请教要如何脱这种壳
软体下在位置:http://file.mychat.to/ncc900/nccsoft9.exe
以下是我分析的片段
//Ctrl+G来到 GetSystemTime,F2设置断点﹐然后F9运行程序﹐中断两次F2取消断点﹐Alt+F9返回
GetSystemTime
*忽略 G 25f14f2 F7追入 返回位置会变动
G 25F0673
*G 037804BE
*G 037804BE
G 0373015B
G 03780000
00401000 >/$ 68 0140A001 push 01A04001
00401005 |. E8 01000000 call 0040100B
0040100A \. C3 retn
0040100B $ C3 retn
*---------返回1
025B27E5 8905 3C805F02 mov dword ptr [25F803C], eax
025B27EB 8BE5 mov esp, ebp
025B27ED 5D pop ebp
025B27EE C3 retn *---------返回1
025B27EF 90 nop
025B27F0 83EC 08 sub esp, 8
*---------返回2
025D2407 E8 040AFEFF call 025B2E10
025D240C 64:8F05 00000000 pop dword ptr fs:[0]
025D2413 83C4 0C add esp, 0C
025D2416 8BC7 mov eax, edi
025D2418 5F pop edi
025D2419 5E pop esi
025D241A 5B pop ebx
025D241B C3 retn *---------返回2
025D241C 53 push ebx
*---------返回3
025F1BCC A3 E46C6002 mov dword ptr [2606CE4], eax
025F1BD1 E8 CAB2FFFF call 025ECEA0
025F1BD6 E8 955BFEFF call 025D7770
025F1BDB 59 pop ecx
025F1BDC 5A pop edx
025F1BDD 5E pop esi
025F1BDE 5B pop ebx
025F1BDF C3 retn *---------返回3
025F1BE0 FFFF ??? ; 未知命令
025F1BE2 FFFF ??? ; 未知命令
*---------返回4
025BF3A4 68 CCD20000 push 0D2CC
025BF3A9 68 00A00500 push 5A000
025BF3AE FF35 D4845F02 push dword ptr [25F84D4]
025BF3B4 E8 23D1FFFF call 025BC4DC
025BF3B9 310424 xor dword ptr [esp], eax
025BF3BC 8B05 D4845F02 mov eax, dword ptr [25F84D4]
025BF3C2 010424 add dword ptr [esp], eax
025BF3C5 C3 retn *---------返回4
*---------返回5
025F1C3C 05 D4845F02 add eax, 25F84D4
025F1C41 E8 02000000 call 025F1C48
025F1C46 E8 6883C404 call 07239FB3
025F1C4B 010424 add dword ptr [esp], eax
025F1C4E C3 retn *---------返回5
*---------返回6
025F14FE 8BC0 mov eax, eax
025F1500 E8 E7FEFFFF call 025F13EC *------------追入
025F1505 C3 retn
025F1506 8BC0 mov eax, eax
025F1508 7B 9C jpo short 025F14A6
*-----------------------
025F13EC
.
.
025F14D9 A1 CC745F02 mov eax, dword ptr [25F74CC]
025F14DE C600 E3 mov byte ptr [eax], 0E3
025F14E1 8BD4 mov edx, esp
025F14E3 A1 F06C6002 mov eax, dword ptr [2606CF0]
025F14E8 E8 57C0FFFF call 025ED544
025F14ED E8 3A3AFFFF call 025E4F2C
025F14F2 E8 75F1FFFF call 025F066C *------------追入
025F14F7 83C4 24 add esp, 24
025F14FA 5F pop edi
025F14FB 5E pop esi
025F14FC 5B pop ebx
025F14FD C3 retn
*--------------
025F066C 1BF7 sbb esi, edi ; NccSoft.00400000
025F066E BE 12E64800 mov esi, 48E612
025F0673 BE 0AA84900 mov esi, 49A80A
.
.
