vfp&exeNc V5.00加壳的程序脱壳后如何修复IAT-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

vfp&exeNc V5.00加壳的程序脱壳后如何修复IAT

发表于: 2005-6-26 00:15 6248

vfp&exeNc V5.00加壳的程序脱壳后如何修复IAT

bios

2005-6-26 00:15

6248

一教育软件tkedit.exe用PEID0.93标准检测为vfp&exeNc V5.00 -> Wang JianGuo

flyODBG载入tkedit.exe,OD设置忽略所有导常,脱壳过程如下;

0042E3F4 >  60             pushad
0042E3F5 E8 00000000    call tkedit.0042E3FA
0042E3FA 5D             pop ebp
0042E3FB 81ED 06104000 sub ebp,tkedit.00401006
0042E401 8D85 56104000 lea eax,dword ptr ss:[ebp+401056]
0042E407 50             push eax
0042E408 64:FF35 0000000>push dword ptr fs:[0]
0042E40F 64:8925 0000000>mov dword ptr fs:[0],esp
0042E416 CC             int3
0042E417 90             nop
0042E418 64:8F05 0000000>pop dword ptr fs:[0]       :F2下断,F9运行到此,取消断点
0042E41F 83C4 04       add esp,4
0042E422 74 05          je short tkedit.0042E429
0042E424 75 03          jnz short tkedit.0042E429
0042E426 EB 07          jmp short tkedit.0042E42F

0042E428 59             pop ecx
0042E429 8D9D 00104000 lea ebx,dword ptr ss:[ebp+401000]
0042E42F 53             push ebx
0042E430 5F             pop edi
0042E431 2BFA          sub edi,edx
0042E433 57             push edi
0042E434 8A03          mov al,byte ptr ds:[ebx]
0042E436 3007          xor byte ptr ds:[edi],al
0042E438 43             inc ebx
0042E439 47             inc edi
0042E43A  ^ E2 F8          loopd short tkedit.0042E434
0042E43C 58             pop eax                      :F4步过
0042E43D 894424 1C    mov dword ptr ss:[esp+1C],eax                   ; tkedit.0042D001
0042E441 61             popad
0042E442 FFE0          jmp eax                      :跳到0042D001             pushad

0042D001 60             pushad
0042D002 E8 03000000    call tkedit.0042D00A    :变形JMP ,F7步过
0042D007  - E9 EB045D45    jmp 459FD4F7
0042D00C 55             push ebp
0042D00D C3             retn
0042D00E E8 01000000    call tkedit.0042D014
0042D013 EB 5D          jmp short tkedit.0042D072
0042D015 BB EDFFFFFF    mov ebx,-13
0042D01A 03DD          add ebx,ebp
0042D01C 81EB 00D00200 sub ebx,2D000

0042D00D C3             retn
0042D00E E8 01000000    call tkedit.0042D014    :变形JMP ,F7步过
0042D013 EB 5D          jmp short tkedit.0042D072
0042D015 BB EDFFFFFF    mov ebx,-13
0042D01A 03DD          add ebx,ebp
0042D01C 81EB 00D00200 sub ebx,2D000
0042D022 83BD 22040000 0>cmp dword ptr ss:[ebp+422],0
0042D029 899D 22040000 mov dword ptr ss:[ebp+422],ebx
0042D02F 0F85 65030000 jnz tkedit.0042D39A
0042D035 8D85 2E040000 lea eax,dword ptr ss:[ebp+42E]
0042D03B 50             push eax

0042D0F9 E8 6E050000    call tkedit.0042D66C
0042D0FE B3 01          mov bl,1
0042D100 80FB 00       cmp bl,0
0042D103 75 5E          jnz short tkedit.0042D163
0042D105 FE85 EC000000 inc byte ptr ss:[ebp+EC]
0042D10B 8B3E          mov edi,dword ptr ds:[esi]
0042D10D 03BD 22040000 add edi,dword ptr ss:[ebp+422]
0042D113 FF37          push dword ptr ds:[edi]
0042D115 C607 C3       mov byte ptr ds:[edi],0C3
0042D118 FFD7          call edi                :EDI=00401000                                  ; tkedit.00401000
0042D11A 8F07          pop dword ptr ds:[edi]
0042D11C 50             push eax
0042D11D 51             push ecx
0042D11E 56             push esi
0042D11F 53             push ebx
0042D120 8BC8          mov ecx,eax
0042D122 83E9 06       sub ecx,6

