【文章标题】:脱壳手记---Themida(2.1.2.0)
【文章作者】: qqmcc
【下载地址】: sayhello.rar
“衣带渐宽终不悔,为伊消得人憔悴”
------柳永《蝶恋花》
王国维先生曾以此比喻治学之第二境,我想以此与仍然苦苦挣扎在KSSD大教室的诸君共勉!
然则高版本的脱壳往往是建立在低版本之上,如果你对低版本已经有所了解可以忽略此处,如果需要了解可以看这里http://bbs.pediy.com/showthread.php?t=172921 或移步KSSD
好了,进入正题!
上OD先直接F9跑一次。
程序结束后,将堆栈往上拉发现(图1):
有个返回到00401510,去反汇编窗口看看:
0040147E 8AD4 MOV DL,AH
00401480 8915 F4844000 MOV DWORD PTR DS:[4084F4],EDX
00401486 8BC8 MOV ECX,EAX
00401488 81E1 FF000000 AND ECX,0FF
0040148E 890D F0844000 MOV DWORD PTR DS:[4084F0],ECX
00401494 C1E1 08 SHL ECX,8
00401497 03CA ADD ECX,EDX
00401499 890D EC844000 MOV DWORD PTR DS:[4084EC],ECX
0040149F C1E8 10 SHR EAX,10
004014A2 A3 E8844000 MOV DWORD PTR DS:[4084E8],EAX
004014A7 6A 00 PUSH 0
004014A9 E8 A80A0000 CALL sayhello.00401F56
004014AE 59 POP ECX
004014AF 85C0 TEST EAX,EAX
004014B1 75 08 JNZ SHORT sayhello.004014BB
004014B3 6A 1C PUSH 1C
004014B5 E8 9A000000 CALL sayhello.00401554
004014BA 59 POP ECX
004014BB 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
004014BF E8 72070000 CALL sayhello.00401C36
004014C4 E8 A0FA2E02 CALL 026F0F69
004014C9 90 NOP
004014CA A3 F8894000 MOV DWORD PTR DS:[4089F8],EAX
004014CF E8 30060000 CALL sayhello.00401B04
004014D4 A3 D0844000 MOV DWORD PTR DS:[4084D0],EAX
004014D9 E8 D9030000 CALL sayhello.004018B7
004014DE E8 1B030000 CALL sayhello.004017FE
004014E3 E8 90000000 CALL sayhello.00401578
004014E8 A1 04854000 MOV EAX,DWORD PTR DS:[408504]
004014ED A3 08854000 MOV DWORD PTR DS:[408508],EAX
004014F2 50 PUSH EAX
004014F3 FF35 FC844000 PUSH DWORD PTR DS:[4084FC]
004014F9 FF35 F8844000 PUSH DWORD PTR DS:[4084F8]
004014FF E8 FCFAFFFF CALL sayhello.00401000
00401504 83C4 0C ADD ESP,0C
00401507 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
0040150A 50 PUSH EAX
0040150B E8 95000000 CALL sayhello.004015A5
00401510 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00401513 8B08 MOV ECX,DWORD PTR DS:[EAX]
00401515 8B09 MOV ECX,DWORD PTR DS:[ECX]
00401517 894D E0 MOV DWORD PTR SS:[EBP-20],ECX
0040151A 50 PUSH EAX
0040151B 51 PUSH ECX
0040151C E8 59010000 CALL sayhello.0040167A
00401521 59 POP ECX
00401522 59 POP ECX
00401523 C3 RETN
004487A0 8F02 POP DWORD PTR DS:[EDX] ;
004C26F9 FF95 7A278906 CALL DWORD PTR SS:[EBP+689277A]
004BF68C C785 2D1D8206 0>MOV DWORD PTR SS:[EBP+6821D2D],0
004BF696 C785 311B8206 0>MOV DWORD PTR SS:[EBP+6821B31],0
004BF6A0 83BD 00B48C06 0>CMP DWORD PTR SS:[EBP+68CB400],0
004BF6E3 83BD 21158206 6>CMP DWORD PTR SS:[EBP+6821521],64
004BF6EA 0F82 09010000 JB sayhello.004BF7F9 ;这里修改成jmp跳过校验
004BF893 3D EEEEEEEE CMP EAX,EEEEEEEE
004BF898 0F85 AB000000 JNZ sayhello.004BF949
004BF89E F5 CMC
004BF89F 813E DDDDDDDD CMP DWORD PTR DS:[ESI],DDDDDDDD
004BF8A5 0F85 9E000000 JNZ sayhello.004BF949
004BF8AB F8 CLC
004BF8AC F8 CLC
004BF8AD 50 PUSH EAX
004BF8AE B8 00000000 MOV EAX,0
004BF8B3 8906 MOV DWORD PTR DS:[ESI],EAX
004BF8B5 8B0424 MOV EAX,DWORD PTR SS:[ESP]
004BF8B8 83C4 04 ADD ESP,4
004BF8BB E9 08000000 JMP sayhello.004BF8C8
004BF8C0 53 PUSH EBX
004BF8C1 F4 HLT ; 特权命令
004BF8C2 213D 7ADF2136 AND DWORD PTR DS:[3621DF7A],EDI
004BF8C8 52 PUSH EDX
004BF8C9 BA 04000000 MOV EDX,4
004BF8CE 81C6 5C04AE28 ADD ESI,28AE045C
004BF8D4 01D6 ADD ESI,EDX
004BF8D6 81EE 5C04AE28 SUB ESI,28AE045C
004BF8DC 5A POP EDX
004BF8DD E9 0F000000 JMP sayhello.004BF8F1
004BF85C AD LODS DWORD PTR DS:[ESI]
004BFC57 3B02 CMP EAX,DWORD PTR DS:[EDX]
004BFC59 0F84 6F000000 JE sayhello.004BFCCE ;找到KEY跳出循环
004BFC5F 0F89 1E000000 JNS sayhello.004BFC83
004BFC65 60 PUSHAD
004BFC66 E8 14000000 CALL sayhello.004BFC7F
004BFC6B AB STOS DWORD PTR ES:[EDI]
004BFC6C F2: PREFIX REPNE: ; 多余前缀
004BFC6D 93 XCHG EAX,EBX
004BFC6E 6B30 A8 IMUL ESI,DWORD PTR DS:[EAX],-58
004BFC71 B6 FD MOV DH,0FD
004BFC73 D19E 2B586176 RCR DWORD PTR DS:[ESI+7661582B],1
004BFC79 B7 07 MOV BH,7
004BFC7B 05 CCF02A5A ADD EAX,5A2AF0CC
004BFC80 60 PUSHAD
004BFC81 61 POPAD
004BFC82 61 POPAD
004BFC83 57 PUSH EDI
004BFC84 893424 MOV DWORD PTR SS:[ESP],ESI
004BFC87 BE 04000000 MOV ESI,4
004BFC8C 01F2 ADD EDX,ESI
004BFC8E 5E POP ESI
004BFC8F FC CLD
004BFC90 52 PUSH EDX
004BFC91 BA 01000000 MOV EDX,1
004BFC96 01D1 ADD ECX,EDX
004BFC98 5A POP EDX
004BFC99 F9 STC
004BFC9A 3B8D B8BF8B06 CMP ECX,DWORD PTR SS:[EBP+68BBFB8]
004BFCA0 ^ 0F85 B1FFFFFF JNZ sayhello.004BFC57
004BFCCE 898D E11C8206 MOV DWORD PTR SS:[EBP+6821CE1],ECX
004BFED7 01C8 ADD EAX,ECX
004BFED9 2D 190F5568 SUB EAX,68550F19
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)