[求助]请问这是rockey4的壳吗？-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

最新回复 (10)
skylly 雪币： 304 活跃值： (82) 能力值： ( LV9，RANK：170 ) 在线值：发帖 70 回帖 1087 粉丝 2 关注私信	skylly 4 2 楼貌似是的~~~~~~~~~ 2007-8-5 15:44 0
starsoul 雪币： 49 活跃值： (156) 能力值： ( LV2，RANK：10 ) 在线值：发帖 32 回帖 100 粉丝 0 关注私信	starsoul 3 楼经过跟踪也发现有rockey4的字符,但这个区段和别的又不大一样,不知道RYDNG与RY4SHL有什么区别? 2007-8-5 16:09 0
starsoul 雪币： 49 活跃值： (156) 能力值： ( LV2，RANK：10 ) 在线值：发帖 32 回帖 100 粉丝 0 关注私信	starsoul 4 楼没人知道吗？难道这个壳要补区段? 2007-8-6 19:58 0
luzhmu 雪币： 86 活跃值： (1043) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 647 粉丝 7 关注私信	luzhmu 5 楼你的是rockey4狗加的壳 2007-8-6 23:22 0
luzhmu 雪币： 86 活跃值： (1043) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 647 粉丝 7 关注私信	luzhmu 6 楼带狗脱跟脱UPX一样简单 2007-8-7 00:27 0
starsoul 雪币： 49 活跃值： (156) 能力值： ( LV2，RANK：10 ) 在线值：发帖 32 回帖 100 粉丝 0 关注私信	starsoul 7 楼带狗找OEP确实简单,和压缩壳差不多,但很多函数是错误的,用ImportREC的跟踪级别1可以找到所有函数,但还是显示是假的,不知道luzhmu大哥在这种程序的修复方面有没什么方法?我还是第一次脱狗壳,以前一直没加密狗不敢碰.呵呵. 我这有个rockey4的crackme,和我的完全都不一样,IAT根本就用不着修复,而且不用狗也能找到OEP脱壳,crackme在附件里. 0069D000 > 55 push ebp ; EP1(ROCKEY4) 0069D001 8BEC mov ebp, esp 0069D003 83EC 54 sub esp, 54 0069D006 53 push ebx 0069D007 56 push esi 0069D008 57 push edi 0069D009 E8 72090000 call 0069D980 0069D00E 8BD8 mov ebx, eax 0069D010 E8 00000000 call 0069D015 0069D015 5A pop edx 0069D016 83EA 15 sub edx, 15 0069D019 66:833B 01 cmp word ptr [ebx], 1 0069D01D 0F84 D8040000 je 0069D4FB 0069D023 66:C703 0100 mov word ptr [ebx], 1 0069D028 8953 1A mov dword ptr [ebx+1A], edx 0069D02B 2B53 16 sub edx, dword ptr [ebx+16] 0069D02E 8953 12 mov dword ptr [ebx+12], edx 0069D031 B9 00000000 mov ecx, 0 0069D036 8B73 1E mov esi, dword ptr [ebx+1E] 0069D039 03F2 add esi, edx 0069D03B 8973 22 mov dword ptr [ebx+22], esi 0069D03E 8B7B 26 mov edi, dword ptr [ebx+26] 0069D041 03FA add edi, edx 0069D043 897B 2A mov dword ptr [ebx+2A], edi 0069D046 8B048E mov eax, dword ptr [esi+ecx4] 0069D049 83F8 00 cmp eax, 0 0069D04C 74 19 je short 0069D067 0069D04E 8B148F mov edx, dword ptr [edi+ecx4] 0069D051 81FA 00000080 cmp edx, 80000000 0069D057 72 0E jb short 0069D067 0069D059 81F2 00000080 xor edx, 80000000 0069D05F 0353 12 add edx, dword ptr [ebx+12] 0069D062 8B048E mov eax, dword ptr [esi+ecx4] 0069D065 8902 mov dword ptr [edx], eax 0069D067 41 inc ecx 0069D068 3B4B 2E cmp ecx, dword ptr [ebx+2E] 0069D06B ^ 72 D9 jb short 0069D046 0069D06D 895D FC mov dword ptr [ebp-4], ebx 0069D070 E8 FB040000 call 0069D570 0069D075 25 FFFF0000 and eax, 0FFFF 0069D07A 85C0 test eax, eax 0069D07C 74 05 je short 0069D083 0069D07E E9 B8040000 jmp 0069D53B 0069D083 66:C745 E4 0000 mov word ptr [ebp-1C], 0 0069D089 C745 F0 0800000>mov dword ptr [ebp-10], 8 0069D090 66:C745 C4 0000 mov word ptr [ebp-3C], 0 0069D096 8B45 FC mov eax, dword ptr [ebp-4] 0069D099 33C9 xor ecx, ecx 0069D09B 66:8B88 EE04000>mov cx, word ptr [eax+4EE] 0069D0A2 894D B8 mov dword ptr [ebp-48], ecx 0069D0A5 8B55 B8 mov edx, dword ptr [ebp-48] 0069D0A8 C1E2 10 shl edx, 10 0069D0AB 8B45 FC mov eax, dword ptr [ebp-4] 0069D0AE 33C9 xor ecx, ecx 0069D0B0 66:8B88 F004000>mov cx, word ptr [eax+4F0] 0069D0B7 0BD1 or edx, ecx 0069D0B9 8955 B8 mov dword ptr [ebp-48], edx 0069D0BC 8B55 FC mov edx, dword ptr [ebp-4] 0069D0BF 33C0 xor eax, eax 0069D0C1 66:8B42 04 mov ax, word ptr [edx+4] 0069D0C5 8B4D FC mov ecx, dword ptr [ebp-4] 0069D0C8 33D2 xor edx, edx 0069D0CA 66:8B91 EE04000>mov dx, word ptr [ecx+4EE] 0069D0D1 33C2 xor eax, edx 0069D0D3 8B4D FC mov ecx, dword ptr [ebp-4] 0069D0D6 66:8941 04 mov word ptr [ecx+4], ax 0069D0DA 8B55 FC mov edx, dword ptr [ebp-4] 0069D0DD 8B42 06 mov eax, dword ptr [edx+6] 0069D0E0 3345 B8 xor eax, dword ptr [ebp-48] 0069D0E3 8B4D FC mov ecx, dword ptr [ebp-4] 0069D0E6 8941 06 mov dword ptr [ecx+6], eax 0069D0E9 8B55 E4 mov edx, dword ptr [ebp-1C] 0069D0EC 81E2 FFFF0000 and edx, 0FFFF 0069D0F2 83FA 02 cmp edx, 2 0069D0F5 0F84 AF010000 je 0069D2AA 0069D0FB 8B45 FC mov eax, dword ptr [ebp-4] 0069D0FE 33C9 xor ecx, ecx 0069D100 66:8B88 EE04000>mov cx, word ptr [eax+4EE] 0069D107 81F1 FFFF0000 xor ecx, 0FFFF 0069D10D 66:894D E8 mov word ptr [ebp-18], cx 0069D111 8B55 FC mov edx, dword ptr [ebp-4] 0069D114 33C0 xor eax, eax 0069D116 66:8B82 F004000>mov ax, word ptr [edx+4F0] 0069D11D 35 FFFF0000 xor eax, 0FFFF 0069D122 66:8945 E0 mov word ptr [ebp-20], ax 0069D126 66:C745 D4 0000 mov word ptr [ebp-2C], 0 0069D12C 66:C745 B4 0000 mov word ptr [ebp-4C], 0 0069D132 8B4D E4 mov ecx, dword ptr [ebp-1C] 0069D135 81E1 FFFF0000 and ecx, 0FFFF 0069D13B 85C9 test ecx, ecx 0069D13D 75 40 jnz short 0069D17F 0069D13F 8D55 BC lea edx, dword ptr [ebp-44] 0069D142 52 push edx 0069D143 8D45 B4 lea eax, dword ptr [ebp-4C] 0069D146 50 push eax 0069D147 8D4D D4 lea ecx, dword ptr [ebp-2C] 0069D14A 51 push ecx 0069D14B 8D55 E0 lea edx, dword ptr [ebp-20] 0069D14E 52 push edx 0069D14F 8D45 E8 lea eax, dword ptr [ebp-18] 0069D152 50 push eax 0069D153 8D4D B0 lea ecx, dword ptr [ebp-50] 0069D156 51 push ecx 0069D157 8D55 B8 lea edx, dword ptr [ebp-48] 0069D15A 52 push edx 0069D15B 8D45 D0 lea eax, dword ptr [ebp-30] 0069D15E 50 push eax 0069D15F 6A 01 push 1 0069D161 E8 4A070000 call 0069D8B0 ; 第一次读狗 0069D166 83C4 24 add esp, 24 0069D169 25 FFFF0000 and eax, 0FFFF 0069D16E 85C0 test eax, eax ; EAX必须清零，则有狗 0069D170 74 05 je short 0069D177 ; 必须跳 0069D172 E9 BF030000 jmp 0069D536 0069D177 66:C745 E4 0100 mov word ptr [ebp-1C], 1 0069D17D EB 38 jmp short 0069D1B7 0069D17F 8D4D BC lea ecx, dword ptr [ebp-44] 0069D182 51 push ecx 0069D183 8D55 B4 lea edx, dword ptr [ebp-4C] 0069D186 52 push edx 0069D187 8D45 D4 lea eax, dword ptr [ebp-2C] 0069D18A 50 push eax 0069D18B 8D4D E0 lea ecx, dword ptr [ebp-20] 0069D18E 51 push ecx 0069D18F 8D55 E8 lea edx, dword ptr [ebp-18] 0069D192 52 push edx 0069D193 8D45 B0 lea eax, dword ptr [ebp-50] 0069D196 50 push eax 0069D197 8D4D B8 lea ecx, dword ptr [ebp-48] 0069D19A 51 push ecx 0069D19B 8D55 D0 lea edx, dword ptr [ebp-30] 0069D19E 52 push edx 0069D19F 6A 02 push 2 0069D1A1 E8 0A070000 call 0069D8B0 0069D1A6 83C4 24 add esp, 