建龙质量验收资料管理2003全国版 简单无狗脱狗壳
作 者:KuNgBiM
狗类型:ROCKEY4
压缩壳:ASPack 2.11
试练目标：主程序"QCReportP.exe"
目的：
近来公司想换一套工程类资料管理软件，一番苦寻后找到该软件。
由于商业软件一般是采用加密狗进行程序保护的，所以程序不能正常试用，
便产生了一试身手的意念。
声明：
由于该软件为工程类商业软件，并给出了软件名称，所以不便在该文详述破解部分。
脱壳：
\\\\\\\\\\ OllyDbg加载后，停在第一层狗壳EP处 \\\\\\\\\\
0069D000 > 55 push ebp ; EP1(ROCKEY4)
0069D001 8BEC mov ebp, esp
0069D003 83EC 54 sub esp, 54
0069D006 53 push ebx
0069D007 56 push esi
0069D008 57 push edi
0069D009 E8 72090000 call 0069D980
0069D00E 8BD8 mov ebx, eax
0069D010 E8 00000000 call 0069D015
0069D015 5A pop edx
0069D016 83EA 15 sub edx, 15
0069D019 66:833B 01 cmp word ptr [ebx], 1
0069D01D 0F84 D8040000 je 0069D4FB
0069D023 66:C703 0100 mov word ptr [ebx], 1
0069D028 8953 1A mov dword ptr [ebx+1A], edx
0069D02B 2B53 16 sub edx, dword ptr [ebx+16]
0069D02E 8953 12 mov dword ptr [ebx+12], edx
0069D031 B9 00000000 mov ecx, 0
0069D036 8B73 1E mov esi, dword ptr [ebx+1E]
0069D039 03F2 add esi, edx
0069D03B 8973 22 mov dword ptr [ebx+22], esi
0069D03E 8B7B 26 mov edi, dword ptr [ebx+26]
0069D041 03FA add edi, edx
0069D043 897B 2A mov dword ptr [ebx+2A], edi
0069D046 8B048E mov eax, dword ptr [esi+ecx*4]
0069D049 83F8 00 cmp eax, 0
0069D04C 74 19 je short 0069D067
0069D04E 8B148F mov edx, dword ptr [edi+ecx*4]
0069D051 81FA 00000080 cmp edx, 80000000
0069D057 72 0E jb short 0069D067
0069D059 81F2 00000080 xor edx, 80000000
0069D05F 0353 12 add edx, dword ptr [ebx+12]
0069D062 8B048E mov eax, dword ptr [esi+ecx*4]
0069D065 8902 mov dword ptr [edx], eax
0069D067 41 inc ecx
0069D068 3B4B 2E cmp ecx, dword ptr [ebx+2E]
0069D06B ^ 72 D9 jb short 0069D046
0069D06D 895D FC mov dword ptr [ebp-4], ebx
0069D070 E8 FB040000 call 0069D570
0069D075 25 FFFF0000 and eax, 0FFFF
0069D07A 85C0 test eax, eax
0069D07C 74 05 je short 0069D083
0069D07E E9 B8040000 jmp 0069D53B
0069D083 66:C745 E4 0000 mov word ptr [ebp-1C], 0
0069D089 C745 F0 0800000>mov dword ptr [ebp-10], 8
0069D090 66:C745 C4 0000 mov word ptr [ebp-3C], 0
0069D096 8B45 FC mov eax, dword ptr [ebp-4]
0069D099 33C9 xor ecx, ecx
0069D09B 66:8B88 EE04000>mov cx, word ptr [eax+4EE]
0069D0A2 894D B8 mov dword ptr [ebp-48], ecx
0069D0A5 8B55 B8 mov edx, dword ptr [ebp-48]
0069D0A8 C1E2 10 shl edx, 10
0069D0AB 8B45 FC mov eax, dword ptr [ebp-4]
0069D0AE 33C9 xor ecx, ecx
0069D0B0 66:8B88 F004000>mov cx, word ptr [eax+4F0]
0069D0B7 0BD1 or edx, ecx
0069D0B9 8955 B8 mov dword ptr [ebp-48], edx
0069D0BC 8B55 FC mov edx, dword ptr [ebp-4]
0069D0BF 33C0 xor eax, eax
0069D0C1 66:8B42 04 mov ax, word ptr [edx+4]
0069D0C5 8B4D FC mov ecx, dword ptr [ebp-4]
