ASProtect 1.30.08.24?简单脱壳

【目??标】：C32Asm V0.4.12
【调试环境】：Olydbg1.1(Fly修改版)、LORDPE、ImportREC1.6Fix、Windows Xp sp2
【简要说明】：很长时间没上论坛了，也很久没调试过程序了，以前电脑上的工具都没有了，早上又在主页上下载了C32Asm 看了一下是Aspr旧版的，与新版相比，旧版的Stolen Code算是在仁慈了，简单脱了一下，给新人入门不错
【作者声明】：只是感兴趣，没有其他目的。

【脱壳过程】：忽略除内存访问异常外的全部异常，去掉调试标志。

一、Stolen Code & OEP

OD载入后停在这里：

/////////////////////////////////////////////////////////////
00401000??68 01406300??? push C32Asm.00634001
00401005??E8 01000000??? call C32Asm.0040100B
0040100A??C3????????retn

F9运行，程序会中断在异常处，Shift+F9通过异常，直至来到ASProtect最后1次典型异常处

/////////////////////////////////////////////////////////////
00EA9CB5??3100???????xor dword ptr ds:[eax],eax?//ASProtect最后1次典型异常
00EA9CB7??64:8F05 00000000?pop dword ptr fs:[0]
00EA9CBE??58????????pop eax
00EA9CBF??833D C4E7EA00 00?cmp dword ptr ds:[EAE7C4],0
00EA9CC6??74 14?????? je short 00EA9CDC
00EA9CC8??6A 0C?????? push 0C
00EA9CCA??B9 C4E7EA00??? mov ecx,0EAE7C4
00EA9CCF??8D45 F8????? lea eax,dword ptr ss:[ebp-8]
00EA9CD2??BA 04000000??? mov edx,4
00EA9CD7??E8 6075FFFF??? call 00EA123C
00EA9CDC??FF75 FC????? push dword ptr ss:[ebp-4]
00EA9CDF??FF75 F8????? push dword ptr ss:[ebp-8]
00EA9CE2??8B45 F4????? mov eax,dword ptr ss:[ebp-C]
00EA9CE5??8338 00????? cmp dword ptr ds:[eax],0
00EA9CE8??74 02?????? je short 00EA9CEC
00EA9CEA??FF30???????push dword ptr ds:[eax]
00EA9CEC??FF75 F0????? push dword ptr ss:[ebp-10]
00EA9CEF??FF75 EC????? push dword ptr ss:[ebp-14]
00EA9CF2??C3????????retn //此处下断，Shift+F9，断在这！F7 返回到 00ECF6DC

////////////////////////////////////////////////////////////
00ECF6DC??81F7 DF3F8F20?? xor edi,208F3FDF
00ECF6E2??E8 11000000??? call 00ECF6F8

命令行输入 HR ESP+8 ,F9 运行 硬件中断在下面

///////////////////////////////////////////////////////////
00ECF806? /EB 44?????? jmp short 00ECF84C //中断在这里
00ECF808? |EB 01?????? jmp short 00ECF80B
00ECF80A? |9A 51579CFC BF00?call far 00BF:FC9C5751
00ECF811? |0000???????add byte ptr ds:[eax],al
00ECF813? |00B9 00000000?? add byte ptr ds:[ecx],bh
00ECF819? |F3:AA?????? rep stos byte ptr es:[edi]
00ECF81B? |9D????????popfd
00ECF81C? |5F????????pop edi
00ECF81D? |59????????pop ecx
00ECF81E? |C3????????retn

中断后删除硬件断点，F7 往下走，直到看到：

///////////////////////////////////////////////////////////
00ECF85E??E8 00000000??? call 00ECF863
00ECF863??5D????????pop ebp
00ECF864??81ED D9B54B00?? sub ebp,4BB5D9
00ECF86A??8D85 7EB54B00?? lea eax,dword ptr ss:[ebp+4BB57E]
00ECF870??8D8D 20B64B00?? lea ecx,dword ptr ss:[ebp+4BB620]
00ECF876??03CB???????add ecx,ebx
00ECF878??8941 01????? mov dword ptr ds:[ecx+1],eax
00ECF87B??8D85 C2B54B00?? lea eax,dword ptr ss:[ebp+4BB5C2]
00ECF881??8D8D 86B54B00?? lea ecx,dword ptr ss:[ebp+4BB586]
00ECF887??8901???????mov dword ptr ds:[ecx],eax
00ECF889??B8 5E280000??? mov eax,285E
00ECF88E??8D8D 8BB54B00?? lea ecx,dword ptr ss:[ebp+4BB58B]
00ECF894??8901???????mov dword ptr ds:[ecx],eax
00ECF896??8D8D 20B64B00?? lea ecx,dword ptr ss:[ebp+4BB620]
00ECF89C??8D85 20DB4B00?? lea eax,dword ptr ss:[ebp+4BDB20]
00ECF8A2??51????????push ecx
00ECF8A3??50????????push eax
00ECF8A4??E8 76FFFFFF??? call 00ECF81F
00ECF8A9??61????????popad?//这里下F2断点，Stolen Code 开始
00ECF8AA??EB 01?????? jmp short 00ECF8AD