0042D12B 33DB          xor ebx,ebx
0042D12D 0BC9          or ecx,ecx
0042D12F 74 2E          je short tkedit.0042D15F
0042D131 78 2C          js short tkedit.0042D15F
0042D133 AC             lods byte ptr ds:[esi]
0042D134 3C E8          cmp al,0E8
0042D136 74 0A          je short tkedit.0042D142
0042D138 EB 00          jmp short tkedit.0042D13A
0042D13A 3C E9          cmp al,0E9
0042D13C 74 04          je short tkedit.0042D142
0042D13E 43             inc ebx
0042D13F 49             dec ecx
0042D140  ^ EB EB          jmp short tkedit.0042D12D
0042D142 8B06          mov eax,dword ptr ds:[esi] :F4步过

0042D152 8906          mov dword ptr ds:[esi],eax
0042D154 83C3 05       add ebx,5
0042D157 83C6 04       add esi,4
0042D15A 83E9 05       sub ecx,5
0042D15D  ^ EB CE          jmp short tkedit.0042D12D :回跳
0042D15F 5B             pop ebx                   :F4步过

0042D187 F3:A4          rep movs byte ptr es:[edi],byte ptr ds:[esi]
0042D189 5E             pop esi
0042D18A 68 00800000    push 8000
0042D18F 6A 00          push 0
0042D191 FFB5 52010000 push dword ptr ss:[ebp+152]
0042D197 FF95 51050000 call dword ptr ss:[ebp+551]
0042D19D 83C6 08       add esi,8
0042D1A0 833E 00       cmp dword ptr ds:[esi],0
0042D1A3  ^ 0F85 1EFFFFFF jnz tkedit.0042D0C7       :回跳
0042D1A9 68 00800000    push 8000
0042D1AE 6A 00          push 0                   :F4步过

0042D36B 53             push ebx
0042D36C 8D85 C6040000 lea eax,dword ptr ss:[ebp+4C6]
0042D372 50             push eax
0042D373 57             push edi
0042D374 EB 4A          jmp short tkedit.0042D3C0
0042D376 8907          mov dword ptr ds:[edi],eax
0042D378 8385 49050000 0>add dword ptr ss:[ebp+549],4
0042D37F  ^ E9 32FFFFFF    jmp tkedit.0042D2B6       :回跳
0042D384 8906          mov dword ptr ds:[esi],eax :F4步过
0042D386 8946 0C       mov dword ptr ds:[esi+C],eax
0042D389 8946 10       mov dword ptr ds:[esi+10],eax

0042D38C 83C6 14       add esi,14
0042D38F 8B95 22040000 mov edx,dword ptr ss:[ebp+422]                ; tkedit.00400000
0042D395  ^ E9 EBFEFFFF    jmp tkedit.0042D285       :回跳
0042D39A B8 43050200    mov eax,20543             :F4步过
0042D39F 50             push eax
0042D3A0 0385 22040000 add eax,dword ptr ss:[ebp+422]
0042D3A6 59             pop ecx
0042D3A7 0BC9          or ecx,ecx
0042D3A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],eax
0042D3AF 61             popad                      :
0042D3B0 75 08          jnz short tkedit.0042D3BA
0042D3B2 B8 01000000    mov eax,1
0042D3B7 C2 0C00       retn 0C
0042D3BA 68 00000000    push 0
0042D3BF C3             retn                   :返回到00420543
0042D3C0 8B85 26040000 mov eax,dword ptr ss:[ebp+426]
0042D3C6 8D8D 3B040000 lea ecx,dword ptr ss:[ebp+43B]
0042D3CC 51             push ecx
0042D3CD 50             push eax

