↑http://www.unpack.cn/thread-13190-1-1.html
00571744 3C 20 cmp al,20
//进入OllyDbg后暂停在这
00571746 F5 cmc
00571747 79 01 jns short 0057174A
00571749 F8 clc
0057174A F5 cmc
0057174B F9 stc
0057174C 60 pushad
0057174D C0C1 70 rol cl,70
00571750 E9 1B000000 jmp 00571770
0013FD6C 005713CC /CALL to VirtualAlloc from UnPackMe.005713CA
0013FD70 00400000 |Address = 00400000
0013FD74 0006B000 |Size = 6B000 (438272.)
0013FD78 00003000 |AllocationType = MEM_COMMIT|MEM_RESERVE
0013FD7C 00000040 \Protect = PAGE_EXECUTE_READWRITE
005713C0 51 push ecx
005713C1 6A 40 push 40
005713C3 68 00300000 push 3000
005713C8 51 push ecx
005713C9 50 push eax
005713CA FFD3 call near ebx ; kernel32.VirtualAlloc
005713CC 59 pop ecx
//返回这里
005713CD 85C0 test eax,eax
005713CF 75 13 jnz short 005713E4
005713D1 6A 40 push 40
005713D3 68 00100000 push 1000
005713D8 51 push ecx
005713D9 50 push eax
005713DA FFD3 call near ebx
005713DC 85C0 test eax,eax
005713DE 0F84 4D020000 je 00571631
005713E4 8945 F4 mov dword ptr ss:[ebp-C],eax
005713E7 89C7 mov edi,eax
005713E9 8B75 08 mov esi,dword ptr ss:[ebp+8]
005713EC 56 push esi
005713ED 89F1 mov ecx,esi
005713EF 034E 3C add ecx,dword ptr ds:[esi+3C]
005713F2 8B49 54 mov ecx,dword ptr ds:[ecx+54]
005713F5 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi]
//ecx=00000400 (decimal 1024.)
//ds:[esi]=[00571B79]=4D ('M')
//es:[edi]=[00400000]=00
//开始把PE头数据复制回00400000
005713F7 5E pop esi
005713F8 0376 3C add esi,dword ptr ds:[esi+3C]
005713FB 81C6 F8000000 add esi,0F8
00571401 8B45 08 mov eax,dword ptr ss:[ebp+8]
00571404 0340 3C add eax,dword ptr ds:[eax+3C]
00571407 0FB640 06 movzx eax,byte ptr ds:[eax+6]
0057140B 8D7D C8 lea edi,dword ptr ss:[ebp-38]
0057140E 57 push edi
0057140F 6A 0A push 0A
00571411 59 pop ecx
00571412 F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi]
//[esi]处是加壳前文件的区段信息
00571414 5F pop edi
00571415 8B57 14 mov edx,dword ptr ds:[edi+14]
00571418 85D2 test edx,edx
0057141A 74 14 je short 00571430
0057141C 56 push esi
0057141D 8B75 08 mov esi,dword ptr ss:[ebp+8]
00571420 01D6 add esi,edx
00571422 8B4F 10 mov ecx,dword ptr ds:[edi+10]
00571425 8B57 0C mov edx,dword ptr ds:[edi+C]
00571428 8B7D F4 mov edi,dword ptr ss:[ebp-C]
0057142B 01D7 add edi,edx
0057142D F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi]
//ecx=00049200 (decimal 299520.)
