-
-
[原创]脱壳手记---Themida（2.1.2.0）
-
发表于: 2013-6-5 13:39
-
【文章标题】:脱壳手记---Themida（2.1.2.0）
【文章作者】: qqmcc
【下载地址】: sayhello.rar
“衣带渐宽终不悔，为伊消得人憔悴”
------柳永《蝶恋花》
王国维先生曾以此比喻治学之第二境，我想以此与仍然苦苦挣扎在KSSD大教室的诸君共勉！
然则高版本的脱壳往往是建立在低版本之上，如果你对低版本已经有所了解可以忽略此处，如果需要了解可以看这里http://bbs.pediy.com/showthread.php?t=172921 或移步KSSD
好了，进入正题！
上OD先直接F9跑一次。
程序结束后，将堆栈往上拉发现（图1）：
有个返回到00401510，去反汇编窗口看看：
0040147E 8AD4 MOV DL,AH 00401480 8915 F4844000 MOV DWORD PTR DS:[4084F4],EDX 00401486 8BC8 MOV ECX,EAX 00401488 81E1 FF000000 AND ECX,0FF 0040148E 890D F0844000 MOV DWORD PTR DS:[4084F0],ECX 00401494 C1E1 08 SHL ECX,8 00401497 03CA ADD ECX,EDX 00401499 890D EC844000 MOV DWORD PTR DS:[4084EC],ECX 0040149F C1E8 10 SHR EAX,10 004014A2 A3 E8844000 MOV DWORD PTR DS:[4084E8],EAX 004014A7 6A 00 PUSH 0 004014A9 E8 A80A0000 CALL sayhello.00401F56 004014AE 59 POP ECX 004014AF 85C0 TEST EAX,EAX 004014B1 75 08 JNZ SHORT sayhello.004014BB 004014B3 6A 1C PUSH 1C 004014B5 E8 9A000000 CALL sayhello.00401554 004014BA 59 POP ECX 004014BB 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 004014BF E8 72070000 CALL sayhello.00401C36 004014C4 E8 A0FA2E02 CALL 026F0F69 004014C9 90 NOP 004014CA A3 F8894000 MOV DWORD PTR DS:[4089F8],EAX 004014CF E8 30060000 CALL sayhello.00401B04 004014D4 A3 D0844000 MOV DWORD PTR DS:[4084D0],EAX 004014D9 E8 D9030000 CALL sayhello.004018B7 004014DE E8 1B030000 CALL sayhello.004017FE 004014E3 E8 90000000 CALL sayhello.00401578 004014E8 A1 04854000 MOV EAX,DWORD PTR DS:[408504] 004014ED A3 08854000 MOV DWORD PTR DS:[408508],EAX 004014F2 50 PUSH EAX 004014F3 FF35 FC844000 PUSH DWORD PTR DS:[4084FC] 004014F9 FF35 F8844000 PUSH DWORD PTR DS:[4084F8] 004014FF E8 FCFAFFFF CALL sayhello.00401000 00401504 83C4 0C ADD ESP,0C 00401507 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 0040150A 50 PUSH EAX 0040150B E8 95000000 CALL sayhello.004015A5 00401510 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] 00401513 8B08 MOV ECX,DWORD PTR DS:[EAX] 00401515 8B09 MOV ECX,DWORD PTR DS:[ECX] 00401517 894D E0 MOV DWORD PTR SS:[EBP-20],ECX 0040151A 50 PUSH EAX 0040151B 51 PUSH ECX 0040151C E8 59010000 CALL sayhello.0040167A 00401521 59 POP ECX 00401522 59 POP ECX 00401523 C3 RETN
004487A0 8F02 POP DWORD PTR DS:[EDX] ;
004C26F9 FF95 7A278906 CALL DWORD PTR SS:[EBP+689277A]
