!EP (ExE Pack) V1.0 UnPacKed
软件介绍： !EP - eXe packer and protector for application
下载地址： http://www.team-x.ru/projects/files/ep.zip
调试环境： WinXP、OllyDBD、PEiD、LordPE、IDA
―――――――――――――――――――――――――――――――――
看到linhanshi版主在工具版的帖子，随手脱一下，给新手朋友看看
0049D0FF 60 pushad
//进入OllyDBD后暂停在这
0049D100 68 54D04900 push 49D054 ; ASCII "KERNEL32.DLL"
0049D105 B8 48D04900 mov eax,49D048
0049D10A FF10 call dword ptr ds:[eax]
0049D10C 68 B3D04900 push 49D0B3 ; ASCII "GlobalAlloc"
0049D111 50 push eax
0049D112 B8 44D04900 mov eax,49D044
0049D117 FF10 call dword ptr ds:[eax]
BP GetModuleHandleA
中断2次后Alt+F9返回
可以用LorPE完全Dump出来了
0049D1D9 BA 00004000 mov edx,400000
0049D1DE BE 00B00700 mov esi,7B000
//7B000=Import Table RVA
//在处理输入表之前Dump出来，就不必使用ImportRec来修复了
0049D1E3 01D6 add esi,edx
0049D1E5 8B46 0C mov eax,dword ptr ds:[esi+C]
0049D1E8 85C0 test eax,eax
0049D1EA 0F84 87000000 je 0049D277
0049D1F0 01D0 add eax,edx
0049D1F2 89C3 mov ebx,eax
0049D1F4 50 push eax
0049D1F5 B8 48D04900 mov eax,49D048
0049D1FA FF10 call dword ptr ds:[eax] ; kernel32.GetModuleHandleA
0049D1FC 85C0 test eax,eax
//返回这里
0049D1FE 75 08 jnz short 0049D208
0049D200 53 push ebx
0049D201 B8 4CD04900 mov eax,49D04C
0049D206 FF10 call dword ptr ds:[eax]
0049D208 8905 CED04900 mov dword ptr ds:[49D0CE],eax
0049D20E C705 D2D04900 0>mov dword ptr ds:[49D0D2],0
0049D218 BA 00004000 mov edx,400000
0049D21D 8B06 mov eax,dword ptr ds:[esi]
0049D21F 85C0 test eax,eax
0049D221 75 03 jnz short 0049D226
0049D223 8B46 10 mov eax,dword ptr ds:[esi+10]
0049D226 01D0 add eax,edx
0049D228 0305 D2D04900 add eax,dword ptr ds:[49D0D2]
0049D22E 8B18 mov ebx,dword ptr ds:[eax]
0049D230 8B7E 10 mov edi,dword ptr ds:[esi+10]
0049D233 01D7 add edi,edx
0049D235 033D D2D04900 add edi,dword ptr ds:[49D0D2]
0049D23B 85DB test ebx,ebx
0049D23D 74 2B je short 0049D26A
0049D23F F7C3 00000080 test ebx,80000000
0049D245 75 04 jnz short 0049D24B
0049D247 01D3 add ebx,edx
0049D249 43 inc ebx
0049D24A 43 inc ebx
0049D24B 81E3 FFFFFF0F and ebx,0FFFFFFF
0049D251 53 push ebx
0049D252 FF35 CED04900 push dword ptr ds:[49D0CE]
0049D258 B8 44D04900 mov eax,49D044
0049D25D FF10 call dword ptr ds:[eax]
0049D25F 8907 mov dword ptr ds:[edi],eax
0049D261 8305 D2D04900 0>add dword ptr ds:[49D0D2],4
0049D268 EB AE jmp short 0049D218
0049D26A 83C6 14 add esi,14
0049D26D BA 00004000 mov edx,400000
