esp +28h], 00B90000h
011122EA 0FBDF5
bsr esi ,
ebp
011122ED 66FFC5
inc bp
011122F0 660FBEDB
movsx bx ,
bl
011122F4 8B742454
mov esi ,
dword ptr [
esp +54h]
011122F8 45
inc ebp
011122F9 660FB6E8
movzx bp ,
al
011122FD E9B1FEFFFF
jmp 011121B3h
011121B3 46
inc esi
011121B4 660FB3FD
btr bp ,
di
011121B8 E9FE35FFFF
jmp 011057BBh
011057BB F7D6
not esi
011057BD 66C1DF02
rcr di , 0002h
011057C1 81EE3D394877
sub esi , 7748393Dh
011057C7 660FB3CF
btr di ,
cx
011057CB 0FACCD1E
shrd ebp ,
ecx , 0000001Eh
011057CF FEC0
inc al
011057D1 66C1ED07
shr bp , 0007h
011057D5 F7DE
neg esi
011057D7 E804090000
call 011060E0h
011060E0 660FB6EB
movzx bp ,
bl
011060E4 46
inc esi
011060E5 F8
clc
011060E6 66F7D5
not bp
011060E9 894C2408
mov dword ptr [
esp +08h],
ecx
011060ED F9
stc
011060EE C1CE19
ror esi , 19h
011060F1 E974720000
jmp 0110D36Ah
0110D36A D2DB
rcr bl ,
cl
0110D36C 8D6C242C
lea ebp ,
dword ptr [
esp +2Ch]
0110D370 0FCF
bswap edi
0110D372 0F96C7
setbe bh
0110D375 349D
xor al , FFFFFF9Dh
0110D377 81EC94000000
sub esp , 00000094h
0110D37D 660FB6D9
movzx bx ,
cl
0110D381 89E7
mov edi ,
esp
0110D383 66D3FB
sar bx ,
cl
0110D386 C0FB06
sar bl , 00000006h
0110D389 660FBDD9
bsr bx ,
cx
0110D38D 89F3
mov ebx ,
esi
0110D38F 240E
and al , 0000000Eh
0110D391 38C8
cmp al ,
cl
0110D393 38CD
cmp ch ,
cl
0110D395 66FFC1
inc cx
0110D398 037500
add esi ,
dword ptr [
ebp +00h]
0110D39B 80E151
and cl , 00000051h
0110D39E 30F0
xor al ,
dh
0110D3A0 D2F1
sal cl ,
cl
0110D3A2 C0F004
sal al , 00000004h
0110D3A5 8A46FF
mov al ,
byte ptr [
esi -01h]
0110D3A8 08ED
or ch ,
ch
0110D3AA 49
dec ecx
0110D3AB 660FB6CA
movzx cx ,
dl
0110D3AF 80D5D9
adc ch , FFFFFFD9h
0110D3B2 00D8
add al ,
bl
0110D3B4 8D0CCDC7651598
lea ecx ,
dword ptr [981565C7h+
ecx *8]
0110D3BB E9948AFFFF
jmp 01105E54h
01105E54 2C3C
sub al , 0000003Ch
01105E56 0F99C1
setns cl
01105E59 F9
stc
01105E5A F7D1
not ecx
01105E5C C0C002
rol al , 00000002h
01105E5F F6C126
test cl , 00000026h
01105E62 66C1C904
ror cx , 0004h
01105E66 0FACF918
shrd ecx ,
edi , 00000018h
01105E6A 10F5
adc ch ,
dh
01105E6C F6D8
neg al
01105E6E 0FBCCD
bsf ecx ,
ebp
01105E71 0FB6CB
movzx ecx ,
bl
01105E74 FEC9
dec cl
01105E76 6681D92DE3
sbb cx , E32Dh
01105E7B 3412
xor al , 00000012h
01105E7D FECD
dec ch
01105E7F 60
pushad
01105E80 F6D5
not ch
01105E82 0FC9
bswap ecx
01105E84 00C3
add bl ,
al
01105E86 660FBAE40B
bt sp , 000Bh
01105E8B 9C
pushfd
01105E8C E9A4000000
jmp 01105F35h
01105F35 660FBBE1
btc cx ,
sp
01105F39 0FB6C0
movzx eax ,
al
01105F3C C0D102
rcl cl , 00000002h
01105F3F 55
push ebp
01105F40 B5E1
mov ch , E1h
01105F42 8B0C85642A1101
mov ecx ,
dword ptr [01112A64h+
eax *4]
01105F49 9C
pushfd
01105F4A 9C
pushfd
01105F4B C1C913
ror ecx , 13h
01105F4E 0FBAE10A
bt ecx , 0Ah
01105F52 E9C5BE0000
jmp 01111E1Ch
01111E1C 81C1B22505EB
add ecx , EB0525B2h
01111E22 F5
cmc
01111E23 38C2
cmp dl ,
al