004BF68C C785 2D1D8206 0>MOV DWORD PTR SS:[EBP+6821D2D],0 004BF696 C785 311B8206 0>MOV DWORD PTR SS:[EBP+6821B31],0 004BF6A0 83BD 00B48C06 0>CMP DWORD PTR SS:[EBP+68CB400],0
004BF6E3 83BD 21158206 6>CMP DWORD PTR SS:[EBP+6821521],64 004BF6EA 0F82 09010000 JB sayhello.004BF7F9 ;这里修改成jmp跳过校验
004BF893 3D EEEEEEEE CMP EAX,EEEEEEEE 004BF898 0F85 AB000000 JNZ sayhello.004BF949 004BF89E F5 CMC 004BF89F 813E DDDDDDDD CMP DWORD PTR DS:[ESI],DDDDDDDD 004BF8A5 0F85 9E000000 JNZ sayhello.004BF949 004BF8AB F8 CLC 004BF8AC F8 CLC 004BF8AD 50 PUSH EAX 004BF8AE B8 00000000 MOV EAX,0 004BF8B3 8906 MOV DWORD PTR DS:[ESI],EAX 004BF8B5 8B0424 MOV EAX,DWORD PTR SS:[ESP] 004BF8B8 83C4 04 ADD ESP,4 004BF8BB E9 08000000 JMP sayhello.004BF8C8 004BF8C0 53 PUSH EBX 004BF8C1 F4 HLT ; 特权命令 004BF8C2 213D 7ADF2136 AND DWORD PTR DS:[3621DF7A],EDI 004BF8C8 52 PUSH EDX 004BF8C9 BA 04000000 MOV EDX,4 004BF8CE 81C6 5C04AE28 ADD ESI,28AE045C 004BF8D4 01D6 ADD ESI,EDX 004BF8D6 81EE 5C04AE28 SUB ESI,28AE045C 004BF8DC 5A POP EDX 004BF8DD E9 0F000000 JMP sayhello.004BF8F1
004BF85C AD LODS DWORD PTR DS:[ESI]
004BFC57 3B02 CMP EAX,DWORD PTR DS:[EDX] 004BFC59 0F84 6F000000 JE sayhello.004BFCCE ;找到KEY跳出循环 004BFC5F 0F89 1E000000 JNS sayhello.004BFC83 004BFC65 60 PUSHAD 004BFC66 E8 14000000 CALL sayhello.004BFC7F 004BFC6B AB STOS DWORD PTR ES:[EDI] 004BFC6C F2: PREFIX REPNE: ; 多余前缀 004BFC6D 93 XCHG EAX,EBX 004BFC6E 6B30 A8 IMUL ESI,DWORD PTR DS:[EAX],-58 004BFC71 B6 FD MOV DH,0FD 004BFC73 D19E 2B586176 RCR DWORD PTR DS:[ESI+7661582B],1 004BFC79 B7 07 MOV BH,7 004BFC7B 05 CCF02A5A ADD EAX,5A2AF0CC 004BFC80 60 PUSHAD 004BFC81 61 POPAD 004BFC82 61 POPAD 004BFC83 57 PUSH EDI 004BFC84 893424 MOV DWORD PTR SS:[ESP],ESI 004BFC87 BE 04000000 MOV ESI,4 004BFC8C 01F2 ADD EDX,ESI 004BFC8E 5E POP ESI 004BFC8F FC CLD 004BFC90 52 PUSH EDX 004BFC91 BA 01000000 MOV EDX,1 004BFC96 01D1 ADD ECX,EDX 004BFC98 5A POP EDX 004BFC99 F9 STC 004BFC9A 3B8D B8BF8B06 CMP ECX,DWORD PTR SS:[EBP+68BBFB8] 004BFCA0 ^ 0F85 B1FFFFFF JNZ sayhello.004BFC57
004BFCCE 898D E11C8206 MOV DWORD PTR SS:[EBP+6821CE1],ECX
004BFED7 01C8 ADD EAX,ECX 004BFED9 2D 190F5568 SUB EAX,68550F19
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
应该是OD没有设置好，好好利用一下StrongOD插件(这个是要感谢一下海风月影大牛的)。你的原件我暂时无法下载下来。
PS:大牛真的不敢当 我的机器上StrongOD:  然后phant0m插件全开就可以调试你这个软件了 |
|
|
看来我还得使劲研究研究，我太菜了，StrongOD很厉害，我用脚本运行，结果还是被拦截了
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
木有SDK VM 汗
  |
|
|
|
|
|
|
|
|
|
