某程序Armadillo脱壳脱壳
；＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
/*
arm3.75版以后的从双进程到单进程转换的Script自动运行脚本
适用于ollyScript0.92，不要勾上OD异常中的〔忽略以下范围的异常〕 选项
by fxyang
*/
dbh //隐藏OD
var address
gpa "OpenMutexA","kernel32.dll"
bp $RESULT
run
eoe code_1
code_1:
mov address,eip //获取第一次PREFIX LOCK:异常地址
esto
lbl3:
cmp eip,address //自动越过异常
ja begin
esto
begin:
exec
PUSHAD
PUSH EDX
push 0
push 0
CALL kernel32.CreateMutexA
POPAD
jmp kernel32.OpenMutexA
ende
//上面的代码就是在Script中运行从双进程到单进程的转换
bc $RESULT
lbl4:
gpa "VirtualProtect","kernel32.dll"
bp $RESULT //对VirtualProtect函数下中断
esto
// 中断后继续
esto
esto
esto
esto
rtr
sto
rtr
sto
sto
sto
sto
sto
sto
sto
sto
sti
sti
pause
//经过了上面的代码程序会停在壳的运行代码中
；＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
00DEF065 PUSH EBP
00DEF066 MOV EBP,ESP
00DEF068 PUSH EBX
00DEF069 MOV EBX,DWORD PTR SS:[EBP+8]
00DEF06C PUSH ESI
00DEF06D MOV ESI,DWORD PTR SS:[EBP+C]
00DEF070 PUSH EDI
00DEF071 MOV EDI,DWORD PTR SS:[EBP+10]
00DEF074 TEST ESI,ESI
00DEF076 JNZ SHORT 00DEF081
00DEF078 CMP DWORD PTR DS:[E01AB4],0
00DEF07F JMP SHORT 00DEF0A7
PUSH EBP
MOV EBP,ESP
PUSH ECX
PUSH EBX
XOR EBX,EBX
00DEBE33 PUSH EBP
00DEBE34 MOV EBP,ESP
00DEBE36 PUSH ECX
00DEBE37 PUSH EBX
00DEBE38 XOR EBX,EBX //特征代码
00DEBE3A CMP BYTE PTR DS:[DFFFFD],BL
00DEBE40 PUSH ESI
00DEBE41 PUSH EDI
00DEBE42 JNZ SHORT 00DEBE5E
00DEBE44 CMP BYTE PTR DS:[DFFC19],BL
00DEBE4A JNZ SHORT 00DEBE5E
00DEBE4C CALL 00DC7591
00DEBE51 TEST EAX,EAX
00DEBE53 JE SHORT 00DEBE5E
00DEBE55 CALL 00DC82D5
00DEBE5A TEST AL,AL
//anti的效验，光标停在这里，F4到这个地方。修改Al值为1
00DEBE5C JE SHORT 00DEBE65
00DEBE5E XOR AL,AL
00DEBE60 JMP 00DEBF91
00DE45CC MOV EAX,C80F9D61
00DE45D1 NOT ECX
00DE45D3 BSWAP EAX
00DE45D5 NOT ECX
00DE45D7 PUSH DWORD PTR DS:[DF0498] ; USER32.SetTimer <--注意
00DE45DD CALL 00DEA2E1
00DE45E2 POP ECX
00DE45E3 MOVZX EAX,AL
00DE45E6 MOV DWORD PTR SS:[EBP-134],EAX
00DE45EC PUSH ECX
00DE45ED BSWAP ECX
00DE45EF NOT ECX
00DE45F1 PUSH EAX
00DE45F2 NOT EAX
00DE45F4 MOV EAX,6C65696D
00DE45F9 XCHG EAX,ECX
00DE4A21 >CALL 00DC14AC
00DE4A26 >ADD ESP,10
00DE4A29 >MOV EAX,DWORD PTR DS:[DFFA1C]
00DE4A2E >MOV DWORD PTR SS:[EBP-399C],EAX
00DE4A34 >CMP DWORD PTR SS:[EBP-399C],0
00DE4A3B >JE SHORT 00DE4A73
00DE4A3D >MOV EAX,DWORD PTR SS:[EBP-399C]