24 0069D1A9 25 FFFF0000 and eax, 0FFFF 0069D1AE 85C0 test eax, eax 0069D1B0 74 05 je short 0069D1B7 0069D1B2 E9 7F030000 jmp 0069D536 0069D1B7 8B45 FC mov eax, dword ptr [ebp-4] 0069D1BA 33C9 xor ecx, ecx 0069D1BC 66:8B48 04 mov cx, word ptr [eax+4] 0069D1C0 83E1 40 and ecx, 40 0069D1C3 85C9 test ecx, ecx 0069D1C5 74 1D je short 0069D1E4 0069D1C7 8B55 FC mov edx, dword ptr [ebp-4] 0069D1CA 8B45 B8 mov eax, dword ptr [ebp-48] 0069D1CD 3B42 06 cmp eax, dword ptr [edx+6] 0069D1D0 74 05 je short 0069D1D7 0069D1D2 ^ E9 12FFFFFF jmp 0069D0E9 0069D1D7 8B4D B8 mov ecx, dword ptr [ebp-48] 0069D1DA 894D C6 mov dword ptr [ebp-3A], ecx 0069D1DD C745 F0 0E00000>mov dword ptr [ebp-10], 0E 0069D1E4 8D55 BC lea edx, dword ptr [ebp-44] 0069D1E7 52 push edx 0069D1E8 8D45 B4 lea eax, dword ptr [ebp-4C] 0069D1EB 50 push eax 0069D1EC 8D4D D4 lea ecx, dword ptr [ebp-2C] 0069D1EF 51 push ecx 0069D1F0 8D55 E0 lea edx, dword ptr [ebp-20] 0069D1F3 52 push edx 0069D1F4 8D45 E8 lea eax, dword ptr [ebp-18] 0069D1F7 50 push eax 0069D1F8 8D4D B0 lea ecx, dword ptr [ebp-50] 0069D1FB 51 push ecx 0069D1FC 8D55 B8 lea edx, dword ptr [ebp-48] 0069D1FF 52 push edx 0069D200 8D45 D0 lea eax, dword ptr [ebp-30] 0069D203 50 push eax 0069D204 6A 03 push 3 0069D206 E8 A5060000 call 0069D8B0 ; 第二次读狗 0069D20B 83C4 24 add esp, 24 0069D20E 25 FFFF0000 and eax, 0FFFF 0069D213 85C0 test eax, eax ; EAX必须清零，则有狗 0069D215 74 05 je short 0069D21C ; 必须跳 0069D217 E9 1A030000 jmp 0069D536 0069D21C 8B4D FC mov ecx, dword ptr [ebp-4] 0069D21F 33D2 xor edx, edx 0069D221 66:8B51 04 mov dx, word ptr [ecx+4] 0069D225 83E2 20 and edx, 20 0069D228 85D2 test edx, edx 0069D22A 74 73 je short 0069D29F ; 第二次读狗成功此处跳转 0069D22C 8B45 FC mov eax, dword ptr [ebp-4] 0069D22F 33C9 xor ecx, ecx 0069D231 66:8B48 04 mov cx, word ptr [eax+4] 0069D235 83E1 0F and ecx, 0F 0069D238 66:894D E8 mov word ptr [ebp-18], cx 0069D23C 8D55 BC lea edx, dword ptr [ebp-44] 0069D23F 52 push edx 0069D240 8D45 B4 lea eax, dword ptr [ebp-4C] 0069D243 50 push eax 0069D244 8D4D D4 lea ecx, dword ptr [ebp-2C] 0069D247 51 push ecx 0069D248 8D55 E0 lea edx, dword ptr [ebp-20] 0069D24B 52 push edx 0069D24C 8D45 E8 lea eax, dword ptr [ebp-18] 0069D24F 50 push eax 0069D250 8D4D B0 lea ecx, dword ptr [ebp-50] 0069D253 51 push ecx 0069D254 8D55 B8 lea edx, dword ptr [ebp-48] 0069D257 52 push edx 0069D258 8D45 D0 lea eax, dword ptr [ebp-30] 0069D25B 50 push eax 0069D25C 6A 0C push 0C 0069D25E E8 4D060000 call 0069D8B0 ; (第三次读狗)忽略 0069D263 83C4 24 add esp, 24 0069D266 25 FFFF0000 and eax, 0FFFF 0069D26B 85C0 test eax, eax 0069D26D 74 05 je short 0069D274 0069D26F E9 98020000 jmp 0069D50C 0069D274 8B4D E0 mov ecx, dword ptr [ebp-20] 0069D277 81E1 FFFF0000 and ecx, 0FFFF 0069D27D 83F9 01 cmp ecx, 1 0069D280 74 05 je short 0069D287 0069D282 ^ E9 62FEFFFF jmp 0069D0E9 0069D287 8B55 FC mov edx, dword ptr [ebp-4] 0069D28A 66:8B42 04 mov ax, word ptr [edx+4] 0069D28E 66:8945 C4 mov word ptr [ebp-3C], ax 0069D292 837D F0 08 cmp dword ptr [ebp-10], 8 0069D296 75 07 jnz short 0069D29F 0069D298 C745 F0 0A00000>mov dword ptr [ebp-10], 0A 0069D29F 66:C745 E4 0200 mov word ptr [ebp-1C], 2 0069D2A5 ^ E9 3FFEFFFF jmp 0069D0E9 0069D2AA 8B4D FC mov ecx, dword ptr [ebp-4] 0069D2AD 83C1 32 add ecx, 32 0069D2B0 894D AC mov dword ptr [ebp-54], ecx 0069D2B3 8B55 AC mov edx, dword ptr [ebp-54] 0069D2B6 833A 00 cmp dword ptr [edx], 0 ; EAX必须清零，则有狗 0069D2B9 0F84 CA000000 je 0069D389 ; 必须跳 0069D2BF 8B45 AC mov eax, dword ptr [ebp-54] 0069D2C2 8378 08 01 cmp dword ptr [eax+8], 1 0069D2C6 0F85 AF000000 jnz 0069D37B 0069D2CC 8B4D AC mov ecx, dword ptr [ebp-54] 0069D2CF 8B11 mov edx, dword ptr [ecx] 0069D2D1 8955 B0 mov dword ptr [ebp-50], edx 0069D2D4 8D45 BC lea eax, dword ptr [ebp-44] 0069D2D7 50 push eax 0069D2D8 8D4D B4 lea ecx, dword ptr [ebp-4C] 0069D2DB 51 push ecx 0069D2DC 8D55 D4 lea edx, dword ptr [ebp-2C] 0069D2DF 52 push edx 0069D2E0 8D45 E0 lea eax, dword ptr [ebp-20] 0069D2E3 50 push eax 0069D2E4 8D4D E8 lea ecx, dword ptr [ebp-18] 0069D2E7 51 push ecx 0069D2E8 8D55 B0 lea edx, dword ptr [ebp-50] 0069D2EB 52 push edx 0069D2EC 8D45 B8 lea eax, dword ptr [ebp-48] 0069D2EF 50 push eax 0069D2F0 8D4D D0 lea ecx, dword ptr [ebp-30] 0069D2F3 51 push ecx 0069D2F4 6A 08 push 8 0069D2F6 E8 B5050000 call 0069D8B0 0069D2FB 83C4 24 add esp, 24 0069D2FE 25 FFFF0000 and eax, 0FFFF 0069D303 85C0 test eax, eax 0069D305 74 05 je short 0069D30C 0069D307 E9 00020000 jmp 0069D50C 0069D30C 66:8B55 E8 mov dx, word ptr [ebp-18] 0069D310 66:8955 BC mov word ptr [ebp-44], dx 0069D314 66:8B45 E0 mov ax, word ptr [ebp-20] 0069D318 66:8945 BE mov word ptr [ebp-42], ax 0069D31C 66:8B4D D4 mov cx, word ptr [ebp-2C] 0069D320 66:894D C0 mov word ptr [ebp-40], cx 0069D324 66:8B55 B4 mov dx, word ptr [ebp-4C] 0069D328 66:8955 C2 mov word ptr [ebp-3E], dx 0069D32C 8B45 FC mov eax, dword ptr [ebp-4] 0069D32F 8B48 12 mov ecx, dword ptr [eax+12] 0069D332 8B55 AC mov edx, dword ptr [ebp-54] 0069D335 030A add ecx, dword ptr [edx] 0069D337 894D F4 mov dword ptr [ebp-C], ecx 0069D33A C745 D8 0000000>mov dword ptr [ebp-28], 0 0069D341 EB 09 jmp short 0069D34C 0069D343 8B45 D8 mov eax, dword ptr [ebp-28] 0069D346 83C0 01 add eax, 1 0069D349 8945 D8 mov dword ptr [ebp-28], eax 0069D34C 8B4D AC mov ecx, dword ptr [ebp-54] 0069D34F 8B55 D8 mov edx, dword ptr [ebp-28] 0069D352 3B51 04 cmp edx, dword ptr [ecx+4] 0069D355 73 24 jnb short 0069D37B 0069D357 8B45 F4 mov eax, dword ptr [ebp-C] 0069D35A 0345 D8 add eax, dword ptr [ebp-28] 0069D35D 33C9 xor ecx, ecx 0069D35F 8A08 mov cl, byte ptr [eax] 0069D361 8B45 D8 mov eax, dword ptr [ebp-28] 0069D364 33D2 xor edx, edx 0069D366 F775 F0 div dword ptr [ebp-10] 0069D369 33C0 xor eax, eax 0069D36B 8A4415 BC mov al, byte ptr [ebp+edx-44] 0069D36F 33C8 xor ecx, eax 0069D371 8B55 F4 mov edx, dword ptr [ebp-C] 0069D374 0355 D8 add edx, dword ptr [ebp-28] 0069D377 880A mov byte ptr [edx], cl 0069D379 ^ EB C8 jmp short 0069D343 0069D37B 8B45 AC mov eax, dword ptr [ebp-54] 0069D37E 83C0 0C add eax, 0C 0069D381 8945 