//ds:[esi]=[00571F79]=56 ('V')
//es:[edi]=[00401000]=00
//复制回各区段数据
0057142F 5E pop esi
00571430 48 dec eax
//原始 NumberOfSections
00571431 75 D8 jnz short 0057140B
//依次复制回所有的区段数据
00571433 8B55 F4 mov edx,dword ptr ss:[ebp-C]
00571436 2B55 FC sub edx,dword ptr ss:[ebp-4]
00571439 74 5C je short 00571497
//判断是否需要重定位处理，DLL使用
0057143B 8B45 F4 mov eax,dword ptr ss:[ebp-C]
0057143E 89C3 mov ebx,eax
00571440 035B 3C add ebx,dword ptr ds:[ebx+3C]
00571443 8B9B A0000000 mov ebx,dword ptr ds:[ebx+A0]
00571449 85DB test ebx,ebx
0057144B 74 4A je short 00571497
0057144D 01C3 add ebx,eax
0057144F 8B43 04 mov eax,dword ptr ds:[ebx+4]
00571452 85C0 test eax,eax
00571454 74 41 je short 00571497
00571456 8D48 F8 lea ecx,dword ptr ds:[eax-8]
00571459 D1E9 shr ecx,1
0057145B 8D7B 08 lea edi,dword ptr ds:[ebx+8]
0057145E 0FB707 movzx eax,word ptr ds:[edi]
00571461 52 push edx
00571462 89C2 mov edx,eax
00571464 C1E8 0C shr eax,0C
00571467 8B75 F4 mov esi,dword ptr ss:[ebp-C]
0057146A 66:81E2 FF0F and dx,0FFF
0057146F 0333 add esi,dword ptr ds:[ebx]
00571471 01D6 add esi,edx
00571473 5A pop edx
00571474 48 dec eax
00571475 75 07 jnz short 0057147E
00571477 89D0 mov eax,edx
00571479 C1E8 10 shr eax,10
0057147C EB 06 jmp short 00571484
0057147E 48 dec eax
0057147F 75 08 jnz short 00571489
00571481 0FB7C2 movzx eax,dx
00571484 66:0106 add word ptr ds:[esi],ax
00571487 EB 05 jmp short 0057148E
00571489 48 dec eax
0057148A 75 02 jnz short 0057148E
0057148C 0116 add dword ptr ds:[esi],edx
0057148E 47 inc edi
0057148F 47 inc edi
00571490 E2 CC loopd short 0057145E
00571492 035B 04 add ebx,dword ptr ds:[ebx+4]
00571495 EB B8 jmp short 0057144F
00571497 8B4D F4 mov ecx,dword ptr ss:[ebp-C]
//ECX=[ebp-C]=00400000 新基址
0057149A 8B55 B0 mov edx,dword ptr ss:[ebp-50]
0057149D 0155 B4 add dword ptr ss:[ebp-4C],edx
005714A0 64:8B05 30000000 mov eax,dword ptr fs:[30]
//获得PEB首地址
005714A7 837D BC 00 cmp dword ptr ss:[ebp-44],0
005714AB 75 03 jnz short 005714B0
005714AD 8948 08 mov dword ptr ds:[eax+8],ecx
//写入00400000新基址
005714B0 8B40 0C mov eax,dword ptr ds:[eax+C]
005714B3 8B40 0C mov eax,dword ptr ds:[eax+C]
005714B6 89C6 mov esi,eax
005714B8 8B50 18 mov edx,dword ptr ds:[eax+18]
005714BB 3B55 B0 cmp edx,dword ptr ss:[ebp-50]
005714BE 75 27 jnz short 005714E7
005714C0 8B50 1C mov edx,dword ptr ds:[eax+1C]
005714C3 3B55 B4 cmp edx,dword ptr ss:[ebp-4C]
005714C6 75 1F jnz short 005714E7
005714C8 8B50 20 mov edx,dword ptr ds:[eax+20]
005714CB 3B55 B8 cmp edx,dword ptr ss:[ebp-48]
005714CE 75 17 jnz short 005714E7
005714D0 8948 18 mov dword ptr ds:[eax+18],ecx
005714D3 038D 30FEFFFF add ecx,dword ptr ss:[ebp-1D0]
005714D9 8948 1C mov dword ptr ds:[eax+1C],ecx
//写入新的EP
005714DC 8B8D 58FEFFFF mov ecx,dword ptr ss:[ebp-1A8]
005714E2 8948 20 mov dword ptr ds:[eax+20],ecx
//写入新的SizeOfImage
005714E5 EB 08 jmp short 005714EF
005714E7 3930 cmp dword ptr ds:[eax],esi
005714E9 74 04 je short 005714EF
005714EB 8B00 mov eax,dword ptr ds:[eax]
005714ED EB C9 jmp short 005714B8
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