中断后就可Dump进程了，取消断点，一直F7往下走，找回Stolen Code

00ECF90E??896C24 04???? mov dword ptr ss:[esp+4],ebp?//push ebp

00ECF92A??8BEC???????mov ebp,esp

00ECF939??6A FF?????? push -1

//////////////////////////////////////////////////////
//00ECF948??9C????????pushfd //看到这个就一直往下走
//
//……
//
//00ECFC22??9D????????popfd?//直到看到这个(可以Ctrl+B，9D EB 01)
//00ECFC23??EB 01?????? jmp short 00ECFC26
//////////////////////////////////////////////////////

00ECFC26??FF35 91F9EC00?? push dword ptr ds:[ECF991] ; C32Asm.005044C8 //push 005044c8

/////////////////////////////////////////////////////////
//00ECFC39??9C????????pushfd
//
//00ECFF13??9D????????popfd //Ctrl+B，9D EB 01 在这里断下
//00ECFF14??EB 01?????? jmp short 00ECFF17
////////////////////////////////////////////////////////

00ECFF17??FF35 82FCEC00?? push dword ptr ds:[ECFC82] ; C32Asm.004CF5AA //push 004CF5AA

00ECFF2A??64:A1 00000000??mov eax,dword ptr fs:[0]

///////////////////////////////////////////////////////
//00ECFF42??51????????push ecx
//00ECFF43??68 5E684700??? push 47685E
//00ECFF48??894424 04???? mov dword ptr ss:[esp+4],eax //看到这样的就是push
///////////////////////////////////////////////////////

00ECFF48??894424 04???? mov dword ptr ss:[esp+4],eax //push eax

00ECFF64??64:8925 00000000?mov dword ptr fs:[0],esp

00ECFF78??83EC 68????? sub esp,68

00ECFF93??895C24 04???? mov dword ptr ss:[esp+4],ebx //push ebx

00ECFFBA??897424 04???? mov dword ptr ss:[esp+4],esi //push esi

00ECFFE1??897C24 04???? mov dword ptr ss:[esp+4],edi //push edi

00ECFFFD??8965 E8????? mov dword ptr ss:[ebp-18],esp

00ED000D??33DB???????xor ebx,ebx

00ED001C??895D FC????? mov dword ptr ss:[ebp-4],ebx

00ED002C??6A 02?????? push 2

00ED003B??FF15 48664E00?? call dword ptr ds:[4E6648] ; msvcrt.__set_app_type

00ED004E??59????????pop ecx

00ED005C??830D 681C5500 FF?or dword ptr ds:[551C68],FFFFFFFF

00ED0070??830D 6C1C5500 FF?or dword ptr ds:[551C6C],FFFFFFFF

00ED0084??FF15 4C664E00?? call dword ptr ds:[4E664C] ; msvcrt.__p__fmode

//////////////////////////////////////////////////////////
//00ED00AF??8D8A 4C1C5500?? lea ecx,dword ptr ds:[edx+551C4C]
//00ED00B8??2BCA???????sub ecx,edx
//00ED00CB??FF3421??????push dword ptr ds:[ecx]
//00ED00E2??59????????pop ecx??//mov ecx,[00551C4C]
/////////////////////////////////////////////////////////

00ED00F0??8908???????mov dword ptr ds:[eax],ecx

00ED00FF??FF15 50664E00?? call dword ptr ds:[4E6650] ; msvcrt.__p__commode

//////////////////////////////////////////////////////////
//00ED012A??8D8A 481C5500?? lea ecx,dword ptr ds:[edx+551C48]
//00ED0133??2BCA???????sub ecx,edx
//00ED0146??FF3421??????push dword ptr ds:[ecx]
//00ED015D??59????????pop ecx?//mov ecx,[00551C48]
//////////////////////////////////////////////////////////

