1.第一层壳
用peid查加壳ASPack 2.12 -> Alexey Solodovnikov,用工具轻松脱壳。
2.第二层壳
(fly说是xIkUg的壳)
用peid查不出,用od手工脱壳。用peid可查出oep=636cec
用od载入,在636cec处直接下硬件断点,F9直接可到达OEP
经分析,该壳只是处理了相应的IAT-JMP,改为NOP,CALL 0032478
00032668 76 14 40 80 58 F2 65 00 6E 14 40 80 5C F2 65 00
00032678 66 14 40 80 60 F2 65 00 5E 14 40 80 64 F2 65 00
00032688 56 14 40 80 68 F2 65 00 4E 14 40 80 6C F2 65 00
00032698 46 14 40 80 70 F2 65 00 3E 14 40 80 74 F2 65 00
000326A8 12 14 40 80 78 F2 65 00 0A 14 40 80 7C F2 65 00
000326B8 02 14 40 80 80 F2 65 00 FA 13 40 80 84 F2 65 00
000326C8 F2 13 40 80 88 F2 65 00 EA 13 40 80 8C F2 65 00
000326D8 CA 13 40 80 90 F2 65 00 C2 13 40 80 94 F2 65 00
000326E8 BA 13 40 80 98 F2 65 00 9A 13 40 80 9C F2 65 00
000326F8 92 13 40 80 A0 F2 65 00 8A 13 40 80 A4 F2 65 00
00032708 7A 13 40 80 A8 F2 65 00 72 13 40 80 AC F2 65 00
00032718 6A 13 40 80 B0 F2 65 00 62 13 40 80 B4 F2 65 00
00032728 5A 13 40 80 B8 F2 65 00 52 13 40 80 BC F2 65 00
00032738 4A 13 40 80 C0 F2 65 00 42 13 40 80 C4 F2 65 00
00032748 3A 13 40 80 C8 F2 65 00 32 13 40 80 CC F2 65 00
00032758 2A 13 40 80 D0 F2 65 00 22 13 40 80 D4 F2 65 00
00032768 1A 13 40 80 D8 F2 65 00 0A 13 40 80 DC F2 65 00
00032778 02 13 40 80 E0 F2 65 00 FA 12 40 80 E4 F2 65 00
00032788 EA 12 40 80 E8 F2 65 00 E2 12 40 80 EC F2 65 00
00032798 DA 12 40 80 F0 F2 65 00 D2 12 40 80 F4 F2 65 00
000327A8 CA 12 40 80 F8 F2 65 00 C2 12 40 80 FC F2 65 00
000327B8 A6 30 40 80 FC F2 65 00 BA 12 40 80 00 F3 65 00
000327C8 B2 12 40 80 04 F3 65 00 AA 12 40 80 08 F3 65 00
000327D8 A2 12 40 80 0C F3 65 00 9A 12 40 80 10 F3 65 00
000327E8 92 12 40 80 14 F3 65 00 2A 3A 40 80 1C F3 65 00
000327F8 82 13 40 80 20 F3 65 00 12 13 40 80 24 F3 65 00
00032808 F2 12 40 80 28 F3 65 00 B2 13 40 80 30 F3 65 00
00032818 AA 13 40 80 34 F3 65 00 A2 13 40 80 38 F3 65 00
00032828 E2 13 40 80 40 F3 65 00 DA 13 40 80 44 F3 65 00
00032838 D2 13 40 80 48 F3 65 00 42 6E 40 80 50 F3 65 00
00032848 3A 6E 40 80 54 F3 65 00 32 6E 40 80 58 F3 65 00
00032858 2A 6E 40 80 5C F3 65 00 26 71 40 80 64 F3 65 00
00032868 1E 71 40 80 68 F3 65 00 16 71 40 80 6C F3 65 00
00032878 0E 71 40 80 70 F3 65 00 06 71 40 80 74 F3 65 00
00032888 66 74 40 80 7C F3 65 00 5E 74 40 80 80 F3 65 00
00032898 56 74 40 80 84 F3 65 00 4E 74 40 80 88 F3 65 00
