【文章标题】: ACProtect 1.32之Code Replace的简单处理
【文章作者】: wynney
【软件名称】: CryptoKeys
【作者声明】: 重点是Code Replace的处理
【特别感谢】: pavka(Russian)
--------------------------------------------------------------------------------
【详细过程】

  一、写在前面
  
  关于Code Replace有不少大狭已经讲述过，但是就我这样的小菜鸟，看起来很吃力，本文介绍一种我个人认为
  很简单的处理方法，旧版的处理方法在此文有介绍http://bbs.pediy.com/showthread.php?threadid=30330，
  看了下ACProtect 2.0的主程序，Code Replace跟1.32版的似乎差不多，当然ACProtect 2.0的主程序还有
  Crypted section、Embedded、OEP Obfuscation等其他保护
  
  二、Fix IAT&Go to OEP
  
  这个程序只有API redirection和Code Replace
  忽略所有异常
  
  

00400000 00001000 CryptoKe PE header Imag R RWE
00401000 000D9000 CryptoKe CODE code Imag R RWE
004DA000 0000D000 CryptoKe DATA code,data Imag R RWE
004E7000 00007000 CryptoKe BSS code Imag R RWE
004EE000 00003000 CryptoKe .idata code Imag R RWE
004F1000 00001000 CryptoKe .tls code Imag R RWE
004F2000 00001000 CryptoKe .rdata code Imag R RWE
004F3000 0000E000 CryptoKe .reloc code Imag R RWE
00501000 0005D000 CryptoKe .rsrc code,resourc Imag R RWE
0055E000 0001F000 CryptoKe .perplex code,imports Imag R RWE

