OdllyDbg + ASProtect 2.0x 高速?? (?例)-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

最新回复 (18)
fly 雪币： 898 活跃值： (4039) 能力值： ( LV9，RANK：3410 ) 在线值：发帖 294 回帖 7686 粉丝 32 关注私信	fly 85 2 楼没有多少ASProtect新版加壳程序可以这样高速脱壳的 syscom兄有时间可以深入研究一下ASProtect的代码变形 2005-9-2 23:08 0
syscom 雪币： 245 活跃值： (195) 能力值： ( LV9，RANK：250 ) 在线值：发帖 17 回帖 156 粉丝 1 关注私信	syscom 6 3 楼最初由 fly 发布没有多少ASProtect新版加壳程序可以这样高速脱壳的 syscom兄有时间可以深入研究一下ASProtect的代码变形呃?是? ASProtect,基本的,?邋..斤新手看的.. 版主是真 OEP 代码变形??,?是有更新的?? ASProtect OEP 代码变形,我好像看咿.... 版主,知道那彦有 ASProtect 加?的代码变形??...我可以 DOWNLOAD 研究看看 2005-9-2 23:27 0
fly 雪币： 898 活跃值： (4039) 能力值： ( LV9，RANK：3410 ) 在线值：发帖 294 回帖 7686 粉丝 32 关注私信	fly 85 4 楼 syscom兄可以搜索一下AlfaClock、BetterJPEG、Magic NetTrace等程序新版其实最佳的试炼目标应该是Asprotect新版主程序 2005-9-2 23:47 0
loveboom 雪币： 556 活跃值： (2298) 能力值： ( LV9，RANK：2130 ) 在线值：发帖 100 回帖 690 粉丝 13 关注私信	loveboom 53 5 楼 stolen code 没有什么好方法对付吧?,我是一个一个的修复，累人:-(,脱了一个通宵，困了，睡了. 2005-9-3 06:31 0
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 6 楼学先 2005-9-3 07:35 0
stephenteh 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 143 粉丝 0 关注私信	stephenteh 7 楼 the VM (stolen code) of aspr has been updated in the latest version 2.2 beta...this version of VM is quite hard to recover...i still dun know how aspr determine the type of jump.... 2005-9-3 09:30 0
夜凉如水雪币： 136 活跃值： (105) 能力值： ( LV9，RANK：140 ) 在线值：发帖 18 回帖 719 粉丝 1 关注私信	夜凉如水 3 8 楼学习了 ,嘿嘿我这个小菜也学习学习脱 !!!! 2005-9-3 09:37 0
VolX 雪币： 229 活跃值： (50) 能力值： ( LV9，RANK：170 ) 在线值：发帖 4 回帖 107 粉丝 2 关注私信	VolX 4 9 楼最初由 stephenteh 发布 the VM (stolen code) of aspr has been updated in the latest version 2.2 beta...this version of VM is quite hard to recover...i still dun know how aspr determine the type of jump.... Do you have the name of your target? maybe I will have a look. 2005-9-3 13:26 0
stephenteh 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 143 粉丝 0 关注私信	stephenteh 10 楼最初由 VolX 发布 Do you have the name of your target? maybe I will have a look. it's asprotect itself... here is the post at exetools http://www.exetools.com/forum/showthread.php?t=7667&highlight=asprotect 2005-9-3 13:57 0
VolX 雪币： 229 活跃值： (50) 能力值： ( LV9，RANK：170 ) 在线值：发帖 4 回帖 107 粉丝 2 关注私信	VolX 4 11 楼 After 3 hrs of tracing .... RVA=1EAA8 or binary search "3131320D0A" (without the "") 0041EAA8 sub_41EAA8 proc near ; CODE XREF: sub_41F108+AFp 0041EAA8 ; sub_41F108+10Fp 0041EAA8 push ebx 0041EAA9 push esi 0041EAAA mov esi, ecx 0041EAAC xor ebx, ebx 0041EAAE jmp short loc_41EAB1 0041EAAE ; -------------------------------------------------------------------- 0041EAB0 db 0E9h 0041EAB1 ; -------------------------------------------------------------------- 0041EAB1 0041EAB1 loc_41EAB1: ; CODE XREF: sub_41EAA8+6j 0041EAB1 xor eax, eax 0041EAB3 mov al, dl 0041EAB5 cmp eax, 0Fh ; switch 16 cases 0041EAB8 ja loc_41ED03 ; default 0041EABE jmp off_41EAC5[eax*4] ; switch jump 0041EABE ; -------------------------------------------------------------------- 0041EAC5 off_41EAC5 dd offset loc_41EB08 ; DATA XREF: sub_41EAA8+16r 0041EAC5 dd offset loc_41EB1E ; jump table for switch 0041EAC5 dd offset loc_41EB37 statement 0041EAC5 dd offset loc_41EB4A 0041EAC5 dd offset loc_41EB60 0041EAC5 dd offset loc_41EB76 0041EAC5 dd offset loc_41EB8F 0041EAC5 dd offset loc_41EBA5 0041EAC5 dd offset loc_41EBBE 0041EAC5 dd offset loc_41EBD4 0041EAC5 dd offset loc_41EBED 0041EAC5 dd offset loc_41EC1B 0041EAC5 dd offset loc_41EC49 0041EAC5 dd offset loc_41EC70 0041EAC5 dd offset loc_41EC94 0041EAC5 dd offset loc_41ECCD 0041EB05 ; -------------------------------------------------------------------- 0041EB05 jmp short loc_41EB08 ; case 0x0 0041EB05 ; -------------------------------------------------------------------- 0041EB07 db 9Ah 0041EB08 ; -------------------------------------------------------------------- 0041EB08 0041EB08 loc_41EB08: ; CODE XREF: sub_41EAA8+16j 0041EB08 ; sub_41EAA8+5Dj 0041EB08 ; DATA XREF: ... 0041EB08 mov edx, 0Bh ; case 0x0 0041EB0D mov eax, esi 0041EB0F call sub_41E2F0 0041EB14 mov ebx, eax 0041EB16 jmp loc_41ED0D 0041EB1B ; -------------------------------------------------------------------- 0041EB1B jmp short loc_41EB1E ; case 0x1 0041EB1B ; -------------------------------------------------------------------- 0041EB1D db 69h 0041EB1E ; -------------------------------------------------------------------- 0041EB1E 0041EB1E loc_41EB1E: ; CODE XREF: sub_41EAA8+16j 0041EB1E ; sub_41EAA8+73j 0041EB1E ; DATA XREF: ... 