00DE4A43 >CMP DWORD PTR DS:[EAX],0
00DE4A46 >JE SHORT 00DE4A73
00DE4A48 >MOV EAX,DWORD PTR SS:[EBP-399C]
00DE4A4E >MOV EAX,DWORD PTR DS:[EAX]
00DE4A50 >MOV EAX,DWORD PTR DS:[EAX]
00DE4A52 >ADD EAX,DWORD PTR DS:[E004F0]
00DE4A58 >MOV ECX,DWORD PTR SS:[EBP-399C]
00DE4A5E >MOV ECX,DWORD PTR DS:[ECX]
00DE4A60 >MOV DWORD PTR DS:[ECX],EAX
00DE4A62 >MOV EAX,DWORD PTR SS:[EBP-399C]
00DE4A68 >ADD EAX,4
00DE4A6B >MOV DWORD PTR SS:[EBP-399C],EAX
00DE4A71 ^>JMP SHORT 00DE4A3D
00DE4A73 >XCHG EAX,ESI //这里结束，F4到这里
00DE4A74 >XCHG CX,CX
00DE4A77 >XCHG EAX,ESI
00DE4A78 >INS DWORD PTR ES:[EDI],DX ; I/O 命令
00DE5209 MOV DWORD PTR DS:[DF68CC],0DF7454 ; ASCII "B4"
00DE5213 MOV EAX,DWORD PTR DS:[E00030]
00DE5218 MOV EAX,DWORD PTR DS:[EAX]
00DE521A MOV DWORD PTR SS:[EBP-3924],EAX
00DE5220 MOV EAX,DWORD PTR DS:[E00030]
00DE5225 ADD EAX,4
00DE5228 MOV DWORD PTR DS:[E00030],EAX
00DE522D CALL 00DEB11B
00DE5232 XOR ECX,ECX
00DE5234 TEST EAX,EAX
00DE5236 SETNE CL
00DE5239 INC ECX
00DE523A MOV EAX,DWORD PTR DS:[E00030]
00DE523F MOV EAX,DWORD PTR DS:[EAX]
00DE5241 XOR EDX,EDX
00DE5243 DIV ECX
00DE5245 MOV DWORD PTR SS:[EBP-37C8],EAX
00DE524B MOV EAX,DWORD PTR DS:[E00030]
00DE5250 ADD EAX,4
00DE5253 MOV DWORD PTR DS:[E00030],EAX
00DE5258 MOV EAX,DWORD PTR SS:[EBP-37C8]
00DE525E SHL EAX,2
00DE5261 PUSH EAX
00DE5262 CALL 00DEEF08 ; JMP to msvcrt.??2@YAPAXI@Z //申请函数
00DE5267 POP ECX
00DE5268 MOV DWORD PTR SS:[EBP+FFFFAFE8],EAX <--返回值，修改这个值
00DE526E MOV EAX,DWORD PTR SS:[EBP+FFFFAFE8]
00DE5274 MOV DWORD PTR SS:[EBP-3928],EAX
00DE527A MOV EAX,DWORD PTR DS:[E00028]
00DE527F MOV EAX,DWORD PTR DS:[EAX+78]
00DE5282 MOV DWORD PTR SS:[EBP+FFFFAE28],EAX
00DE5288 MOV EAX,DWORD PTR SS:[EBP+FFFFAE28]
00DE528E MOV DWORD PTR SS:[EBP-39F8],EAX
00DE5294 AND DWORD PTR SS:[EBP-39FC],0
00DE529B JMP SHORT 00DE52AA
00DE529D MOV EAX,DWORD PTR SS:[EBP-39FC]
00DE52A3 INC EAX
00DE52A4 MOV DWORD PTR SS:[EBP-39FC],EAX
00DE52AA MOV EAX,DWORD PTR SS:[EBP-39FC]
00DE52B0 CMP EAX,DWORD PTR SS:[EBP-37C8]
00DE52B6 JNB 00DE5379
00DE52BC MOV DWORD PTR SS:[EBP+FFFFAE14],14
00DE52C6 PUSH 1DF5E0D
00DE52CB PUSH DWORD PTR SS:[EBP-39F8]
00DE52D1 LEA ECX,DWORD PTR SS:[EBP-39F8]
00DE52D7 CALL 00DC1071
00DE52DC INC EAX
00DE52DD XOR EDX,EDX
00DE52DF MOV ECX,5F5E100
