脱 北 斗 壳 { 适合新手 }
这是我的第一篇脱文,本人属大菜鸟一个,方法有什么不对,还请各位大虾指导指导~~~~~~
手动脱壳建议大家用Ollydbg,工作平台Win2000,WinXp,Win9x不推荐~
手动脱壳时,脱壳程序里面会有好多循环。对付循环时，只能让程序往前运行，基本不能让它往回跳{有时后要往前,以便跳处循环}~~~
用OD载入程序后,Od提示程序加壳~~
0040CE93 N> 9C pushfd 停在这~~ F8往前走,
0040CE94 60 pushad
0040CE95 E8 00000000 call NOTEPAD.0040CE9A
0040CE9A 5D pop ebp
0040CE9B B8 07000000 mov eax,7
0040CEA0 2BE8 sub ebp,eax
0040CEA2 8DB5 C5FDFFFF lea esi,dword ptr ss:[ebp-23B]
0040CEA8 8B06 mov eax,dword ptr ds:[esi]
0040CEAA 83F8 00 cmp eax,0
0040CEAD 74 11 je short NOTEPAD.0040CEC0 跳走 ~~
0040CEAF 8DB5 EDFDFFFF lea esi,dword ptr ss:[ebp-213]
0040CEB5 8B06 mov eax,dword ptr ds:[esi]
0040CEB7 83F8 01 cmp eax,1
0040CEBA 0F84 4B020000 je NOTEPAD.0040D10B
0040CEC0 C706 01000000 mov dword ptr ds:[esi],1 到达这 ,F8继续
0040CEC6 8BD5 mov edx,ebp
0040CEC8 8B85 81FDFFFF mov eax,dword ptr ss:[ebp-27F]
0040CECE 2BD0 sub edx,eax
0040CED0 8995 81FDFFFF mov dword ptr ss:[ebp-27F],edx
0040CED6 0195 B1FDFFFF add dword ptr ss:[ebp-24F],edx
0040CEDC 8DB5 F5FDFFFF lea esi,dword ptr ss:[ebp-20B]
0040CEE2 0116 add dword ptr ds:[esi],edx
0040CEE4 8B36 mov esi,dword ptr ds:[esi]
0040CEE6 8BFD mov edi,ebp
0040CEE8 60 pushad
0040CEE9 6A 40 push 40
0040CEEB 68 00100000 push 1000
0040CEF0 68 00100000 push 1000
0040CEF5 6A 00 push 0
0040CEF7 FF95 29FEFFFF call dword ptr ss:[ebp-1D7]
0040CEFD 85C0 test eax,eax
0040CEFF 0F84 65030000 je NOTEPAD.0040D26A
0040CF05 8985 A9FDFFFF mov dword ptr ss:[ebp-257],eax
0040CF0B E8 00000000 call NOTEPAD.0040CF10
0040CF10 5B pop ebx
0040CF11 B9 63030000 mov ecx,363
0040CF16 03D9 add ebx,ecx
0040CF18 50 push eax
0040CF19 53 push ebx
0040CF1A E8 AC020000 call NOTEPAD.0040D1CB
0040CF1F 61 popad 这里popad,观察后面的跳转,跨段不大 不是OEP,不管他,F8继续~
0040CF20 03BD 71FDFFFF add edi,dword ptr ss:[ebp-28F]
0040CF26 8BDF mov ebx,edi
0040CF28 833F 00 cmp dword ptr ds:[edi],0
0040CF2B /75 0A jnz short NOTEPAD.0040CF37
0040CF2D |83C7 04 add edi,4
0040CF30 |B9 00000000 mov ecx,0
0040CF35 |EB 16 jmp short NOTEPAD.0040CF4D 跳走~~~
来到这__________
0040CF4D 57 push edi F8继续 ~~~~
0040CF4E 51 push ecx
0040CF4F 52 push edx
0040CF50 53 push ebx
0040CF51 FFB5 2DFEFFFF push dword ptr ss:[ebp-1D3]
0040CF57 FFB5 29FEFFFF push dword ptr ss:[ebp-1D7]
0040CF5D 8BD6 mov edx,esi
0040CF5F 8BCF mov ecx,edi
0040CF61 8B85 A9FDFFFF mov eax,dword ptr ss:[ebp-257]
0040CF67 05 A9050000 add eax,5A9
0040CF6C FFD0 call eax
0040CF6E 5B pop ebx
0040CF6F 5A pop edx
0040CF70 59 pop ecx
0040CF71 5F pop edi
0040CF72 83F9 00 cmp ecx,0
0040CF75 /74 05 je short NOTEPAD.0040CF7C
0040CF77 |83C3 08 add ebx,8
0040CF7A ^|EB C5 jmp short NOTEPAD.0040CF41
0040CF7C \68 00800000 push 8000
0040CF81 6A 00 push 0
0040CF83 FFB5 A9FDFFFF push dword ptr ss:[ebp-257]
0040CF89 FF95 2DFEFFFF call dword ptr ss:[ebp-1D3]
0040CF8F 8DB5 B1FDFFFF lea esi,dword ptr ss:[ebp-24F]
0040CF95 8B4E 08 mov ecx,dword ptr ds:[esi+8]
0040CF98 8D56 10 lea edx,dword ptr ds:[esi+10]
0040CF9B 8B36 mov esi,dword ptr ds:[esi]
0040CF9D 8BFE mov edi,esi
0040CF9F 83F9 00 cmp ecx,0
