Themida1800 demo的HeapMagic
VM保护代码里面检测了1个标记,是在这里设置的:
00B27354 83BD AD244F03 0>cmp dword ptr [ebp+34F24AD], 1
00B2735B 0F85 C2000000 jnz 00B27423
00B27361 83BD C1054F03 0>cmp dword ptr [ebp+34F05C1], 0
00B27368 0F85 B5000000 jnz 00B27423
00B2736E 83BD C92F4F03 0>cmp dword ptr [ebp+34F2FC9], 0
00B27375 0F85 A8000000 jnz 00B27423
00B2737B 8D85 04D66003 lea eax, dword ptr [ebp+360D604]
00B27381 90 nop
00B27382 50 push eax
00B27383 90 nop
00B27384 64:FF35 0000000>push dword ptr fs:[0]
00B2738B 64:8925 0000000>mov dword ptr fs:[0], esp
00B27392 64:A1 30000000 mov eax, dword ptr fs:[30]
00B27398 8B40 0C mov eax, dword ptr [eax+C]
00B2739B B9 30000000 mov ecx, 30
00B273A0 40 inc eax
00B273A1 8138 EEFEEEFE cmp dword ptr [eax], FEEEFEEE
00B273A7 ^ 0F85 F3FFFFFF jnz 00B273A0
00B273AD 49 dec ecx
00B273AE ^ 0F85 ECFFFFFF jnz 00B273A0
00B273B4 8BC0 mov eax, eax
00B273B6 83BD 5D2C4F03 0>cmp dword ptr [ebp+34F2C5D], 0
00B273BD 75 09 jnz short 00B273C8
00B273BF 83BD 4D0C4F03 0>cmp dword ptr [ebp+34F0C4D], 0
00B273C6 74 13 je short 00B273DB
00B273C8 50 push eax
00B273C9 53 push ebx
00B273CA 8BC0 mov eax, eax
00B273CC B8 D1040000 mov eax, 4D1
00B273D1 8D9D 674A5D03 lea ebx, dword ptr [ebp+35D4A67]
00B273D7 FFD3 call ebx
00B273D9 5B pop ebx
00B273DA 58 pop eax
00B273DB 8BC0 mov eax, eax
00B273DD C785 8D1D4F03 0>mov dword ptr [ebp+34F1D8D], 1 ; 这里
00B273E7 E9 2D000000 jmp 00B27419
00B273EC 8B5C24 0C mov ebx, dword ptr [esp+C]
00B273F0 50 push eax
00B273F1 892C24 mov dword ptr [esp], ebp
00B273F4 E8 00000000 call 00B273F9
00B273F9 5D pop ebp
00B273FA 81ED 11D66003 sub ebp, 360D611
00B27400 8B83 B8000000 mov eax, dword ptr [ebx+B8]
00B27406 8D85 31D66003 lea eax, dword ptr [ebp+360D631]
00B2740C 8983 B8000000 mov dword ptr [ebx+B8], eax
00B27412 5D pop ebp
00B27413 B8 00000000 mov eax, 0
00B27418 C3 retn
00B27419 64:8F05 0000000>pop dword ptr fs:[0]
00B27420 83C4 04 add esp, 4
00B27423 8BC0 mov eax, eax
00B27425 83BD 5D2C4F03 0>cmp dword ptr [ebp+34F2C5D], 0
00B2742C 75 09 jnz short 00B27437
00B2742E 83BD 4D0C4F03 0>cmp dword ptr [ebp+34F0C4D], 0
00B27435 74 19 je short 00B27450
如果没被调试,会产生异常,这里的代码和ap0x的例子一字不差;-)
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法