000328A8 46 74 40 80 8C F3 65 00 3E 74 40 80 90 F3 65 00
000328B8 36 74 40 80 94 F3 65 00 2E 74 40 80 98 F3 65 00
000328C8 26 74 40 80 9C F3 65 00 1E 74 40 80 A0 F3 65 00
000328D8 16 74 40 80 A4 F3 65 00 0E 74 40 80 A8 F3 65 00
000328E8 06 74 40 80 AC F3 65 00 FE 73 40 80 B0 F3 65 00
000328F8 F6 73 40 80 B4 F3 65 00 EE 73 40 80 B8 F3 65 00
00032908 E6 73 40 80 BC F3 65 00 DE 73 40 80 C0 F3 65 00
00032918 D6 73 40 80 C4 F3 65 00 CE 73 40 80 C8 F3 65 00
00032928 C6 73 40 80 CC F3 65 00 BE 73 40 80 D0 F3 65 00
00032938 B6 73 40 80 D4 F3 65 00 AE 73 40 80 D8 F3 65 00
00032948 A6 73 40 80 DC F3 65 00 9E 73 40 80 E0 F3 65 00
00032958 96 73 40 80 E4 F3 65 00 8E 73 40 80 E8 F3 65 00
00032968 86 73 40 80 EC F3 65 00 7E 73 40 80 F0 F3 65 00
00032978 76 73 40 80 F4 F3 65 00 6E 73 40 80 F8 F3 65 00
00032988 66 73 40 80 FC F3 65 00 5E 73 40 80 00 F4 65 00
00032998 56 73 40 80 04 F4 65 00 4E 73 40 80 08 F4 65 00
000329A8 46 73 40 80 0C F4 65 00 3E 73 40 80 10 F4 65 00
000329B8 36 73 40 80 14 F4 65 00 2E 73 40 80 18 F4 65 00
000329C8 26 73 40 80 1C F4 65 00 1E 73 40 80 20 F4 65 00
000329D8 16 73 40 80 24 F4 65 00 0E 73 40 80 28 F4 65 00
000329E8 06 73 40 80 2C F4 65 00 FE 72 40 80 30 F4 65 00
000329F8 F6 72 40 80 34 F4 65 00 EE 72 40 80 38 F4 65 00
00032A08 E6 72 40 80 3C F4 65 00 DE 72 40 80 40 F4 65 00
00032A18 D6 72 40 80 44 F4 65 00 CE 72 40 80 48 F4 65 00
00032A28 C6 72 40 80 4C F4 65 00 BE 72 40 80 50 F4 65 00
00032A38 B6 72 40 80 54 F4 65 00 AE 72 40 80 58 F4 65 00
00032A48 A6 72 40 80 5C F4 65 00 9E 72 40 80 60 F4 65 00
00032A58 96 72 40 80 64 F4 65 00 8E 72 40 80 68 F4 65 00
00032A68 86 72 40 80 6C F4 65 00 7E 72 40 80 70 F4 65 00
00032A78 76 72 40 80 74 F4 65 00 6E 72 40 80 78 F4 65 00
00032A88 66 72 40 80 7C F4 65 00 5E 72 40 80 80 F4 65 00
00032A98 56 72 40 80 84 F4 65 00 4E 72 40 80 88 F4 65 00
00032AA8 46 72 40 80 8C F4 65 00 3E 72 40 80 90 F4 65 00
00032AB8 36 72 40 80 94 F4 65 00 2E 72 40 80 98 F4 65 00
00032AC8 26 72 40 80 9C F4 65 00 1E 72 40 80 A0 F4 65 00
00032AD8 16 72 40 80 A4 F4 65 00 0E 72 40 80 A8 F4 65 00
00032AE8 06 72 40 80 AC F4 65 00 FE 71 40 80 B0 F4 65 00
00032AF8 F6 71 40 80 B4 F4 65 00 EE 71 40 80 B8 F4 65 00
00032B08 E6 71 40 80 BC F4 65 00 DE 71 40 80 C0 F4 65 00