0041EB1E mov edx, 0Bh ; case 0x1 0041EB23 mov eax, esi 0041EB25 call sub_41E2F0 0041EB2A mov ebx, eax 0041EB2C xor bl, 1 0041EB2F jmp loc_41ED0D 0041EB34 ; -------------------------------------------------------------------- 0041EB34 jmp short loc_41EB37 ; case 0x2 0041EB34 ; -------------------------------------------------------------------- 0041EB36 db 0C7h 0041EB37 ; -------------------------------------------------------------------- 0041EB37 0041EB37 loc_41EB37: ; CODE XREF: sub_41EAA8+16j 0041EB37 ; sub_41EAA8+8Cj 0041EB37 ; DATA XREF: ... 0041EB37 xor edx, edx ; case 0x2 0041EB39 mov eax, esi 0041EB3B call sub_41E2F0 0041EB40 mov ebx, eax 0041EB42 jmp loc_41ED0D 0041EB47 ; -------------------------------------------------------------------- 0041EB47 jmp short loc_41EB4A ; case 0x3 0041EB47 ; -------------------------------------------------------------------- 0041EB49 db 0E8h 0041EB4A ; -------------------------------------------------------------------- 0041EB4A 0041EB4A loc_41EB4A: ; CODE XREF: sub_41EAA8+16j 0041EB4A ; sub_41EAA8+9Fj 0041EB4A ; DATA XREF: ... 0041EB4A xor edx, edx ; case 0x3 0041EB4C mov eax, esi 0041EB4E call sub_41E2F0 0041EB53 mov ebx, eax 0041EB55 xor bl, 1 0041EB58 jmp loc_41ED0D 0041EB5D ; -------------------------------------------------------------------- 0041EB5D jmp short loc_41EB60 ; case 0x4 0041EB5D ; -------------------------------------------------------------------- 0041EB5F db 0E9h 0041EB60 ; -------------------------------------------------------------------- 0041EB60 0041EB60 loc_41EB60: ; CODE XREF: sub_41EAA8+16j 0041EB60 ; sub_41EAA8+B5j 0041EB60 ; DATA XREF: ... 0041EB60 mov edx, 6 ; case 0x4 0041EB65 mov eax, esi 0041EB67 call sub_41E2F0 0041EB6C mov ebx, eax 0041EB6E jmp loc_41ED0D 0041EB73 ; -------------------------------------------------------------------- 0041EB73 jmp short loc_41EB76 ; case 0x5 0041EB73 ; -------------------------------------------------------------------- 0041EB75 db 9Ah 0041EB76 ; -------------------------------------------------------------------- 0041EB76 0041EB76 loc_41EB76: ; CODE XREF: sub_41EAA8+16j 0041EB76 ; sub_41EAA8+CBj 0041EB76 ; DATA XREF: ... 0041EB76 mov edx, 6 ; case 0x5 0041EB7B mov eax, esi 0041EB7D call sub_41E2F0 0041EB82 mov ebx, eax 0041EB84 xor bl, 1 0041EB87 jmp loc_41ED0D 0041EB8C ; -------------------------------------------------------------------- 0041EB8C jmp short loc_41EB8F ; case 0x6 0041EB8C ; -------------------------------------------------------------------- 0041EB8E db 9Ah 0041EB8F ; -------------------------------------------------------------------- 0041EB8F 0041EB8F loc_41EB8F: ; CODE XREF: sub_41EAA8+16j 0041EB8F ; sub_41EAA8+E4j 0041EB8F ; DATA XREF: ... 0041EB8F mov edx, 2 ; case 0x6 0041EB94 mov eax, esi 0041EB96 call sub_41E2F0 0041EB9B mov ebx, eax 0041EB9D jmp loc_41ED0D 0041EBA2 ; -------------------------------------------------------------------- 0041EBA2 jmp short loc_41EBA5 ; case 0x7 0041EBA2 ; -------------------------------------------------------------------- 0041EBA4 db 9Ah 0041EBA5 ; -------------------------------------------------------------------- 0041EBA5 0041EBA5 loc_41EBA5: ; CODE XREF: sub_41EAA8+16j 0041EBA5 ; sub_41EAA8+FAj 0041EBA5 ; DATA XREF: ... 0041EBA5 mov edx, 2 ; case 0x7 0041EBAA mov eax, esi 0041EBAC call sub_41E2F0 0041EBB1 mov ebx, eax 0041EBB3 xor bl, 1 0041EBB6 jmp loc_41ED0D 0041EBBB ; -------------------------------------------------------------------- 0041EBBB jmp short loc_41EBBE ; case 0x8 0041EBBB ; -------------------------------------------------------------------- 0041EBBD db 69h 0041EBBE ; -------------------------------------------------------------------- 0041EBBE 0041EBBE loc_41EBBE: ; CODE XREF: sub_41EAA8+16j 0041EBBE ; sub_41EAA8+113j 0041EBBE ; DATA XREF: ... 0041EBBE mov edx, 7 ; case 0x8 0041EBC3 mov eax, esi 0041EBC5 call sub_41E2F0 0041EBCA mov ebx, eax 0041EBCC jmp loc_41ED0D 0041EBD1 ; -------------------------------------------------------------------- 0041EBD1 jmp short loc_41EBD4 ; case 0x9 0041EBD1 ; -------------------------------------------------------------------- 0041EBD3 db 0C7h 0041EBD4 ; -------------------------------------------------------------------- 0041EBD4 0041EBD4 loc_41EBD4: ; CODE XREF: sub_41EAA8+16j 0041EBD4 ; sub_41EAA8+129j 0041EBD4 ; DATA XREF: ... 