0069D0C8 33D2 xor edx, edx
0069D0CA 66:8B91 EE04000>mov dx, word ptr [ecx+4EE]
0069D0D1 33C2 xor eax, edx
0069D0D3 8B4D FC mov ecx, dword ptr [ebp-4]
0069D0D6 66:8941 04 mov word ptr [ecx+4], ax
0069D0DA 8B55 FC mov edx, dword ptr [ebp-4]
0069D0DD 8B42 06 mov eax, dword ptr [edx+6]
0069D0E0 3345 B8 xor eax, dword ptr [ebp-48]
0069D0E3 8B4D FC mov ecx, dword ptr [ebp-4]
0069D0E6 8941 06 mov dword ptr [ecx+6], eax
0069D0E9 8B55 E4 mov edx, dword ptr [ebp-1C]
0069D0EC 81E2 FFFF0000 and edx, 0FFFF
0069D0F2 83FA 02 cmp edx, 2
0069D0F5 0F84 AF010000 je 0069D2AA
0069D0FB 8B45 FC mov eax, dword ptr [ebp-4]
0069D0FE 33C9 xor ecx, ecx
0069D100 66:8B88 EE04000>mov cx, word ptr [eax+4EE]
0069D107 81F1 FFFF0000 xor ecx, 0FFFF
0069D10D 66:894D E8 mov word ptr [ebp-18], cx
0069D111 8B55 FC mov edx, dword ptr [ebp-4]
0069D114 33C0 xor eax, eax
0069D116 66:8B82 F004000>mov ax, word ptr [edx+4F0]
0069D11D 35 FFFF0000 xor eax, 0FFFF
0069D122 66:8945 E0 mov word ptr [ebp-20], ax
0069D126 66:C745 D4 0000 mov word ptr [ebp-2C], 0
0069D12C 66:C745 B4 0000 mov word ptr [ebp-4C], 0
0069D132 8B4D E4 mov ecx, dword ptr [ebp-1C]
0069D135 81E1 FFFF0000 and ecx, 0FFFF
0069D13B 85C9 test ecx, ecx
0069D13D 75 40 jnz short 0069D17F
0069D13F 8D55 BC lea edx, dword ptr [ebp-44]
0069D142 52 push edx
0069D143 8D45 B4 lea eax, dword ptr [ebp-4C]
0069D146 50 push eax
0069D147 8D4D D4 lea ecx, dword ptr [ebp-2C]
0069D14A 51 push ecx
0069D14B 8D55 E0 lea edx, dword ptr [ebp-20]
0069D14E 52 push edx
0069D14F 8D45 E8 lea eax, dword ptr [ebp-18]
0069D152 50 push eax
0069D153 8D4D B0 lea ecx, dword ptr [ebp-50]
0069D156 51 push ecx
0069D157 8D55 B8 lea edx, dword ptr [ebp-48]
0069D15A 52 push edx
0069D15B 8D45 D0 lea eax, dword ptr [ebp-30]
0069D15E 50 push eax
0069D15F 6A 01 push 1
0069D161 E8 4A070000 call 0069D8B0 ; 第一次读狗
0069D166 83C4 24 add esp, 24
0069D169 25 FFFF0000 and eax, 0FFFF
0069D16E 85C0 test eax, eax ; EAX必须清零，则有狗
0069D170 74 05 je short 0069D177 ; 必须跳
0069D172 E9 BF030000 jmp 0069D536
0069D177 66:C745 E4 0100 mov word ptr [ebp-1C], 1
0069D17D EB 38 jmp short 0069D1B7
0069D17F 8D4D BC lea ecx, dword ptr [ebp-44]
0069D182 51 push ecx
0069D183 8D55 B4 lea edx, dword ptr [ebp-4C]
0069D186 52 push edx
0069D187 8D45 D4 lea eax, dword ptr [ebp-2C]
0069D18A 50 push eax
0069D18B 8D4D E0 lea ecx, dword ptr [ebp-20]
0069D18E 51 push ecx
0069D18F 8D55 E8 lea edx, dword ptr [ebp-18]
0069D192 52 push edx
0069D193 8D45 B0 lea eax, dword ptr [ebp-50]
0069D196 50 push eax
0069D197 8D4D B8 lea ecx, dword ptr [ebp-48]
0069D19A 51 push ecx
