一直潜水于看雪，学习大师们的好文。今日碰到一个未知壳，试着自已脱着，过程如下，不当之处，请各位老鸟、大虾指点。
【文章标题】: 脱未知壳
【文章作者】: Vincent
【软件名称】: auto
【加壳方式】: 未知
【使用工具】: OllyICE v1.10 修改版
【操作平台】: XP
【文件信息】:
文件大小：16,954B
MD5: e28f94e84dabbdccc31ca6fcc31e142e
详细过程
OD载入后，
0040101B >-/E9 97B40000 JMP auto.0040C4B7
00401020 > $ |0BC0 OR EAX,EAX ; OD载入
00401022 . |0BC0 OR EAX,EAX
00401024 . |0BC0 OR EAX,EAX
00401026 . |0BC0 OR EAX,EAX
00401028 . |0BC0 OR EAX,EAX
0040102A . |0BC0 OR EAX,EAX
0040102C . |0BC0 OR EAX,EAX
0040102E . |0BC0 OR EAX,EAX
00401030 . |EB 02 JMP SHORT auto.00401034
00401032 |FF DB FF
00401033 |80 DB 80
00401034 >^\EB E5 JMP SHORT auto.0040101B
F7单步到0040101B, 然后转到
0040C4B7 /EB 00 JMP SHORT auto.0040C4B9
0040C4B9 \60 PUSHAD
0040C4BA E8 03000000 CALL auto.0040C4C2 ;F8
0040C4BF EB 03 JMP SHORT auto.0040C4C4 ;跳
0040C4C4 61 POPAD
0040C4C5 EB 5C JMP SHORT auto.0040C523 ;跳
0040C523 /EB 27 JMP SHORT auto.0040C54C
0040C525 ^|EB AC JMP SHORT auto.0040C4D3
0040C527 |90 NOP
0040C528 |90 NOP
0040C529 |8985 F9FDFFFF MOV DWORD PTR SS:[EBP-207],EAX
0040C52F |E8 00000000 CALL auto.0040C534
0040C534 |5B POP EBX
0040C535 |B9 54030000 MOV ECX,354
0040C53A |03D9 ADD EBX,ECX
0040C53C |50 PUSH EAX
0040C53D |53 PUSH EBX
0040C53E |E8 9D020000 CALL auto.0040C7E0
0040C543 |61 POPAD
0040C544 |03BD C1FDFFFF ADD EDI,DWORD PTR SS:[EBP-23F]
0040C54A |EB 1B JMP SHORT auto.0040C567
0040C54C \60 PUSHAD
0040C54D 61 POPAD
0040C54E 60 PUSHAD
0040C54F 9C PUSHFD
0040C550 E8 01000000 CALL auto.0040C556 ; F7跟进
来到：
0040C556 5D POP EBP ; auto.0040C555
0040C557 81ED 9E000000 SUB EBP,9E
0040C55D ^ EB C6 JMP SHORT auto.0040C525 ;跳
0040C525 ^\EB AC JMP SHORT auto.0040C4D3 ;跳
0040C4D3 8DB5 3DFEFFFF LEA ESI,DWORD PTR SS:[EBP-1C3]
0040C4D9 8B06 MOV EAX,DWORD PTR DS:[ESI]
0040C4DB 83F8 01 CMP EAX,1
0040C4DE 0F84 EA010000 JE auto.0040C6CE
0040C4E4 C706 01000000 MOV DWORD PTR DS:[ESI],1
0040C4EA 8BD5 MOV EDX,EBP
0040C4EC 8B85 D1FDFFFF MOV EAX,DWORD PTR SS:[EBP-22F]
0040C4F2 2BD0 SUB EDX,EAX
0040C4F4 8995 D1FDFFFF MOV DWORD PTR SS:[EBP-22F],EDX
0040C4FA 0195 01FEFFFF ADD DWORD PTR SS:[EBP-1FF],EDX
0040C500 8DB5 45FEFFFF LEA ESI,DWORD PTR SS:[EBP-1BB]
0040C506 0116 ADD DWORD PTR DS:[ESI],EDX
0040C508 8B36 MOV ESI,DWORD PTR DS:[ESI]
0040C50A 8BFD MOV EDI,EBP
0040C50C ^ EB C0 JMP SHORT auto.0040C4CE ;跳
0040C4CE 60 PUSHAD
0040C4CF 6A 40 PUSH 40
0040C4D1 EB 3C JMP SHORT auto.0040C50F
0040C50F 68 00100000 PUSH 1000
0040C514 68 00100000 PUSH 1000
0040C519 6A 00 PUSH 0
0040C51B FF95 79FEFFFF CALL DWORD PTR SS:[EBP-187] ;F8步过
0040C521 EB 06 JMP SHORT auto.0040C529 ;跳
0040C529 8985 F9FDFFFF MOV DWORD PTR SS:[EBP-207],EAX
0040C52F E8 00000000 CALL auto.0040C534 ; F8
0040C534 5B POP EBX ; auto.0040C534
0040C535 B9 54030000 MOV ECX,354
0040C53A 03D9 ADD EBX,ECX
0040C53C 50 PUSH EAX
0040C53D 53 PUSH EBX
0040C53E E8 9D020000 CALL auto.0040C7E0 ; F8
0040C543 61 POPAD
0040C544 03BD C1FDFFFF ADD EDI,DWORD PTR SS:[EBP-23F]
0040C54A EB 1B JMP SHORT auto.0040C567 ; 跳
然后到0040C607行F4，再F8。
0040C607 E8 2A010000 CALL auto.0040C736 ; F4 + f8
0040C60C 8D8D 15FEFFFF LEA ECX,DWORD PTR SS:[EBP-1EB]
0040C612 8B41 08 MOV EAX,DWORD PTR DS:[ECX+8]
0040C615 83F8 00 CMP EAX,0
0040C618 0F84 81000000 JE auto.0040C69F
在0040C6D0设断点F2, F9运行
0040C6D0 /EB 5E JMP SHORT auto.0040C730 ; F2 + F9
0040C6D2 |90 NOP
0040C6D3 |83C6 08 ADD ESI,8
0040C6D6 |B9 08000000 MOV ECX,8
0040C6DB |F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
两次JMP后来到这里：
0040A000 E9 DB E9
0040A001 07 DB 07
0040A002 00 DB 00
0040A003 00 DB 00
0040A004 00 DB 00
0040A005 00 DB 00
0040A006 00 DB 00
0040A007 00 DB 00
Ctrl + A分析代码，然后一路F7到里
0040905F > \60 PUSHAD
00409060 . 9C PUSHFD
00409061 . 9D POPFD
00409062 . 61 POPAD
00409063 . E9 00000000 JMP auto.00409068
00409068 > 8D05 4F1F4000 LEA EAX,DWORD PTR DS:[401F4F]
0040906E . 50 PUSH EAX ;哈哈OEP
0040906F . C3 RETN ;最后一次F7，然后Dump
Dump程序运行正常。
不能上传附件啊~
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
