能力值：
( LV9，RANK：170 )
|
-
-
12 楼
这是我以前写的脱kbys的插件代码
//关键脱壳函数--API
extern "C" void WINAPI StartUnpack(PROCESS_INFORMATION pi, DWORD dwBaseAddress, DWORD dwEntryPoint)
{
DWORD dwPid = pi.dwProcessId;
DWORD dwTid = pi.dwThreadId;
HANDLE hProcess = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
HANDLE hThread = ::OpenThread(THREAD_ALL_ACCESS, FALSE, dwTid);
ASSERT(hProcess);
ASSERT(hThread);
//发消息表示开始脱壳
DWORD dwOep = 0;
DWORD dwRead = 0;
CONTEXT context;
UCHAR szFirst[] = {0xE8, 0x01, 0x00, 0x00, 0x00, 0xC3, 0xC3};
DWORD dwMagic = FindMemory(hProcess, dwEntryPoint, szFirst, sizeof(szFirst), 0x100);
if (dwMagic != dwEntryPoint + 5)
{//shoooo超级伪装壳
TellUnpacker(g_szError);
return Terminate(hProcess, hThread);
}
beginning:
DWORD dwNewPP = 0;
ReadMemory(hProcess, dwEntryPoint + 1, &dwNewPP, 4, &dwRead);
GO(hProcess, hThread, dwNewPP, context);
UCHAR szNewJmp[] = {0xFF, 0xE0};
dwMagic = FindMemory(hProcess, dwNewPP, szNewJmp, sizeof(szNewJmp), 0x100);
if (dwMagic != (dwNewPP + 0xC))
{
DWORD dwLoadLib = GetAddress("kernel32.dll", "LoadLibraryA");
GO(hProcess, hThread, dwLoadLib, context);
RTU(hProcess, hThread, context);
DWORD dwIAT = context.Edi;
UCHAR szMagic[] = {0xFF, 0x63, 0x0C};
dwMagic = FindMemory(hProcess, context.Eip, szMagic, sizeof(szMagic), 0x100);
if (0 == dwMagic)
{
//出错
TellUnpacker(g_szError);
return Terminate(hProcess, hThread);
}
//0.22
TellUnpacker("kbys 0.22");
GO(hProcess, hThread, dwMagic, context);
ReadMemory(hProcess, context.Ebx + 0xC, &dwOep, 4, &dwRead);
GO(hProcess, hThread, dwOep, context);
RTU(hProcess, hThread, context);
dwOep = context.Eip;
DumeNow(dwOep, dwIAT);
return Terminate(hProcess, hThread);
}
TellUnpacker("kbys 0.28");
DWORD dwLoadLib = GetAddress("kernel32.dll", "LoadLibraryA");
GO(hProcess, hThread, dwLoadLib, context);
RTU(hProcess, hThread, context);
DWORD dwIAT = context.Edi;
GO(hProcess, hThread, dwMagic, context);
dwOep = context.Eax;
dwEntryPoint = dwOep;
dwMagic = FindMemory(hProcess, dwEntryPoint, szFirst, sizeof(szFirst), 0x100);
if (dwMagic == dwEntryPoint + 5)
{
if (::MessageBox(g_hWndList, "似乎还有一层,是否继续脱?", "INFO", MB_YESNO) == IDYES)
goto beginning;
}
DumeNow(dwOep, dwIAT);
return Terminate(hProcess, hThread);
}
|
能力值：
![]()
(RANK：450 )
|
-
-
18 楼
这个壳目前好象有挺多万能脱壳机都能脱的,我没有脱壳机,
不过,过段时间,我会放出我写的,完全基于虚拟机的通用脱壳机出来,支持脱这个壳
|
能力值：
( LV3，RANK：30 )
|
-
-
19 楼
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
00401BF0 . 55 push ebp ;在这个地方用ollydump插件dump吧
00401BF1 . 8BEC mov ebp, esp
00401BF3 . 6A FF push -1
00401BF5 . 68 90254000 push 00402590
00401BFA . 68 001E4000 push 00401E00 ; jmp 到 msvcrt._except_handler3; SE 处理程序安装
00401BFF . 64:A1 0000000>mov eax, dword ptr fs:[0]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
请问用LordPE DUMP 不行嘛
然后再用ImpREC 修复
我试过
ImpREC 居然始终无法OEP定位
呵呵
|
能力值：
( LV2，RANK：10 )
|
-
-
20 楼
堀北压缩 0.28 脱壳记录
0100739D . 6A 70 PUSH 70
偶脱的这个壳的OEP是这里....跟楼主不一样...但这个我搞了一会...如果是初学者可能还不会这个壳.....我也是费了一点劲...本来想放弃.后来试了两把.终于搞定了这个壳..我们的壳的入口是一样.但我跟楼主的方法不一样...呵...反正最后还是脱掉了.用IRP修复.两个指针不行.剪掉了.再重建PE.搞定了...