0069D19B 8D55 D0 lea edx, dword ptr [ebp-30]
0069D19E 52 push edx
0069D19F 6A 02 push 2
0069D1A1 E8 0A070000 call 0069D8B0
0069D1A6 83C4 24 add esp, 24
0069D1A9 25 FFFF0000 and eax, 0FFFF
0069D1AE 85C0 test eax, eax
0069D1B0 74 05 je short 0069D1B7
0069D1B2 E9 7F030000 jmp 0069D536
0069D1B7 8B45 FC mov eax, dword ptr [ebp-4]
0069D1BA 33C9 xor ecx, ecx
0069D1BC 66:8B48 04 mov cx, word ptr [eax+4]
0069D1C0 83E1 40 and ecx, 40
0069D1C3 85C9 test ecx, ecx
0069D1C5 74 1D je short 0069D1E4
0069D1C7 8B55 FC mov edx, dword ptr [ebp-4]
0069D1CA 8B45 B8 mov eax, dword ptr [ebp-48]
0069D1CD 3B42 06 cmp eax, dword ptr [edx+6]
0069D1D0 74 05 je short 0069D1D7
0069D1D2 ^ E9 12FFFFFF jmp 0069D0E9
0069D1D7 8B4D B8 mov ecx, dword ptr [ebp-48]
0069D1DA 894D C6 mov dword ptr [ebp-3A], ecx
0069D1DD C745 F0 0E00000>mov dword ptr [ebp-10], 0E
0069D1E4 8D55 BC lea edx, dword ptr [ebp-44]
0069D1E7 52 push edx
0069D1E8 8D45 B4 lea eax, dword ptr [ebp-4C]
0069D1EB 50 push eax
0069D1EC 8D4D D4 lea ecx, dword ptr [ebp-2C]
0069D1EF 51 push ecx
0069D1F0 8D55 E0 lea edx, dword ptr [ebp-20]
0069D1F3 52 push edx
0069D1F4 8D45 E8 lea eax, dword ptr [ebp-18]
0069D1F7 50 push eax
0069D1F8 8D4D B0 lea ecx, dword ptr [ebp-50]
0069D1FB 51 push ecx
0069D1FC 8D55 B8 lea edx, dword ptr [ebp-48]
0069D1FF 52 push edx
0069D200 8D45 D0 lea eax, dword ptr [ebp-30]
0069D203 50 push eax
0069D204 6A 03 push 3
0069D206 E8 A5060000 call 0069D8B0 ; 第二次读狗
0069D20B 83C4 24 add esp, 24
0069D20E 25 FFFF0000 and eax, 0FFFF
0069D213 85C0 test eax, eax ; EAX必须清零，则有狗
0069D215 74 05 je short 0069D21C ; 必须跳
0069D217 E9 1A030000 jmp 0069D536
0069D21C 8B4D FC mov ecx, dword ptr [ebp-4]
0069D21F 33D2 xor edx, edx
0069D221 66:8B51 04 mov dx, word ptr [ecx+4]
0069D225 83E2 20 and edx, 20
0069D228 85D2 test edx, edx
0069D22A 74 73 je short 0069D29F ; 第二次读狗成功此处跳转
0069D22C 8B45 FC mov eax, dword ptr [ebp-4]
0069D22F 33C9 xor ecx, ecx
0069D231 66:8B48 04 mov cx, word ptr [eax+4]
0069D235 83E1 0F and ecx, 0F
0069D238 66:894D E8 mov word ptr [ebp-18], cx
0069D23C 8D55 BC lea edx, dword ptr [ebp-44]
0069D23F 52 push edx
0069D240 8D45 B4 lea eax, dword ptr [ebp-4C]
0069D243 50 push eax
0069D244 8D4D D4 lea ecx, dword ptr [ebp-2C]
0069D247 51 push ecx
0069D248 8D55 E0 lea edx, dword ptr [ebp-20]
0069D24B 52 push edx
0069D24C 8D45 E8 lea eax, dword ptr [ebp-18]
0069D24F 50 push eax
0069D250 8D4D B0 lea ecx, dword ptr [ebp-50]
0069D253 51 push ecx
0069D254 8D55 B8 lea edx, dword ptr [ebp-48]
0069D257 52 push edx
0069D258 8D45 D0 lea eax, dword ptr [ebp-30]
0069D25B 50 push eax