025F077C 2BF3 sub esi, ebx
025F077E 56 push esi
025F077F 81DE B66AB001 sbb esi, 1B06AB6
025F0785 C3 retn *位址会变动-----到 03730000
*-------
03730000 66:BF E8E1 mov di, 0E1E8
03730004 E8 06000000 call 0373000F *------------追入
03730009 A6 cmps byte ptr [esi], byte ptr es:[edi>
*-----
03730037 33DB xor ebx, ebx
03730039 E8 14000000 call 03730052 *------------追入
0373003E 8CD5 mov bp, ss
03730040 EA DB7851B6 B72>jmp far 24B7:B65178DB
*------
0373006F 5E pop esi
03730070 E8 0F000000 call 03730084 *------------追入
03730075 AB stos dword ptr es:[edi]
03730076 08A1 C687B4DD or byte ptr [ecx+DDB487C6], ah
*---
037300B1 52 push edx
037300B2 66:8BF8 mov di, ax
037300B5 E8 06000000 call 037300C0 *------------追入
037300BA 36:37 aaa
037300BC A4 movs byte ptr es:[edi], byte ptr [esi>
*------
03730113 81F7 01E72A62 xor edi, 622AE701
03730119 E8 0C000000 call 0373012A *------------追入
0373011E 94 xchg eax, esp
0373011F 3D 32830039 cmp eax, 39008332
*----
0373014B 66:B8 4591 mov ax, 9145
0373014F 81FB C8FFFFFF cmp ebx, -38
03730155 ^ 0F85 4EFFFFFF jnz 037300A9 回圈
0373015B 66:81E8 5498 sub ax, 9854 *-----------
03730160 BE 438BFD42 mov esi, 42FD8B43
.
0373018E 03C3 add eax, ebx
03730190 5C pop esp
03730191 - FFE0 jmp eax *------跳到 ; NccSoft.0117493C
03730193 17 pop ss
03730194 8801 mov byte ptr [ecx], al
03730196 C3 retn
*---
0117493C
0117494F . C8 1301E8 enter 113, 0E8
01174953 . 1D 8629FF8B sbb eax, 8BFF2986
01174958 ? 1D C09E2C01 sbb eax, 012C9EC0
0117495D . 8B35 C89C2C01 mov esi, dword ptr [12C9CC8] ; NccSoft.012D2650
*
01174952 ? E8 1D8629FF call 0040CF74
01174957 . 8B1D C09E2C01 mov ebx, dword ptr [12C9EC0] ; NccSoft.012EE118
0117495D . 8B35 C89C2C01 mov esi, dword ptr [12C9CC8] ; NccSoft.012D2650
01174963 . 33C0 xor eax, eax
01174965 . 55 push ebp
01174966 ? 68 2D4D1701 push 01174D2D
0117496B . 64:FF30 push dword ptr fs:[eax]
0117496E ? 64:8920 mov dword ptr fs:[eax], esp
01174971 . E8 0E0729FF call 00405084
*--
.
.跳到
0040CF74 53 db 53 ; CHAR 'S'
0040CF75 8B db 8B
0040CF76 D8 db D8
0040CF77 33 db 33 ; CHAR '3'
0040CF78 C0 db C0
*--------
037804AE 8D8425 1019C600 lea eax, dword ptr [ebp+C61910]
037804B5 2BC5 sub eax, ebp
037804B7 8B00 mov eax, dword ptr [eax]
037804B9 68 651D7803 push 3781D65
037804BE E8 3DFB0A00 call 03830000 *-------------
037804C3 8B55 C8 mov edx, dword ptr [ebp-38]
037804C6 8D45 CC lea eax, dword ptr [ebp-34]
*------
*
025D658C 55 push ebp
025D658D 8BEC mov ebp, esp
025D658F 83C4 F8 add esp, -8
025D6592 53 push ebx
025D6593 56 push esi
*--
025D664C 0373 6C add esi, dword ptr [ebx+6C]
025D664F 85FF test edi, edi
025D6651 ^ 77 A0 ja short 025D65F3
025D6653 68 70665D02 push 25D6670 ; ASCII "111",CR,LF
025D6658 E8 BBFDFEFF call 025C6418
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