01111E25 F7D9
neg ecx
01111E27 E8AA42FFFF
call 011060D6h
011060D6 E83F6E0000
call 0110CF1Ah
0110CF1A E83087FFFF
call 0110564Fh
0110564F 4E
dec esi
01105650 85CA
test edx ,
ecx
01105652 6849FEB96E
push 6EB9FE49h
01105657 81F19ED2C1E5
xor ecx , E5C1D29Eh
0110565D 0FA3DC
bt esp ,
ebx
01105660 F9
stc
01105661 81C10000B900
add ecx , 00B90000h
01105667 68488F8842
push 42888F48h
0110566C 6689642404
mov word ptr [
esp +04h],
sp
01105671 E91B080000
jmp 01105E91h
01105E91 894C2440
mov dword ptr [
esp +40h],
ecx
01105E95 68EE88E91E
push 1EE988EEh
01105E9A FF742444
push dword ptr [
esp +44h]
01105E9E C24800
retn 0048h
------------------------------------------------------
------------------------------------------------------
OpCode 指针算法
----------------------
inc esi
not esi
sub esi , 7748393Dh
neg esi
inc esi
ror esi , 19h
ByteDate 算法
----------------------
mov al ,
byte ptr [
esi -01h]
add al ,
bl
sub al , 0000003Ch
rol al , 00000002h
neg al
xor al , 00000012h
add bl ,
al
movzx eax ,
al
Handle 指针算法
----------------------
mov ecx ,
dword ptr [01112A64h+
eax *4]
ror ecx , 13h
add ecx , EB0525B2h
neg ecx
dec esi
xor ecx , E5C1D29Eh
add ecx , 00B90000h
------------------------------------------------------
------------------------------------------------------
VMP 自动分析启动:
--------------------------------------------
Handle: 01106011
----------------------------------
01106011 8D04752BBF229B
lea eax ,
dword ptr [9B22BF2Bh+
esi *2]
01106018 D406
aam 06h
0110601A 0F9BC2
setnp dl
0110601D 66D3C8
ror ax ,
cl
01106020 8B4500
mov eax ,
dword ptr [
ebp +00h]
01106023 F6DA
neg dl
01106025 8A5504
mov dl ,
byte ptr [
ebp +04h]
01106028 F5
cmc
01106029 0FA3C3
bt ebx ,
eax
0110602C 80FF2E
cmp bh , 0000002Eh
0110602F 68C6F7DEF2
push F2DEF7C6h
01106034 83C506
add ebp , 06h
01106037 60
pushad
01106038 C60424FD
mov byte ptr [
esp ], FFFFFFFDh
0110603C E96B9D0000
jmp 0110FDACh
0110FDAC 368810
mov byte ptr [
eax ],
dl
0110FDAF 9C
pushfd
0110FDB0 C60424D2
mov byte ptr [
esp ], FFFFFFD2h
0110FDB4 9C
pushfd
0110FDB5 FF3424
push dword ptr [
esp ]
0110FDB8 8D642430
lea esp ,
dword ptr [
esp +30h]
0110FDBC E9DAD5FFFF
jmp 0110D39Bh
0110D39B 80E151
and cl , 00000051h
0110D39E 30F0
xor al ,
dh
0110D3A0 D2F1
sal cl ,
cl
0110D3A2 C0F004
sal al , 00000004h
0110D3A5 8A46FF
mov al ,
byte ptr [
esi -01h]
......(由于代码太多,中间部分省略。)
--------------------------------------------
Handle: 01105B25
----------------------------------
01105B25 F8
clc
01105B26 8B4500
mov eax ,
dword ptr [
ebp +00h]
01105B29 F8
clc
01105B2A 8A5504
mov dl ,
byte ptr [
ebp +04h]
01105B2D F5
cmc
01105B2E 83C506
add ebp , 06h
01105B31 9C
pushfd
01105B32 9C
pushfd
01105B33 268810
mov byte ptr [
eax ],
dl
01105B36 52
push edx
01105B37 FF3424
push dword ptr [
esp ]
01105B3A 8D642410
lea esp ,
dword ptr [
esp +10h]
01105B3E E958780000
jmp 0110D39Bh
0110D39B 80E151
and cl , 00000051h