00ED016B??8908???????mov dword ptr ds:[eax],ecx

00ED017A??A1 54664E00??? mov eax,dword ptr ds:[4E6654]

00ED018C??8B00???????mov eax,dword ptr ds:[eax]

00ED019B??A3 641C5500??? mov dword ptr ds:[551C64],eax

///////////////////////////////////////////////////////////
//00ED01AD??68 D1F54C00??? push 4CF5D1
//00ED01B6??C3????????retn? //call 004CF5D1
///////////////////////////////////////////////////////////

00ED01C7??391D 30B65300?? cmp dword ptr ds:[53B630],ebx

///////////////////////////////////////////////////////////
//00ED01D1??9C????????pushfd
//
//00ED03AF??9D????????popfd
//00ED03B0??EB 01?????? jmp short 00ED03B3
//00ED03B3??FF35 DC01ED00?? push dword ptr ds:[ED01DC]?; C32Asm.004CF48A //伪OEP
//00ED03B9??68 08F8EC00??? push 0ECF808
//00ED03BE??C3????????retn
///////////////////////////////////////////////////////////

004CF48A??75 0C?????? jnz short C32Asm.004CF498 //最后我们会停在这里

代码向上翻，看到这里

///////////////////////////////////////////////////////////
004CF40C??F7D8???????neg eax
004CF40E??83DA 00????? sbb edx,0
004CF411??5B????????pop ebx
004CF412??C2 1000????? retn 10
004CF415??EF????????out dx,eax?//原始OEP为：004CF415

分析以上代码得出Stolen Code如下：

///////////////////////////////////////////////////////////
push ebp
mov ebp,esp
push -1
push 5044C8
push 4CF5AA
mov eax,dword ptr fs:[0]
push eax
mov dword ptr fs:[0],esp
sub esp,68
push ebx
push esi
push edi
mov dword ptr ss:[ebp-18],esp
xor ebx,ebx
mov dword ptr ss:[ebp-4],ebx
push 2
call dword ptr ds:[4E6648]
pop ecx
or dword ptr ds:[551C68],FFFFFFFF
or dword ptr ds:[551C6C],FFFFFFFF
call dword ptr ds:[4E664C]
mov ecx,dword ptr ds:[551C4C]
mov dword ptr ds:[eax],ecx
call dword ptr ds:[4E6650]
mov ecx,dword ptr ds:[551C48]
mov dword ptr ds:[eax],ecx
mov eax,dword ptr ds:[4E6654]
mov eax,dword ptr ds:[eax]
mov dword ptr ds:[551C64],eax
call 004CF5D1
cmp dword ptr ds:[53B630],ebx

二进制：
55 8B EC 6A FF 68 C8 44 50 00 68 AA F5 4C 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68
53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 48 66 4E 00 59 83 0D 68 1C 55 00 FF 83 0D 6C 1C 55
00 FF FF 15 4C 66 4E 00 8B 0D 4C 1C 55 00 89 08 FF 15 50 66 4E 00 8B 0D 48 1C 55 00 89 08 A1 54
66 4E 00 8B 00 A3 64 1C 55 00 E8 4D 01 00 00 39 1D 30 B6 53 00

原始OEP：004CF415

二、输入表 处理

运行ImportREC，选择这个进程。把OEP改为000CF415，RVA=000E5000，大小＝1908
点“Get Import”，用Trace Level1可以修复绝大部分，剩余几个用插件可以修复。
也可以重新运行程序，对加密过的函数地址下内存写入断点，看看加密处理的部分：