00032B18 D6 71 40 80 C4 F4 65 00 CE 71 40 80 C8 F4 65 00
00032B28 C6 71 40 80 CC F4 65 00 BE 71 40 80 D0 F4 65 00
00032B38 B6 71 40 80 D4 F4 65 00 AE 71 40 80 D8 F4 65 00
00032B48 A6 71 40 80 DC F4 65 00 9E 71 40 80 E0 F4 65 00
00032B58 96 71 40 80 E4 F4 65 00 8E 71 40 80 E8 F4 65 00
00032B68 86 71 40 80 EC F4 65 00 7E 71 40 80 F0 F4 65 00
00032B78 76 71 40 80 F4 F4 65 00 6E 71 40 80 F8 F4 65 00
00032B88 66 71 40 80 FC F4 65 00 56 71 40 80 00 F5 65 00
00032B98 5E 71 40 80 00 F5 65 00 4E 71 40 80 04 F5 65 00
00032BA8 46 71 40 80 08 F5 65 00 3E 71 40 80 0C F5 65 00
00032BB8 36 71 40 80 10 F5 65 00 2E 71 40 80 14 F5 65 00
00032BC8 86 74 40 80 1C F5 65 00 7E 74 40 80 20 F5 65 00
00032BD8 76 74 40 80 24 F5 65 00 6E 74 40 80 28 F5 65 00
00032BE8 9E 74 40 80 30 F5 65 00 96 74 40 80 34 F5 65 00
00032BF8 8E 74 40 80 38 F5 65 00 9E 77 40 80 40 F5 65 00
00032C08 96 77 40 80 44 F5 65 00 8E 77 40 80 48 F5 65 00
00032C18 86 77 40 80 4C F5 65 00 7E 77 40 80 50 F5 65 00
00032C28 76 77 40 80 54 F5 65 00 6E 77 40 80 58 F5 65 00
00032C38 66 77 40 80 5C F5 65 00 5E 77 40 80 60 F5 65 00
00032C48 56 77 40 80 64 F5 65 00 4E 77 40 80 68 F5 65 00
00032C58 46 77 40 80 6C F5 65 00 3E 77 40 80 70 F5 65 00
00032C68 36 77 40 80 74 F5 65 00 2E 77 40 80 78 F5 65 00
00032C78 26 77 40 80 7C F5 65 00 1E 77 40 80 80 F5 65 00
00032C88 16 77 40 80 84 F5 65 00 0E 77 40 80 88 F5 65 00
00032C98 06 77 40 80 8C F5 65 00 FE 76 40 80 90 F5 65 00
00032CA8 F6 76 40 80 94 F5 65 00 EE 76 40 80 98 F5 65 00
00032CB8 E6 76 40 80 9C F5 65 00 DE 76 40 80 A0 F5 65 00
00032CC8 D6 76 40 80 A4 F5 65 00 CE 76 40 80 A8 F5 65 00
00032CD8 C6 76 40 80 AC F5 65 00 BE 76 40 80 B0 F5 65 00
00032CE8 B6 76 40 80 B4 F5 65 00 AE 76 40 80 B8 F5 65 00
00032CF8 A6 76 40 80 BC F5 65 00 9E 76 40 80 C0 F5 65 00
00032D08 96 76 40 80 C4 F5 65 00 8E 76 40 80 C8 F5 65 00
00032D18 86 76 40 80 CC F5 65 00 7E 76 40 80 D0 F5 65 00
00032D28 76 76 40 80 D4 F5 65 00 6E 76 40 80 D8 F5 65 00
00032D38 66 76 40 80 DC F5 65 00 5E 76 40 80 E0 F5 65 00
00032D48 56 76 40 80 E4 F5 65 00 4E 76 40 80 E8 F5 65 00
00032D58 46 76 40 80 EC F5 65 00 3E 76 40 80 F0 F5 65 00
00032D68 36 76 40 80 F4 F5 65 00 2E 76 40 80 F8 F5 65 00
00032D78 26 76 40 80 FC F5 65 00 1E 76 40 80 00 F6 65 00