0069D25C 6A 0C push 0C
0069D25E E8 4D060000 call 0069D8B0 ; (第三次读狗)忽略
0069D263 83C4 24 add esp, 24
0069D266 25 FFFF0000 and eax, 0FFFF
0069D26B 85C0 test eax, eax
0069D26D 74 05 je short 0069D274
0069D26F E9 98020000 jmp 0069D50C
0069D274 8B4D E0 mov ecx, dword ptr [ebp-20]
0069D277 81E1 FFFF0000 and ecx, 0FFFF
0069D27D 83F9 01 cmp ecx, 1
0069D280 74 05 je short 0069D287
0069D282 ^ E9 62FEFFFF jmp 0069D0E9
0069D287 8B55 FC mov edx, dword ptr [ebp-4]
0069D28A 66:8B42 04 mov ax, word ptr [edx+4]
0069D28E 66:8945 C4 mov word ptr [ebp-3C], ax
0069D292 837D F0 08 cmp dword ptr [ebp-10], 8
0069D296 75 07 jnz short 0069D29F
0069D298 C745 F0 0A00000>mov dword ptr [ebp-10], 0A
0069D29F 66:C745 E4 0200 mov word ptr [ebp-1C], 2
0069D2A5 ^ E9 3FFEFFFF jmp 0069D0E9
0069D2AA 8B4D FC mov ecx, dword ptr [ebp-4]
0069D2AD 83C1 32 add ecx, 32
0069D2B0 894D AC mov dword ptr [ebp-54], ecx
0069D2B3 8B55 AC mov edx, dword ptr [ebp-54]
0069D2B6 833A 00 cmp dword ptr [edx], 0 ; EAX必须清零，则有狗
0069D2B9 0F84 CA000000 je 0069D389 ; 必须跳
0069D2BF 8B45 AC mov eax, dword ptr [ebp-54]
0069D2C2 8378 08 01 cmp dword ptr [eax+8], 1
0069D2C6 0F85 AF000000 jnz 0069D37B
0069D2CC 8B4D AC mov ecx, dword ptr [ebp-54]
0069D2CF 8B11 mov edx, dword ptr [ecx]
0069D2D1 8955 B0 mov dword ptr [ebp-50], edx
0069D2D4 8D45 BC lea eax, dword ptr [ebp-44]
0069D2D7 50 push eax
0069D2D8 8D4D B4 lea ecx, dword ptr [ebp-4C]
0069D2DB 51 push ecx
0069D2DC 8D55 D4 lea edx, dword ptr [ebp-2C]
0069D2DF 52 push edx
0069D2E0 8D45 E0 lea eax, dword ptr [ebp-20]
0069D2E3 50 push eax
0069D2E4 8D4D E8 lea ecx, dword ptr [ebp-18]
0069D2E7 51 push ecx
0069D2E8 8D55 B0 lea edx, dword ptr [ebp-50]
0069D2EB 52 push edx
0069D2EC 8D45 B8 lea eax, dword ptr [ebp-48]
0069D2EF 50 push eax
0069D2F0 8D4D D0 lea ecx, dword ptr [ebp-30]
0069D2F3 51 push ecx
0069D2F4 6A 08 push 8
0069D2F6 E8 B5050000 call 0069D8B0
0069D2FB 83C4 24 add esp, 24
0069D2FE 25 FFFF0000 and eax, 0FFFF
0069D303 85C0 test eax, eax
0069D305 74 05 je short 0069D30C
0069D307 E9 00020000 jmp 0069D50C
0069D30C 66:8B55 E8 mov dx, word ptr [ebp-18]
0069D310 66:8955 BC mov word ptr [ebp-44], dx
0069D314 66:8B45 E0 mov ax, word ptr [ebp-20]
0069D318 66:8945 BE mov word ptr [ebp-42], ax
0069D31C 66:8B4D D4 mov cx, word ptr [ebp-2C]
0069D320 66:894D C0 mov word ptr [ebp-40], cx
0069D324 66:8B55 B4 mov dx, word ptr [ebp-4C]
0069D328 66:8955 C2 mov word ptr [ebp-3E], dx
0069D32C 8B45 FC mov eax, dword ptr [ebp-4]
0069D32F 8B48 12 mov ecx, dword ptr [eax+12]
0069D332 8B55 AC mov edx, dword ptr [ebp-54]