AC mov dword ptr [ebp-54], eax 0069D384 ^ E9 2AFFFFFF jmp 0069D2B3 0069D389 8D4D BC lea ecx, dword ptr [ebp-44] 0069D38C 51 push ecx 0069D38D 8D55 B4 lea edx, dword ptr [ebp-4C] 0069D390 52 push edx 0069D391 8D45 D4 lea eax, dword ptr [ebp-2C] 0069D394 50 push eax 0069D395 8D4D E0 lea ecx, dword ptr [ebp-20] 0069D398 51 push ecx 0069D399 8D55 E8 lea edx, dword ptr [ebp-18] 0069D39C 52 push edx 0069D39D 8D45 B0 lea eax, dword ptr [ebp-50] 0069D3A0 50 push eax 0069D3A1 8D4D B8 lea ecx, dword ptr [ebp-48] 0069D3A4 51 push ecx 0069D3A5 8D55 D0 lea edx, dword ptr [ebp-30] 0069D3A8 52 push edx 0069D3A9 6A 04 push 4 0069D3AB E8 00050000 call 0069D8B0 ; 第四次读狗 0069D3B0 83C4 24 add esp, 24 0069D3B3 25 FFFF0000 and eax, 0FFFF 0069D3B8 85C0 test eax, eax ; EAX必须清零，则有狗 0069D3BA 74 25 je short 0069D3E1 ; 必须跳 0069D3BC 6A 00 push 0 0069D3BE 8B45 FC mov eax, dword ptr [ebp-4] 0069D3C1 05 5A050000 add eax, 55A 0069D3C6 50 push eax 0069D3C7 8B4D FC mov ecx, dword ptr [ebp-4] 0069D3CA 81C1 8C050000 add ecx, 58C 0069D3D0 51 push ecx 0069D3D1 6A 00 push 0 0069D3D3 8B55 FC mov edx, dword ptr [ebp-4] 0069D3D6 FF92 0A050000 call dword ptr [edx+50A] 0069D3DC E9 7B010000 jmp 0069D55C 0069D3E1 E8 3A020000 call 0069D620 0069D3E6 8B5D FC mov ebx, dword ptr [ebp-4] 0069D3E9 8B83 E2040000 mov eax, dword ptr [ebx+4E2] 0069D3EF 83F8 00 cmp eax, 0 ; EAX必须清零，则有狗 0069D3F2 0F84 D4000000 je 0069D4CC ; 必须跳 0069D3F8 0343 12 add eax, dword ptr [ebx+12] 0069D3FB 8983 E6040000 mov dword ptr [ebx+4E6], eax 0069D401 8B43 12 mov eax, dword ptr [ebx+12] 0069D404 2B43 0E sub eax, dword ptr [ebx+E] 0069D407 8945 CC mov dword ptr [ebp-34], eax 0069D40A 8B45 FC mov eax, dword ptr [ebp-4] 0069D40D 8B88 E6040000 mov ecx, dword ptr [eax+4E6] 0069D413 8379 04 00 cmp dword ptr [ecx+4], 0 0069D417 0F84 AF000000 je 0069D4CC 0069D41D 8B55 FC mov edx, dword ptr [ebp-4] 0069D420 8B82 E6040000 mov eax, dword ptr [edx+4E6] 0069D426 8B48 04 mov ecx, dword ptr [eax+4] 0069D429 83E9 08 sub ecx, 8 0069D42C D1E9 shr ecx, 1 0069D42E 894D F8 mov dword ptr [ebp-8], ecx 0069D431 8B55 FC mov edx, dword ptr [ebp-4] 0069D434 8B82 E6040000 mov eax, dword ptr [edx+4E6] 0069D43A 83C0 08 add eax, 8 0069D43D 8945 EC mov dword ptr [ebp-14], eax 0069D440 C745 D8 0000000>mov dword ptr [ebp-28], 0 0069D447 EB 09 jmp short 0069D452 0069D449 8B4D D8 mov ecx, dword ptr [ebp-28] 0069D44C 83C1 01 add ecx, 1 0069D44F 894D D8 mov dword ptr [ebp-28], ecx 0069D452 8B55 D8 mov edx, dword ptr [ebp-28] 0069D455 3B55 F8 cmp edx, dword ptr [ebp-8] 0069D458 73 4F jnb short 0069D4A9 0069D45A 8B45 EC mov eax, dword ptr [ebp-14] 0069D45D 33C9 xor ecx, ecx 0069D45F 66:8B08 mov cx, word ptr [eax] 0069D462 81E1 00F00000 and ecx, 0F000 0069D468 C1F9 0C sar ecx, 0C 0069D46B 83F9 03 cmp ecx, 3 0069D46E 75 2E jnz short 0069D49E 0069D470 8B55 EC mov edx, dword ptr [ebp-14] 0069D473 33C0 xor eax, eax 0069D475 66:8B02 mov ax, word ptr [edx] 0069D478 25 FF0F0000 and eax, 0FFF 0069D47D 8B4D FC mov ecx, dword ptr [ebp-4] 0069D480 8B91 E6040000 mov edx, dword ptr [ecx+4E6] 0069D486 0302 add eax, dword ptr [edx] 0069D488 8B4D FC mov ecx, dword ptr [ebp-4] 0069D48B 0341 12 add eax, dword ptr [ecx+12] 0069D48E 8945 DC mov dword ptr [ebp-24], eax 0069D491 8B55 DC mov edx, dword ptr [ebp-24] 0069D494 8B02 mov eax, dword ptr [edx] 0069D496 0345 CC add eax, dword ptr [ebp-34] 0069D499 8B4D DC mov ecx, dword ptr [ebp-24] 0069D49C 8901 mov dword ptr [ecx], eax 0069D49E 8B55 EC mov edx, dword ptr [ebp-14] 0069D4A1 83C2 02 add edx, 2 0069D4A4 8955 EC mov dword ptr [ebp-14], edx 0069D4A7 ^ EB A0 jmp short 0069D449 0069D4A9 8B45 FC mov eax, dword ptr [ebp-4] 0069D4AC 8B88 E6040000 mov ecx, dword ptr [eax+4E6] 0069D4B2 8B55 FC mov edx, dword ptr [ebp-4] 0069D4B5 8B82 E6040000 mov eax, dword ptr [edx+4E6] 0069D4BB 0341 04 add eax, dword ptr [ecx+4] 0069D4BE 8B4D FC mov ecx, dword ptr [ebp-4] 0069D4C1 8981 E6040000 mov dword ptr [ecx+4E6], eax 0069D4C7 ^ E9 3EFFFFFF jmp 0069D40A 0069D4CC 8B5D FC mov ebx, dword ptr [ebp-4] 0069D4CF B9 00000000 mov ecx, 0 0069D4D4 8B73 22 mov esi, dword ptr [ebx+22] 0069D4D7 8B7B 2A mov edi, dword ptr [ebx+2A] 0069D4DA 8B048E mov eax, dword ptr [esi+ecx4] 0069D4DD 83F8 00 cmp eax, 0 0069D4E0 74 13 je short 0069D4F5 0069D4E2 8B148F mov edx, dword ptr [edi+ecx4] 0069D4E5 81FA 00000080 cmp edx, 80000000 0069D4EB 73 08 jnb short 0069D4F5 0069D4ED 0353 12 add edx, dword ptr [ebx+12] 0069D4F0 8B048E mov eax, dword ptr [esi+ecx4] 0069D4F3 8902 mov dword ptr [edx], eax 0069D4F5 41 inc ecx 0069D4F6 3B4B 2E cmp ecx, dword ptr [ebx+2E] 0069D4F9 ^ 72 DF jb short 0069D4DA 0069D4FB 8B83 EA040000 mov eax, dword ptr [ebx+4EA] 0069D501 0343 12 add eax, dword ptr [ebx+12] 0069D504 5F pop edi 0069D505 5E pop esi 0069D506 5B pop ebx 0069D507 8BE5 mov esp, ebp 0069D509 5D pop ebp 0069D50A FFE0 jmp eax ; //解码完毕，飞向OEP（ASPack入口）再按照ASPack的方法脱壳就行了,不用修复IAT. 上传的附件： QCReportP.rar （766.46kb，63次下载） 2007-8-7 15:26 0
luzhmu 雪币： 86 活跃值： (1043) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 647 粉丝 7 关注私信	luzhmu 8 楼呵呵。。需要手工找回些函数。。有狗脱没什么难度。。老兄看看手工修复IAT的文章就可以了 2007-8-7 17:51 0
luzhmu 雪币： 86 活跃值： (1043) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 647 粉丝 7 关注私信	luzhmu 9 楼 0069D30C 66:8B55 E8 MOV DX,WORD PTR SS:[EBP-18] 0069D310 66:8955 BC MOV WORD PTR SS:[EBP-44],DX 0069D314 66:8B45 E0 MOV AX,WORD PTR SS:[EBP-20] 0069D318 66:8945 BE MOV WORD PTR SS:[EBP-42],AX 0069D31C 66:8B4D D4 MOV CX,WORD PTR SS:[EBP-2C] 0069D320 66:894D C0 MOV WORD PTR SS:[EBP-40],CX 0069D324 66:8B55 B4 MOV DX,WORD PTR SS:[EBP-4C] 0069D328 66:8955 C2 MOV WORD PTR SS:[EBP-3E],DX 2007-8-7 19:17 0
starsoul 雪币： 49 活跃值： (156) 能力值： ( LV2，RANK：10 ) 在线值：发帖 32 回帖 100 粉丝 0 关注私信	starsoul 10 楼我用IMRc的跟踪级别1可以全部找到,而且我跟了一下和跟踪级别1的函数是一样的,也就是说可以用跟踪级别1找到所有函数,但还是显示假,图片我发在这里了. http://bbs.pediy.com/showthread.php?p=342896#post342896 2007-8-7 20:52 0
luzhmu 雪币： 86 活跃值： (1043) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 647 粉丝 7 关注私信	luzhmu 11 楼 ImportREC只是工具，有时候也不管用的。。需要手工恢复 2007-8-8 21:42 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

