这里我把手动脱壳的过程贴出来,希望大家练习时用手动脱,用工具脱提高不了多少水平的.当然了,对付UPX壳还可以用一些更简单的方法,比如说esp定律,内存断点,SFX大法之类都可以脱,不过这里为了让大家看得明白些我还是用手动一步一步脱吧
手动脱壳一般不要向上跳,遇到向上跳就f4跳过,远CALL用F8,近call用F7
好了正文开始,有不明白的可以在下面跟贴或加我QQ:348885333
00522FC0 > 60 pushad ;OD载入停在这里, 所有有标志位入栈对应的应该是popad,所以入口点应该在popad附近找
00522FC1 BE 00004C00 mov esi,finalrec.004C0000 ;将第二个节的虚拟地址给esi
00522FC6 8DBE 0010F4FF lea edi,dword ptr ds:[esi+FFF41000] ;目的地址为第一节,UPX加壳后的软件第一节在未解压之前是未初始化的.一般为upx0
00522FCC 57 push edi
00522FCD 83CD FF or ebp,FFFFFFFF
00522FD0 EB 10 jmp short finalrec.00522FE2 ;向下跳,F8
00522FD2 90 nop
00522FD3 90 nop
00522FD4 90 nop
00522FD5 90 nop
00522FD6 90 nop
00522FD7 90 nop
00522FD8 8A06 mov al,byte ptr ds:[esi]
00522FDA 46 inc esi
00522FDB 8807 mov byte ptr ds:[edi],al
00522FDD 47 inc edi
00522FDE 01DB add ebx,ebx
00522FE0 75 07 jnz short finalrec.00522FE9
00522FE2 8B1E mov ebx,dword ptr ds:[esi] ;到达这里,F8继续
00522FE4 83EE FC sub esi,-4
00522FE7 11DB adc ebx,ebx
00522FE9 ^ 72 ED jb short finalrec.00522FD8 ;向上跳
00522FEB B8 01000000 mov eax,1 ;F4到这里,f8继续
00522FF0 01DB add ebx,ebx
00522FF2 75 07 jnz short finalrec.00522FFB ;向下跳,f8继续
00522FF4 8B1E mov ebx,dword ptr ds:[esi]
00522FF6 83EE FC sub esi,-4
00522FF9 11DB adc ebx,ebx
00522FFB 11C0 adc eax,eax ;到这里,f8继续
00522FFD 01DB add ebx,ebx
00522FFF 73 0B jnb short finalrec.0052300C ;跳转未实现, 不用管它,f8继续
00523001 75 19 jnz short finalrec.0052301C ;向下跳,f8继续
00523003 8B1E mov ebx,dword ptr ds:[esi]
00523005 83EE FC sub esi,-4
00523008 11DB adc ebx,ebx
0052300A 72 10 jb short finalrec.0052301C
0052300C 48 dec eax
0052300D 01DB add ebx,ebx
0052300F 75 07 jnz short finalrec.00523018
00523011 8B1E mov ebx,dword ptr ds:[esi]
00523013 83EE FC sub esi,-4
00523016 11DB adc ebx,ebx
00523018 11C0 adc eax,eax
0052301A ^ EB D4 jmp short finalrec.00522FF0
0052301C 31C9 xor ecx,ecx ;到达这里,f8继续
0052301E 83E8 03 sub eax,3
00523021 72 11 jb short finalrec.00523034 ;;向下跳,f8继续
00523023 C1E0 08 shl eax,8
00523026 8A06 mov al,byte ptr ds:[esi]
00523028 46 inc esi
00523029 83F0 FF xor eax,FFFFFFFF
0052302C 74 78 je short finalrec.005230A6
0052302E D1F8 sar eax,1
00523030 89C5 mov ebp,eax
00523032 EB 0B jmp short finalrec.0052303F
00523034 01DB add ebx,ebx ;到达这里,f8继续
00523036 75 07 jnz short finalrec.0052303F ;向下跳,f8继续
00523038 8B1E mov ebx,dword ptr ds:[esi]
0052303A 83EE FC sub esi,-4
0052303D 11DB adc ebx,ebx
0052303F 11C9 adc ecx,ecx ;到达这里,f8继续
00523041 01DB add ebx,ebx
00523043 75 07 jnz short finalrec.0052304C ;向下跳,f8继续
00523045 8B1E mov ebx,dword ptr ds:[esi]
00523047 83EE FC sub esi,-4
0052304A 11DB adc ebx,ebx
0052304C 11C9 adc ecx,ecx ;到达这里,f8继续
0052304E 75 20 jnz short finalrec.00523070 ;向下跳,f8继续
00523050 41 inc ecx
00523051 01DB add ebx,ebx
00523053 75 07 jnz short finalrec.0052305C
00523055 8B1E mov ebx,dword ptr ds:[esi]
00523057 83EE FC sub esi,-4
0052305A 11DB adc ebx,ebx
0052305C 11C9 adc ecx,ecx
0052305E 01DB add ebx,ebx
00523060 ^ 73 EF jnb short finalrec.00523051
00523062 75 09 jnz short finalrec.0052306D
00523064 8B1E mov ebx,dword ptr ds:[esi]