0041EBD4 mov edx, 7 ; case 0x9 0041EBD9 mov eax, esi 0041EBDB call sub_41E2F0 0041EBE0 mov ebx, eax 0041EBE2 xor bl, 1 0041EBE5 jmp loc_41ED0D 0041EBEA ; -------------------------------------------------------------------- 0041EBEA jmp short loc_41EBED ; case 0xA 0041EBEA ; -------------------------------------------------------------------- 0041EBEC db 0E8h 0041EBED ; -------------------------------------------------------------------- 0041EBED 0041EBED loc_41EBED: ; CODE XREF: sub_41EAA8+16j 0041EBED ; sub_41EAA8+142j 0041EBED ; DATA XREF: ... 0041EBED xor edx, edx ; case 0xA 0041EBEF mov eax, esi 0041EBF1 call sub_41E2F0 0041EBF6 test al, al 0041EBF8 jnz short loc_41EC11 0041EBFA mov edx, 6 0041EBFF mov eax, esi 0041EC01 call sub_41E2F0 0041EC06 test al, al 0041EC08 jnz short loc_41EC11 0041EC0A xor ebx, ebx 0041EC0C jmp loc_41ED0D 0041EC11 ; -------------------------------------------------------------------- 0041EC11 0041EC11 loc_41EC11: ; CODE XREF: sub_41EAA8+150j 0041EC11 ; sub_41EAA8+160j 0041EC11 mov bl, 1 0041EC13 jmp loc_41ED0D 0041EC18 ; -------------------------------------------------------------------- 0041EC18 jmp short loc_41EC1B ; case 0xB 0041EC18 ; -------------------------------------------------------------------- 0041EC1A db 0E9h 0041EC1B ; -------------------------------------------------------------------- 0041EC1B 0041EC1B loc_41EC1B: ; CODE XREF: sub_41EAA8+16j 0041EC1B ; sub_41EAA8+170j 0041EC1B ; DATA XREF: ... 0041EC1B xor edx, edx ; case 0xB 0041EC1D mov eax, esi 0041EC1F call sub_41E2F0 0041EC24 test al, al 0041EC26 jnz short loc_41EC38 0041EC28 mov edx, 6 0041EC2D mov eax, esi 0041EC2F call sub_41E2F0 0041EC34 test al, al 0041EC36 jz short loc_41EC3F 0041EC38 0041EC38 loc_41EC38: ; CODE XREF: sub_41EAA8+17Ej 0041EC38 xor ebx, ebx 0041EC3A jmp loc_41ED0D 0041EC3F ; -------------------------------------------------------------------- 0041EC3F 0041EC3F loc_41EC3F: ; CODE XREF: sub_41EAA8+18Ej 0041EC3F mov bl, 1 0041EC41 jmp loc_41ED0D 0041EC46 ; -------------------------------------------------------------------- 0041EC46 jmp short loc_41EC49 ; case 0xC 0041EC46 ; -------------------------------------------------------------------- 0041EC48 db 9Ah 0041EC49 ; -------------------------------------------------------------------- 0041EC49 0041EC49 loc_41EC49: ; CODE XREF: sub_41EAA8+16j 0041EC49 ; sub_41EAA8+19Ej 0041EC49 ; DATA XREF: ... 0041EC49 mov edx, 7 ; case 0xC 0041EC4E mov eax, esi 0041EC50 call sub_41E2F0 0041EC55 mov ebx, eax 0041EC57 mov edx, 0Bh 0041EC5C mov eax, esi 0041EC5E call sub_41E2F0 0041EC63 cmp bl, al 0041EC65 setnz bl 0041EC68 jmp loc_41ED0D 0041EC6D ; -------------------------------------------------------------------- 0041EC6D jmp short loc_41EC70 ; case 0xD 0041EC6D ; -------------------------------------------------------------------- 0041EC6F db 9Ah 0041EC70 ; -------------------------------------------------------------------- 0041EC70 0041EC70 loc_41EC70: ; CODE XREF: sub_41EAA8+16j 0041EC70 ; sub_41EAA8+1C5j 0041EC70 ; DATA XREF: ... 0041EC70 mov edx, 7 ; case 0xD 0041EC75 mov eax, esi 0041EC77 call sub_41E2F0 0041EC7C mov ebx, eax 0041EC7E mov edx, 0Bh 0041EC83 mov eax, esi 0041EC85 call sub_41E2F0 0041EC8A cmp bl, al 0041EC8C setz bl 0041EC8F jmp short loc_41ED0D 0041EC91 ; -------------------------------------------------------------------- 0041EC91 jmp short loc_41EC94 ; case 0xE 0041EC91 ; -------------------------------------------------------------------- 0041EC93 db 9Ah 0041EC94 ; -------------------------------------------------------------------- 0041EC94 0041EC94 loc_41EC94: ; CODE XREF: sub_41EAA8+16j 0041EC94 ; sub_41EAA8+1E9j 0041EC94 ; DATA XREF: ... 0041EC94 mov edx, 6 ; case 0xE 0041EC99 mov eax, esi 0041EC9B call sub_41E2F0 0041ECA0 test al, al 0041ECA2 jnz short loc_41ECC6 0041ECA4 mov edx, 7 0041ECA9 mov eax, esi 0041ECAB call sub_41E2F0 0041ECB0 mov ebx, eax 0041ECB2 mov edx, 0Bh 0041ECB7 mov eax, esi 0041ECB9 call sub_41E2F0 0041ECBE cmp bl, al 0041ECC0 jnz short loc_41ECC6 0041ECC2 xor ebx, ebx 0041ECC4 jmp short loc_41ED0D 0041ECC6 ; -------------------------------------------------------------------- 0041ECC6 0041ECC6 loc_41ECC6: ; CODE XREF: sub_41EAA8+1FAj 0041ECC6 ; sub_41EAA8+218j 0041ECC6 mov bl, 1 0041ECC8 jmp short loc_41ED0D 0041ECCA ; -------------------------------------------------------------------- 0041ECCA jmp short loc_41ECCD ; case 0xF 0041ECCA ; -------------------------------------------------------------------- 0041ECCC db 9Ah 0041ECCD ; -------------------------------------------------------------------- 0041ECCD 0041ECCD loc_41ECCD: ; CODE XREF: sub_41EAA8+16j 0041ECCD ; sub_41EAA8+222j 0041ECCD ; DATA XREF: ... 