0110D39E 30F0
xor al ,
dh
0110D3A0 D2F1
sal cl ,
cl
0110D3A2 C0F004
sal al , 00000004h
0110D3A5 8A46FF
mov al ,
byte ptr [
esi -01h]
--------------------------------------------
分析结束
--------------------------------------------
Handler Count:52
--------------------------------------------
伪指令解析开始:
----------------------------
H:(00): 01106011 -> STORE_SS_B
H:(01): 0110FC58 -> DIV_D
H:(02): 0110ED66 -> STORE_DS_W
H:(03): 011113D4 -> STORE_SS_W
H:(04): 01105C55 -> BRANCH
H:(05): 0110F6EA -> EXIT_VM
H:(06): 011115A3 -> STORE_DS_D
H:(07): 0110FD77 -> LOAD_DS_W
H:(08): 01113056 -> ADD_W
H:(09): 011055A2 -> STORE_SS_D
H:(10): 011060D1 -> NOR_B
H:(11): 0110573B -> ADD_D
H:(12): 01110FBF -> LOAD_SS_W
H:(13): 0110597C -> SHR_W
H:(14): 01105C41 -> STORE_DS_B
H:(15): 01112FA8 -> SHLD_D
H:(16): 0110D20F -> SET_STACK
H:(17): 011110CE -> SHRD_D
H:(18): 0110F57A -> SHL_B
H:(19): 0111240F -> PUSH_I_D_W
----------------------------
mov ax ,
word ptr [
esi -02h]
xchg al ,
ah
xor ax ,
bx
sub ax , 00007B74h
xchg al ,
ah
xor ax , 0000D140h
neg ax
xor bx ,
ax
cwde
add esi , FFFFFFFEh
----------------------
H:(20): 01105DB8 -> POP_R_W
----------------------------
mov al ,
byte ptr [
esi -01h]
sub al ,
bl
neg al
not al
inc al
not al
sub bl ,
al
dec esi
----------------------
H:(21): 01105EC7 -> SHR_D
H:(22): 0111219C -> PUSH_I_D_B
----------------------------
mov al ,
byte ptr [
esi -01h]
add al ,
bl
not al
sub al , 00000042h
neg al
add esi , FFFFFFFFh
inc al
add bl ,
al
cbw
cwde
----------------------
H:(23): 01112EA9 -> LOAD_DS_D
H:(24): 0110594E -> LOAD_SS_D
H:(25): 011060F6 -> LOAD_FS_D
H:(26): 01105939 -> ADD_B
H:(27): 01105E3B -> PUSH_STACK_W
H:(28): 0110FE31 -> SHL_D
H:(29): 01112901 -> PUSH_R_W
----------------------------
mov al ,
byte ptr [
esi -01h]
sub esi , 01h
sub al ,
bl
neg al
not al
inc al
not al
sub bl ,
al
----------------------
H:(30): 01105C9B -> POP_R_B
----------------------------
mov al ,
byte ptr [
esi -01h]
add al ,
bl
not al
add al , FFFFFFECh
rol al , 00000007h
xor al , 00000038h
add bl ,
al
lea esi ,
dword ptr [
esi -01h]
----------------------
H:(31): 01112214 -> PUSH_R_B
----------------------------
movzx eax ,
byte ptr [
esi -01h]
add al ,
bl
not al
add al , FFFFFFECh
rol al , 00000007h
xor al , 00000038h
add bl ,
al
dec esi
----------------------
H:(32): 011130CE -> NOR_D
H:(33): 0111238D ->
IDIV
H:(34): 0110CE77 -> MUL_D
H:(35): 01112E6F -> SHL_W
H:(36): 01105BEA -> PUSH_R_D
----------------------------
inc al
not al
dec al
xor al , FFFFFF98h
and al , 0000003Ch
----------------------
H:(37): 01111171 -> POP_R_D
----------------------------
inc al
not al
dec al
xor al , FFFFFF98h
and al , 0000003Ch
----------------------
H:(38): 0110F6B6 -> SHR_B
H:(39): 0111156C -> PUSH_I_D
----------------------------
mov eax ,
dword ptr [
esi -04h]
bswap eax
xor eax ,
ebx
add eax , E0F98A24h