///////////////////////////////////////////////////////////////////////
00EA8CFC??55????????push ebp
00EA8CFD??8BEC???????mov ebp,esp
00EA8CFF??81C4 FCFEFFFF?? add esp,-104
00EA8D05??53????????push ebx
00EA8D06??56????????push esi
00EA8D07??57????????push edi
00EA8D08??8B75 10????? mov esi,dword ptr ss:[ebp+10]
00EA8D0B??8B7D 08????? mov edi,dword ptr ss:[ebp+8]
00EA8D0E??8BC6???????mov eax,esi
00EA8D10??48????????dec eax
00EA8D11??33DB???????xor ebx,ebx
00EA8D13??8A18???????mov bl,byte ptr ds:[eax]
00EA8D15??8D85 FFFEFFFF?? lea eax,dword ptr ss:[ebp-101]
00EA8D1B??33C9???????xor ecx,ecx
00EA8D1D??BA 00010000??? mov edx,100
00EA8D22??E8 7D9AFEFF??? call 00E927A4
00EA8D27??8BC3???????mov eax,ebx
00EA8D29??83E8 02????? sub eax,2
00EA8D2C??74 15?????? je short 00EA8D43
00EA8D2E??48????????dec eax
00EA8D2F??74 5E?????? je short 00EA8D8F
00EA8D31??48????????dec eax
00EA8D32??0F84 3F010000?? je 00EA8E77
00EA8D38??48????????dec eax
00EA8D39??83E8 05????? sub eax,5
00EA8D3C??72 51?????? jb short 00EA8D8F
00EA8D3E??E9 3D010000??? jmp 00EA8E80
00EA8D43??8A06???????mov al,byte ptr ds:[esi]
00EA8D45??8845 FF????? mov byte ptr ss:[ebp-1],al
00EA8D48??46????????inc esi
00EA8D49??33DB???????xor ebx,ebx
00EA8D4B??8A5D FF????? mov bl,byte ptr ss:[ebp-1]
00EA8D4E??8BCB???????mov ecx,ebx
00EA8D50??8D85 FFFEFFFF?? lea eax,dword ptr ss:[ebp-101]
00EA8D56??8BD6???????mov edx,esi
00EA8D58??E8 CFC8FEFF??? call 00E9562C
00EA8D5D??6A 0A?????? push 0A
00EA8D5F??B9 8EE7EA00??? mov ecx,0EAE78E
00EA8D64??8BD3???????mov edx,ebx
00EA8D66??8D85 FFFEFFFF?? lea eax,dword ptr ss:[ebp-101]
00EA8D6C??E8 CB84FFFF??? call 00EA123C
00EA8D71??8DB5 FFFEFFFF?? lea esi,dword ptr ss:[ebp-101]
00EA8D77??56????????push esi
00EA8D78??8B45 0C????? mov eax,dword ptr ss:[ebp+C]
00EA8D7B??50????????push eax
00EA8D7C??E8 3FFCFFFF??? call 00EA89C0
00EA8D81??E8 7EFEFFFF??? call 00EA8C04
00EA8D86??8B17???????mov edx,dword ptr ds:[edi]
00EA8D88??8902???????mov dword ptr ds:[edx],eax
00EA8D8A??E9 F1000000??? jmp 00EA8E80
00EA8D8F??83FB 06????? cmp ebx,6
00EA8D92??74 14?????? je short 00EA8DA8
00EA8D94??83FB 09????? cmp ebx,9
00EA8D97??74 0F?????? je short 00EA8DA8
00EA8D99??83FB 07????? cmp ebx,7
00EA8D9C??74 0A?????? je short 00EA8DA8
00EA8D9E??83FB 08????? cmp ebx,8
00EA8DA1??74 05?????? je short 00EA8DA8
00EA8DA3??83FB 03????? cmp ebx,3
00EA8DA6??75 37?????? jnz short 00EA8DDF
00EA8DA8??8A06???????mov al,byte ptr ds:[esi]
00EA8DAA??8845 FF????? mov byte ptr ss:[ebp-1],al
00EA8DAD??46????????inc esi
00EA8DAE??33C9???????xor ecx,ecx
00EA8DB0??8A4D FF????? mov cl,byte ptr ss:[ebp-1]
00EA8DB3??8D85 FFFEFFFF?? lea eax,dword ptr ss:[ebp-101]
00EA8DB9??8BD6???????mov edx,esi
00EA8DBB??E8 6CC8FEFF??? call 00E9562C
00EA8DC0??6A 0A?????? push 0A
00EA8DC2??B9 84E7EA00??? mov ecx,0EAE784
00EA8DC7??33D2???????xor edx,edx
00EA8DC9??8A55 FF????? mov dl,byte ptr ss:[ebp-1]