0041ECCD mov edx, 6 ; case 0xF 0041ECD2 mov eax, esi 0041ECD4 call sub_41E2F0 0041ECD9 test al, al 0041ECDB jnz short loc_41ECFB 0041ECDD mov edx, 7 0041ECE2 mov eax, esi 0041ECE4 call sub_41E2F0 0041ECE9 mov ebx, eax 0041ECEB mov edx, 0Bh 0041ECF0 mov eax, esi 0041ECF2 call sub_41E2F0 0041ECF7 cmp bl, al 0041ECF9 jz short loc_41ECFF 0041ECFB 0041ECFB loc_41ECFB: ; CODE XREF: sub_41EAA8+233j 0041ECFB xor ebx, ebx 0041ECFD jmp short loc_41ED0D 0041ECFF ; -------------------------------------------------------------------- 0041ECFF 0041ECFF loc_41ECFF: ; CODE XREF: sub_41EAA8+251j 0041ECFF mov bl, 1 0041ED01 jmp short loc_41ED0D 0041ED03 ; -------------------------------------------------------------------- 0041ED03 0041ED03 loc_41ED03: ; CODE XREF: sub_41EAA8+10j 0041ED03 push offset _str_112__.Text ; default 0041ED08 call sub_4150A8 0041ED0D 0041ED0D loc_41ED0D: ; CODE XREF: sub_41EAA8+6Ej 0041ED0D ; sub_41EAA8+87j ... 0041ED0D mov eax, ebx 0041ED0F pop esi 0041ED10 pop ebx 0041ED11 retn 0041ED11 sub_41EAA8 endp ; sp = -4 2005-9-5 10:47 0
wekabc 雪币： 211 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 17 回帖 271 粉丝 0 关注私信	wekabc 12 楼好象挺容易的,先学习. 2005-9-6 20:04 0
stephenteh 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 143 粉丝 0 关注私信	stephenteh 13 楼最初由 VolX 发布 After 3 hrs of tracing .... RVA=1EAA8 or binary search "3131320D0A" (without the "") 0041EAA8 sub_41EAA8 proc near ; CODE XREF: sub_41F108+AFp ........ the above code is never get executed... i found more than 1 like the above code in the code section...but all never get called.. check this code 0108F315 3B45 FC CMP EAX,DWORD PTR SS:[EBP-4] 0108F318 75 45 JNZ SHORT 0108F35F 0108F31A EB 01 JMP SHORT 0108F31D 0108F31C 9A 807B7400 742>CALL FAR 2274:00747B80 ; Far call 0108F323 EB 01 JMP SHORT 0108F326 0108F325 9A 8B451050 8B4>CALL FAR 458B:5010458B ; Far call 0108F32C 14 50 ADC AL,50 0108F32E E8 25F7FFFF CALL 0108EA58 0108F333 50 PUSH EAX 0108F334 8BCE MOV ECX,ESI 0108F336 8B55 18 MOV EDX,DWORD PTR SS:[EBP+18] 0108F339 8BC3 MOV EAX,EBX 0108F33B E8 44FCFFFF CALL 0108EF84 <--this is the call use to determine the call/jump type in this latest version... 0108F340 EB 1D JMP SHORT 0108F35F 0108F342 EB 01 JMP SHORT 0108F345 0108F344 - E9 8B451050 JMP 511938D4 0108F349 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14] 0108F34C 50 PUSH EAX 0108F34D E8 06F7FFFF CALL 0108EA58 0108F352 50 PUSH EAX 0108F353 8BCE MOV ECX,ESI 0108F355 8B55 18 MOV EDX,DWORD PTR SS:[EBP+18] 0108F358 8BC3 MOV EAX,EBX 0108F35A E8 A9FDFFFF CALL 0108F108 <--this is the call to determine call/jump type in previous version but in this version it's never get executed... 0108F35F 4F DEC EDI 0108F360 0373 6C ADD ESI,DWORD PTR DS:[EBX+6C] 0108F363 85FF TEST EDI,EDI 0108F365 ^ 77 A0 JA SHORT 0108F307 0108F367 68 84F30801 PUSH 108F384 ; ASCII "111 " 0108F36C E8 375DFFFF CALL 010850A8 ...no time to get more analysis on this new aspr VM...maybe after there is a working reg key that we can protect our own exe which make the work much easier... 2005-9-6 23:27 0
brightsm 雪币： 196 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 42 粉丝 0 关注私信	brightsm 14 楼不好意思，什么叫stolencode!小弟还是新手！ 2005-9-7 02:15 0
一知半解雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 19 粉丝 0 关注私信	一知半解 15 楼这个我现在正在学，楼主真是及时雨啊！！我有事想请教一下，请问如何联系！！ 2005-9-7 07:55 0
brightsm 雪币： 196 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 42 粉丝 0 关注私信	brightsm 16 楼再多做几个例子吧！ 2005-9-7 17:24 0
syscom 雪币： 245 活跃值： (195) 能力值： ( LV9，RANK：250 ) 在线值：发帖 17 回帖 156 粉丝 1 关注私信	syscom 6 17 楼最初由 brightsm 发布再多做几个例子吧！不知道,你呃个例子,你成功了?????? 要在看更多例子,?搜? "ASProtect" 2005-9-8 14:54 0
auroraxxx 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 34 粉丝 0 关注私信	auroraxxx 18 楼最初由 syscom 发布不知道,你呃个例子,你成功了?????? 要在看更多例子,?搜? "ASProtect" 不行啊...按照着来做,到最后导出的程序运行不了... 2005-9-12 11:19 0
syscom 雪币： 245 活跃值： (195) 能力值： ( LV9，RANK：250 ) 在线值：发帖 17 回帖 156 粉丝 1 关注私信	syscom 6 19 楼最初由 auroraxxx 发布不行啊...按照着来做,到最后导出的程序运行不了... 可能我?的,不好,你先去找 FLY 的??文章他解真的比蒉??.. 2005-9-12 11:37 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