我喜欢手脱...除非是些特别的壳和难度较高的壳我才用专脱工具...
简单说些我的思路吧
01019F89 ^\EB E0 JMP SHORT 堀北压缩.01019F6B |在这里不跟往上回走,也不能在这行下面下断.往上走回去了.下走程序运行了.我试过几次.|
OD打开后直接单步走...不用回头.
01019F8B 25 FFFFFF7F AND EAX,7FFFFFFF
01019F90 50 PUSH EAX
01019F91 55 PUSH EBP
01019F92 FF53 04 CALL DWORD PTR DS:[EBX+4]
01019F95 AB STOS DWORD PTR ES:[EDI]
01019F96 ^ EB D8 JMP SHORT 堀北压缩.01019F70
01019F98 5D POP EBP |在这里下断.上面的不用管它|
01019F99 5F POP EDI
01019F9A C3 RETN |这里返回|
7C809AE4 > 8BFF MOV EDI,EDI | 接着上面的.返回到这里,再接着单步走|
7C809AE6 55 PUSH EBP
7C809AE7 8BEC MOV EBP,ESP
7C809AE9 FF75 10 PUSH DWORD PTR SS:[EBP+10]
7C809AEC FF75 0C PUSH DWORD PTR SS:[EBP+C]
7C809AEF FF75 08 PUSH DWORD PTR SS:[EBP+8]
7C809AF2 6A FF PUSH -1
7C809AF4 E8 09000000 CALL kernel32.VirtualFreeEx
7C809AF9 5D POP EBP
7C809AFA C2 0C00 RETN 0C |走到这里他又返回了.不过是返回到|7C809AE4 > 8BFF 这里了..晕..就像一个回圈一样..不过他一直这样.跟本往下走不了|
7C809AFD 90 NOP
7C809AFE 90 NOP
7C809AFF 90 NOP
7C809B00 90 NOP
7C809B01 90 NOP
7C809B02 > 8BFF MOV EDI,EDI |偶在这里F4下断,接着单步|
7C809B04 55 PUSH EBP
7C809B05 8BEC MOV EBP,ESP
7C809B07 F645 15 80 TEST BYTE PTR SS:[EBP+15],80
7C809B0B 74 0A JE SHORT kernel32.7C809B17
7C809B0D 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
7C809B11 0F85 BE690300 JNZ kernel32.7C8404D5
7C809B17 56 PUSH ESI
7C809B18 8B35 A811807C MOV ESI,DWORD PTR DS:[<&ntdll.NtFreeVirt>; ntdll.ZwFreeVirtualMemory
7C809B1E 57 PUSH EDI
7C809B1F FF75 14 PUSH DWORD PTR SS:[EBP+14]
7C809B22 8D45 10 LEA EAX,DWORD PTR SS:[EBP+10]
7C809B25 50 PUSH EAX
7C809B26 8D45 0C LEA EAX,DWORD PTR SS:[EBP+C]
7C809B29 50 PUSH EAX
7C809B2A FF75 08 PUSH DWORD PTR SS:[EBP+8]
7C809B2D FFD6 CALL ESI
7C809B2F 8BF8 MOV EDI,EAX
7C809B31 85FF TEST EDI,EDI
7C809B33 0F8C 68C60200 JL kernel32.7C8361A1
7C809B39 33C0 XOR EAX,EAX
7C809B3B 40 INC EAX
7C809B3C 5F POP EDI
7C809B3D 5E POP ESI
7C809B3E 5D POP EBP
7C809B3F C2 1000 RETN 10 |走到这里后他又开始返回了|
7C809AF9 5D POP EBP |返回到这里了.又要返回.日|
7C809AFA C2 0C00 RETN 0C |返回到这里了.跟着走吧|
01019E74 61 POPAD |这里开始出来了.跟着走吧.慢慢来.|
01019E75 B8 9D730000 MOV EAX,739D
01019E7A BA 00000001 MOV EDX,堀北压缩.01000000
01019E7F 03C2 ADD EAX,EDX
01019E81 FFE0 JMP EAX |嘿嘿.不用偶说吧.这里大伙应该很熟了.|
0100739D . 6A 70 PUSH 70 |这是哪大伙都知道了吧.不过说一下.来到这里时要CTRL+A分析一下.再脱吧.方法是这样.搞定了.|
0100739F . 68 98180001 PUSH 堀北压缩.01001898
010073A4 . E8 BF010000 CALL 堀北压缩.01007568
010073A9 . 33DB XOR EBX,EBX
010073AB . 53 PUSH EBX ; /pModule => NULL
最后用IRP修复.两个指针不行.剪掉了.再重建PE.......
|
俺目前好像还没有这个实力，努力中......