00032D88 16 76 40 80 04 F6 65 00 0E 76 40 80 08 F6 65 00
00032D98 06 76 40 80 0C F6 65 00 FE 75 40 80 10 F6 65 00
00032DA8 F6 75 40 80 14 F6 65 00 EE 75 40 80 18 F6 65 00
00032DB8 E6 75 40 80 1C F6 65 00 DE 75 40 80 20 F6 65 00
00032DC8 D6 75 40 80 24 F6 65 00 CE 75 40 80 28 F6 65 00
00032DD8 C6 75 40 80 2C F6 65 00 BE 75 40 80 30 F6 65 00
00032DE8 B6 75 40 80 34 F6 65 00 AE 75 40 80 38 F6 65 00
00032DF8 A6 75 40 80 3C F6 65 00 9E 75 40 80 40 F6 65 00
00032E08 96 75 40 80 44 F6 65 00 8E 75 40 80 48 F6 65 00
00032E18 86 75 40 80 4C F6 65 00 7E 75 40 80 50 F6 65 00
00032E28 76 75 40 80 54 F6 65 00 6E 75 40 80 58 F6 65 00
00032E38 66 75 40 80 5C F6 65 00 5E 75 40 80 60 F6 65 00
00032E48 56 75 40 80 64 F6 65 00 4E 75 40 80 68 F6 65 00
00032E58 46 75 40 80 6C F6 65 00 3E 75 40 80 70 F6 65 00
00032E68 36 75 40 80 74 F6 65 00 2E 75 40 80 78 F6 65 00
00032E78 26 75 40 80 7C F6 65 00 1E 75 40 80 80 F6 65 00
00032E88 16 75 40 80 84 F6 65 00 0E 75 40 80 88 F6 65 00
00032E98 06 75 40 80 8C F6 65 00 FE 74 40 80 90 F6 65 00
00032EA8 F6 74 40 80 94 F6 65 00 EE 74 40 80 98 F6 65 00
00032EB8 E6 74 40 80 9C F6 65 00 DE 74 40 80 A0 F6 65 00
00032EC8 D6 74 40 80 A4 F6 65 00 CE 74 40 80 A8 F6 65 00
00032ED8 C6 74 40 80 AC F6 65 00 BE 74 40 80 B0 F6 65 00
00032EE8 B6 74 40 80 B4 F6 65 00 AE 74 40 80 B8 F6 65 00
00032EF8 A6 74 40 80 BC F6 65 00 CE 7E 40 80 C4 F6 65 00
00032F08 D6 7D 40 80 C8 F6 65 00 CE 7D 40 80 CC F6 65 00
00032F18 C6 7D 40 80 D0 F6 65 00 BE 7D 40 80 D4 F6 65 00
00032F28 B6 7D 40 80 D8 F6 65 00 AE 7D 40 80 DC F6 65 00
00032F38 A6 7D 40 80 E0 F6 65 00 9E 7D 40 80 E4 F6 65 00
00032F48 96 7D 40 80 E8 F6 65 00 8E 7D 40 80 EC F6 65 00
00032F58 86 7D 40 80 F0 F6 65 00 7E 7D 40 80 F4 F6 65 00
00032F68 76 7D 40 80 F8 F6 65 00 6E 7D 40 80 FC F6 65 00
00032F78 66 7D 40 80 00 F7 65 00 5E 7D 40 80 04 F7 65 00
00032F88 56 7D 40 80 08 F7 65 00 4E 7D 40 80 0C F7 65 00
00032F98 46 7D 40 80 10 F7 65 00 3E 7D 40 80 14 F7 65 00
00032FA8 36 7D 40 80 18 F7 65 00 2E 7D 40 80 1C F7 65 00
00032FB8 26 7D 40 80 20 F7 65 00 1E 7D 40 80 24 F7 65 00
00032FC8 16 7D 40 80 28 F7 65 00 0E 7D 40 80 2C F7 65 00
00032FD8 06 7D 40 80 30 F7 65 00 FE 7C 40 80 34 F7 65 00
00032FE8 F6 7C 40 80 38 F7 65 00 EE 7C 40 80 3C F7 65 00