fly

雪币： 898

活跃值： (4039)

能力值：

( LV9，RANK：3410 )

在线值：

发帖

294

回帖

7686

粉丝

32

关注

私信

fly 85: 2 楼

没有多少ASProtect新版加壳程序可以这样高速脱壳的
syscom兄有时间可以深入研究一下ASProtect的代码变形

2005-9-2 23:08

0

syscom

雪币： 245

活跃值： (195)

能力值：

( LV9，RANK：250 )

在线值：

发帖

17

回帖

156

粉丝

1

关注

私信

syscom 6: 3 楼

最初由 fly 发布
没有多少ASProtect新版加壳程序可以这样高速脱壳的
syscom兄有时间可以深入研究一下ASProtect的代码变形

呃?是? ASProtect,基本的,?邋..斤新手看的..

版主是真 OEP 代码变形??,?是有更新的??

ASProtect OEP 代码变形,我好像看咿....

版主,知道那彦有 ASProtect 加?的代码变形??...我可以 DOWNLOAD 研究看看

2005-9-2 23:27

0

fly

雪币： 898

活跃值： (4039)

能力值：

( LV9，RANK：3410 )

在线值：

发帖

294

回帖

7686

粉丝

32

关注

私信

fly 85: 4 楼

syscom兄可以搜索一下AlfaClock、BetterJPEG、Magic NetTrace等程序新版
其实最佳的试炼目标应该是Asprotect新版主程序

2005-9-2 23:47

0

loveboom

雪币： 556

活跃值： (2298)

能力值：

( LV9，RANK：2130 )

在线值：

发帖

100

回帖

690

粉丝

13

关注

私信

loveboom 53: 5 楼

stolen code 没有什么好方法对付吧?,我是一个一个的修复，累人:-(,脱了一个通宵，困了，睡了.

2005-9-3 06:31

0

pendan2001

雪币： 61

活跃值： (160)

能力值：

( LV9，RANK：170 )

在线值：

发帖

25

回帖

1180

粉丝

0

关注

私信

pendan2001 4: 6 楼

学先

2005-9-3 07:35

0

stephenteh

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

2

回帖

143

粉丝

0

关注

私信

stephenteh: 7 楼

the VM (stolen code) of aspr has been updated in the latest version 2.2 beta...this version of VM is quite hard to recover...i still dun know how aspr determine the type of jump....

2005-9-3 09:30

0

夜凉如水

雪币： 136

活跃值： (105)

能力值：

( LV9，RANK：140 )

在线值：

发帖

18

回帖

719

粉丝

1

关注

私信

夜凉如水 3: 8 楼

学习了 ,嘿嘿我这个小菜也学习学习脱 !!!!

2005-9-3 09:37

0

VolX

雪币： 229

活跃值： (50)

能力值：

( LV9，RANK：170 )

在线值：

发帖

4

回帖

107

粉丝

2

关注

私信

VolX 4: 9 楼

最初由 stephenteh 发布
the VM (stolen code) of aspr has been updated in the latest version 2.2 beta...this version of VM is quite hard to recover...i still dun know how aspr determine the type of jump....

Do you have the name of your target? maybe I will have a look.

2005-9-3 13:26

0

stephenteh

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

2

回帖

143

粉丝

0

关注

私信

stephenteh: 10 楼

最初由 VolX 发布

Do you have the name of your target? maybe I will have a look.

it's asprotect itself...

here is the post at exetools

http://www.exetools.com/forum/showthread.php?t=7667&highlight=asprotect

2005-9-3 13:57

0

VolX

雪币： 229

活跃值： (50)

能力值：

( LV9，RANK：170 )

在线值：

发帖

4

回帖

107

粉丝

2

关注

私信

VolX 4: 11 楼

After 3 hrs of tracing ....
RVA=1EAA8
or binary search "3131320D0A" (without the "")