skylly

雪币： 304

活跃值： (82)

能力值：

( LV9，RANK：170 )

在线值：

发帖

70

回帖

1087

粉丝

2

关注

私信

skylly 4: 2 楼

貌似是的~~~~~~~~~

2007-8-5 15:44

0

starsoul

雪币： 49

活跃值： (156)

能力值：

( LV2，RANK：10 )

在线值：

发帖

32

回帖

100

粉丝

0

关注

私信

starsoul: 3 楼

经过跟踪也发现有rockey4的字符,但这个区段和别的又不大一样,不知道RYDNG与RY4SHL有什么区别?

2007-8-5 16:09

0

starsoul

雪币： 49

活跃值： (156)

能力值：

( LV2，RANK：10 )

在线值：

发帖

32

回帖

100

粉丝

0

关注

私信

starsoul: 4 楼

没人知道吗？难道这个壳要补区段?

2007-8-6 19:58

0

luzhmu

雪币： 86

活跃值： (1043)

能力值：

( LV2，RANK：10 )

在线值：

发帖

5

回帖

647

粉丝

7

关注

私信

luzhmu: 5 楼

你的是rockey4狗加的壳

2007-8-6 23:22

0

luzhmu

雪币： 86

活跃值： (1043)

能力值：

( LV2，RANK：10 )

在线值：

发帖

5

回帖

647

粉丝

7

关注

私信

luzhmu: 6 楼

带狗脱跟脱UPX一样简单

2007-8-7 00:27

0

starsoul

雪币： 49

活跃值： (156)

能力值：

( LV2，RANK：10 )