00032FF8 E6 7C 40 80 40 F7 65 00 DE 7C 40 80 44 F7 65 00
00033008 D6 7C 40 80 48 F7 65 00 CE 7C 40 80 4C F7 65 00
00033018 C6 7C 40 80 50 F7 65 00 BE 7C 40 80 54 F7 65 00
00033028 B6 7C 40 80 58 F7 65 00 AE 7C 40 80 5C F7 65 00
00033038 A6 7C 40 80 60 F7 65 00 9E 7C 40 80 64 F7 65 00
00033048 96 7C 40 80 68 F7 65 00 8E 7C 40 80 6C F7 65 00
00033058 86 7C 40 80 70 F7 65 00 7E 7C 40 80 74 F7 65 00
00033068 76 7C 40 80 78 F7 65 00 6E 7C 40 80 7C F7 65 00
00033078 66 7C 40 80 80 F7 65 00 5E 7C 40 80 84 F7 65 00
00033088 56 7C 40 80 88 F7 65 00 4E 7C 40 80 8C F7 65 00
00033098 46 7C 40 80 90 F7 65 00 3E 7C 40 80 94 F7 65 00
000330A8 36 7C 40 80 98 F7 65 00 2E 7C 40 80 9C F7 65 00
000330B8 26 7C 40 80 A0 F7 65 00 1E 7C 40 80 A4 F7 65 00
000330C8 16 7C 40 80 A8 F7 65 00 0E 7C 40 80 AC F7 65 00
000330D8 06 7C 40 80 B0 F7 65 00 FE 7B 40 80 B4 F7 65 00
000330E8 F6 7B 40 80 B8 F7 65 00 EE 7B 40 80 BC F7 65 00
000330F8 E6 7B 40 80 C0 F7 65 00 DE 7B 40 80 C4 F7 65 00
00033108 D6 7B 40 80 C8 F7 65 00 CE 7B 40 80 CC F7 65 00
00033118 C6 7B 40 80 D0 F7 65 00 BE 7B 40 80 D4 F7 65 00
00033128 B6 7B 40 80 D8 F7 65 00 AE 7B 40 80 DC F7 65 00
00033138 A6 7B 40 80 E0 F7 65 00 9E 7B 40 80 E4 F7 65 00
00033148 96 7B 40 80 E8 F7 65 00 8E 7B 40 80 EC F7 65 00
00033158 86 7B 40 80 F0 F7 65 00 7E 7B 40 80 F4 F7 65 00
00033168 76 7B 40 80 F8 F7 65 00 6E 7B 40 80 FC F7 65 00
00033178 66 7B 40 80 00 F8 65 00 5E 7B 40 80 04 F8 65 00
00033188 56 7B 40 80 08 F8 65 00 4E 7B 40 80 0C F8 65 00
00033198 46 7B 40 80 10 F8 65 00 3E 7B 40 80 14 F8 65 00
000331A8 36 7B 40 80 18 F8 65 00 2E 7B 40 80 1C F8 65 00
000331B8 26 7B 40 80 20 F8 65 00 1E 7B 40 80 24 F8 65 00
000331C8 16 7B 40 80 28 F8 65 00 0E 7B 40 80 2C F8 65 00
000331D8 06 7B 40 80 30 F8 65 00 FE 7A 40 80 34 F8 65 00
000331E8 F6 7A 40 80 38 F8 65 00 EE 7A 40 80 3C F8 65 00
000331F8 DE 7A 40 80 40 F8 65 00 E6 7A 40 80 40 F8 65 00
00033208 D6 7A 40 80 44 F8 65 00 CE 7A 40 80 48 F8 65 00
00033218 C6 7A 40 80 4C F8 65 00 BE 7A 40 80 50 F8 65 00
00033228 B6 7A 40 80 54 F8 65 00 AE 7A 40 80 58 F8 65 00
00033238 A6 7A 40 80 5C F8 65 00 9E 7A 40 80 60 F8 65 00
00033248 8E 7A 40 80 64 F8 65 00 86 7A 40 80 68 F8 65 00
00033258 7E 7A 40 80 6C F8 65 00 76 7A 40 80 70 F8 65 00
