程序名：?ぜ乖EP破解
下载地址：百度随便一搜应该都能找到~~~~
PEiD查壳发现：NsPack V1.4 -> LiuXingPing [覆盖]
脱壳过程：
OD载入~~
停在：00411561 > 9C pushfd
F8单步走一步后停在：00411562 60 pushad
然后看到右边的寄存器的ESP值为：0012FFC0 EIP值为：00411562
于是乎用ESP定律在命令中输入：dd 0012FFC0
然后回车，下内存访问断点，F9运行后来到这里：
00411786 - E9 A620FFFF jmp ?ぜ乖EP.00403831
0041178B 8BB5 A3FEFFFF mov esi,dword ptr ss:[ebp-15D]
00411791 0BF6 or esi,esi
00411793 0F84 97000000 je ?ぜ乖EP.00411830
00411799 8B95 A7FEFFFF mov edx,dword ptr ss:[ebp-159]
0041179F 03F2 add esi,edx
004117A1 833E 00 cmp dword ptr ds:[esi],0
004117A4 75 0E jnz short ?ぜ乖EP.004117B4
004117A6 837E 04 00 cmp dword ptr ds:[esi+4],0
004117AA 75 08 jnz short ?ぜ乖EP.004117B4
004117AC 837E 08 00 cmp dword ptr ds:[esi+8],0
004117B0 75 02 jnz short ?ぜ乖EP.004117B4
004117B2 EB 7A jmp short ?ぜ乖EP.0041182E
004117B4 8B5E 08 mov ebx,dword ptr ds:[esi+8]
004117B7 03DA add ebx,edx
004117B9 53 push ebx
004117BA 52 push edx
004117BB 56 push esi
004117BC 8DBD 4FFFFFFF lea edi,dword ptr ss:[ebp-B1]
清除断点后又一下F8来到了程序的OEP 00403831：
00403831 55 push ebp
00403832 8BEC mov ebp,esp
00403834 6A FF push -1
00403836 68 F0624000 push ?ぜ乖EP.004062F0
0040383B 68 A44C4000 push ?ぜ乖EP.00404CA4
00403840 64:A1 00000000 mov eax,dword ptr fs:[0]
00403846 50 push eax
00403847 64:8925 0000000>mov dword ptr fs:[0],esp
0040384E 83EC 58 sub esp,58
00403851 53 push ebx
00403852 56 push esi
00403853 57 push edi
00403854 8965 E8 mov dword ptr ss:[ebp-18],esp
00403857 FF15 48604000 call dword ptr ds:[406048] ; kernel32.GetVersion
0040385D 33D2 xor edx,edx
0040385F 8AD4 mov dl,ah
00403861 8915 6C8A4000 mov dword ptr ds:[408A6C],edx
00403867 8BC8 mov ecx,eax
00403869 81E1 FF000000 and ecx,0FF
然后用LoadPE脱壳，IF修复后程序出现了问题~~
补充一下这是IF捕捉到的指针，都是有效的：
; Syntax for each function in a thunk (the separator is a TAB)
; ------------------------------------------------------------
; Flag RVA ModuleName Ordinal Name
;
; Details for <Valid> parameter:
; ------------------------------
; Flag: 0 = valid: no -> - Name contains the address of the redirected API (you can set
; it to zero if you edit it).
; - Ordinal is not considered but you should let '0000' as value.
; - ModuleName is not considered but you should let '?' as value.
;
; 1 = valid: yes -> All next parameters on the line will be considered.
; Function imported by ordinal must have no name (the 4th TAB must
; be there though).
;
; 2 = Equivalent to 0 but it is for the loader.
;
; 3 = Equivalent to 1 but it is for the loader.
;
; 4 = Equivalent to 0 with (R) tag.
;
; 5 = Equivalent to 1 with (R) tag.
;
; And finally, edit this file as your own risk! :-)
Target: C:\Documents and Settings\RICHTECH\桌面\?ぜ乖EP破解.exe
OEP: 00003831 IATRVA: 00005FFC IATSize: 000000BC
FThunk: 00006000 NbFunc: 0000002A
1 00006000 kernel32.dll 0191 GetProcAddress
1 00006004 kernel32.dll 023B LoadLibraryA
1 00006008 kernel32.dll 0030 CloseHandle
1 0000600C kernel32.dll 0385 WriteFile
1 00006010 kernel32.dll 0046 CreateDirectoryA
1 00006014 kernel32.dll 01C2 GetTempPathA
1 00006018 kernel32.dll 029D ReadFile
1 0000601C kernel32.dll 0300 SetFilePointer
1 00006020 kernel32.dll 004E CreateFileA
1 00006024 kernel32.dll 016D GetModuleFileNameA
1 00006028 kernel32.dll 01A9 GetStringTypeA
1 0000602C kernel32.dll 022E LCMapStringW
1 00006030 kernel32.dll 022D LCMapStringA
1 00006034 kernel32.dll 01FC HeapAlloc
1 00006038 kernel32.dll 0202 HeapFree
1 0000603C kernel32.dll 016F GetModuleHandleA
1 00006040 kernel32.dll 01A6 GetStartupInfoA
1 00006044 kernel32.dll 0103 GetCommandLineA
1 00006048 kernel32.dll 01D4 GetVersion
1 0000604C kernel32.dll 00B0 ExitProcess
1 00006050 kernel32.dll 0200 HeapDestroy
1 00006054 kernel32.dll 01FE HeapCreate
1 00006058 kernel32.dll 0367 VirtualFree
1 0000605C kernel32.dll 0364 VirtualAlloc
1 00006060 kernel32.dll 0206 HeapReAlloc
1 00006064 kernel32.dll 0340 TerminateProcess
1 00006068 kernel32.dll 0135 GetCurrentProcess
1 0000606C kernel32.dll 0351 UnhandledExceptionFilter
1 00006070 kernel32.dll 00E8 FreeEnvironmentStringsA
1 00006074 kernel32.dll 00E9 FreeEnvironmentStringsW
1 00006078 kernel32.dll 0378 WideCharToMultiByte
1 0000607C kernel32.dll 0147 GetEnvironmentStrings
1 00006080 kernel32.dll 0149 GetEnvironmentStringsW
1 00006084 kernel32.dll 024E LockResource
1 00006088 kernel32.dll 01A8 GetStdHandle
1 0000608C kernel32.dll 0158 GetFileType
1 00006090 kernel32.dll 02BE RtlUnwind
1 00006094 kernel32.dll 00F7 GetCPInfo
1 00006098 kernel32.dll 00F0 GetACP
1 0000609C kernel32.dll 0184 GetOEMCP
1 000060A0 kernel32.dll 025E MultiByteToWideChar
1 000060A4 kernel32.dll 01AC GetStringTypeW
FThunk: 000060AC NbFunc: 00000002
1 000060AC user32.dll 01DD MessageBoxA
1 000060B0 user32.dll 02D9 wsprintfA
修复完成后的文件“dumped_.exe”，出现一个窗口标题为Error；错误信息为Invaild data in the file!的错误提示.......
我看一下文件大小发现未脱壳的原文件为538KB，而脱壳后的文件为104KB，郁闷啊~~按照常例来说脱壳后的文件应该比未脱壳的文件要小才对啊~~~而且脱完壳后程序还出现我未见过的错误提示运行不起来~~~~这是怎么回事啊？
哪位大狭帮帮我？本人第一次碰到这样的问题`素手无策~~望高手指点！
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