00523066 83EE FC sub esi,-4
00523069 11DB adc ebx,ebx
0052306B ^ 73 E4 jnb short finalrec.00523051
0052306D 83C1 02 add ecx,2
00523070 81FD 00FBFFFF cmp ebp,-500 ;到达这里,f8继续
00523076 83D1 01 adc ecx,1
00523079 8D142F lea edx,dword ptr ds:[edi+ebp]
0052307C 83FD FC cmp ebp,-4
0052307F 76 0F jbe short finalrec.00523090 ;跳转未实现,不用管,f8 继续
00523081 8A02 mov al,byte ptr ds:[edx]
00523083 42 inc edx
00523084 8807 mov byte ptr ds:[edi],al
00523086 47 inc edi
00523087 49 dec ecx
00523088 ^ 75 F7 jnz short finalrec.00523081 ;向上跳转
0052308A ^ E9 4FFFFFFF jmp finalrec.00522FDE ;向上跳转
0052308F 90 nop
00523090 8B02 mov eax,dword ptr ds:[edx] ;f4到这里,从而跳过前面的两个向上跳转,手动脱壳时一般都不要向上跳转,除了今后遇到的一些猛壳除外
00523092 83C2 04 add edx,4 ;F8继续
00523095 8907 mov dword ptr ds:[edi],eax
00523097 83C7 04 add edi,4
0052309A 83E9 04 sub ecx,4
0052309D ^ 77 F1 ja short finalrec.00523090 ;向上跳
0052309F 01CF add edi,ecx ;F4到这里
005230A1 ^ E9 38FFFFFF jmp finalrec.00522FDE ;又是向上跳
005230A6 5E pop esi ;F4 到这里
005230A7 89F7 mov edi,esi
005230A9 B9 1D4D0000 mov ecx,4D1D
005230AE 8A07 mov al,byte ptr ds:[edi]
005230B0 47 inc edi
005230B1 2C E8 sub al,0E8
005230B3 3C 01 cmp al,1
005230B5 ^ 77 F7 ja short finalrec.005230AE ;向上跳
005230B7 803F 16 cmp byte ptr ds:[edi],16
005230BA ^ 75 F2 jnz short finalrec.005230AE ;又是向上跳
005230BC 8B07 mov eax,dword ptr ds:[edi] ;F4 到这里
005230BE 8A5F 04 mov bl,byte ptr ds:[edi+4] ;f8继续
005230C1 66:C1E8 08 shr ax,8
005230C5 C1C0 10 rol eax,10
005230C8 86C4 xchg ah,al
005230CA 29F8 sub eax,edi
005230CC 80EB E8 sub bl,0E8
005230CF 01F0 add eax,esi
005230D1 8907 mov dword ptr ds:[edi],eax
005230D3 83C7 05 add edi,5
005230D6 89D8 mov eax,ebx
005230D8 ^ E2 D9 loopd short finalrec.005230B3 ;loop循环向上跳转
005230DA 8DBE 00F01100 lea edi,dword ptr ds:[esi+11F000] ;F4到这里
005230E0 8B07 mov eax,dword ptr ds:[edi]
005230E2 09C0 or eax,eax
005230E4 74 3C je short finalrec.00523122 ;跳转未实现,f8继续
005230E6 8B5F 04 mov ebx,dword ptr ds:[edi+4]
005230E9 8D8430 F44A1200 lea eax,dword ptr ds:[eax+esi+124AF4]
005230F0 01F3 add ebx,esi
005230F2 50 push eax
005230F3 83C7 08 add edi,8
005230F6 FF96 D04B1200 call dword ptr ds:[esi+124BD0]
005230FC 95 xchg eax,ebp
005230FD 8A07 mov al,byte ptr ds:[edi]
005230FF 47 inc edi
00523100 08C0 or al,al
00523102 ^ 74 DC je short finalrec.005230E0 ;跳转未实现f8继续
00523104 89F9 mov ecx,edi
00523106 57 push edi
00523107 48 dec eax
00523108 F2:AE repne scas byte ptr es:[edi]
0052310A 55 push ebp
0052310B FF96 D44B1200 call dword ptr ds:[esi+124BD4]
00523111 09C0 or eax,eax
00523113 74 07 je short finalrec.0052311C ;跳转未实现f8继续
00523115 8903 mov dword ptr ds:[ebx],eax
00523117 83C3 04 add ebx,4
0052311A ^ EB E1 jmp short finalrec.005230FD ;向上跳转
0052311C FF96 D84B1200 call dword ptr ds:[esi+124BD8] ;不要F4到这里,一跳就必然跑飞
00523122 61 popad ;f4到这里,popad所有的寄存器出栈,入口点就在附近,F8继续
00523123 - E9 ACC5F8FF jmp finalrec.004AF6D4 ;跨段跳跃,F8到达OEP
----------------------------------------------------
004AF6D4 55 push ebp ;oep,脱壳就搞定了,不用手动修复输入表
004AF6D5 8BEC mov ebp,esp
004AF6D7 33C9 xor ecx,ecx