0041EAA8 sub_41EAA8    proc near             ; CODE XREF: sub_41F108+AFp
0041EAA8                                        ; sub_41F108+10Fp
0041EAA8                push ebx
0041EAA9                push esi
0041EAAA                mov    esi, ecx
0041EAAC                xor    ebx, ebx
0041EAAE                jmp    short loc_41EAB1
0041EAAE ; --------------------------------------------------------------------
0041EAB0                db 0E9h
0041EAB1 ; --------------------------------------------------------------------
0041EAB1
0041EAB1 loc_41EAB1:                            ; CODE XREF: sub_41EAA8+6j
0041EAB1                xor    eax, eax
0041EAB3                mov    al, dl
0041EAB5                cmp    eax, 0Fh       ; switch 16 cases
0041EAB8                ja    loc_41ED03    ; default
0041EABE                jmp    off_41EAC5[eax*4] ; switch jump
0041EABE ; --------------------------------------------------------------------
0041EAC5 off_41EAC5    dd offset loc_41EB08 ; DATA XREF: sub_41EAA8+16r
0041EAC5                dd offset loc_41EB1E ; jump table for switch
0041EAC5                dd offset loc_41EB37    statement
0041EAC5                dd offset loc_41EB4A
0041EAC5                dd offset loc_41EB60
0041EAC5                dd offset loc_41EB76
0041EAC5                dd offset loc_41EB8F
0041EAC5                dd offset loc_41EBA5
0041EAC5                dd offset loc_41EBBE
0041EAC5                dd offset loc_41EBD4
0041EAC5                dd offset loc_41EBED
0041EAC5                dd offset loc_41EC1B
0041EAC5                dd offset loc_41EC49
0041EAC5                dd offset loc_41EC70
0041EAC5                dd offset loc_41EC94
0041EAC5                dd offset loc_41ECCD
0041EB05 ; --------------------------------------------------------------------
0041EB05                jmp    short loc_41EB08 ; case 0x0
0041EB05 ; --------------------------------------------------------------------
0041EB07                db 9Ah
0041EB08 ; --------------------------------------------------------------------
0041EB08
0041EB08 loc_41EB08:                            ; CODE XREF: sub_41EAA8+16j
0041EB08                                        ; sub_41EAA8+5Dj
0041EB08                                        ; DATA XREF: ...
0041EB08                mov    edx, 0Bh       ; case 0x0
0041EB0D                mov    eax, esi
0041EB0F                call sub_41E2F0
0041EB14                mov    ebx, eax
0041EB16                jmp    loc_41ED0D
0041EB1B ; --------------------------------------------------------------------
0041EB1B                jmp    short loc_41EB1E ; case 0x1
0041EB1B ; --------------------------------------------------------------------
0041EB1D                db 69h
0041EB1E ; --------------------------------------------------------------------
0041EB1E
0041EB1E loc_41EB1E:                            ; CODE XREF: sub_41EAA8+16j
0041EB1E                                        ; sub_41EAA8+73j
0041EB1E                                        ; DATA XREF: ...
0041EB1E                mov    edx, 0Bh       ; case 0x1
0041EB23                mov    eax, esi
0041EB25                call sub_41E2F0
0041EB2A                mov    ebx, eax
0041EB2C                xor    bl, 1
0041EB2F                jmp    loc_41ED0D
0041EB34 ; --------------------------------------------------------------------
0041EB34                jmp    short loc_41EB37 ; case 0x2
0041EB34 ; --------------------------------------------------------------------
0041EB36                db 0C7h
0041EB37 ; --------------------------------------------------------------------
0041EB37
0041EB37 loc_41EB37:                            ; CODE XREF: sub_41EAA8+16j
0041EB37                                        ; sub_41EAA8+8Cj
0041EB37                                        ; DATA XREF: ...
0041EB37                xor    edx, edx       ; case 0x2
0041EB39                mov    eax, esi
0041EB3B                call sub_41E2F0
0041EB40                mov    ebx, eax
0041EB42                jmp    loc_41ED0D
0041EB47 ; --------------------------------------------------------------------
0041EB47                jmp    short loc_41EB4A ; case 0x3
0041EB47 ; --------------------------------------------------------------------
0041EB49                db 0E8h
0041EB4A ; --------------------------------------------------------------------
0041EB4A
0041EB4A loc_41EB4A:                            ; CODE XREF: sub_41EAA8+16j
0041EB4A                                        ; sub_41EAA8+9Fj
0041EB4A                                        ; DATA XREF: ...
0041EB4A                xor    edx, edx       ; case 0x3
0041EB4C                mov    eax, esi
0041EB4E                call sub_41E2F0
0041EB53                mov    ebx, eax
0041EB55                xor    bl, 1
0041EB58                jmp    loc_41ED0D
0041EB5D ; --------------------------------------------------------------------
0041EB5D                jmp    short loc_41EB60 ; case 0x4
0041EB5D ; --------------------------------------------------------------------
0041EB5F                db 0E9h
0041EB60 ; --------------------------------------------------------------------
0041EB60
0041EB60 loc_41EB60:                            ; CODE XREF: sub_41EAA8+16j
0041EB60                                        ; sub_41EAA8+B5j
0041EB60                                        ; DATA XREF: ...
0041EB60                mov    edx, 6       ; case 0x4
0041EB65                mov    eax, esi
0041EB67                call sub_41E2F0
0041EB6C                mov    ebx, eax
0041EB6E                jmp    loc_41ED0D
0041EB73 ; --------------------------------------------------------------------
0041EB73                jmp    short loc_41EB76 ; case 0x5
0041EB73 ; --------------------------------------------------------------------
0041EB75                db 9Ah
0041EB76 ; --------------------------------------------------------------------
0041EB76
0041EB76 loc_41EB76:                            ; CODE XREF: sub_41EAA8+16j
0041EB76                                        ; sub_41EAA8+CBj
0041EB76                                        ; DATA XREF: ...
0041EB76                mov    edx, 6       ; case 0x5
0041EB7B                mov    eax, esi
0041EB7D                call sub_41E2F0
0041EB82                mov    ebx, eax
0041EB84                xor    bl, 1
0041EB87                jmp    loc_41ED0D
0041EB8C ; --------------------------------------------------------------------
0041EB8C                jmp    short loc_41EB8F ; case 0x6
0041EB8C ; --------------------------------------------------------------------
0041EB8E                db 9Ah
0041EB8F ; --------------------------------------------------------------------
0041EB8F
0041EB8F loc_41EB8F:                            ; CODE XREF: sub_41EAA8+16j
0041EB8F                                        ; sub_41EAA8+E4j
0041EB8F                                        ; DATA XREF: ...
0041EB8F                mov    edx, 2       ; case 0x6
0041EB94                mov    eax, esi
0041EB96                call sub_41E2F0
0041EB9B                mov    ebx, eax
0041EB9D                jmp    loc_41ED0D
0041EBA2 ; --------------------------------------------------------------------
0041EBA2                jmp    short loc_41EBA5 ; case 0x7
0041EBA2 ; --------------------------------------------------------------------
0041EBA4                db 9Ah
0041EBA5 ; --------------------------------------------------------------------
0041EBA5
0041EBA5 loc_41EBA5:                            ; CODE XREF: sub_41EAA8+16j
0041EBA5                                        ; sub_41EAA8+FAj
0041EBA5                                        ; DATA XREF: ...
0041EBA5                mov    edx, 2       ; case 0x7
0041EBAA                mov    eax, esi
0041EBAC                call sub_41E2F0
0041EBB1                mov    ebx, eax
0041EBB3                xor    bl, 1
0041EBB6                jmp    loc_41ED0D
0041EBBB ; --------------------------------------------------------------------
0041EBBB                jmp    short loc_41EBBE ; case 0x8
0041EBBB ; --------------------------------------------------------------------
0041EBBD                db 69h
0041EBBE ; --------------------------------------------------------------------
0041EBBE
0041EBBE loc_41EBBE:                            ; CODE XREF: sub_41EAA8+16j
0041EBBE                                        ; sub_41EAA8+113j
0041EBBE                                        ; DATA XREF: ...
0041EBBE                mov    edx, 7       ; case 0x8
0041EBC3                mov    eax, esi
0041EBC5                call sub_41E2F0
0041EBCA                mov    ebx, eax
0041EBCC                jmp    loc_41ED0D
0041EBD1 ; --------------------------------------------------------------------
0041EBD1                jmp    short loc_41EBD4 ; case 0x9
0041EBD1 ; --------------------------------------------------------------------