在线值：

发帖

32

回帖

100

粉丝

0

关注

私信

starsoul: 7 楼

带狗找OEP确实简单,和压缩壳差不多,但很多函数是错误的,用ImportREC的跟踪级别1可以找到所有函数,但还是显示是假的,不知道luzhmu大哥在这种程序的修复方面有没什么方法?我还是第一次脱狗壳,以前一直没加密狗不敢碰.呵呵.
我这有个rockey4的crackme,和我的完全都不一样,IAT根本就用不着修复,而且不用狗也能找到OEP脱壳,crackme在附件里.
0069D000 >  55             push ebp                            ; EP1(ROCKEY4)
0069D001 8BEC          mov    ebp, esp
0069D003 83EC 54       sub    esp, 54
0069D006 53             push ebx
0069D007 56             push esi
0069D008 57             push edi
0069D009 E8 72090000    call 0069D980
0069D00E 8BD8          mov    ebx, eax
0069D010 E8 00000000    call 0069D015
0069D015 5A             pop    edx
0069D016 83EA 15       sub    edx, 15
0069D019 66:833B 01    cmp    word ptr [ebx], 1
0069D01D 0F84 D8040000 je    0069D4FB
0069D023 66:C703 0100 mov    word ptr [ebx], 1
0069D028 8953 1A       mov    dword ptr [ebx+1A], edx
0069D02B 2B53 16       sub    edx, dword ptr [ebx+16]
0069D02E 8953 12       mov    dword ptr [ebx+12], edx
0069D031 B9 00000000    mov    ecx, 0
0069D036 8B73 1E       mov    esi, dword ptr [ebx+1E]
0069D039 03F2          add    esi, edx
0069D03B 8973 22       mov    dword ptr [ebx+22], esi
0069D03E 8B7B 26       mov    edi, dword ptr [ebx+26]
0069D041 03FA          add    edi, edx
0069D043 897B 2A       mov    dword ptr [ebx+2A], edi
0069D046 8B048E       mov    eax, dword ptr [esi+ecx*4]
0069D049 83F8 00       cmp    eax, 0
0069D04C 74 19          je    short 0069D067
0069D04E 8B148F       mov    edx, dword ptr [edi+ecx*4]
0069D051 81FA 00000080 cmp    edx, 80000000
0069D057 72 0E          jb    short 0069D067
0069D059 81F2 00000080 xor    edx, 80000000
0069D05F 0353 12       add    edx, dword ptr [ebx+12]
0069D062 8B048E       mov    eax, dword ptr [esi+ecx*4]
0069D065 8902          mov    dword ptr [edx], eax
0069D067 41             inc    ecx
0069D068 3B4B 2E       cmp    ecx, dword ptr [ebx+2E]
0069D06B  ^ 72 D9          jb    short 0069D046
0069D06D 895D FC       mov    dword ptr [ebp-4], ebx
0069D070 E8 FB040000    call 0069D570
0069D075 25 FFFF0000    and    eax, 0FFFF
0069D07A 85C0          test eax, eax
0069D07C 74 05          je    short 0069D083
0069D07E E9 B8040000    jmp    0069D53B
0069D083 66:C745 E4 0000 mov    word ptr [ebp-1C], 0
0069D089 C745 F0 0800000>mov    dword ptr [ebp-10], 8
0069D090 66:C745 C4 0000 mov    word ptr [ebp-3C], 0
0069D096 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D099 33C9          xor    ecx, ecx
0069D09B 66:8B88 EE04000>mov    cx, word ptr [eax+4EE]
0069D0A2 894D B8       mov    dword ptr [ebp-48], ecx
0069D0A5 8B55 B8       mov    edx, dword ptr [ebp-48]
0069D0A8 C1E2 10       shl    edx, 10
0069D0AB 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D0AE 33C9          xor    ecx, ecx
0069D0B0 66:8B88 F004000>mov    cx, word ptr [eax+4F0]
0069D0B7 0BD1          or    edx, ecx
0069D0B9 8955 B8       mov    dword ptr [ebp-48], edx
0069D0BC 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D0BF 33C0          xor    eax, eax
0069D0C1 66:8B42 04    mov    ax, word ptr [edx+4]
0069D0C5 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D0C8 33D2          xor    edx, edx
0069D0CA 66:8B91 EE04000>mov    dx, word ptr [ecx+4EE]
0069D0D1 33C2          xor    eax, edx
0069D0D3 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D0D6 66:8941 04    mov    word ptr [ecx+4], ax
0069D0DA 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D0DD 8B42 06       mov    eax, dword ptr [edx+6]
0069D0E0 3345 B8       xor    eax, dword ptr [ebp-48]
0069D0E3 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D0E6 8941 06       mov    dword ptr [ecx+6], eax
0069D0E9 8B55 E4       mov    edx, dword ptr [ebp-1C]
0069D0EC 81E2 FFFF0000 and    edx, 0FFFF
0069D0F2 83FA 02       cmp    edx, 2
0069D0F5 0F84 AF010000 je    0069D2AA
0069D0FB 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D0FE 33C9          xor    ecx, ecx
0069D100 66:8B88 EE04000>mov    cx, word ptr [eax+4EE]
0069D107 81F1 FFFF0000 xor    ecx, 0FFFF
0069D10D 66:894D E8    mov    word ptr [ebp-18], cx
0069D111 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D114 33C0          xor    eax, eax
0069D116 66:8B82 F004000>mov    ax, word ptr [edx+4F0]
0069D11D 35 FFFF0000    xor    eax, 0FFFF
0069D122 66:8945 E0    mov    word ptr [ebp-20], ax
0069D126 66:C745 D4 0000 mov    word ptr [ebp-2C], 0
0069D12C 66:C745 B4 0000 mov    word ptr [ebp-4C], 0
0069D132 8B4D E4       mov    ecx, dword ptr [ebp-1C]
0069D135 81E1 FFFF0000 and    ecx, 0FFFF
0069D13B 85C9          test ecx, ecx
0069D13D 75 40          jnz    short 0069D17F
0069D13F 8D55 BC       lea    edx, dword ptr [ebp-44]
0069D142 52             push edx
0069D143 8D45 B4       lea    eax, dword ptr [ebp-4C]
0069D146 50             push eax
0069D147 8D4D D4       lea    ecx, dword ptr [ebp-2C]
0069D14A 51             push ecx
0069D14B 8D55 E0       lea    edx, dword ptr [ebp-20]
0069D14E 52             push edx
0069D14F 8D45 E8       lea    eax, dword ptr [ebp-18]
0069D152 50             push eax
0069D153 8D4D B0       lea    ecx, dword ptr [ebp-50]
0069D156 51             push ecx
0069D157 8D55 B8       lea    edx, dword ptr [ebp-48]
0069D15A 52             push edx
0069D15B 8D45 D0       lea    eax, dword ptr [ebp-30]
0069D15E 50             push eax
0069D15F 6A 01          push 1
0069D161 E8 4A070000    call 0069D8B0                      ; 第一次读狗
0069D166 83C4 24       add    esp, 24
0069D169 25 FFFF0000    and    eax, 0FFFF
0069D16E 85C0          test eax, eax                      ; EAX必须清零，则有狗
0069D170 74 05          je    short 0069D177                ; 必须跳
0069D172 E9 BF030000    jmp    0069D536
0069D177 66:C745 E4 0100 mov    word ptr [ebp-1C], 1
0069D17D EB 38          jmp    short 0069D1B7
0069D17F 8D4D BC       lea    ecx, dword ptr [ebp-44]
0069D182 51             push ecx
0069D183 8D55 B4       lea    edx, dword ptr [ebp-4C]
0069D186 52             push edx
0069D187 8D45 D4       lea    eax, dword ptr [ebp-2C]
0069D18A 50             push eax
0069D18B 8D4D E0       lea    ecx, dword ptr [ebp-20]
0069D18E 51             push ecx
0069D18F 8D55 E8       lea    edx, dword ptr [ebp-18]
0069D192 52             push edx
0069D193 8D45 B0       lea    eax, dword ptr [ebp-50]
0069D196 50             push eax
0069D197 8D4D B8       lea    ecx, dword ptr [ebp-48]
0069D19A 51             push ecx
0069D19B 8D55 D0       lea    edx, dword ptr [ebp-30]
0069D19E 52             push edx
0069D19F 6A 02          push 2
0069D1A1 E8 0A070000    call 0069D8B0
0069D1A6 83C4 24       add    esp, 24
0069D1A9 25 FFFF0000    and    eax, 0FFFF
0069D1AE 85C0          test eax, eax
0069D1B0 74 05          je    short 0069D1B7
0069D1B2 E9 7F030000    jmp    0069D536
0069D1B7 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D1BA 33C9          xor    ecx, ecx