0049D272 E9 6EFFFFFF jmp 0049D1E5
//循环处理输入表
0049D277 68 54D04900 push 49D054 ; ASCII "KERNEL32.DLL"
0049D27C B8 48D04900 mov eax,49D048
0049D281 FF10 call dword ptr ds:[eax]
0049D283 68 BFD04900 push 49D0BF ; ASCII "GlobalFree"
0049D288 50 push eax
0049D289 B8 44D04900 mov eax,49D044
0049D28E FF10 call dword ptr ds:[eax]
0049D290 8B15 CAD04900 mov edx,dword ptr ds:[49D0CA]
0049D296 52 push edx
0049D297 FFD0 call eax ; kernel32.GlobalFree
0049D299 61 popad
0049D29A B8 20604700 mov eax,476020
//476020=OEP VA
0049D29F BA EA000000 mov edx,0EA
0049D2A4 B9 15E00000 mov ecx,0E015
0049D2A9 01D1 add ecx,edx
0049D2AB 87CA xchg edx,ecx
0049D2AD 31DB xor ebx,ebx
0049D2AF 90 nop
0049D2B0 01C3 add ebx,eax
0049D2B2 90 nop
0049D2B3 31C0 xor eax,eax
0049D2B5 90 nop
0049D2B6 01D0 add eax,edx
0049D2B8 90 nop
0049D2B9 50 push eax
0049D2BA 31C0 xor eax,eax
0049D2BC 01D8 add eax,ebx
0049D2BE 31C9 xor ecx,ecx
0049D2C0 01E1 add ecx,esp
0049D2C2 31D2 xor edx,edx
0049D2C4 01C2 add edx,eax
0049D2C6 83F2 20 xor edx,20
0049D2C9 31C0 xor eax,eax
0049D2CB 39D0 cmp eax,edx
0049D2CD 74 0C je short 0049D2DB
0049D2CF EB 07 jmp short 0049D2D8
0049D2D1 C3 retn
0049D2D2 EB 04 jmp short 0049D2D8
0049D2D4 C3 retn
0049D2D5 EB 01 jmp short 0049D2D8
0049D2D7 C3 retn
0049D2D8 40 inc eax
0049D2D9 EB F0 jmp short 0049D2CB
0049D2DB 83F0 20 xor eax,20
0049D2DE 51 push ecx
0049D2DF C3 retn
//返回到 0012FFC0
0012FFC0 FFE0 jmp eax ; Packer.00476020
//飞向光明之巅
―――――――――――――――――――――――――――――――――
00476020 55 push ebp
//OEP
00476021 8BEC mov ebp,esp
00476023 83C4 F0 add esp,-10
00476026 B8 105E4700 mov eax,475E10
0047602B E8 20FCF8FF call 00405C50
00476030 A1 448B4700 mov eax,dword ptr ds:[478B44]
00476035 8B00 mov eax,dword ptr ds:[eax]
00476037 E8 A869FEFF call 0045C9E4
0047603C A1 448B4700 mov eax,dword ptr ds:[478B44]
00476041 8B00 mov eax,dword ptr ds:[eax]
00476043 BA 98604700 mov edx,476098 ; ASCII "!EP (EXE Pack)"
00476048 E8 8F65FEFF call 0045C5DC
修正Dump.eXe的OEP RVA和Import Table RVA就完成脱壳了。
―――――――――――――――――――――――――――――――――
, _/
/ _.-~/ \_ , 青春都一晌
( /~ / \~-._ \
`\\ _/ \ ~\ ) 忍把浮名
_-~~~-.) )__/;;,. \_ //'
/'_,\ --~ \ ~~~- ,;;\___( (.-~~~-. 换了脱壳轻狂
`~ _( ,_..--\ ( ,;'' / ~-- /._`\
/~~//' /' `~\ ) /--.._, )_ `~
" `~" " `" /~'`\ `\\~~\
" " "~' ""
UnPacKed By : fly
2005-07-24 16:00
附件:exe.pack.v1.0.unpacked.rar
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