0041EBD3                db 0C7h
0041EBD4 ; --------------------------------------------------------------------
0041EBD4
0041EBD4 loc_41EBD4:                            ; CODE XREF: sub_41EAA8+16j
0041EBD4                                        ; sub_41EAA8+129j
0041EBD4                                        ; DATA XREF: ...
0041EBD4                mov    edx, 7       ; case 0x9
0041EBD9                mov    eax, esi
0041EBDB                call sub_41E2F0
0041EBE0                mov    ebx, eax
0041EBE2                xor    bl, 1
0041EBE5                jmp    loc_41ED0D
0041EBEA ; --------------------------------------------------------------------
0041EBEA                jmp    short loc_41EBED ; case 0xA
0041EBEA ; --------------------------------------------------------------------
0041EBEC                db 0E8h
0041EBED ; --------------------------------------------------------------------
0041EBED
0041EBED loc_41EBED:                            ; CODE XREF: sub_41EAA8+16j
0041EBED                                        ; sub_41EAA8+142j
0041EBED                                        ; DATA XREF: ...
0041EBED                xor    edx, edx       ; case 0xA
0041EBEF                mov    eax, esi
0041EBF1                call sub_41E2F0
0041EBF6                test al, al
0041EBF8                jnz    short loc_41EC11
0041EBFA                mov    edx, 6
0041EBFF                mov    eax, esi
0041EC01                call sub_41E2F0
0041EC06                test al, al
0041EC08                jnz    short loc_41EC11
0041EC0A                xor    ebx, ebx
0041EC0C                jmp    loc_41ED0D
0041EC11 ; --------------------------------------------------------------------
0041EC11
0041EC11 loc_41EC11:                            ; CODE XREF: sub_41EAA8+150j
0041EC11                                        ; sub_41EAA8+160j
0041EC11                mov    bl, 1
0041EC13                jmp    loc_41ED0D
0041EC18 ; --------------------------------------------------------------------
0041EC18                jmp    short loc_41EC1B ; case 0xB
0041EC18 ; --------------------------------------------------------------------
0041EC1A                db 0E9h
0041EC1B ; --------------------------------------------------------------------
0041EC1B
0041EC1B loc_41EC1B:                            ; CODE XREF: sub_41EAA8+16j
0041EC1B                                        ; sub_41EAA8+170j
0041EC1B                                        ; DATA XREF: ...
0041EC1B                xor    edx, edx       ; case 0xB
0041EC1D                mov    eax, esi
0041EC1F                call sub_41E2F0
0041EC24                test al, al
0041EC26                jnz    short loc_41EC38
0041EC28                mov    edx, 6
0041EC2D                mov    eax, esi
0041EC2F                call sub_41E2F0
0041EC34                test al, al
0041EC36                jz    short loc_41EC3F
0041EC38
0041EC38 loc_41EC38:                            ; CODE XREF: sub_41EAA8+17Ej
0041EC38                xor    ebx, ebx
0041EC3A                jmp    loc_41ED0D
0041EC3F ; --------------------------------------------------------------------
0041EC3F
0041EC3F loc_41EC3F:                            ; CODE XREF: sub_41EAA8+18Ej
0041EC3F                mov    bl, 1
0041EC41                jmp    loc_41ED0D
0041EC46 ; --------------------------------------------------------------------
0041EC46                jmp    short loc_41EC49 ; case 0xC
0041EC46 ; --------------------------------------------------------------------
0041EC48                db 9Ah
0041EC49 ; --------------------------------------------------------------------
0041EC49
0041EC49 loc_41EC49:                            ; CODE XREF: sub_41EAA8+16j
0041EC49                                        ; sub_41EAA8+19Ej
0041EC49                                        ; DATA XREF: ...
0041EC49                mov    edx, 7       ; case 0xC
0041EC4E                mov    eax, esi
0041EC50                call sub_41E2F0
0041EC55                mov    ebx, eax
0041EC57                mov    edx, 0Bh
0041EC5C                mov    eax, esi
0041EC5E                call sub_41E2F0
0041EC63                cmp    bl, al
0041EC65                setnz bl
0041EC68                jmp    loc_41ED0D
0041EC6D ; --------------------------------------------------------------------
0041EC6D                jmp    short loc_41EC70 ; case 0xD
0041EC6D ; --------------------------------------------------------------------
0041EC6F                db 9Ah
0041EC70 ; --------------------------------------------------------------------
0041EC70
0041EC70 loc_41EC70:                            ; CODE XREF: sub_41EAA8+16j
0041EC70                                        ; sub_41EAA8+1C5j
0041EC70                                        ; DATA XREF: ...
0041EC70                mov    edx, 7       ; case 0xD
0041EC75                mov    eax, esi
0041EC77                call sub_41E2F0
0041EC7C                mov    ebx, eax
0041EC7E                mov    edx, 0Bh
0041EC83                mov    eax, esi
0041EC85                call sub_41E2F0
0041EC8A                cmp    bl, al
0041EC8C                setz bl
0041EC8F                jmp    short loc_41ED0D
0041EC91 ; --------------------------------------------------------------------
0041EC91                jmp    short loc_41EC94 ; case 0xE
0041EC91 ; --------------------------------------------------------------------
0041EC93                db 9Ah
0041EC94 ; --------------------------------------------------------------------
0041EC94
0041EC94 loc_41EC94:                            ; CODE XREF: sub_41EAA8+16j
0041EC94                                        ; sub_41EAA8+1E9j
0041EC94                                        ; DATA XREF: ...
0041EC94                mov    edx, 6       ; case 0xE
0041EC99                mov    eax, esi
0041EC9B                call sub_41E2F0
0041ECA0                test al, al
0041ECA2                jnz    short loc_41ECC6
0041ECA4                mov    edx, 7
0041ECA9                mov    eax, esi
0041ECAB                call sub_41E2F0
0041ECB0                mov    ebx, eax
0041ECB2                mov    edx, 0Bh
0041ECB7                mov    eax, esi
0041ECB9                call sub_41E2F0
0041ECBE                cmp    bl, al
0041ECC0                jnz    short loc_41ECC6
0041ECC2                xor    ebx, ebx
0041ECC4                jmp    short loc_41ED0D
0041ECC6 ; --------------------------------------------------------------------
0041ECC6
0041ECC6 loc_41ECC6:                            ; CODE XREF: sub_41EAA8+1FAj
0041ECC6                                        ; sub_41EAA8+218j
0041ECC6                mov    bl, 1
0041ECC8                jmp    short loc_41ED0D
0041ECCA ; --------------------------------------------------------------------
0041ECCA                jmp    short loc_41ECCD ; case 0xF
0041ECCA ; --------------------------------------------------------------------
0041ECCC                db 9Ah
0041ECCD ; --------------------------------------------------------------------
0041ECCD
0041ECCD loc_41ECCD:                            ; CODE XREF: sub_41EAA8+16j
0041ECCD                                        ; sub_41EAA8+222j
0041ECCD                                        ; DATA XREF: ...
0041ECCD                mov    edx, 6       ; case 0xF
0041ECD2                mov    eax, esi
0041ECD4                call sub_41E2F0
0041ECD9                test al, al
0041ECDB                jnz    short loc_41ECFB
0041ECDD                mov    edx, 7
0041ECE2                mov    eax, esi
0041ECE4                call sub_41E2F0
0041ECE9                mov    ebx, eax
0041ECEB                mov    edx, 0Bh
0041ECF0                mov    eax, esi
0041ECF2                call sub_41E2F0
0041ECF7                cmp    bl, al
0041ECF9                jz    short loc_41ECFF
0041ECFB
0041ECFB loc_41ECFB:                            ; CODE XREF: sub_41EAA8+233j
0041ECFB                xor    ebx, ebx
0041ECFD                jmp    short loc_41ED0D
0041ECFF ; --------------------------------------------------------------------
0041ECFF
0041ECFF loc_41ECFF:                            ; CODE XREF: sub_41EAA8+251j
0041ECFF                mov    bl, 1
0041ED01                jmp    short loc_41ED0D
0041ED03 ; --------------------------------------------------------------------
0041ED03
0041ED03 loc_41ED03:                            ; CODE XREF: sub_41EAA8+10j
0041ED03                push offset _str_112__.Text ; default
0041ED08                call sub_4150A8
0041ED0D
0041ED0D loc_41ED0D:                            ; CODE XREF: sub_41EAA8+6Ej
0041ED0D                                        ; sub_41EAA8+87j ...
0041ED0D                mov    eax, ebx
0041ED0F                pop    esi
0041ED10                pop    ebx
0041ED11                retn
0041ED11 sub_41EAA8    endp ; sp = -4

