目标程序:http://www.sm1000y.cn/download/smss-jxqn.rar
脱壳工具:FLYODBG,LordPE,PEiD,ImportREC
开工:
1,打开OD,忽略所有异常,隐藏OD,载入CSMSSXX5.EXE,停在壳的入口处:
006F1000 > 60 pushad <<壳的入口
006F1001 E8 00000000 call CSMSSXX5.006F1006
006F1006 5D pop ebp
006F1007 50 push eax
006F1008 51 push ecx
006F1009 0FCA bswap edx
006F100B F7D2 not edx
006F100D 9C pushfd
006F100E F7D2 not edx
006F1010 0FCA bswap edx
006F1012 EB 0F jmp short CSMSSXX5.006F1023
006F1014 B9 EB0FB8EB mov ecx,EBB80FEB
2,下 BP GetModuleHandleA+5 按shift+F9运行,中断,注意堆栈的变化
77E5ACDE /0F84 37010000 je kernel32.77E5AE1B <<断在这里
77E5ACE4 |FF7424 04 push dword ptr ss:[esp+4]
77E5ACE8 |E8 F8050000 call kernel32.77E5B2E5
77E5ACED |85C0 test eax,eax
77E5ACEF |74 08 je short kernel32.77E5ACF9
77E5ACF1 |FF70 04 push dword ptr ds:[eax+4]
77E5ACF4 |E8 27060000 call kernel32.GetModuleHandleW
77E5ACF9 |C2 0400 retn 4
77E5ACFC > |55 push ebp
77E5ACFD |8BEC mov ebp,esp
此时堆栈如下:
0012FF10 006EB728 返回到 CSMSSXX5.006EB728 来自 kernel32.GetModuleHandleA
0012FF14 00000000
0012FF18 00000000
0012FF1C 00141F0F
0012FF20 0000000A
0012FF24 00000004
0012FF28 77E657D4 kernel32.77E657D4
0012FF2C 006EB660 CSMSSXX5.006EB660
0012FF30 0012BBB8
0012FF34 00141F0F
按shift+F9继续
堆栈如下:
0012CEA4 77C059FC 返回到 msvcrt.77C059FC 来自 kernel32.GetModuleHandleA
0012CEA8 77BE31AC ASCII "kernel32.dll"
0012CEAC 77C2CA20 msvcrt.77C2CA20
0012CEB0 00000000
0012CEB4 77BEE94F msvcrt.<ModuleEntryPoint>
0012CEB8 77F59A7B 返回到 ntdll.77F59A7B 来自 ntdll.77F78C4E
按shift+f9继续
0012CF68 772B6687 返回到 SHLWAPI.772B6687 来自 kernel32.GetModuleHandleA
0012CF6C 772A6BA8 ASCII "KERNEL32.DLL"
0012CF70 00000000
0012CF74 772A0000 SHLWAPI.772A0000
0012CF78 0012CFB4
0012CF7C 00000001
按shift+f9继续
0012CE90 770FB124 返回到 OLEAUT32.770FB124 来自 kernel32.GetModuleHandleA
0012CE94 771722E4 ASCII "KERNEL32.DLL"
0012CE98 770FAD56 返回到 OLEAUT32.770FAD56 来自 OLEAUT32.770FB119
0012CE9C 77172080 OLEAUT32.77172080
0012CEA0 000003E8
0012CEA4 770FB0CA 返回到 OLEAUT32.770FB0CA 来自 OLEAUT32.770FAD34
按shift+f9继续
0012CE8C 770FB124 返回到 OLEAUT32.770FB124 来自 kernel32.GetModuleHandleA
0012CE90 771722E4 ASCII "KERNEL32.DLL"
0012CE94 770FADAC 返回到 OLEAUT32.770FADAC 来自 OLEAUT32.770FB119
0012CE98 77172064 OLEAUT32.77172064
0012CE9C 000003E8
按shift+f9继续
0012D71C 006D65A3 返回到 CSMSSXX5.006D65A3 来自 kernel32.GetModuleHandleA
0012D720 00000000
0012D724 00000000
0012D728 00D96C55
0012D72C 00743B59 CSMSSXX5.00743B59
0012D730 00000000
0012D734 00721000 ASCII "PDATA000"