0057283D 8B46 0C mov eax,dword ptr ds:[esi+C]
00572840 0BC0 or eax,eax
00572842 0F84 25020000 je CryptoKe.00572A6D
00572848 8366 0C 00 and dword ptr ds:[esi+C],0
0057284C 03C2 add eax,edx
0057284E 8BD8 mov ebx,eax
00572850 56 push esi
00572851 57 push edi
00572852 50 push eax
00572853 8BF3 mov esi,ebx
00572855 8BFB mov edi,ebx
00572857 AC lods byte ptr ds:[esi]
00572858 C0C0 03 rol al,3
0057285B AA stos byte ptr es:[edi]
0057285C 803F 00 cmp byte ptr ds:[edi],0
0057285F ^ 75 F6 jnz short CryptoKe.00572857
00572861 58 pop eax
00572862 5F pop edi
00572863 5E pop esi
00572864 50 push eax
00572865 FF95 90E24100 call dword ptr ss:[ebp+41E290]
0057286B 0BC0 or eax,eax
0057286D 75 43 jnz short CryptoKe.005728B2
0057286F 90 nop
00572870 90 nop
00572871 90 nop
00572872 90 nop
00572873 53 push ebx
00572874 FF95 94E24100 call dword ptr ss:[ebp+41E294]
0057287A 0BC0 or eax,eax
0057287C 75 34 jnz short CryptoKe.005728B2
0057287E 90 nop
0057287F 90 nop
00572880 90 nop
00572881 90 nop
00572882 8B95 1FFC4000 mov edx,dword ptr ss:[ebp+40FC1F]
00572888 0195 1D1F4000 add dword ptr ss:[ebp+401F1D],edx
0057288E 0195 211F4000 add dword ptr ss:[ebp+401F21],edx
00572894 6A 00 push 0
00572896 FFB5 1D1F4000 push dword ptr ss:[ebp+401F1D]
0057289C FFB5 211F4000 push dword ptr ss:[ebp+401F21]
005728A2 6A 00 push 0
005728A4 FF95 9CE24100 call dword ptr ss:[ebp+41E29C]
005728AA 6A 00 push 0
005728AC FF95 98E24100 call dword ptr ss:[ebp+41E298]
005728B2 60 pushad
005728B3 2BC0 sub eax,eax
005728B5 8803 mov byte ptr ds:[ebx],al
005728B7 43 inc ebx
005728B8 3803 cmp byte ptr ds:[ebx],al
005728BA ^ 75 F9 jnz short CryptoKe.005728B5
005728BC 61 popad
005728BD 8985 17FC4000 mov dword ptr ss:[ebp+40FC17],eax
005728C3 C785 1BFC4000 000>mov dword ptr ss:[ebp+40FC1B],0
005728CD 8B95 1FFC4000 mov edx,dword ptr ss:[ebp+40FC1F]
005728D3 8B06 mov eax,dword ptr ds:[esi]
005728D5 0BC0 or eax,eax
005728D7 75 07 jnz short CryptoKe.005728E0
005728D9 90 nop
005728DA 90 nop
005728DB 90 nop
005728DC 90 nop
005728DD 8B46 10 mov eax,dword ptr ds:[esi+10]
005728E0 03C2 add eax,edx
005728E2 0385 1BFC4000 add eax,dword ptr ss:[ebp+40FC1B]
005728E8 8B18 mov ebx,dword ptr ds:[eax]
005728EA 8B7E 10 mov edi,dword ptr ds:[esi+10]
005728ED 03FA add edi,edx
005728EF 03BD 1BFC4000 add edi,dword ptr ss:[ebp+40FC1B]
005728F5 85DB test ebx,ebx
005728F7 0F84 62010000 je CryptoKe.00572A5F
005728FD F7C3 00000080 test ebx,80000000
00572903 75 1D jnz short CryptoKe.00572922
00572905 90 nop
00572906 90 nop
00572907 90 nop
00572908 90 nop
00572909 03DA add ebx,edx
0057290B 83C3 02 add ebx,2
0057290E 56 push esi
0057290F 57 push edi
00572910 50 push eax
00572911 8BF3 mov esi,ebx
00572913 8BFB mov edi,ebx