0069D1BC 66:8B48 04    mov    cx, word ptr [eax+4]
0069D1C0 83E1 40       and    ecx, 40
0069D1C3 85C9          test ecx, ecx
0069D1C5 74 1D          je    short 0069D1E4
0069D1C7 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D1CA 8B45 B8       mov    eax, dword ptr [ebp-48]
0069D1CD 3B42 06       cmp    eax, dword ptr [edx+6]
0069D1D0 74 05          je    short 0069D1D7
0069D1D2  ^ E9 12FFFFFF    jmp    0069D0E9
0069D1D7 8B4D B8       mov    ecx, dword ptr [ebp-48]
0069D1DA 894D C6       mov    dword ptr [ebp-3A], ecx
0069D1DD C745 F0 0E00000>mov    dword ptr [ebp-10], 0E
0069D1E4 8D55 BC       lea    edx, dword ptr [ebp-44]
0069D1E7 52             push edx
0069D1E8 8D45 B4       lea    eax, dword ptr [ebp-4C]
0069D1EB 50             push eax
0069D1EC 8D4D D4       lea    ecx, dword ptr [ebp-2C]
0069D1EF 51             push ecx
0069D1F0 8D55 E0       lea    edx, dword ptr [ebp-20]
0069D1F3 52             push edx
0069D1F4 8D45 E8       lea    eax, dword ptr [ebp-18]
0069D1F7 50             push eax
0069D1F8 8D4D B0       lea    ecx, dword ptr [ebp-50]
0069D1FB 51             push ecx
0069D1FC 8D55 B8       lea    edx, dword ptr [ebp-48]
0069D1FF 52             push edx
0069D200 8D45 D0       lea    eax, dword ptr [ebp-30]
0069D203 50             push eax
0069D204 6A 03          push 3
0069D206 E8 A5060000    call 0069D8B0                      ; 第二次读狗
0069D20B 83C4 24       add    esp, 24
0069D20E 25 FFFF0000    and    eax, 0FFFF
0069D213 85C0          test eax, eax                      ; EAX必须清零，则有狗
0069D215 74 05          je    short 0069D21C                ; 必须跳
0069D217 E9 1A030000    jmp    0069D536
0069D21C 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D21F 33D2          xor    edx, edx
0069D221 66:8B51 04    mov    dx, word ptr [ecx+4]
0069D225 83E2 20       and    edx, 20
0069D228 85D2          test edx, edx
0069D22A 74 73          je    short 0069D29F                ; 第二次读狗成功此处跳转
0069D22C 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D22F 33C9          xor    ecx, ecx
0069D231 66:8B48 04    mov    cx, word ptr [eax+4]
0069D235 83E1 0F       and    ecx, 0F
0069D238 66:894D E8    mov    word ptr [ebp-18], cx
0069D23C 8D55 BC       lea    edx, dword ptr [ebp-44]
0069D23F 52             push edx
0069D240 8D45 B4       lea    eax, dword ptr [ebp-4C]
0069D243 50             push eax
0069D244 8D4D D4       lea    ecx, dword ptr [ebp-2C]
0069D247 51             push ecx
0069D248 8D55 E0       lea    edx, dword ptr [ebp-20]
0069D24B 52             push edx
0069D24C 8D45 E8       lea    eax, dword ptr [ebp-18]
0069D24F 50             push eax
0069D250 8D4D B0       lea    ecx, dword ptr [ebp-50]
0069D253 51             push ecx
0069D254 8D55 B8       lea    edx, dword ptr [ebp-48]
0069D257 52             push edx
0069D258 8D45 D0       lea    eax, dword ptr [ebp-30]
0069D25B 50             push eax
0069D25C 6A 0C          push 0C
0069D25E E8 4D060000    call 0069D8B0                      ; (第三次读狗)忽略
0069D263 83C4 24       add    esp, 24
0069D266 25 FFFF0000    and    eax, 0FFFF
0069D26B 85C0          test eax, eax
0069D26D 74 05          je    short 0069D274
0069D26F E9 98020000    jmp    0069D50C
0069D274 8B4D E0       mov    ecx, dword ptr [ebp-20]
0069D277 81E1 FFFF0000 and    ecx, 0FFFF
0069D27D 83F9 01       cmp    ecx, 1
0069D280 74 05          je    short 0069D287
0069D282  ^ E9 62FEFFFF    jmp    0069D0E9
0069D287 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D28A 66:8B42 04    mov    ax, word ptr [edx+4]
0069D28E 66:8945 C4    mov    word ptr [ebp-3C], ax
0069D292 837D F0 08    cmp    dword ptr [ebp-10], 8
0069D296 75 07          jnz    short 0069D29F
0069D298 C745 F0 0A00000>mov    dword ptr [ebp-10], 0A
0069D29F 66:C745 E4 0200 mov    word ptr [ebp-1C], 2
0069D2A5  ^ E9 3FFEFFFF    jmp    0069D0E9
0069D2AA 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D2AD 83C1 32       add    ecx, 32
0069D2B0 894D AC       mov    dword ptr [ebp-54], ecx
0069D2B3 8B55 AC       mov    edx, dword ptr [ebp-54]
0069D2B6 833A 00       cmp    dword ptr [edx], 0             ; EAX必须清零，则有狗
0069D2B9 0F84 CA000000 je    0069D389                      ; 必须跳
0069D2BF 8B45 AC       mov    eax, dword ptr [ebp-54]
0069D2C2 8378 08 01    cmp    dword ptr [eax+8], 1
0069D2C6 0F85 AF000000 jnz    0069D37B
0069D2CC 8B4D AC       mov    ecx, dword ptr [ebp-54]
0069D2CF 8B11          mov    edx, dword ptr [ecx]
0069D2D1 8955 B0       mov    dword ptr [ebp-50], edx
0069D2D4 8D45 BC       lea    eax, dword ptr [ebp-44]
0069D2D7 50             push eax
0069D2D8 8D4D B4       lea    ecx, dword ptr [ebp-4C]
0069D2DB 51             push ecx
0069D2DC 8D55 D4       lea    edx, dword ptr [ebp-2C]
0069D2DF 52             push edx
0069D2E0 8D45 E0       lea    eax, dword ptr [ebp-20]
0069D2E3 50             push eax
0069D2E4 8D4D E8       lea    ecx, dword ptr [ebp-18]
0069D2E7 51             push ecx
0069D2E8 8D55 B0       lea    edx, dword ptr [ebp-50]
0069D2EB 52             push edx
0069D2EC 8D45 B8       lea    eax, dword ptr [ebp-48]
0069D2EF 50             push eax
0069D2F0 8D4D D0       lea    ecx, dword ptr [ebp-30]
0069D2F3 51             push ecx
0069D2F4 6A 08          push 8
0069D2F6 E8 B5050000    call 0069D8B0
0069D2FB 83C4 24       add    esp, 24
0069D2FE 25 FFFF0000    and    eax, 0FFFF
0069D303 85C0          test eax, eax
0069D305 74 05          je    short 0069D30C
0069D307 E9 00020000    jmp    0069D50C
0069D30C 66:8B55 E8    mov    dx, word ptr [ebp-18]
0069D310 66:8955 BC    mov    word ptr [ebp-44], dx
0069D314 66:8B45 E0    mov    ax, word ptr [ebp-20]
0069D318 66:8945 BE    mov    word ptr [ebp-42], ax
0069D31C 66:8B4D D4    mov    cx, word ptr [ebp-2C]
0069D320 66:894D C0    mov    word ptr [ebp-40], cx
0069D324 66:8B55 B4    mov    dx, word ptr [ebp-4C]
0069D328 66:8955 C2    mov    word ptr [ebp-3E], dx
0069D32C 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D32F 8B48 12       mov    ecx, dword ptr [eax+12]
0069D332 8B55 AC       mov    edx, dword ptr [ebp-54]
0069D335 030A          add    ecx, dword ptr [edx]
0069D337 894D F4       mov    dword ptr [ebp-C], ecx
0069D33A C745 D8 0000000>mov    dword ptr [ebp-28], 0
0069D341 EB 09          jmp    short 0069D34C
0069D343 8B45 D8       mov    eax, dword ptr [ebp-28]
0069D346 83C0 01       add    eax, 1
0069D349 8945 D8       mov    dword ptr [ebp-28], eax
0069D34C 8B4D AC       mov    ecx, dword ptr [ebp-54]
0069D34F 8B55 D8       mov    edx, dword ptr [ebp-28]
0069D352 3B51 04       cmp    edx, dword ptr [ecx+4]
0069D355 73 24          jnb    short 0069D37B
0069D357 8B45 F4       mov    eax, dword ptr [ebp-C]
0069D35A 0345 D8       add    eax, dword ptr [ebp-28]