0069D335 030A add ecx, dword ptr [edx]
0069D337 894D F4 mov dword ptr [ebp-C], ecx
0069D33A C745 D8 0000000>mov dword ptr [ebp-28], 0
0069D341 EB 09 jmp short 0069D34C
0069D343 8B45 D8 mov eax, dword ptr [ebp-28]
0069D346 83C0 01 add eax, 1
0069D349 8945 D8 mov dword ptr [ebp-28], eax
0069D34C 8B4D AC mov ecx, dword ptr [ebp-54]
0069D34F 8B55 D8 mov edx, dword ptr [ebp-28]
0069D352 3B51 04 cmp edx, dword ptr [ecx+4]
0069D355 73 24 jnb short 0069D37B
0069D357 8B45 F4 mov eax, dword ptr [ebp-C]
0069D35A 0345 D8 add eax, dword ptr [ebp-28]
0069D35D 33C9 xor ecx, ecx
0069D35F 8A08 mov cl, byte ptr [eax]
0069D361 8B45 D8 mov eax, dword ptr [ebp-28]
0069D364 33D2 xor edx, edx
0069D366 F775 F0 div dword ptr [ebp-10]
0069D369 33C0 xor eax, eax
0069D36B 8A4415 BC mov al, byte ptr [ebp+edx-44]
0069D36F 33C8 xor ecx, eax
0069D371 8B55 F4 mov edx, dword ptr [ebp-C]
0069D374 0355 D8 add edx, dword ptr [ebp-28]
0069D377 880A mov byte ptr [edx], cl
0069D379 ^ EB C8 jmp short 0069D343
0069D37B 8B45 AC mov eax, dword ptr [ebp-54]
0069D37E 83C0 0C add eax, 0C
0069D381 8945 AC mov dword ptr [ebp-54], eax
0069D384 ^ E9 2AFFFFFF jmp 0069D2B3
0069D389 8D4D BC lea ecx, dword ptr [ebp-44]
0069D38C 51 push ecx
0069D38D 8D55 B4 lea edx, dword ptr [ebp-4C]
0069D390 52 push edx
0069D391 8D45 D4 lea eax, dword ptr [ebp-2C]
0069D394 50 push eax
0069D395 8D4D E0 lea ecx, dword ptr [ebp-20]
0069D398 51 push ecx
0069D399 8D55 E8 lea edx, dword ptr [ebp-18]
0069D39C 52 push edx
0069D39D 8D45 B0 lea eax, dword ptr [ebp-50]
0069D3A0 50 push eax
0069D3A1 8D4D B8 lea ecx, dword ptr [ebp-48]
0069D3A4 51 push ecx
0069D3A5 8D55 D0 lea edx, dword ptr [ebp-30]
0069D3A8 52 push edx
0069D3A9 6A 04 push 4
0069D3AB E8 00050000 call 0069D8B0 ; 第四次读狗
0069D3B0 83C4 24 add esp, 24
0069D3B3 25 FFFF0000 and eax, 0FFFF
0069D3B8 85C0 test eax, eax ; EAX必须清零，则有狗
0069D3BA 74 25 je short 0069D3E1 ; 必须跳
0069D3BC 6A 00 push 0
0069D3BE 8B45 FC mov eax, dword ptr [ebp-4]
0069D3C1 05 5A050000 add eax, 55A
0069D3C6 50 push eax
0069D3C7 8B4D FC mov ecx, dword ptr [ebp-4]
0069D3CA 81C1 8C050000 add ecx, 58C
0069D3D0 51 push ecx
0069D3D1 6A 00 push 0
0069D3D3 8B55 FC mov edx, dword ptr [ebp-4]
0069D3D6 FF92 0A050000 call dword ptr [edx+50A]
0069D3DC E9 7B010000 jmp 0069D55C
0069D3E1 E8 3A020000 call 0069D620
0069D3E6 8B5D FC mov ebx, dword ptr [ebp-4]
0069D3E9 8B83 E2040000 mov eax, dword ptr [ebx+4E2]
0069D3EF 83F8 00 cmp eax, 0 ; EAX必须清零，则有狗
0069D3F2 0F84 D4000000 je 0069D4CC ; 必须跳
0069D3F8 0343 12 add eax, dword ptr [ebx+12]
0069D3FB 8983 E6040000 mov dword ptr [ebx+4E6], eax
