PEiD查为Armadillo 3.78 - 4.xx -> Silicon Realms Toolworks壳
ArmadilloFindProtected12
!- Protected Armadillo
<Protection Options>
Debug-Blocker
Enable Import Table Elimination
Enable Strategic Code Splicing
Enable Nanomites Processing
<Backup Key Options>
Fixed Backup Keys
<Compression Options>
Better/Slower Compression
运行程序查看进程为双进程，OD载入
BP OpenMutexA
00401000 60 PUSHAD
00401001 9C PUSHFD
00401002 68 B0FD1200 PUSH 12FDB0 ; ASCII "DA4:A844894CC"
00401007 33C0 XOR EAX,EAX
00401009 50 PUSH EAX
0040100A 50 PUSH EAX
0040100B E8 2FDB407C CALL kernel32.CreateMutexA
00401010 9D POPFD
00401011 61 POPAD
00401012 - E9 04DC407C JMP kernel32.OpenMutexA
60 9C 68 B0 FD 12 00 33 C0 50 50 E8 2F DB 40 7C 9D 61 E9 04 DC 40 7C
HE GetModuleHandleA
015D665F /75 16 JNZ SHORT 015D6677
015D6661 |8D85 B4FEFFFF LEA EAX,DWORD PTR SS:[EBP-14C]
015D6667 |50 PUSH EAX
015D6668 |FF15 BC725F01 CALL DWORD PTR DS:[15F72BC] ; kernel32.LoadLibraryA
015D666E |8B0D FC516001 MOV ECX,DWORD PTR DS:[16051FC]
015D6674 |89040E MOV DWORD PTR DS:[ESI+ECX],EAX
015D6677 \A1 FC516001 MOV EAX,DWORD PTR DS:[16051FC]
015D667C 391C06 CMP DWORD PTR DS:[ESI+EAX],EBX
015D667F 0F84 2F010000 JE 015D67B4 改JMP
015D6685 33C9 XOR ECX,ECX
015D6687 8B07 MOV EAX,DWORD PTR DS:[EDI]
ALT+M内存断点，F8慢走到OEP
004E210C 6A 60 PUSH 60 OEP
004E210E 68 70146400 PUSH FlyWoool.00641470
004E2113 E8 DC0B0000 CALL FlyWoool.004E2CF4
004E2118 BF 94000000 MOV EDI,94
004E211D 8BC7 MOV EAX,EDI
004E211F E8 DCCAFFFF CALL FlyWoool.004DEC00
004E2124 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
004E2127 8BF4 MOV ESI,ESP
004E2129 893E MOV DWORD PTR DS:[ESI],EDI
004E212B 56 PUSH ESI
004E212C FF15 24C98D00 CALL DWORD PTR DS:[8DC924] ; kernel32.GetVersionExA
004E2132 8B4E 10 MOV ECX,DWORD PTR DS:[ESI+10]
ArmInline载入程序，删除拼接，修复IAT成功，用LordPE转存时出现提示：无法抓取进程内存
请大侠指教
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