0069D35D 33C9          xor    ecx, ecx
0069D35F 8A08          mov    cl, byte ptr [eax]
0069D361 8B45 D8       mov    eax, dword ptr [ebp-28]
0069D364 33D2          xor    edx, edx
0069D366 F775 F0       div    dword ptr [ebp-10]
0069D369 33C0          xor    eax, eax
0069D36B 8A4415 BC    mov    al, byte ptr [ebp+edx-44]
0069D36F 33C8          xor    ecx, eax
0069D371 8B55 F4       mov    edx, dword ptr [ebp-C]
0069D374 0355 D8       add    edx, dword ptr [ebp-28]
0069D377 880A          mov    byte ptr [edx], cl
0069D379  ^ EB C8          jmp    short 0069D343
0069D37B 8B45 AC       mov    eax, dword ptr [ebp-54]
0069D37E 83C0 0C       add    eax, 0C
0069D381 8945 AC       mov    dword ptr [ebp-54], eax
0069D384  ^ E9 2AFFFFFF    jmp    0069D2B3
0069D389 8D4D BC       lea    ecx, dword ptr [ebp-44]
0069D38C 51             push ecx
0069D38D 8D55 B4       lea    edx, dword ptr [ebp-4C]
0069D390 52             push edx
0069D391 8D45 D4       lea    eax, dword ptr [ebp-2C]
0069D394 50             push eax
0069D395 8D4D E0       lea    ecx, dword ptr [ebp-20]
0069D398 51             push ecx
0069D399 8D55 E8       lea    edx, dword ptr [ebp-18]
0069D39C 52             push edx
0069D39D 8D45 B0       lea    eax, dword ptr [ebp-50]
0069D3A0 50             push eax
0069D3A1 8D4D B8       lea    ecx, dword ptr [ebp-48]
0069D3A4 51             push ecx
0069D3A5 8D55 D0       lea    edx, dword ptr [ebp-30]
0069D3A8 52             push edx
0069D3A9 6A 04          push 4
0069D3AB E8 00050000    call 0069D8B0                      ; 第四次读狗
0069D3B0 83C4 24       add    esp, 24
0069D3B3 25 FFFF0000    and    eax, 0FFFF
0069D3B8 85C0          test eax, eax                      ; EAX必须清零，则有狗
0069D3BA 74 25          je    short 0069D3E1                ; 必须跳
0069D3BC 6A 00          push 0
0069D3BE 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D3C1 05 5A050000    add    eax, 55A
0069D3C6 50             push eax
0069D3C7 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D3CA 81C1 8C050000 add    ecx, 58C
0069D3D0 51             push ecx
0069D3D1 6A 00          push 0
0069D3D3 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D3D6 FF92 0A050000 call dword ptr [edx+50A]
0069D3DC E9 7B010000    jmp    0069D55C
0069D3E1 E8 3A020000    call 0069D620
0069D3E6 8B5D FC       mov    ebx, dword ptr [ebp-4]
0069D3E9 8B83 E2040000 mov    eax, dword ptr [ebx+4E2]
0069D3EF 83F8 00       cmp    eax, 0                         ; EAX必须清零，则有狗
0069D3F2 0F84 D4000000 je    0069D4CC                      ; 必须跳
0069D3F8 0343 12       add    eax, dword ptr [ebx+12]
0069D3FB 8983 E6040000 mov    dword ptr [ebx+4E6], eax
0069D401 8B43 12       mov    eax, dword ptr [ebx+12]
0069D404 2B43 0E       sub    eax, dword ptr [ebx+E]
0069D407 8945 CC       mov    dword ptr [ebp-34], eax
0069D40A 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D40D 8B88 E6040000 mov    ecx, dword ptr [eax+4E6]
0069D413 8379 04 00    cmp    dword ptr [ecx+4], 0
0069D417 0F84 AF000000 je    0069D4CC
0069D41D 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D420 8B82 E6040000 mov    eax, dword ptr [edx+4E6]
0069D426 8B48 04       mov    ecx, dword ptr [eax+4]
0069D429 83E9 08       sub    ecx, 8
0069D42C D1E9          shr    ecx, 1
0069D42E 894D F8       mov    dword ptr [ebp-8], ecx
0069D431 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D434 8B82 E6040000 mov    eax, dword ptr [edx+4E6]
0069D43A 83C0 08       add    eax, 8
0069D43D 8945 EC       mov    dword ptr [ebp-14], eax
0069D440 C745 D8 0000000>mov    dword ptr [ebp-28], 0
0069D447 EB 09          jmp    short 0069D452
0069D449 8B4D D8       mov    ecx, dword ptr [ebp-28]
0069D44C 83C1 01       add    ecx, 1
0069D44F 894D D8       mov    dword ptr [ebp-28], ecx
0069D452 8B55 D8       mov    edx, dword ptr [ebp-28]
0069D455 3B55 F8       cmp    edx, dword ptr [ebp-8]
0069D458 73 4F          jnb    short 0069D4A9
0069D45A 8B45 EC       mov    eax, dword ptr [ebp-14]
0069D45D 33C9          xor    ecx, ecx
0069D45F 66:8B08       mov    cx, word ptr [eax]
0069D462 81E1 00F00000 and    ecx, 0F000
0069D468 C1F9 0C       sar    ecx, 0C
0069D46B 83F9 03       cmp    ecx, 3
0069D46E 75 2E          jnz    short 0069D49E
0069D470 8B55 EC       mov    edx, dword ptr [ebp-14]
0069D473 33C0          xor    eax, eax
0069D475 66:8B02       mov    ax, word ptr [edx]
0069D478 25 FF0F0000    and    eax, 0FFF
0069D47D 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D480 8B91 E6040000 mov    edx, dword ptr [ecx+4E6]
0069D486 0302          add    eax, dword ptr [edx]
0069D488 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D48B 0341 12       add    eax, dword ptr [ecx+12]
0069D48E 8945 DC       mov    dword ptr [ebp-24], eax
0069D491 8B55 DC       mov    edx, dword ptr [ebp-24]
0069D494 8B02          mov    eax, dword ptr [edx]
0069D496 0345 CC       add    eax, dword ptr [ebp-34]
0069D499 8B4D DC       mov    ecx, dword ptr [ebp-24]
0069D49C 8901          mov    dword ptr [ecx], eax
0069D49E 8B55 EC       mov    edx, dword ptr [ebp-14]
0069D4A1 83C2 02       add    edx, 2
0069D4A4 8955 EC       mov    dword ptr [ebp-14], edx
0069D4A7  ^ EB A0          jmp    short 0069D449
0069D4A9 8B45 FC       mov    eax, dword ptr [ebp-4]
0069D4AC 8B88 E6040000 mov    ecx, dword ptr [eax+4E6]
0069D4B2 8B55 FC       mov    edx, dword ptr [ebp-4]
0069D4B5 8B82 E6040000 mov    eax, dword ptr [edx+4E6]
0069D4BB 0341 04       add    eax, dword ptr [ecx+4]
0069D4BE 8B4D FC       mov    ecx, dword ptr [ebp-4]
0069D4C1 8981 E6040000 mov    dword ptr [ecx+4E6], eax
0069D4C7  ^ E9 3EFFFFFF    jmp    0069D40A
0069D4CC 8B5D FC       mov    ebx, dword ptr [ebp-4]
0069D4CF B9 00000000    mov    ecx, 0
0069D4D4 8B73 22       mov    esi, dword ptr [ebx+22]
0069D4D7 8B7B 2A       mov    edi, dword ptr [ebx+2A]
0069D4DA 8B048E       mov    eax, dword ptr [esi+ecx*4]
0069D4DD 83F8 00       cmp    eax, 0
0069D4E0 74 13          je    short 0069D4F5
0069D4E2 8B148F       mov    edx, dword ptr [edi+ecx*4]
0069D4E5 81FA 00000080 cmp    edx, 80000000
0069D4EB 73 08          jnb    short 0069D4F5
0069D4ED 0353 12       add    edx, dword ptr [ebx+12]
0069D4F0 8B048E       mov    eax, dword ptr [esi+ecx*4]
0069D4F3 8902          mov    dword ptr [edx], eax
0069D4F5 41             inc    ecx
0069D4F6 3B4B 2E       cmp    ecx, dword ptr [ebx+2E]
0069D4F9  ^ 72 DF          jb    short 0069D4DA
0069D4FB 8B83 EA040000 mov    eax, dword ptr [ebx+4EA]
0069D501 0343 12       add    eax, dword ptr [ebx+12]
0069D504 5F             pop    edi
0069D505 5E             pop    esi
0069D506 5B             pop    ebx
0069D507 8BE5          mov    esp, ebp
0069D509 5D             pop    ebp
0069D50A FFE0          jmp    eax                            ; //解码完毕，飞向OEP（ASPack入口）

