PESPIN v0.7脱壳(完结篇)
【目 标】: win98’s notepad和自己随便写的一个masm程序
【工 具】:Olydbg1.1
【任 务】:完成上篇文章里没有完成的任务脱壳and修复
【操作平台】:WINXP pro sp1
【作 者】:loveboom[DFCG][FCG]
【相关链接】: 见附见
【简要说明】:看过我上篇关于脱pespin 的文章就知道我上次只做了一半的工作,所以我们这次的任务是脱衣+说服”她”(修复)。
【详细过程】:
上次我们说怎么到关键代码处,所以这里不再多讲了,如果你没看过的话,可以先去看看我的上篇文章,话说通过上一篇我们到了关键代码处(这次的程序和上次不同,不过关键代码是一样的,LoadLibraryA断后,来到了这里:
0040C887 60 [color=#0000D0]PUSHAD[/color] [color=#008000];最后到了这里[/color]
0040C888 EB 04 [color=#0000D0]JMP[/color] SHORT VC.0040C88E
0040C88A CB [color=#0000D0]RETF[/color] [color=#008000]; Far return[/color]
0040C88B EB 04 [color=#0000D0]JMP[/color] SHORT VC.0040C891
0040C918 8BBD 792B4000 [color=#0000D0]MOV[/color] [color=#FF0000]EDI[/color],[color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]SS[/color]:[[color=#FF0000]EBP[/color]+402B79]
0040C91E 3BC7 [color=#0000D0]CMP[/color] [color=#FF0000]EAX[/color],[color=#FF0000]EDI[/color]
0040C920 76 35 [color=#0000D0]JBE[/color] SHORT VC.0040C957
[color=#008000];找到这里后,改成jmp xxxx[/color]
0040C922 03BD 7D2B4000 [color=#0000D0]ADD[/color] [color=#FF0000]EDI[/color],[color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]SS[/color]:[[color=#FF0000]EBP[/color]+402B7D]
……
0040C950 50 [color=#0000D0]PUSH[/color] [color=#FF0000]EAX[/color]
0040C951 FF95 C4394000 [color=#0000D0]CALL[/color] [color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]SS[/color]:[[color=#FF0000]EBP[/color]+4039C4]
0040C957 EB 01 [color=#0000D0]JMP[/color] SHORT VC.0040C95A
0040C959 90 [color=#0000D0]NOP[/color]
0040C95A 894424 1C [color=#0000D0]MOV[/color] [color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]SS[/color]:[[color=#FF0000]ESP[/color]+1C],[color=#FF0000]EAX[/color]
[color=#008000];这里改成 mov ss:[edx],eax,移入正确的函数[/color]
0040C95E 61 [color=#0000D0]POPAD[/color]
0040C962 0BC0 [color=#0000D0]OR[/color] [color=#FF0000]EAX[/color],[color=#FF0000]EAX[/color]
0040C964 C3 [color=#0000D0]RETN[/color] [color=#008000];这里就是Ret[/color]
0040C965 EB 01 [color=#0000D0]JMP[/color] SHORT VC.0040C968
0040C967 90 [color=#0000D0]NOP[/color]
0040C968 57 [color=#0000D0]PUSH[/color] [color=#FF0000]EDI[/color]
0040C969 51 [color=#0000D0]PUSH[/color] [color=#FF0000]ECX[/color]
0040C96A 90 [color=#0000D0]NOP[/color]
0040C96B 90 [color=#0000D0]NOP[/color]
0040C96C 90 [color=#0000D0]NOP[/color]
0040C96D 90 [color=#0000D0]NOP[/color]
0040C96E 90 [color=#0000D0]NOP[/color]
0040C96F 90 [color=#0000D0]NOP[/color]
0040C970 90 [color=#0000D0]NOP[/color]
0040C971 90 [color=#0000D0]NOP[/color]
0040C972 90 [color=#0000D0]NOP[/color]
0040C973 BF 4FE24000 [color=#0000D0]MOV[/color] [color=#FF0000]EDI[/color],VC.0040E24F
0040C978 EB 01 [color=#0000D0]JMP[/color] SHORT VC.0040C97B
0040C97A 90 [color=#0000D0]NOP[/color]
0040C97B B9 7F020000 [color=#0000D0]MOV[/color] [color=#FF0000]ECX[/color],27F
0040C980 EB 01 [color=#0000D0]JMP[/color] SHORT VC.0040C983
0040C982 90 [color=#0000D0]NOP[/color]
0040C983 3917 [color=#0000D0]CMP[/color] [color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EDI[/color]],[color=#FF0000]EDX[/color]
0040C985 74 0A [color=#0000D0]JE[/color] SHORT VC.0040C991
0040C987 47 [color=#0000D0]INC[/color] [color=#FF0000]EDI[/color]
0040C988 ^ E2 F9 LOOPD SHORT VC.0040C983
0040C98A EB 01 [color=#0000D0]JMP[/color] SHORT VC.0040C98D
0040C98C 90 [color=#0000D0]NOP[/color]