00EA8DCC??8D85 FFFEFFFF?? lea eax,dword ptr ss:[ebp-101]
00EA8DD2??E8 6584FFFF??? call 00EA123C
00EA8DD7??8DB5 FFFEFFFF?? lea esi,dword ptr ss:[ebp-101]
00EA8DDD??EB 02?????? jmp short 00EA8DE1
00EA8DDF??8B36???????mov esi,dword ptr ds:[esi]
00EA8DE1??83FB 07????? cmp ebx,7
00EA8DE4??75 1D?????? jnz short 00EA8E03
00EA8DE6??56????????push esi
00EA8DE7??8B45 0C????? mov eax,dword ptr ss:[ebp+C]
00EA8DEA??50????????push eax
00EA8DEB??E8 D0FBFFFF??? call 00EA89C0
00EA8DF0??8B15 04C7EA00?? mov edx,dword ptr ds:[EAC704]
00EA8DF6??8902???????mov dword ptr ds:[edx],eax
00EA8DF8??B8 086EEA00??? mov eax,0EA6E08?//加密
00EA8DFD??8B17???????mov edx,dword ptr ds:[edi]
00EA8DFF??8902???????mov dword ptr ds:[edx],eax
00EA8E01??EB 7D?????? jmp short 00EA8E80
00EA8E03??83FB 08????? cmp ebx,8
00EA8E06??75 1D?????? jnz short 00EA8E25
00EA8E08??56????????push esi
00EA8E09??8B45 0C????? mov eax,dword ptr ss:[ebp+C]
00EA8E0C??50????????push eax
00EA8E0D??E8 AEFBFFFF??? call 00EA89C0
00EA8E12??8B15 44C6EA00?? mov edx,dword ptr ds:[EAC644]
00EA8E18??8902???????mov dword ptr ds:[edx],eax
00EA8E1A??B8 246EEA00??? mov eax,0EA6E24?//加密
00EA8E1F??8B17???????mov edx,dword ptr ds:[edi]
00EA8E21??8902???????mov dword ptr ds:[edx],eax
00EA8E23??EB 5B?????? jmp short 00EA8E80
00EA8E25??83FB 09????? cmp ebx,9
00EA8E28??75 1B?????? jnz short 00EA8E45
00EA8E2A??A1 1CC6EA00??? mov eax,dword ptr ds:[EAC61C]
00EA8E2F??8B40 0C????? mov eax,dword ptr ds:[eax+C]
00EA8E32??8B15 80C6EA00?? mov edx,dword ptr ds:[EAC680]
00EA8E38??8902???????mov dword ptr ds:[edx],eax
00EA8E3A??B8 E86DEA00??? mov eax,0EA6DE8 //加密
00EA8E3F??8B17???????mov edx,dword ptr ds:[edi]
00EA8E41??8902???????mov dword ptr ds:[edx],eax
00EA8E43??EB 3B?????? jmp short 00EA8E80
00EA8E45??83FB 03????? cmp ebx,3
00EA8E48??75 1D?????? jnz short 00EA8E67
00EA8E4A??56????????push esi
00EA8E4B??8B45 0C????? mov eax,dword ptr ss:[ebp+C]
00EA8E4E??50????????push eax
00EA8E4F??E8 6CFBFFFF??? call 00EA89C0
00EA8E54??8B15 58C6EA00?? mov edx,dword ptr ds:[EAC658]
00EA8E5A??8902???????mov dword ptr ds:[edx],eax
00EA8E5C??B8 2C52EA00??? mov eax,0EA522C //加密
00EA8E61??8B17???????mov edx,dword ptr ds:[edi]
00EA8E63??8902???????mov dword ptr ds:[edx],eax
00EA8E65??EB 19?????? jmp short 00EA8E80
00EA8E67??56????????push esi
00EA8E68??8B45 0C????? mov eax,dword ptr ss:[ebp+C]
00EA8E6B??50????????push eax
00EA8E6C??E8 4FFBFFFF??? call 00EA89C0
00EA8E71??8B17???????mov edx,dword ptr ds:[edi]
00EA8E73??8902???????mov dword ptr ds:[edx],eax
00EA8E75??EB 09?????? jmp short 00EA8E80
00EA8E77??B8 0052EA00??? mov eax,0EA5200 //加密
00EA8E7C??8B17???????mov edx,dword ptr ds:[edi]
00EA8E7E??8902???????mov dword ptr ds:[edx],eax
00EA8E80??8307 04????? add dword ptr ds:[edi],4
00EA8E83??5F????????pop edi
00EA8E84??5E????????pop esi
00EA8E85??5B????????pop ebx
00EA8E86??8BE5???????mov esp,ebp
00EA8E88??5D????????pop ebp
00EA8E89??C2 0C00????? retn 0C