0069D401 8B43 12 mov eax, dword ptr [ebx+12]
0069D404 2B43 0E sub eax, dword ptr [ebx+E]
0069D407 8945 CC mov dword ptr [ebp-34], eax
0069D40A 8B45 FC mov eax, dword ptr [ebp-4]
0069D40D 8B88 E6040000 mov ecx, dword ptr [eax+4E6]
0069D413 8379 04 00 cmp dword ptr [ecx+4], 0
0069D417 0F84 AF000000 je 0069D4CC
0069D41D 8B55 FC mov edx, dword ptr [ebp-4]
0069D420 8B82 E6040000 mov eax, dword ptr [edx+4E6]
0069D426 8B48 04 mov ecx, dword ptr [eax+4]
0069D429 83E9 08 sub ecx, 8
0069D42C D1E9 shr ecx, 1
0069D42E 894D F8 mov dword ptr [ebp-8], ecx
0069D431 8B55 FC mov edx, dword ptr [ebp-4]
0069D434 8B82 E6040000 mov eax, dword ptr [edx+4E6]
0069D43A 83C0 08 add eax, 8
0069D43D 8945 EC mov dword ptr [ebp-14], eax
0069D440 C745 D8 0000000>mov dword ptr [ebp-28], 0
0069D447 EB 09 jmp short 0069D452
0069D449 8B4D D8 mov ecx, dword ptr [ebp-28]
0069D44C 83C1 01 add ecx, 1
0069D44F 894D D8 mov dword ptr [ebp-28], ecx
0069D452 8B55 D8 mov edx, dword ptr [ebp-28]
0069D455 3B55 F8 cmp edx, dword ptr [ebp-8]
0069D458 73 4F jnb short 0069D4A9
0069D45A 8B45 EC mov eax, dword ptr [ebp-14]
0069D45D 33C9 xor ecx, ecx
0069D45F 66:8B08 mov cx, word ptr [eax]
0069D462 81E1 00F00000 and ecx, 0F000
0069D468 C1F9 0C sar ecx, 0C
0069D46B 83F9 03 cmp ecx, 3
0069D46E 75 2E jnz short 0069D49E
0069D470 8B55 EC mov edx, dword ptr [ebp-14]
0069D473 33C0 xor eax, eax
0069D475 66:8B02 mov ax, word ptr [edx]
0069D478 25 FF0F0000 and eax, 0FFF
0069D47D 8B4D FC mov ecx, dword ptr [ebp-4]
0069D480 8B91 E6040000 mov edx, dword ptr [ecx+4E6]
0069D486 0302 add eax, dword ptr [edx]
0069D488 8B4D FC mov ecx, dword ptr [ebp-4]
0069D48B 0341 12 add eax, dword ptr [ecx+12]
0069D48E 8945 DC mov dword ptr [ebp-24], eax
0069D491 8B55 DC mov edx, dword ptr [ebp-24]
0069D494 8B02 mov eax, dword ptr [edx]
0069D496 0345 CC add eax, dword ptr [ebp-34]
0069D499 8B4D DC mov ecx, dword ptr [ebp-24]
0069D49C 8901 mov dword ptr [ecx], eax
0069D49E 8B55 EC mov edx, dword ptr [ebp-14]
0069D4A1 83C2 02 add edx, 2
0069D4A4 8955 EC mov dword ptr [ebp-14], edx
0069D4A7 ^ EB A0 jmp short 0069D449
0069D4A9 8B45 FC mov eax, dword ptr [ebp-4]
0069D4AC 8B88 E6040000 mov ecx, dword ptr [eax+4E6]
0069D4B2 8B55 FC mov edx, dword ptr [ebp-4]
0069D4B5 8B82 E6040000 mov eax, dword ptr [edx+4E6]
0069D4BB 0341 04 add eax, dword ptr [ecx+4]
0069D4BE 8B4D FC mov ecx, dword ptr [ebp-4]
0069D4C1 8981 E6040000 mov dword ptr [ecx+4E6], eax
0069D4C7 ^ E9 3EFFFFFF jmp 0069D40A
0069D4CC 8B5D FC mov ebx, dword ptr [ebp-4]
0069D4CF B9 00000000 mov ecx, 0
0069D4D4 8B73 22 mov esi, dword ptr [ebx+22]