0040C98D 8902 [color=#0000D0]MOV[/color] [color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EDX[/color]],[color=#FF0000]EAX[/color]
[color=#008000];这里就是进行搞破坏,所以这里要NOP它[/color]
0040C98F EB 25 [color=#0000D0]JMP[/color] SHORT VC.0040C9B6
0040C991 90 [color=#0000D0]NOP[/color]
0040C992 90 [color=#0000D0]NOP[/color]
0040C993 90 [color=#0000D0]NOP[/color]
0040C994 90 [color=#0000D0]NOP[/color]
0040C995 90 [color=#0000D0]NOP[/color]
0040C996 90 [color=#0000D0]NOP[/color]
0040C997 90 [color=#0000D0]NOP[/color]
0040C998 90 [color=#0000D0]NOP[/color]
0040C999 90 [color=#0000D0]NOP[/color]
0040C99A 807F FF 00 [color=#0000D0]CMP[/color] [color=#b000b0]BYTE[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EDI[/color]-1],0
0040C99E 74 11 [color=#0000D0]JE[/color] SHORT VC.0040C9B1
0040C9A0 807F FF E9 [color=#0000D0]CMP[/color] [color=#b000b0]BYTE[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EDI[/color]-1],0E9
[color=#008000];这里是判断是不是MASM的程序.后面再讲[/color]
0040C9A4 ^ 75 E7 [color=#0000D0]JNZ[/color] SHORT VC.0040C98D
0040C9A6 83C7 04 [color=#0000D0]ADD[/color] [color=#FF0000]EDI[/color],4
0040C9A9 2BC7 [color=#0000D0]SUB[/color] [color=#FF0000]EAX[/color],[color=#FF0000]EDI[/color]
0040C9AB 8947 FC [color=#0000D0]MOV[/color] [color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EDI[/color]-4],[color=#FF0000]EAX[/color]
0040C9AE EB 06 [color=#0000D0]JMP[/color] SHORT VC.0040C9B6
0040C9B0 90 [color=#0000D0]NOP[/color] [color=#008000];这里是花指令,nop掉[/color]
0040C9B1 8907 [color=#0000D0]MOV[/color] [color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EDI[/color]],[color=#FF0000]EAX[/color]
[color=#008000];对于VC/DELPHI加的壳的程序,这里是最重要的了[/color]
0040C9B3 EB 01 [color=#0000D0]JMP[/color] SHORT VC.0040C9B6
0040C9B5 90 [color=#0000D0]NOP[/color]
0040C9B6 59 [color=#0000D0]POP[/color] [color=#FF0000]ECX[/color]
0040C9B1 /E9 3A4A0000 [color=#0000D0]JMP[/color] VC.004113F0
004113F0 60 [color=#0000D0]PUSHAD[/color]
004113F1 9C [color=#0000D0]PUSHFD[/color]
004113F2 BB 00104000 [color=#0000D0]MOV[/color] [color=#FF0000]EBX[/color],VC.00401000 [color=#008000]; CODEBASE[/color]
004113F7 B9 00400000 [color=#0000D0]MOV[/color] [color=#FF0000]ECX[/color],4000 [color=#008000]; CODESIZE[/color]
004113FC 8B13 [color=#0000D0]MOV[/color] [color=#FF0000]EDX[/color],[color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EBX[/color]]
004113FE 3BD7 [color=#0000D0]CMP[/color] [color=#FF0000]EDX[/color],[color=#FF0000]EDI[/color]
00411400 75 0C [color=#0000D0]JNZ[/color] SHORT VC.0041140E
00411402 8B17 [color=#0000D0]MOV[/color] [color=#FF0000]EDX[/color],[color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EDI[/color]]
00411404 8913 [color=#0000D0]MOV[/color] [color=#b000b0]DWORD[/color] [color=#b000b0]PTR[/color] [color=#FF0000]DS[/color]:[[color=#FF0000]EBX[/color]],[color=#FF0000]EDX[/color]
00411406 83C3 04 [color=#0000D0]ADD[/color] [color=#FF0000]EBX[/color],4
00411409 83E9 03 [color=#0000D0]SUB[/color] [color=#FF0000]ECX[/color],3
0041140C EB 03 [color=#0000D0]JMP[/color] SHORT VC.00411411
0041140E 83C3 01 [color=#0000D0]ADD[/color] [color=#FF0000]EBX[/color],1
00411411 ^ E2 E9 LOOPD SHORT VC.004113FC
00411413 9D [color=#0000D0]POPFD[/color]
00411414 61 [color=#0000D0]POPAD[/color]
00411415 ^ E9 9CB5FFFF [color=#0000D0]JMP[/color] VC.0040C9B6 [color=#008000];找完后回去老地方[/color]
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)