上面这个CALL 就是输入表处理部分，郁闷的是，这个地方不能修改避开加密，一改内存就错
还好函数不多，修复起来还是很简单。

三、暗桩 去除
被上Stolen Code，修正OEP，Fix dumper 之后，程序还是无法运行，用OD载入脱壳后的程序，F9运行，
下面异常：

///////////////////////////////////////////////////////////////////////////////////////
call dword ptr ds:[538358] //这里进去会异常，指向壳地址

重新运行这个程序，对538358下内存写入断断，发现在到Stolen Code 之前，会初始化部分数据，具体代码如下：

00471D70??8B4424 04???? mov eax,dword ptr ss:[esp+4]
00471D74??A3 D0E65300??? mov dword ptr ds:[53E6D0],eax //EAX=00F17510
00471D79??C3????????retn

00F17510?64 74 31 2F 77 41 42 77 62 5A 59 3D???????dt1/wABwbZY=? //硬盘指纹

004717C4??A3 50835300??? mov dword ptr ds:[538350],eax //EAX=00EA5590
004717C9??C2 0400????? retn 4

00EA5590??C3????????retn

00471804??A3 54835300??? mov dword ptr ds:[538354],eax //EAX=00EA5590
00471809??C2 0400????? retn 4

00EA5590??C3????????retn

00471810??8B4424 04???? mov eax,dword ptr ss:[esp+4]
00471814??A3 58835300??? mov dword ptr ds:[538358],eax //EAX=00EA5660
00471819??C2 0400????? retn 4

00471800??8B4424 04???? mov eax,dword ptr ss:[esp+4]
00471804??A3 54835300??? mov dword ptr ds:[538354],eax
00471809??C2 0400????? retn 4

004717C0??8B4424 04???? mov eax,dword ptr ss:[esp+4]
004717C4??A3 50835300??? mov dword ptr ds:[538350],eax
004717C9??C2 0400????? retn 4

00471D60??8B4424 04???? mov eax,dword ptr ss:[esp+4]
00471D64??A3 CCE65300??? mov dword ptr ds:[53E6CC],eax //EAX=00E939B1
00471D69??C2 0400????? retn 4

00E939B1??00B8 B139E900?? add byte ptr ds:[eax+E939B1],bh
00E939B7??C3????????retn

输入表处理完之后，对数据段部分下内存写入断点就可以找到上面的代码，处理时我是直接修改EIP到返回
然后到Stolen Code代码起始处，补上Stolen Code后dump出来，Fix Dumper，程序正常运行，会提示被脱壳了

BP MessageBoxA
F9
ALT+F9

返回在这里：

///////////////////////////////////////////////////////////////////////
00448816??E8 4B600800??? call <jmp.&mfc42.#3318_CFile::GetLength> //获取文件大小
0044881B??8D4D CC????? lea ecx,dword ptr ss:[ebp-34]
0044881E??8BF0???????mov esi,eax
00448820??E8 2F600800??? call <jmp.&mfc42.#1979_CFile::Close>
00448825??33C0???????xor eax,eax
00448827??81FE 60E32600?? cmp esi,16E360 //文件如果比0x16E360 大就提示被脱壳了，
0044882D??0F9CC0??????setl al        ?? //这里偶们只须改一下0x16E360这个值就好，偶改成0x26E360
00448830??85C0???????test eax,eax
00448832??A3 68E85300??? mov dword ptr ds:[53E868],eax
00448837??75 0C?????? jnz short Unpacked.00448845
00448839??50????????push eax
0044883A??50????????push eax
0044883B??68 60125300??? push Unpacked.00531260??; 哇！脱壳了，利害，利害,\n再接再厉,把功能破解出来
00448840??E8 F15F0800??? call <jmp.&mfc42.#1200_AfxMessageBox>
00448845??8D4D CC????? lea ecx,dword ptr ss:[ebp-34] //返回在这

修改一下文件大小的比较值就可以去掉这个NAG

最后用FixRes 处理一下Res段，删除最后2个壳的区段，完美脱壳

BTW：

这个程序脱壳非常简单，适合新手入门，老鸟路过就好：)

THX: FLY,LoveBoom,shoooo,KanXue……

没别的话了，转载请注明出自看雪论坛

http://wangshy.ys168.com
里面有脱壳后的文件

[课程]Android-CTF解题方法汇总！