00572915 AC lods byte ptr ds:[esi]
00572916 C0C0 03 rol al,3
00572919 AA stos byte ptr es:[edi]
0057291A 803F 00 cmp byte ptr ds:[edi],0
0057291D ^ 75 F6 jnz short CryptoKe.00572915
0057291F 58 pop eax
00572920 5F pop edi
00572921 5E pop esi
00572922 3B9D 1FFC4000 cmp ebx,dword ptr ss:[ebp+40FC1F]
00572928 7C 11 jl short CryptoKe.0057293B
0057292A 90 nop
0057292B 90 nop
0057292C 90 nop
0057292D 90 nop
0057292E 83BD 02244000 00 cmp dword ptr ss:[ebp+402402],0
00572935 75 0A jnz short CryptoKe.00572941
00572937 90 nop
00572938 90 nop
00572939 90 nop
0057293A 90 nop
0057293B 81E3 FFFFFF0F and ebx,0FFFFFFF
00572941 53 push ebx
00572942 FFB5 17FC4000 push dword ptr ss:[ebp+40FC17]
00572948 FF95 8CE24100 call dword ptr ss:[ebp+41E28C]
0057294E 3B9D 1FFC4000 cmp ebx,dword ptr ss:[ebp+40FC1F]
00572954 7C 0F jl short CryptoKe.00572965
00572956 90 nop
00572957 90 nop
00572958 90 nop
00572959 90 nop
0057295A 60 pushad
0057295B 2BC0 sub eax,eax
0057295D 8803 mov byte ptr ds:[ebx],al
0057295F 43 inc ebx
00572960 3803 cmp byte ptr ds:[ebx],al
00572962 ^ 75 F9 jnz short CryptoKe.0057295D
00572964 61 popad
00572965 0BC0 or eax,eax
00572967 ^ 0F84 15FFFFFF je CryptoKe.00572882
0057296D 3B85 9CE24100 cmp eax,dword ptr ss:[ebp+41E29C] ; 比较是否是MessageBoxA
00572973 74 20 je short CryptoKe.00572995 ; nop掉
00572975 90 nop
00572976 90 nop
00572977 90 nop
00572978 90 nop
00572979 3B85 9D014100 cmp eax,dword ptr ss:[ebp+41019D] ; 比较是否是RegisterHotKey
0057297F 74 09 je short CryptoKe.0057298A ; nop掉
00572981 90 nop
00572982 90 nop
00572983 90 nop
00572984 90 nop
00572985 EB 14 jmp short CryptoKe.0057299B
00572987 90 nop
00572988 90 nop
00572989 90 nop
0057298A 8D85 0A024100 lea eax,dword ptr ss:[ebp+41020A]
00572990 EB 09 jmp short CryptoKe.0057299B
00572992 90 nop
00572993 90 nop
00572994 90 nop
00572995 8D85 24024100 lea eax,dword ptr ss:[ebp+410224]
0057299B 56 push esi
0057299C FFB5 17FC4000 push dword ptr ss:[ebp+40FC17]
005729A2 5E pop esi
005729A3 39B5 FA234000 cmp dword ptr ss:[ebp+4023FA],esi
005729A9 74 15 je short CryptoKe.005729C0
005729AB 90 nop
005729AC 90 nop
005729AD 90 nop
005729AE 90 nop
005729AF 39B5 FE234000 cmp dword ptr ss:[ebp+4023FE],esi
005729B5 74 09 je short CryptoKe.005729C0
005729B7 90 nop
005729B8 90 nop
005729B9 90 nop
005729BA 90 nop
005729BB EB 63 jmp short CryptoKe.00572A20
005729BD 90 nop
005729BE 90 nop
005729BF 90 nop
005729C0 80BD D2594100 00 cmp byte ptr ss:[ebp+4159D2],0
005729C7 74 57 je short CryptoKe.00572A20 ; Magic Jump，改Jmp
005729C9 90 nop
005729CA 90 nop
005729CB 90 nop
005729CC 90 nop
005729CD EB 07 jmp short CryptoKe.005729D6
005729CF 90 nop
005729D0 90 nop
005729D1 90 nop
005729D2 0000 add byte ptr ds:[eax],al