00033268 6E 7A 40 80 74 F8 65 00 66 7A 40 80 78 F8 65 00
00033278 5E 7A 40 80 7C F8 65 00 56 7A 40 80 80 F8 65 00
00033288 4E 7A 40 80 84 F8 65 00 46 7A 40 80 88 F8 65 00
00033298 3E 7A 40 80 8C F8 65 00 36 7A 40 80 90 F8 65 00
000332A8 2E 7A 40 80 94 F8 65 00 96 7A 40 80 94 F8 65 00
000332B8 26 7A 40 80 98 F8 65 00 1E 7A 40 80 9C F8 65 00
000332C8 16 7A 40 80 A0 F8 65 00 0E 7A 40 80 A4 F8 65 00
000332D8 06 7A 40 80 A8 F8 65 00 FE 79 40 80 AC F8 65 00
000332E8 F6 79 40 80 B0 F8 65 00 EE 79 40 80 B4 F8 65 00
000332F8 E6 79 40 80 B8 F8 65 00 DE 79 40 80 BC F8 65 00
00033308 D6 79 40 80 C0 F8 65 00 CE 79 40 80 C4 F8 65 00
00033318 C6 79 40 80 C8 F8 65 00 BE 79 40 80 CC F8 65 00
00033328 B6 79 40 80 D0 F8 65 00 AE 79 40 80 D4 F8 65 00
00033338 A6 79 40 80 D8 F8 65 00 9E 79 40 80 DC F8 65 00
00033348 96 79 40 80 E0 F8 65 00 8E 79 40 80 E4 F8 65 00
00033358 86 79 40 80 E8 F8 65 00 7E 79 40 80 EC F8 65 00
00033368 76 79 40 80 F0 F8 65 00 6E 79 40 80 F4 F8 65 00
00033378 66 79 40 80 F8 F8 65 00 5E 79 40 80 FC F8 65 00
00033388 56 79 40 80 00 F9 65 00 4E 79 40 80 04 F9 65 00
00033398 46 79 40 80 08 F9 65 00 3E 79 40 80 0C F9 65 00
000333A8 36 79 40 80 10 F9 65 00 2E 79 40 80 14 F9 65 00
000333B8 26 79 40 80 18 F9 65 00 1E 79 40 80 1C F9 65 00
000333C8 16 79 40 80 20 F9 65 00 0E 79 40 80 24 F9 65 00
000333D8 06 79 40 80 28 F9 65 00 FE 78 40 80 2C F9 65 00
000333E8 F6 78 40 80 30 F9 65 00 EE 78 40 80 34 F9 65 00
000333F8 E6 78 40 80 38 F9 65 00 DE 78 40 80 3C F9 65 00
00033408 D6 78 40 80 40 F9 65 00 CE 78 40 80 44 F9 65 00
00033418 BE 78 40 80 48 F9 65 00 C6 78 40 80 48 F9 65 00
00033428 B6 78 40 80 4C F9 65 00 AE 78 40 80 50 F9 65 00
00033438 A6 78 40 80 54 F9 65 00 9E 78 40 80 58 F9 65 00
00033448 96 78 40 80 5C F9 65 00 8E 78 40 80 60 F9 65 00
00033458 86 78 40 80 64 F9 65 00 7E 78 40 80 68 F9 65 00
00033468 76 78 40 80 6C F9 65 00 6E 78 40 80 70 F9 65 00
00033478 66 78 40 80 74 F9 65 00 5E 78 40 80 78 F9 65 00
00033488 56 78 40 80 7C F9 65 00 4E 78 40 80 80 F9 65 00
00033498 46 78 40 80 84 F9 65 00 3E 78 40 80 88 F9 65 00
000334A8 36 78 40 80 8C F9 65 00 2E 78 40 80 90 F9 65 00
000334B8 26 78 40 80 94 F9 65 00 1E 78 40 80 98 F9 65 00
000334C8 16 78 40 80 9C F9 65 00 0E 78 40 80 A0 F9 65 00
000334D8 06 78 40 80 A4 F9 65 00 FE 77 40 80 A8 F9 65 00