2005-9-5 10:47

0

wekabc

雪币： 211

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

17

回帖

271

粉丝

0

关注

私信

wekabc: 12 楼

好象挺容易的,先学习.

2005-9-6 20:04

0

stephenteh

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

2

回帖

143

粉丝

0

关注

私信

stephenteh: 13 楼

最初由 VolX 发布
After 3 hrs of tracing ....
RVA=1EAA8
or binary search "3131320D0A" (without the "")

0041EAA8 sub_41EAA8 proc near ; CODE XREF: sub_41F108+AFp
........

the above code is never get executed...

i found more than 1 like the above code in the code section...but all never get called..

check this code

0108F315 3B45 FC       CMP EAX,DWORD PTR SS:[EBP-4]
0108F318 75 45          JNZ SHORT 0108F35F
0108F31A EB 01          JMP SHORT 0108F31D
0108F31C 9A 807B7400 742>CALL FAR 2274:00747B80                ; Far call
0108F323 EB 01          JMP SHORT 0108F326
0108F325 9A 8B451050 8B4>CALL FAR 458B:5010458B                ; Far call
0108F32C 14 50          ADC AL,50
0108F32E E8 25F7FFFF    CALL 0108EA58
0108F333 50             PUSH EAX
0108F334 8BCE          MOV ECX,ESI
0108F336 8B55 18       MOV EDX,DWORD PTR SS:[EBP+18]
0108F339 8BC3          MOV EAX,EBX
0108F33B E8 44FCFFFF    CALL 0108EF84 <--this is the call use to determine the call/jump type in this latest version...
0108F340 EB 1D          JMP SHORT 0108F35F
0108F342 EB 01          JMP SHORT 0108F345
0108F344  - E9 8B451050    JMP 511938D4
0108F349 8B45 14       MOV EAX,DWORD PTR SS:[EBP+14]
0108F34C 50             PUSH EAX
0108F34D E8 06F7FFFF    CALL 0108EA58
0108F352 50             PUSH EAX
0108F353 8BCE          MOV ECX,ESI
0108F355 8B55 18       MOV EDX,DWORD PTR SS:[EBP+18]
0108F358 8BC3          MOV EAX,EBX
0108F35A E8 A9FDFFFF    CALL 0108F108  <--this is the call to determine call/jump type in previous version but in this version it's never get executed...
0108F35F 4F             DEC EDI
0108F360 0373 6C       ADD ESI,DWORD PTR DS:[EBX+6C]
0108F363 85FF          TEST EDI,EDI
0108F365  ^ 77 A0          JA SHORT 0108F307
0108F367 68 84F30801    PUSH 108F384                            ; ASCII "111
"
0108F36C E8 375DFFFF    CALL 010850A8

...no time to get more analysis on this new aspr VM...maybe after there is a working reg key that we can protect our own exe which make the work much easier...

2005-9-6 23:27

0