00420539 06             push es
0042053A 8187 100B8D61 0>add dword ptr ds:[edi+618D0B10],60E17708
00420544 E8 00000000    call tkedit.00420549
00420549 5D             pop ebp
0042054A 81ED 06104000 sub ebp,tkedit.00401006
00420550 8D85 56104000 lea eax,dword ptr ss:[ebp+401056]
00420556 50             push eax
00420557 64:FF35 0000000>push dword ptr fs:[0]
0042055E 64:8925 0000000>mov dword ptr fs:[0],esp
00420565 CC             int3                   :中断检测
00420566 90             nop
00420567 64:8F05 0000000>pop dword ptr fs:[0]    :F2下断,F9运行到此,取消断点
0042056E 83C4 04       add esp,4
00420571 74 05          je short tkedit.00420578
00420573 75 03          jnz short tkedit.00420578
00420575 EB 07          jmp short tkedit.0042057E
00420577 59             pop ecx

00420578 8D9D 00104000 lea ebx,dword ptr ss:[ebp+401000]
0042057E 53             push ebx
0042057F 5F             pop edi
00420580 2BFA          sub edi,edx
00420582 57             push edi
00420583 8A03          mov al,byte ptr ds:[ebx]
00420585 3007          xor byte ptr ds:[edi],al
00420587 43             inc ebx
00420588 47             inc edi
00420589  ^ E2 F8          loopd short tkedit.00420583
0042058B 58             pop eax                   :F4步过
0042058C 894424 1C    mov dword ptr ss:[esp+1C],eax
00420590 61             popad
00420591 FFE0          jmp eax    :跳向0041F3C8  飞向光明之巅?

0041F3C8 55             push ebp       :OD插件DUMP
0041F3C9 8BEC          mov ebp,esp
0041F3CB B9 08000000    mov ecx,8
0041F3D0 6A 00          push 0
0041F3D2 6A 00          push 0
0041F3D4 49             dec ecx
0041F3D5  ^ 75 F9          jnz short tkedit.0041F3D0
0041F3D7 53             push ebx
0041F3D8 56             push esi
0041F3D9 57             push edi
0041F3DA B8 38F34100    mov eax,tkedit.0041F338
0041F3DF E8 1871FEFF    call tkedit.004064FC
0041F3E4 33C0          xor eax,eax
0041F3E6 55             push ebp
0041F3E7 68 64024200    push tkedit.00420264

运行ImportREC 1.6，选择这个进程。把OEP改为001F3C8，点IT AutoSearch
点获取输入表提示指针00021030为分假
FThunk: 00021030 NbFunc: 00000002
RVA: 00021030 ? PTR: 00402108
RVA: 00021034 ? PTR: 00402298

请问如何修复.

软件下载链接:
http://free.ys168.com/?biosdiy  shell目录中20041WYGmn.rar

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

收藏・0

免费・0

支持

最新回复 (2)
Aming 雪币： 207 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 117 粉丝 2 关注私信	Aming 2 楼哇，怎么PEID能检测到NC？！！！事实上，这个并不是NC5加密的，EXE采用加密方式编译，经NC低版本加密。没任何一个垃圾文件作陷阱。 2005-6-26 11:29 0
hhlhhl 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 3 粉丝 0 关注私信	hhlhhl 3 楼请问Aming,peid不能检测出vfp&exeNc加密吗?我是新手,请多指导啊. 我用peid检测这一程序(http://software.whedu21.com/show.asp?id=271)显示是用其加密的,而且用winhex得出了一假注册码,那用什么工具合适? 2006-12-29 15:59 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

bios

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (2)
Aming 雪币： 207 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 117 粉丝 2 关注私信	Aming 2 楼哇，怎么PEID能检测到NC？！！！事实上，这个并不是NC5加密的，EXE采用加密方式编译，经NC低版本加密。没任何一个垃圾文件作陷阱。 2005-6-26 11:29 0
hhlhhl 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 3 粉丝 0 关注私信	hhlhhl 3 楼请问Aming,peid不能检测出vfp&exeNc加密吗?我是新手,请多指导啊. 我用peid检测这一程序(http://software.whedu21.com/show.asp?id=271)显示是用其加密的,而且用winhex得出了一假注册码,那用什么工具合适? 2006-12-29 15:59 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复