00DE52E4 DIV ECX
00DE52E6 MOV DWORD PTR SS:[EBP-39F8],EDX
00DE52EC MOV DWORD PTR SS:[EBP+FFFFAE00],100
00DE52F6 PUSH 1DF5E0D
00DE52FB PUSH DWORD PTR SS:[EBP-39F8]
00DE5301 LEA ECX,DWORD PTR SS:[EBP-39F8]
00DE5307 CALL 00DC1071
00DE530C INC EAX
00DE530D XOR EDX,EDX
00DE530F MOV ECX,5F5E100
00DE5314 DIV ECX
00DE5316 MOV DWORD PTR SS:[EBP-39F8],EDX
00DE531C MOV EAX,DWORD PTR SS:[EBP-39F8]
00DE5322 XOR EDX,EDX
00DE5324 MOV ECX,2710
00DE5329 DIV ECX
00DE532B IMUL EAX,DWORD PTR SS:[EBP+FFFFAE14]
00DE5332 XOR EDX,EDX
00DE5334 MOV ECX,2710
00DE5339 DIV ECX
00DE533B MOV ECX,EAX
00DE533D MOV EAX,DWORD PTR SS:[EBP-39F8]
00DE5343 XOR EDX,EDX
00DE5345 MOV ESI,2710
00DE534A DIV ESI
00DE534C IMUL EAX,DWORD PTR SS:[EBP+FFFFAE00]
00DE5353 XOR EDX,EDX
00DE5355 MOV ESI,2710
00DE535A DIV ESI
00DE535C MOV ECX,DWORD PTR SS:[EBP+ECX*4-3978]
00DE5363 ADD ECX,EAX
00DE5365 MOV EAX,DWORD PTR SS:[EBP-39FC]
00DE536B MOV EDX,DWORD PTR SS:[EBP-3928]
00DE5371 MOV DWORD PTR DS:[EDX+EAX*4],ECX //值放到上面修改的地址中
00DE5374 JMP 00DE529D
00DE5379 MOV EAX,DWORD PTR DS:[E00030] //这是出口，F4到这里
00DE5963 CALL 00DC14AC
00DE5968 ADD ESP,10
00DE596B MOV EAX,DWORD PTR DS:[DFFA20]
00DE5970 MOV DWORD PTR SS:[EBP-3A34],EAX
00DE5976 CMP DWORD PTR SS:[EBP-3A34],0
00DE597D JE SHORT 00DE59B5
00DE597F MOV EAX,DWORD PTR SS:[EBP-3A34]
00DE5985 CMP DWORD PTR DS:[EAX],0
00DE5988 JE SHORT 00DE59B5
00DE598A MOV EAX,DWORD PTR SS:[EBP-3A34]
00DE5990 MOV EAX,DWORD PTR DS:[EAX]
00DE5992 MOV EAX,DWORD PTR DS:[EAX]
00DE5994 ADD EAX,DWORD PTR DS:[E004F0]
00DE599A MOV ECX,DWORD PTR SS:[EBP-3A34]
00DE59A0 MOV ECX,DWORD PTR DS:[ECX]
00DE59A2 MOV DWORD PTR DS:[ECX],EAX
00DE59A4 MOV EAX,DWORD PTR SS:[EBP-3A34]
00DE59AA ADD EAX,4
00DE59AD MOV DWORD PTR SS:[EBP-3A34],EAX
00DE59B3 JMP SHORT 00DE597F
00DE59B5 XCHG EAX,EDI //这里结束，F4到这里
00DE59B6 XCHG CX,CX
00DE59B9 XCHG EAX,EDI
00DE59BA OR ESI,DWORD PTR DS:[ECX+EBX*2]
00DE5A9F MOV EAX,DWORD PTR SS:[EBP-3A48]
00DE5AA5 AND EAX,7FFFFFFF
00DE5AAA MOV ECX,DWORD PTR SS:[EBP-3910]
00DE5AB0 ADD EAX,DWORD PTR DS:[ECX+88]
00DE5AB6 MOV DWORD PTR SS:[EBP-3A48],EAX
00DE5ABC MOV EAX,DWORD PTR DS:[E00030]
00DE5AC1 MOV EAX,DWORD PTR DS:[EAX]
00DE5AC3 XOR EAX,DWORD PTR DS:[E00034]
00DE5AC9 MOV DWORD PTR SS:[EBP-3A44],EAX