005729D4 0000 add byte ptr ds:[eax],al
005729D6 8BB5 E4FC4000 mov esi,dword ptr ss:[ebp+40FCE4]
005729DC 83C6 0D add esi,0D
005729DF 81EE EA1B4000 sub esi,CryptoKe.00401BEA
005729E5 2BF5 sub esi,ebp
005729E7 83FE 00 cmp esi,0
005729EA 7F 34 jg short CryptoKe.00572A20
005729EC 90 nop
005729ED 90 nop
005729EE 90 nop
005729EF 90 nop
005729F0 8BB5 E4FC4000 mov esi,dword ptr ss:[ebp+40FCE4]
005729F6 53 push ebx
005729F7 50 push eax
005729F8 E8 A3B2FFFF call CryptoKe.0056DCA0
005729FD 8BD8 mov ebx,eax
005729FF 58 pop eax
00572A00 33C3 xor eax,ebx
00572A02 C606 68 mov byte ptr ds:[esi],68
00572A05 8946 01 mov dword ptr ds:[esi+1],eax
00572A08 C746 05 81342400 mov dword ptr ds:[esi+5],243481
00572A0F 895E 08 mov dword ptr ds:[esi+8],ebx
00572A12 C646 0C C3 mov byte ptr ds:[esi+C],0C3
00572A16 5B pop ebx
00572A17 8BC6 mov eax,esi
00572A19 8385 E4FC4000 0D add dword ptr ss:[ebp+40FCE4],0D
00572A20 5E pop esi
00572A21 60 pushad
00572A22 8BD0 mov edx,eax
00572A24 2BBD 1FFC4000 sub edi,dword ptr ss:[ebp+40FC1F]
00572A2A 8BC7 mov eax,edi
00572A2C B9 01010000 mov ecx,101
00572A31 8DBD D3F04000 lea edi,dword ptr ss:[ebp+40F0D3]
00572A37 F2:AF repne scas dword ptr es:[edi]
00572A39 0BC9 or ecx,ecx
00572A3B 74 13 je short CryptoKe.00572A50
00572A3D 90 nop
00572A3E 90 nop
00572A3F 90 nop
00572A40 90 nop
00572A41 81E9 01010000 sub ecx,101
00572A47 F7D1 not ecx
00572A49 89948D D3EC4000 mov dword ptr ss:[ebp+ecx*4+40ECD3],ed>
00572A50 61 popad
00572A51 8907 mov dword ptr ds:[edi],eax
00572A53 8385 1BFC4000 04 add dword ptr ss:[ebp+40FC1B],4
00572A5A ^ E9 6EFEFFFF jmp CryptoKe.005728CD
00572A5F 83C6 14 add esi,14
00572A62 8B95 1FFC4000 mov edx,dword ptr ss:[ebp+40FC1F]
00572A68 ^ E9 D0FDFFFF jmp CryptoKe.0057283D
00572A6D 8DBD D3F04000 lea edi,dword ptr ss:[ebp+40F0D3]
00572A73 33C0 xor eax,eax
00572A75 B9 00010000 mov ecx,100
00572A7A F3:AB rep stos dword ptr es:[edi]
00572A7C 60 pushad
00572A7D E8 00000000 call CryptoKe.00572A82
00572A82 5E pop esi
00572A83 83EE 06 sub esi,6
00572A86 B9 70020000 mov ecx,270
00572A8B 29CE sub esi,ecx
00572A8D BA 9F084E24 mov edx,244E089F
00572A92 C1E9 02 shr ecx,2
00572A95 83E9 02 sub ecx,2
00572A98 83F9 00 cmp ecx,0
00572A9B 7C 1A jl short CryptoKe.00572AB7
00572A9D 8B048E mov eax,dword ptr ds:[esi+ecx*4]
00572AA0 8B5C8E 04 mov ebx,dword ptr ds:[esi+ecx*4+4]
00572AA4 33C3 xor eax,ebx
00572AA6 C1C0 10 rol eax,10
00572AA9 33C2 xor eax,edx
00572AAB 81C2 E044CE4F add edx,4FCE44E0
00572AB1 89048E mov dword ptr ds:[esi+ecx*4],eax
00572AB4 49 dec ecx
00572AB5 ^ EB E1 jmp short CryptoKe.00572A98
00572AB7 61 popad ; 改完上面3处后，直接在这F4
00572AB8 61 popad
00572AB9 E8 EFD9FFFF call CryptoKe.005704AD
00572ABE C3 retn