0040CFA2 /74 3F je short NOTEPAD.0040CFE3
0040CFA4 |8A07 mov al,byte ptr ds:[edi]
0040CFA6 |47 inc edi
0040CFA7 |2C E8 sub al,0E8
0040CFA9 |3C 01 cmp al,1
0040CFAB ^|77 F7 ja short NOTEPAD.0040CFA4 有个往回的跳转,不要执行它
0040CFAD |8B07 mov eax,dword ptr ds:[edi] F4到这里,继续~~
0040CFAF 807A 01 00 cmp byte ptr ds:[edx+1],0
0040CFB3 74 14 je short NOTEPAD.0040CFC9
0040CFB5 8A1A mov bl,byte ptr ds:[edx]
0040CFB7 381F cmp byte ptr ds:[edi],bl
0040CFB9 ^ 75 E9 jnz short NOTEPAD.0040CFA4 往回的跳转,不要执行它
0040CFBB 8A5F 04 mov bl,byte ptr ds:[edi+4] F4到这里,继续~
0040CFBE 66:C1E8 08 shr ax,8
0040CFC2 C1C0 10 rol eax,10
0040CFC5 86C4 xchg ah,al
0040CFC7 /EB 0A jmp short NOTEPAD.0040CFD3
0040CFC9 |8A5F 04 mov bl,byte ptr ds:[edi+4]
0040CFCC |86C4 xchg ah,al
0040CFCE |C1C0 10 rol eax,10
0040CFD1 |86C4 xchg ah,al
0040CFD3 \2BC7 sub eax,edi
0040CFD5 03C6 add eax,esi
0040CFD7 8907 mov dword ptr ds:[edi],eax
0040CFD9 83C7 05 add edi,5
0040CFDC 80EB E8 sub bl,0E8
0040CFDF 8BC3 mov eax,ebx
0040CFE1 ^ E2 C6 loopd short NOTEPAD.0040CFA9 往回的跳转,不要执行它
0040CFE3 E8 39010000 call NOTEPAD.0040D121 F4到这里,继续~~
0040CFE8 8D8D C5FDFFFF lea ecx,dword ptr ss:[ebp-23B]
0040CFEE 8B41 08 mov eax,dword ptr ds:[ecx+8]
0040CFF1 83F8 00 cmp eax,0
0040CFF4 0F84 81000000 je NOTEPAD.0040D07B 跳~~~
跳到这~~~~
0040D07B 8DB5 81FDFFFF lea esi,dword ptr ss:[ebp-27F]
0040D081 8B16 mov edx,dword ptr ds:[esi]
0040D083 8DB5 DDFDFFFF lea esi,dword ptr ss:[ebp-223]
0040D089 8B06 mov eax,dword ptr ds:[esi]
0040D08B 83F8 01 cmp eax,1
0040D08E /75 42 jnz short NOTEPAD.0040D0D2 跳~~~~~~
来到这__________
0040D0D2 8BDD mov ebx,ebp ; NOTEPAD.<ModuleEntryPoint>
0040D0D4 81EB 21000000 sub ebx,21
0040D0DA 33C9 xor ecx,ecx
0040D0DC 8A0B mov cl,byte ptr ds:[ebx]
0040D0DE 83F9 00 cmp ecx,0
0040D0E1 /74 28 je short NOTEPAD.0040D10B
0040D0E3 |43 inc ebx
0040D0E4 |8DB5 81FDFFFF lea esi,dword ptr ss:[ebp-27F]
0040D0EA |8B16 mov edx,dword ptr ds:[esi]
0040D0EC |56 push esi
0040D0ED |51 push ecx
0040D0EE |53 push ebx
0040D0EF |52 push edx ; NOTEPAD.00400000
0040D0F0 |56 push esi
0040D0F1 |FF33 push dword ptr ds:[ebx]
0040D0F3 |FF73 04 push dword ptr ds:[ebx+4]
0040D0F6 |8B43 08 mov eax,dword ptr ds:[ebx+8]
0040D0F9 |03C2 add eax,edx
0040D0FB |50 push eax
0040D0FC FF95 25FEFFFF call dword ptr ss:[ebp-1DB]
0040D102 5A pop edx
0040D103 5B pop ebx
0040D104 59 pop ecx
0040D105 5E pop esi
0040D106 83C3 0C add ebx,0C
0040D109 ^\E2 E1 loopd short NOTEPAD.0040D0EC 往回的跳转,不要执行它
0040D10B B8 00000000 mov eax,0
0040D110 83F8 00 cmp eax,0 F4到这里0040D113 /74 05 0040D113 /74 05 je short NOTEPAD.0040D11A 跳~~~
0040D115 |61 popad
0040D116 |9D popfd
0040D117 |C2 0C00 retn 0C
0040D11A \61 popad 跳到这,跨段比较大 ,OEP找到了~~~~
0040D11B 9D popfd
0040D11C - E9 AB3FFFFF jmp NOTEPAD.004010CC F8 到这~~~ OEP
004010CC 55 db 55 DUMP下来,保存就好了{右键,脱壳当前进程,保存,OK!!}
004010CD 8B db 8B
004010CE EC db EC
004010CF 83 db 83
004010D0 EC db EC
004010D1 44 db 44 '
004010D2 56 db 56
004010D3 FF db FF
004010D4 15 db 15
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