00DE5ACF MOV EAX,DWORD PTR DS:[E00030]
00DE5AD4 ADD EAX,4
00DE5AD7 MOV DWORD PTR DS:[E00030],EAX
00DE5ADC MOV EAX,DWORD PTR SS:[EBP-3A44]
00DE5AE2 ADD EAX,10000 ; UNICODE "=::=::\"
00DE5AE7 PUSH EAX
00DE5AE8 CALL 00DEEF08 ; JMP to msvcrt.??2@YAPAXI@Z
00DE5AED POP ECX
00DE5AEE MOV DWORD PTR SS:[EBP+FFFFAFDC],EAX
00DE5AF4 MOV EAX,DWORD PTR SS:[EBP+FFFFAFDC]
00DE5AFA MOV DWORD PTR SS:[EBP-3A40],EAX
00DE5B00 MOV EAX,DWORD PTR SS:[EBP-3A40]
00DE5B06 MOV DWORD PTR SS:[EBP-3A38],EAX
00DE5B0C MOV EAX,DWORD PTR SS:[EBP-3A44]
00DE5B12 ADD EAX,10000 ; UNICODE "=::=::\"
00DE5B17 PUSH EAX
00DE5B18 PUSH 0
00DE5B1A PUSH DWORD PTR SS:[EBP-3A40]
00DE5B20 CALL 00DEEF14 ; JMP to msvcrt.memset
00DE5B25 ADD ESP,0C
00DE5B28 PUSH 1
00DE5B2A POP EAX
00DE5B2B TEST EAX,EAX
00DE5B2D JE 00DE5BBC
00DE5F3D LEA EAX,DWORD PTR SS:[EBP-3A4C]
00DE5F43 PUSH EAX
00DE5F44 PUSH 4
00DE5F46 PUSH DWORD PTR SS:[EBP-3A44]
00DE5F4C MOV EAX,DWORD PTR SS:[EBP-3900]
00DE5F52 ADD EAX,DWORD PTR SS:[EBP-3A48]
00DE5F58 PUSH EAX
00DE5F59 CALL DWORD PTR DS:[DF0148] ; kernel32.VirtualProtect
00DE5F5F PUSH DWORD PTR SS:[EBP-3A44]
00DE5F65 PUSH DWORD PTR SS:[EBP-3A40]
00DE5F6B MOV EAX,DWORD PTR SS:[EBP-3900]
00DE5F71 ADD EAX,DWORD PTR SS:[EBP-3A48]
00DE5F77 PUSH EAX
00DE5F78 CALL 00DEEF02 ; JMP to msvcrt.memcpy
00DE5F7D ADD ESP,0C //内存数据复制
00DE5F80 LEA EAX,DWORD PTR SS:[EBP-3A4C]
00DE5F86 PUSH EAX
00DE5F87 PUSH DWORD PTR SS:[EBP-3A4C]
00DE5F8D PUSH DWORD PTR SS:[EBP-3A44]
00DE5F93 MOV EAX,DWORD PTR SS:[EBP-3900]
00DE5F99 ADD EAX,DWORD PTR SS:[EBP-3A48]
00DE5F9F PUSH EAX
00DE5FA0 CALL DWORD PTR DS:[DF0148] ; kernel32.VirtualProtect
00DE5FA6 MOV EAX,DWORD PTR SS:[EBP-3A40]
00DE5FAC MOV DWORD PTR SS:[EBP+FFFFAFD8],EAX
00DE5FB2 PUSH DWORD PTR SS:[EBP+FFFFAFD8]
00DE5FB8 CALL 00DEEEFC ; JMP to msvcrt.??3@YAXPAX@Z
00DE5FBD POP ECX
00DE5FBE JMP 00DE5A57
00DE5FC3 AND DWORD PTR DS:[E00034],0
00DE5FCA CMP DWORD PTR SS:[EBP-379C],0
00DE5FD1 JE SHORT 00DE6006
00DE637D CALL 00DC14AC
00DE6382 ADD ESP,10
00DE6385 MOV EAX,DWORD PTR DS:[DFFA24]
00DE638A MOV DWORD PTR SS:[EBP-3AA0],EAX
00DE6390 CMP DWORD PTR SS:[EBP-3AA0],0
00DE6397 JE SHORT 00DE63CF
00DE6399 MOV EAX,DWORD PTR SS:[EBP-3AA0]
00DE639F CMP DWORD PTR DS:[EAX],0
00DE63A2 JE SHORT 00DE63CF