004D8F8C 55 push ebp ; OEP
004D8F8D 8BEC mov ebp, esp
004D8F8F 83C4 F0 add esp, -10
004D8F92 53 push ebx
004D8F93 B8 E4884D00 mov eax, 004D88E4
004D8F98 E8 6FD4F2FF call 0040640C
004D8F9D 8B1D 2C634E00 mov ebx, dword ptr [4E632C] ; CryptoKe.004E7BE0
004D8FA3 8B03 mov eax, dword ptr [ebx]
004D8FA5 E8 3ACCF8FF call 00465BE4
004D8FAA 8B03 mov eax, dword ptr [ebx]
004D8FAC BA 18904D00 mov edx, 004D9018 ; ASCII "CryptoFLR - Prodhim Celesash"

0055F5C1 E8 0CEF0000 call UnPacked.0056E4D2
0055F5C6 8B4424 20 mov eax,dword ptr ss:[esp+20]
0055F5CA 33C9 xor ecx,ecx
0055F5CC 8B9C8D 69324000 mov ebx,dword ptr ss:[ebp+ecx*4+403269>
0055F5D3 039D 1FFC4000 add ebx,dword ptr ss:[ebp+40FC1F]
0055F5D9 3BC3 cmp eax,ebx
0055F5DB 74 07 je short UnPacked.0055F5E4
0055F5DD 90 nop
0055F5DE 90 nop
0055F5DF 90 nop
0055F5E0 90 nop
0055F5E1 41 inc ecx
0055F5E2 ^ EB E8 jmp short UnPacked.0055F5CC
0055F5E4 8DB5 49614000 lea esi,dword ptr ss:[ebp+406149]
0055F5EA B8 0A000000 mov eax,0A
0055F5EF F7E1 mul ecx
0055F5F1 03F0 add esi,eax
0055F5F3 8DBD EF1B4000 lea edi,dword ptr ss:[ebp+401BEF]
0055F5F9 0FB6840D B1264000 movzx eax,byte ptr ss:[ebp+ecx+4026B1]
0055F601 FEC0 inc al
0055F603 88840D B1264000 mov byte ptr ss:[ebp+ecx+4026B1],al
0055F60A 3C 20 cmp al,20
0055F60C 75 13 jnz short UnPacked.0055F621
0055F60E 90 nop
0055F60F 90 nop
0055F610 90 nop
0055F611 90 nop
0055F612 8BBD 23FC4000 mov edi,dword ptr ss:[ebp+40FC23]
0055F618 B8 0A000000 mov eax,0A
0055F61D F7E1 mul ecx
0055F61F 03F8 add edi,eax
0055F621 8A9D 06244000 mov bl,byte ptr ss:[ebp+402406]
0055F627 B9 0A000000 mov ecx,0A
0055F62C AC lods byte ptr ds:[esi]
0055F62D 32C3 xor al,bl
0055F62F AA stos byte ptr es:[edi] ; 异常，停在这里
0055F630 ^ E2 FA loopd short UnPacked.0055F62C
0055F632 83EF 0A sub edi,0A
0055F635 57 push edi
0055F636 8DB5 EF1B4000 lea esi,dword ptr ss:[ebp+401BEF]
0055F63C 33F7 xor esi,edi
0055F63E 74 19 je short UnPacked.0055F659
0055F640 90 nop
0055F641 90 nop
0055F642 90 nop
0055F643 90 nop
0055F644 8B7424 24 mov esi,dword ptr ss:[esp+24]
0055F648 83EE 04 sub esi,4
0055F64B AD lods dword ptr ds:[esi]
0055F64C 81EF 16244000 sub edi,UnPacked.00402416
0055F652 2BFD sub edi,ebp
0055F654 03C7 add eax,edi
0055F656 8946 FC mov dword ptr ds:[esi-4],eax
0055F659 5F pop edi
0055F65A 57 push edi
0055F65B 33C9 xor ecx,ecx
0055F65D 83F9 08 cmp ecx,8
0055F660 74 0E je short UnPacked.0055F670
0055F662 90 nop
0055F663 90 nop
0055F664 90 nop
0055F665 90 nop
0055F666 8B448C 04 mov eax,dword ptr ss:[esp+ecx*4+4]
0055F66A 89048C mov dword ptr ss:[esp+ecx*4],eax
0055F66D 41 inc ecx
0055F66E ^ EB ED jmp short UnPacked.0055F65D
0055F670 893C8C mov dword ptr ss:[esp+ecx*4],edi
0055F673 60 pushad
0055F674 E8 00000000 call UnPacked.0055F679
0055F679 5E pop esi
0055F67A 83EE 06 sub esi,6
0055F67D B9 B2000000 mov ecx,0B2
0055F682 29CE sub esi,ecx
0055F684 BA BDECBFFD mov edx,FDBFECBD
0055F689 C1E9 02 shr ecx,2
0055F68C 83E9 02 sub ecx,2
0055F68F 83F9 00 cmp ecx,0
0055F692 7C 1A jl short UnPacked.0055F6AE
0055F694 8B048E mov eax,dword ptr ds:[esi+ecx*4]
0055F697 8B5C8E 04 mov ebx,dword ptr ds:[esi+ecx*4+4]
0055F69B 2BC3 sub eax,ebx
0055F69D C1C0 1E rol eax,1E
0055F6A0 03C2 add eax,edx
0055F6A2 81C2 C7CD5106 add edx,651CDC7
0055F6A8 89048E mov dword ptr ds:[esi+ecx*4],eax
0055F6AB 49 dec ecx
0055F6AC ^ EB E1 jmp short UnPacked.0055F68F
0055F6AE 61 popad
0055F6AF 61 popad
0055F6B0 C3 retn

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)