再按照ASPack的方法脱壳就行了,不用修复IAT.

上传的附件：

QCReportP.rar （766.46kb，63次下载）

2007-8-7 15:26

0

luzhmu

雪币： 86

活跃值： (1043)

能力值：

( LV2，RANK：10 )

在线值：

发帖

5

回帖

647

粉丝

7

关注

私信

luzhmu: 8 楼

呵呵。。需要手工找回些函数。。有狗脱没什么难度。。老兄看看手工修复IAT的文章就可以了

2007-8-7 17:51

0

luzhmu

雪币： 86

活跃值： (1043)

能力值：

( LV2，RANK：10 )

在线值：

发帖

5

回帖

647

粉丝

7

关注

私信

luzhmu: 9 楼

0069D30C 66:8B55 E8    MOV DX,WORD PTR SS:[EBP-18]
0069D310 66:8955 BC    MOV WORD PTR SS:[EBP-44],DX
0069D314 66:8B45 E0    MOV AX,WORD PTR SS:[EBP-20]
0069D318 66:8945 BE    MOV WORD PTR SS:[EBP-42],AX
0069D31C 66:8B4D D4    MOV CX,WORD PTR SS:[EBP-2C]
0069D320 66:894D C0    MOV WORD PTR SS:[EBP-40],CX
0069D324 66:8B55 B4    MOV DX,WORD PTR SS:[EBP-4C]
0069D328 66:8955 C2    MOV WORD PTR SS:[EBP-3E],DX

2007-8-7 19:17

0