000334E8 F6 77 40 80 AC F9 65 00 CE 77 40 80 B0 F9 65 00
000334F8 C6 77 40 80 B4 F9 65 00 BE 77 40 80 B8 F9 65 00
00033508 DE 77 40 80 BC F9 65 00 D6 77 40 80 C0 F9 65 00
00033518 B6 77 40 80 C4 F9 65 00 EE 77 40 80 C8 F9 65 00
00033528 E6 77 40 80 CC F9 65 00 AE 77 40 80 D0 F9 65 00
00033538 A6 77 40 80 D4 F9 65 00 4E EB 40 80 DC F9 65 00
00033548 A2 FB 40 80 E4 F9 65 00 9A FB 40 80 E8 F9 65 00
00033558 92 FB 40 80 EC F9 65 00 8A FB 40 80 F0 F9 65 00
00033568 3E F7 40 80 F4 F9 65 00 36 F7 40 80 F8 F9 65 00
00033578 2E F7 40 80 FC F9 65 00 26 F7 40 80 00 FA 65 00
00033588 9A 7A 41 80 08 FA 65 00 92 7A 41 80 0C FA 65 00
00033598 8A 7A 41 80 10 FA 65 00 82 7A 41 80 14 FA 65 00
000335A8 AA 7A 41 80 1C FA 65 00 A2 7A 41 80 20 FA 65 00
000335B8 0A FA 42 80 28 FA 65 00 02 FA 42 80 2C FA 65 00
000335C8 FA F9 42 80 30 FA 65 00 F2 F9 42 80 34 FA 65 00
000335D8 EA F9 42 80 38 FA 65 00 E2 F9 42 80 3C FA 65 00
000335E8 DA F9 42 80 40 FA 65 00 D2 F9 42 80 44 FA 65 00
000335F8 CA F9 42 80 48 FA 65 00 C2 F9 42 80 4C FA 65 00
00033608 BA F9 42 80 50 FA 65 00 B2 F9 42 80 54 FA 65 00
00033618 AA F9 42 80 58 FA 65 00 A2 F9 42 80 5C FA 65 00
00033628 9A F9 42 80 60 FA 65 00 92 F9 42 80 64 FA 65 00
00033638 8A F9 42 80 68 FA 65 00 72 F9 42 80 6C FA 65 00
00033648 6A F9 42 80 70 FA 65 00 62 F9 42 80 74 FA 65 00
00033658 5A F9 42 80 78 FA 65 00 52 F9 42 80 7C FA 65 00
00033668 4A F9 42 80 80 FA 65 00 42 F9 42 80 84 FA 65 00
00033678 A6 F8 42 80 88 FA 65 00 82 19 43 80 90 FA 65 00
00033688 7A 19 43 80 94 FA 65 00 72 19 43 80 98 FA 65 00
00033698 6A 19 43 80 9C FA 65 00 72 35 43 80 A4 FA 65 00
000336A8 6A 35 43 80 A8 FA 65 00 62 35 43 80 AC FA 65 00
000336B8 EA 35 43 80 B4 FA 65 00 12 37 43 80 BC FA 65 00
000336C8 0A 37 43 80 C0 FA 65 00 02 37 43 80 C4 FA 65 00
000336D8 9E 07 49 80 CC FA 65 00 96 07 49 80 D0 FA 65 00
000336E8 DA 08 49 80 D8 FA 65 00 8E C9 50 80 E0 FA 65 00
000336F8 86 C9 50 80 E4 FA 65 00 7E C9 50 80 E8 FA 65 00
00033708 8A 06 53 80 F0 FA 65 00 82 06 53 80 F4 FA 65 00
00033718 7A 06 53 80 F8 FA 65 00 72 06 53 80 FC FA 65 00
00033728 6A 06 53 80 00 FB 65 00 62 06 53 80 04 FB 65 00
00033738 5A 06 53 80 08 FB 65 00 52 06 53 80 0C FB 65 00
00033748 4A 06 53 80 10 FB 65 00 42 06 53 80 14 FB 65 00
00033758 3A 06 53 80 18 FB 65 00 76 43 5A 80 20 FB 65 00
00033768 6E 43 5A 80 24 FB 65 00 66 43 5A 80 28 FB 65 00
00033778 D6 EE 5E 80 30 FB 65 00 CE EE 5E 80 34 FB 65 00
00033788 C6 EE 5E 80 38 FB 65 00 BE EE 5E 80 3C FB 65 00
00033798 96 4A 60 80 44 FB 65 00 8E 4A 60 80 48 FB 65 00
000337A8 8A 55 60 80 50 FB 65 00 82 55 60 80 54 FB 65 00
000337B8 7A 55 60 80 58 FB 65 00 72 55 60 80 5C FB 65 00
000337C8 6A 55 60 80 60 FB 65 00 62 55 60 80 64 FB 65 00
000337D8 5A 55 60 80 68 FB 65 00 52 55 60 80 6C FB 65 00
000337E8 4A 55 60 80 70 FB 65 00 42 55 60 80 74 FB 65 00
000337F8 3A 55 60 80 78 FB 65 00 32 55 60 80 7C FB 65 00
00033808 2A 55 60 80 80 FB 65 00 22 55 60 80 84 FB 65 00
00033818 1A 55 60 80 88 FB 65 00 12 55 60 80 8C FB 65 00
00033828 0A 55 60 80 90 FB 65 00 02 55 60 80 94 FB 65 00
00033838 FA 54 60 80 98 FB 65 00 F2 54 60 80 9C FB 65 00
00033848 EA 54 60 80 A0 FB 65 00 E2 54 60 80 A4 FB 65 00
00033858 DA 54 60 80 A8 FB 65 00 D2 54 60 80 AC FB 65 00
00033868 CA 54 60 80 B0 FB 65 00 C2 54 60 80 B4 FB 65 00
00033878 BA 54 60 80 B8 FB 65 00 B2 54 60 80 BC FB 65 00
00033888 AA 54 60 80 C0 FB 65 00 A2 54 60 80 C4 FB 65 00
00033898 9A 54 60 80 C8 FB 65 00 92 54 60 80 CC FB 65 00
000338A8 8A 54 60 80 D0 FB 65 00 82 54 60 80 D4 FB 65 00
000338B8 7A 54 60 80 D8 FB 65 00 72 54 60 80 DC FB 65 00
000338C8 6A 54 60 80 E0 FB 65 00 FA 55 60 80 E8 FB 65 00
000338D8 F2 55 60 80 EC FB 65 00 EA 55 60 80 F0 FB 65 00
000338E8 E2 55 60 80 F4 FB 65 00 DA 55 60 80 F8 FB 65 00
000338F8 D2 55 60 80 FC FB 65 00 CA 55 60 80 00 FC 65 00
上面数据区就是加壳后处理计算还原JMP代码的关键数据表
我们跟随一个CALL调用
00406E24 90 nop
00406E25 E8 4EB6C2FF call 00032478
00406E2A 8BC0 mov eax,eax
00406E2C 90 nop
00406E2D E8 46B6C2FF call 00032478
00406E32 8BC0 mov eax,eax
00406E34 90 nop
00406E35 E8 3EB6C2FF call 00032478
00406E3A 8BC0 mov eax,eax
00406E3C 90 nop
00406E3D E8 36B6C2FF call 00032478
00406E24 90E84EB6C2FF 这里原来应该是IAT的JMP代码FF25XXXXXXXX
我们注意406E2A这个数据,在上面关键数据表中搜索2A6E40,在00032858处找到
那么0003285C保存的四字节数5C F3 65 00就是XXXXXXXX
那么原来00406E24的数据就是FF255CF36500,0065F35C--〉IAT表
逐一恢复所有的nop call 0032478,就可还原出原代码,再用lpe和importrec工具
就可完成脱壳。
3.破解
具体可以参考fly的3.8.2版,稍有不同就是水印字的去除有所变化,作者将字符做了base64加密处理,容易找到。
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)