0012D738 77F79000 ntdll.77F79000
按shift+f9继续
00127CA8 00DB0C08 返回到 00DB0C08 来自 kernel32.GetModuleHandleA
00127CAC 00DC4D68 ASCII "kernel32.dll"
00127CB0 00DC5F58 ASCII "VirtualAlloc"
00127CB4 00000001
00127CB8 003C4C50
按shift+f9继续
00127CA8 00DB0C25 返回到 00DB0C25 来自 kernel32.GetModuleHandleA
00127CAC 00DC4D68 ASCII "kernel32.dll"
00127CB0 00DC5F4C ASCII "VirtualFree"
00127CB4 00000001
00127CB8 003C4C50
按shift+f9继续
00127A20 00D99905 返回到 00D99905 来自 kernel32.GetModuleHandleA
00127A24 00127B5C ASCII "kernel32.dll"
00127A28 00000000
00127A2C CF480000
00127A30 33190012
取消断点,现在就要到Magic Jmp 了,按ALT+F9返回
00D99905 8B0D 40A1DC00 mov ecx,dword ptr ds:[DCA140]<<返回到这里
00D9990B 89040E mov dword ptr ds:[esi+ecx],eax
00D9990E A1 40A1DC00 mov eax,dword ptr ds:[DCA140]
00D99913 393C06 cmp dword ptr ds:[esi+eax],edi
00D99916 75 16 jnz short 00D9992E
00D99918 8D85 B4FEFFFF lea eax,dword ptr ss:[ebp-14C]
00D9991E 50 push eax
00D9991F FF15 D4F0DB00 call dword ptr ds:[DBF0D4] ; kernel32.LoadLibraryA
00D99925 8B0D 40A1DC00 mov ecx,dword ptr ds:[DCA140]
00D9992B 89040E mov dword ptr ds:[esi+ecx],eax
00D9992E A1 40A1DC00 mov eax,dword ptr ds:[DCA140]
00D99933 393C06 cmp dword ptr ds:[esi+eax],edi
00D99936 0F84 AC000000 je 00D999E8<<这里就是Magic JMP,改为jmp 00D999E8
00D9993C 33C9 xor ecx,ecx
00D9993E 8B03 mov eax,dword ptr ds:[ebx]
00D99940 3938 cmp dword ptr ds:[eax],edi
00D99942 74 06 je short 00D9994A
00D99944 41 inc ecx
接下来ALT+M,打开内存映像,在地址为401000处下内存断点,按shift+f9直达OEP
0044A3B0 6A 60 push 60 <<来到这里
0044A3B2 68 50E94700 push CSMSSXX5.0047E950
0044A3B7 E8 FC070000 call CSMSSXX5.0044ABB8
0044A3BC BF 94000000 mov edi,94
0044A3C1 8BC7 mov eax,edi
0044A3C3 E8 48F2FFFF call CSMSSXX5.00449610
0044A3C8 8965 E8 mov dword ptr ss:[ebp-18],esp
0044A3CB 8BF4 mov esi,esp
0044A3CD 893E mov dword ptr ds:[esi],edi
0044A3CF 56 push esi
0044A3D0 FF15 44034700 call dword ptr ds:[470344] ; kernel32.GetVersionExA
0044A3D6 8B4E 10 mov ecx,dword ptr ds:[esi+10]
0044A3D9 890D 98F36B00 mov dword ptr ds:[6BF398],ecx
0044A3DF 8B46 04 mov eax,dword ptr ds:[esi+4]
0044A3E2 A3 A4F36B00 mov dword ptr ds:[6BF3A4],eax
0044A3E7 8B56 08 mov edx,dword ptr ds:[esi+8]
3,打开LordPE,完全Dump,打开importREC,OEP=4A3B0 得到IAT表,剪掉无用的指针修复刚刚脱壳的dumped.exe,成功
4,运行测试,问题来了:
AppName: dumped_.exe AppVer: 6.0.0.1 ModName: unknown
ModVer: 0.0.0.0 Offset: 00000000
5,这里我想问的是,我脱壳的过程有没有不对的地方, 还有,为什么无法运行.
请指教,谢谢
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