0069D4D7 8B7B 2A mov edi, dword ptr [ebx+2A]
0069D4DA 8B048E mov eax, dword ptr [esi+ecx*4]
0069D4DD 83F8 00 cmp eax, 0
0069D4E0 74 13 je short 0069D4F5
0069D4E2 8B148F mov edx, dword ptr [edi+ecx*4]
0069D4E5 81FA 00000080 cmp edx, 80000000
0069D4EB 73 08 jnb short 0069D4F5
0069D4ED 0353 12 add edx, dword ptr [ebx+12]
0069D4F0 8B048E mov eax, dword ptr [esi+ecx*4]
0069D4F3 8902 mov dword ptr [edx], eax
0069D4F5 41 inc ecx
0069D4F6 3B4B 2E cmp ecx, dword ptr [ebx+2E]
0069D4F9 ^ 72 DF jb short 0069D4DA
0069D4FB 8B83 EA040000 mov eax, dword ptr [ebx+4EA]
0069D501 0343 12 add eax, dword ptr [ebx+12]
0069D504 5F pop edi
0069D505 5E pop esi
0069D506 5B pop ebx
0069D507 8BE5 mov esp, ebp
0069D509 5D pop ebp
0069D50A FFE0 jmp eax ; //解码完毕，飞向OEP（ASPack入口）
\\\\\\\\\\ 到达第二层壳EP处 \\\\\\\\\\
00699001 > 60 pushad ; EP2(ASPack 2.11)
00699002 E9 3D040000 jmp 00699444 ; ASPack通用脱法：ESP定律此处下断，F9运行
00699007 B5 FB mov ch, 0FB
00699009 F8 clc
0069900A - EB CD jmp short 00698FD9
0069900C C1F5 A6 sal ebp, 0A6
0069900F FD std
00699010 0F39 ??? ; 未知命令
00699012 EC in al, dx
00699013 D0B3 20899D16 sal byte ptr [ebx+169D8920], 1
00699019 39EC cmp esp, ebp
0069901B 50 push eax
0069901C 94 xchg eax, esp
0069901D F1 int1
0069901E 35 11D7F474 xor eax, 74F4D711
.........(中间代码略去)
006993AB /75 08 jnz short 006993B5 ; 中断在此，F8单步
006993AD |B8 01000000 mov eax, 1
006993B2 |C2 0C00 retn 0C
006993B5 \68 F0FD5A00 push 005AFDF0 ; OEP=005AFDF0
006993BA C3 retn ; 飞向程序真正的OEP
\\\\\\\\\\ 飞向程序OEP \\\\\\\\\\
005AFDF0 55 push ebp ; 程序OEP，OD自带插件脱壳即可，无需修复IAT
005AFDF1 8BEC mov ebp, esp
005AFDF3 83C4 EC add esp, -14
005AFDF6 33C0 xor eax, eax
005AFDF8 8945 EC mov dword ptr [ebp-14], eax
005AFDFB B8 00F85A00 mov eax, 005AF800
005AFE00 E8 7B79E5FF call 00407780
005AFE05 33C0 xor eax, eax
005AFE07 55 push ebp
005AFE08 68 51005B00 push 005B0051
005AFE0D 64:FF30 push dword ptr fs:[eax]
005AFE10 64:8920 mov dword ptr fs:[eax], esp
005AFE13 68 60005B00 push 005B0060 ; ASCII "QcReport"
005AFE18 E8 F37CE5FF call 00407B10 ; jmp 到 kernel32.GlobalFindAtomA
005AFE1D 66:85C0 test ax, ax
005AFE20 0F85 DC010000 jnz 005B0002
005AFE26 68 60005B00 push 005B0060 ; ASCII "QcReport"
005AFE2B E8 C87CE5FF call 00407AF8 ; jmp 到 kernel32.GlobalAddAtomA
005AFE30 A1 386F5B00 mov eax, dword ptr [5B6F38]
005AFE35 8B00 mov eax, dword ptr [eax]
脱壳后的程序正常运行，主程序为Borland Delphi 6.0 - 7.0编译。
给出一些数据供大家研究：
狗类型:ROCKEY4
P1:B0EF
P2:BC70
P3:0000
P4:0000
LP1:4F10438F
Ret:0003
\\.\ROCKEYNT 12FBF4
另外Cell32.ocx控件脱法与主程序相似，大家也可以同时练习！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
老k