not eax
xor eax , 4DFCFC2Fh
lea esi ,
dword ptr [
esi -04h]
rol eax , 0Eh
xor ebx ,
eax
----------------------
H:(40): 01110EEA -> PUSH_I_W
----------------------------
mov ax ,
word ptr [
esi -02h]
xchg al ,
ah
xor ax ,
bx
sub ax , 00007B74h
xchg al ,
ah
sub esi , 02h
xor ax , 0000D140h
neg ax
xor bx ,
ax
----------------------
H:(41): 011128E2 -> STORE_ES_D
H:(42): 01112638 -> PUSH_I_B
----------------------------
mov al ,
byte ptr [
esi -01h]
add al ,
bl
not al
sub al , 00000042h
neg al
lea esi ,
dword ptr [
esi -01h]
inc al
add bl ,
al
----------------------
H:(43): 011058B2 -> LOAD_SS_B
H:(44): 01110F58 -> SET_STACK_W
H:(45): 0111264A -> NOR_W
H:(46): 0110FDC1 -> STORE_FS_D
H:(47): 011114F5 -> LOAD_DS_B
H:(48): 011115C0 -> POP_FLAG
H:(49): 01111DDE ->
IMUL
H:(50): 01105F71 -> PUSH_STACK
H:(51): 01105B25 -> STORE_ES_B
----------------------------
解析结束:
未能解析的伪指令个数: 0
部分还原:
label_BD16520A: (references=0)
tv1792- = ASSIGN SS:[EBP+8]
tv1797- = ASSIGN SS:[EBP+8]
tv1800- = BITXOR DS:[tv1792-], EAX
DS:[tv1797-] = ASSIGN tv1800-
tv1807- = ASSIGN SS:[EBP+8]
SS:[EBP-16] = ASSIGN DS:[tv1807-]
EAX = ADD 4, SS:[EBP+8]
EAX = ASSIGN DS:[EAX]
SS:[EBP-20] = ASSIGN EAX
ECX = ASSIGN SS:[EBP+8]
ESP = ASSIGN DS:[ECX+8]
SS:[EBP-24] = ASSIGN ESP
tv1845-, EFLAGS = COMPARE(NE) 0, global_1000d044
EDX = ASSIGN ESP
CONDITIONALBRANCH(True) tv1845-, label_1005AAFC, label_1004F87E
label_1004AE87: (references=0)
local_FFFFFFF9 = ASSIGN EDX
local_FFFFFFF7 = ASSIGN EAX
tv1995- = BITXOR 138077080(0x083ae398), local_FFFFFFF5
EDX = ASSIGN SS:[EBP+8]
DS:[EDX] = ASSIGN 3469594061(0xcecdcdcd)
tv2009- = BITOR 65536(0x00010000), global_100163d4
EAX = ASSIGN tv2009-
global_100163d4 = ASSIGN EAX
tv2020- = BITXOR 138077080(0x083ae398), tv1995-
local_FFFFFFF8 = ASSIGN tv2009-
local_FFFFFFF5 = ASSIGN tv2020-
GOTO label_1004ADB9
label_1005B4FE: (references=0)
SS:[ESP], {&ESP:ESP} = push EBP
tv2150- = ASSIGN ESP
SS:[ESP], {&ESP:ESP} = push 0
ECX = ASSIGN SS:[tv2150-+8]
tv2162- = BITAND 255(0x000000ff), ECX
tv2165-, EFLAGS = COMPARE(LT) 255(0x000000ff), tv2162-
local_FFFFFFFC = ASSIGN tv2162-
local_FFFFFFFB = ASSIGN EFLAGS
local_FFFFFFF9 = ASSIGN 0
local_FFFFFFF8 = ASSIGN EBX
local_FFFFFFF7 = ASSIGN tv2150-
CONDITIONALBRANCH(True) tv2165-, label_1004BD25, label_10035AE3
label_1005AAFC: (references=0)
SS:[ESP], {&ESP:ESP} = push &global_100101e4
SS:[ESP], {&ESP:ESP} = push 0
SS:[ESP], {&ESP:ESP} = push 0
SS:[ESP], {&ESP:ESP} = push &global_10005a30
SS:[ESP], {&ESP:ESP} = push 0
SS:[ESP], {&ESP:ESP} = push 0
tv2404- = ASSIGN &global_1002602d
DS:[tv2404-] = ASSIGN 104(0x68)
DS:[tv2404-+1] = ASSIGN 2568114807(0x99125277)
DS:[tv2404-+5] = ASSIGN 232(0xe8)
DS:[tv2404-+6] = ASSIGN 4294819895(0xfffdc037)
call KERNEL32.dll.CreateThread
GOTO label_99125277
未完待续...
[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》,视频+靶场+题目!助力进入CTF世界
上传的附件: