有一个程序用PEiD查为：
Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks
用FI查为:
Armadillo 4.00<glue> SRT
使用OD载入:
00691B53 >/$ 55 push ebp
00691B54 |. 8BEC mov ebp, esp
00691B56 |. 6A FF push -1
00691B58 |. 68 F8BE6B00 push 006BBEF8
00691B5D |. 68 90186900 push 00691890 ; SE 处理程序安装
00691B62 |. 64:A1 0000000>mov eax, fs:[0]
00691B68 |. 50 push eax
00691B69 |. 64:8925 00000>mov fs:[0], esp
00691B70 |. 83EC 58 sub esp, 58
00691B73 |. 53 push ebx
00691B74 |. 56 push esi
00691B75 |. 57 push edi
00691B76 |. 8965 E8 mov [ebp-18], esp
00691B79 |. FF15 88616B00 call [<&KERNEL32.GetVersion>] ; kernel32.GetVersion
首先：he GetModuleHandleA下断点，下面是堆栈：
0012FF38 00691C1B /CALL 到 GetModuleHandleA 来自 iccavrid.00691C15
0012FF3C 00000000 \pModule = NULL
0012CE78 5D175394 /CALL 到 GetModuleHandleA 来自 5D17538E
0012CE7C 5D1753E0 \pModule = "kernel32.dll"
0012CF3A 501C77F4 /CALL 到 GetModuleHandleA 来自 SHLWAPI.77F45BD2
0012CF3E 000177F4 \pModule = "KERNEL32.DLL"
0012D750 0067C8B3 /CALL 到 GetModuleHandleA 来自 iccavrid.0067C8AD
0012D754 00000000 \pModule = NULL
00127980 00E45837 /CALL 到 GetModuleHandleA 来自 00E45831
00127984 00E59BAC \pModule = "kernel32.dll"
00127988 00E5AE48 ASCII "VirtualAlloc"
00127980 00E45854 /CALL 到 GetModuleHandleA 来自 00E4584E
00127984 00E59BAC \pModule = "kernel32.dll"
00127988 00E5AE3C ASCII "VirtualFree"
001276E4 00E35252 /CALL 到 GetModuleHandleA 来自 00E3524C
001276E8 00127834 \pModule = "kernel32.dll"
此时清除断点，ALT+F9返回
00E35252 8B0D 3C1EE600 mov ecx, [E61E3C]
00E35258 89040E mov [esi+ecx], eax
00E3525B A1 3C1EE600 mov eax, [E61E3C]
00E35260 391C06 cmp [esi+eax], ebx
00E35263 75 16 jnz short 00E3527B
00E35265 8D85 B4FEFFFF lea eax, [ebp-14C]
00E3526B 50 push eax
00E3526C FF15 B842E500 call [E542B8] ; kernel32.LoadLibraryA
00E35272 8B0D 3C1EE600 mov ecx, [E61E3C]
00E35278 89040E mov [esi+ecx], eax
00E3527B A1 3C1EE600 mov eax, [E61E3C]
00E35280 391C06 cmp [esi+eax], ebx
00E35283 0F84 2F010000 je 00E353B8 ; Magic jump
00E35289 33C9 xor ecx, ecx
00E3528B 8B07 mov eax, [edi]
00E3528D 3918 cmp [eax], ebx
00E3528F 74 06 je short 00E35297
将00E35283 0F84 2F010000 je 00E353B8 ; Magic jump
改为jmp 00E353B8
下BP GetCurrentThreadId 断点
00126FA4 73391E36 /CALL 到 GetCurrentThreadId 来自 73391E30
00126FA8 00000001
00126F84 7339353F /CALL 到 GetCurrentThreadId 来自 73393539
00126F88 00000000
0012722C 01A516BC /CALL 到 GetCurrentThreadId 来自 DlPortIO.01A516B6
00127230 00000000
00127190 01A76990 /CALL 到 GetCurrentThreadId 来自 WWHAPI.01A7698A
00127194 00000A28
00127170 01A75EDA /CALL 到 GetCurrentThreadId 来自 WWHAPI.01A75ED4
00127174 01A7E004 WWHAPI.01A7E004
0012D794 00E3561E /CALL 到 GetCurrentThreadId 来自 00E35618
0012D798 00000000
清除断点，按ALT+F9返回：
00E3561E 50 push eax
00E3561F FF75 FC push dword ptr [ebp-4]
00E35622 E8 05000000 call 00E3562C
00E35627 83C4 0C add esp, 0C
00E3562A C9 leave
00E3562B C3 retn
然后F8单步
00E4DD90 6A 00 push 0
00E4DD92 E8 79D8FEFF call 00E3B610
00E4DD97 59 pop ecx
00E4DD98 BF 68D9E500 mov edi, 0E5D968
00E4DD9D 8BCF mov ecx, edi
00E4DD9F E8 32A4FDFF call 00E281D6
00E4DDA4 84C0 test al, al
00E4DDA6 75 09 jnz short 00E4DDB1
00E4DDA8 6A 01 push 1
00E4DDAA 8BCF mov ecx, edi
00E4DDAC E8 66F3FDFF call 00E2D117
00E4DDB1 B9 D0CCE500 mov ecx, 0E5CCD0
00E4DDB6 C705 70A0E500 5>mov dword ptr [E5A070], 0E5AF>
00E4DDC0 E8 A6F2FFFF call 00E4D06B
00E4DDC5 6A 00 push 0
00E4DDC7 E8 9FF2FFFF call 00E4D06B
00E4DDCC A1 B0DFE500 mov eax, [E5DFB0]
00E4DDD1 59 pop ecx
00E4DDD2 8B16 mov edx, [esi]
00E4DDD4 8B48 70 mov ecx, [eax+70]
00E4DDD7 3348 4C xor ecx, [eax+4C]
00E4DDDA 3348 24 xor ecx, [eax+24]
00E4DDDD 030D C8DFE500 add ecx, [E5DFC8] ; iccavrid.00400000
00E4DDE3 85D2 test edx, edx
00E4DDE5 75 18 jnz short 00E4DDFF
00E4DDE7 8B50 74 mov edx, [eax+74]
00E4DDEA FF76 18 push dword ptr [esi+18]
00E4DDED 3350 4C xor edx, [eax+4C]
00E4DDF0 FF76 14 push dword ptr [esi+14]
00E4DDF3 3350 28 xor edx, [eax+28]
00E4DDF6 FF76 10 push dword ptr [esi+10]
00E4DDF9 2BCA sub ecx, edx
00E4DDFB FFD1 call ecx
00E4DDFD EB 1D jmp short 00E4DE1C
00E4DDFF 83FA 01 cmp edx, 1
00E4DE02 75 1A jnz short 00E4DE1E
00E4DE04 FF76 04 push dword ptr [esi+4]
00E4DE07 8B50 74 mov edx, [eax+74]
00E4DE0A 3350 4C xor edx, [eax+4C]
00E4DE0D FF76 08 push dword ptr [esi+8]
00E4DE10 3350 28 xor edx, [eax+28]
00E4DE13 6A 00 push 0
00E4DE15 FF76 0C push dword ptr [esi+C]
00E4DE18 2BCA sub ecx, edx
00E4DE1A FFD1 call ecx ;此处F7进入 ECX=00401000
00E4DE1C 8BD8 mov ebx, eax
00E4DE1E 5F pop edi
00E4DE1F 8BC3 mov eax, ebx
00E4DE21 5E pop esi
00E4DE22 5B pop ebx
00E4DE23 C3 retn
进入想象中的OEP：
00401000 A1 10E65600 mov eax, [56E610]
00401005 C1E0 02 shl eax, 2
00401008 A3 14E65600 mov [56E614], eax
0040100D 57 push edi
0040100E 51 push ecx
0040100F 33C0 xor eax, eax
00401011 BF F8E95800 mov edi, 0058E9F8
00401016 B9 08555B00 mov ecx, 005B5508
0040101B 3BCF cmp ecx, edi
0040101D 76 05 jbe short 00401024
0040101F 2BCF sub ecx, edi
00401021 FC cld
00401022 F3:AA rep stos byte ptr es:[edi]
00401024 59 pop ecx
00401025 5F pop edi
00401026 52 push edx
00401027 6A 00 push 0
00401029 E8 42C21600 call 0056D270 ; jmp 到 kernel32.GetModuleHandleA
0040102E 8BD0 mov edx, eax
00401030 E8 23EC1500 call 0055FC58
00401035 5A pop edx
00401036 6A 00 push 0
00401038 E8 FBFC1500 call 00560D38
0040103D 59 pop ecx
0040103E 68 D8E55600 push 0056E5D8
00401043 6A 00 push 0
00401045 E8 26C21600 call 0056D270 ; jmp 到 kernel32.GetModuleHandleA
0040104A A3 18E65600 mov [56E618], eax
0040104F 6A 00 push 0
请问各位，这个是OEP吗?是否还有第二层壳?
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