00DE63A4 MOV EAX,DWORD PTR SS:[EBP-3AA0]
00DE63AA MOV EAX,DWORD PTR DS:[EAX]
00DE63AC MOV EAX,DWORD PTR DS:[EAX]
00DE63AE ADD EAX,DWORD PTR DS:[E004F0]
00DE63B4 MOV ECX,DWORD PTR SS:[EBP-3AA0]
00DE63BA MOV ECX,DWORD PTR DS:[ECX]
00DE63BC MOV DWORD PTR DS:[ECX],EAX
00DE63BE MOV EAX,DWORD PTR SS:[EBP-3AA0]
00DE63C4 ADD EAX,4
00DE63C7 MOV DWORD PTR SS:[EBP-3AA0],EAX
00DE63CD JMP SHORT 00DE6399
00DE63CF PUSH EDI //这里结束，F4到这里
00DE63D0 XCHG BX,BX
00DE63D3 POP EDI
00DE68DC CALL 00DC14AC
00DE68E1 ADD ESP,10
00DE68E4 MOV EAX,DWORD PTR DS:[DFFA2C]
00DE68E9 MOV DWORD PTR SS:[EBP-3B64],EAX
00DE68EF CMP DWORD PTR SS:[EBP-3B64],0
00DE68F6 JE SHORT 00DE692E
00DE68F8 MOV EAX,DWORD PTR SS:[EBP-3B64]
00DE68FE CMP DWORD PTR DS:[EAX],0
00DE6901 JE SHORT 00DE692E
00DE6903 MOV EAX,DWORD PTR SS:[EBP-3B64]
00DE6909 MOV EAX,DWORD PTR DS:[EAX]
00DE690B MOV EAX,DWORD PTR DS:[EAX]
00DE690D ADD EAX,DWORD PTR DS:[E004F0]
00DE6913 MOV ECX,DWORD PTR SS:[EBP-3B64]
00DE6919 MOV ECX,DWORD PTR DS:[ECX]
00DE691B MOV DWORD PTR DS:[ECX],EAX
00DE691D MOV EAX,DWORD PTR SS:[EBP-3B64]
00DE6923 ADD EAX,4
00DE6926 MOV DWORD PTR SS:[EBP-3B64],EAX
00DE692C JMP SHORT 00DE68F8
00DE692E XCHG AX,CX //这里结束，F4到这里
00DE6930 NOP
00DE6931 XCHG AX,CX
00DE6B32 PUSH DWORD PTR SS:[EBP-3B70]
00DE6B38 CALL 00DC9950
00DE6B3D POP ECX
00DE6B3E AND DWORD PTR SS:[EBP-3B74],0
00DE6B45 PUSH 0
00DE6B47 CALL DWORD PTR DS:[DF00D4] ; kernel32.GetModuleHandleA
00DE6B4D CMP DWORD PTR SS:[EBP-3B70],EAX //可以对上面的函数下中断到这里
00DE6B53 JNZ SHORT 00DE6B64
00DE6B55 MOV DWORD PTR SS:[EBP-3B74],0DF5180
00DE6B5F JMP 00DE6C28
00DE6B64 AND DWORD PTR SS:[EBP-3D98],0
00DE6B6B MOV DWORD PTR SS:[EBP-3D9C],0DF57C0
00DE6B75 JMP SHORT 00DE6B93
00DE6B77 MOV EAX,DWORD PTR SS:[EBP-3D9C]
00DE6B7D ADD EAX,0C
00DE6B80 MOV DWORD PTR SS:[EBP-3D9C],EAX
00DE6B86 MOV EAX,DWORD PTR SS:[EBP-3D98]
00DE6B8C INC EAX
00DE6B8D MOV DWORD PTR SS:[EBP-3D98],EAX
00DE6B93 MOV EAX,DWORD PTR SS:[EBP-3D9C]
00DE6B99 CMP DWORD PTR DS:[EAX],0 <--这个就是Magic jmp
00DE6B9C JE 00DE6C28 //修改为JMP 00DE6C28
00DE6BA2 MOV EAX,DWORD PTR SS:[EBP-3D9C]
00DE6BA8 MOV EAX,DWORD PTR DS:[EAX+8]
00DE6BAB AND EAX,1
00DE6BAE TEST EAX,EAX
00DE6BB0 JE SHORT 00DE6BD7
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
