-
-
[求助]请高手指教 如何学习CodeReplace
-
发表于: 2008-8-19 19:31
-
最近研究很多壳，总是在最后一关 CodeReplace拦住。
比如讲 非S的 EPE 070411 和 ASProtect 2.X SKE ==
高手指教下，比如EPE 070411 非S
跟入模拟程序执行的Call
始终找不到他怎么执行 被替换的代码的
而且始终找不到他到底是怎么判断被替换的代码的种类...
高手指教下 关键点在什么地方...
这一类的壳的CodeReplace究竟该怎么办？ 找不到被替换的CodeReplace在何处...
比如讲 非S的 EPE 070411 和 ASProtect 2.X SKE ==
高手指教下，比如EPE 070411 非S
跟入模拟程序执行的Call
始终找不到他怎么执行 被替换的代码的
而且始终找不到他到底是怎么判断被替换的代码的种类...
高手指教下 关键点在什么地方...
这一类的壳的CodeReplace究竟该怎么办？ 找不到被替换的CodeReplace在何处...
711F4940 55 push ebp
711F4941 8BEC mov ebp, esp
711F4943 83C4 D8 add esp, -28
711F4946 53 push ebx
711F4947 33C0 xor eax, eax
711F4949 8945 D8 mov dword ptr [ebp-28], eax
711F494C 8945 DC mov dword ptr [ebp-24], eax
711F494F 8945 E0 mov dword ptr [ebp-20], eax
711F4952 8945 E8 mov dword ptr [ebp-18], eax
711F4955 33C0 xor eax, eax
711F4957 55 push ebp
711F4958 68 994B1F71 push 711F4B99
711F495D 64:FF30 push dword ptr fs:[eax]
711F4960 64:8920 mov dword ptr fs:[eax], esp
711F4963 50 push eax
711F4964 8B4424 68 mov eax, dword ptr [esp+68]
711F4968 8945 FC mov dword ptr [ebp-4], eax
711F496B 58 pop eax
711F496C 8B45 FC mov eax, dword ptr [ebp-4]
711F496F 40 inc eax
711F4970 8B00 mov eax, dword ptr [eax]
711F4972 8945 F8 mov dword ptr [ebp-8], eax
711F4975 50 push eax
711F4976 8B45 F8 mov eax, dword ptr [ebp-8]
711F4979 894424 68 mov dword ptr [esp+68], eax
711F497D 58 pop eax
711F497E 8B45 FC mov eax, dword ptr [ebp-4]
711F4981 8038 00 cmp byte ptr [eax], 0
711F4984 0F85 EC010000 jnz 711F4B76
711F498A 68 6C182271 push 7122186C
711F498F E8 642AF3FF call 711273F8 ; jmp 到 ntdll.RtlEnterCriticalSection
711F4994 8B55 FC mov edx, dword ptr [ebp-4]
711F4997 8BC2 mov eax, edx
711F4999 83C0 05 add eax, 5
711F499C 8B00 mov eax, dword ptr [eax]
711F499E 8945 F4 mov dword ptr [ebp-C], eax
711F49A1 8BC2 mov eax, edx
711F49A3 83C0 09 add eax, 9
711F49A6 8B00 mov eax, dword ptr [eax]
711F49A8 8945 F0 mov dword ptr [ebp-10], eax
711F49AB 8BC2 mov eax, edx
711F49AD 83C0 0D add eax, 0D
711F49B0 8B00 mov eax, dword ptr [eax]
711F49B2 8945 EC mov dword ptr [ebp-14], eax
711F49B5 8BC2 mov eax, edx
711F49B7 83C0 15 add eax, 15
711F49BA 8B18 mov ebx, dword ptr [eax]
711F49BC 8D45 E7 lea eax, dword ptr [ebp-19]
711F49BF 83C2 19 add edx, 19
711F49C2 B9 01000000 mov ecx, 1
711F49C7 E8 D838F3FF call 711282A4
711F49CC 8B45 FC mov eax, dword ptr [ebp-4]
711F49CF 83C0 10 add eax, 10
711F49D2 33D2 xor edx, edx
711F49D4 83C0 01 add eax, 1 ; 关键地方 必须要 !! ====> add eax,1
711F49D7 90 nop
711F49D8 8B18 mov ebx, dword ptr [eax]
711F49DA 803B 00 cmp byte ptr [ebx], 0
711F49DD 0F85 C0000000 jnz 711F4AA3
711F49E3 8D45 E8 lea eax, dword ptr [ebp-18]
711F49E6 BA 09000000 mov edx, 9
711F49EB E8 6407F3FF call 71125154
711F49F0 8D45 E8 lea eax, dword ptr [ebp-18]
711F49F3 E8 2806F3FF call 71125020
711F49F8 C600 24 mov byte ptr [eax], 24
711F49FB 8D45 E8 lea eax, dword ptr [ebp-18]
711F49FE E8 1D06F3FF call 71125020
711F4A03 40 inc eax
711F4A04 8B55 F0 mov edx, dword ptr [ebp-10]
711F4A07 83EA 08 sub edx, 8
711F4A0A B9 08000000 mov ecx, 8
711F4A0F E8 9038F3FF call 711282A4
711F4A14 803D B6182371 0>cmp byte ptr [712318B6], 0
711F4A1B 74 4C je short 711F4A69
711F4A1D 807D E7 00 cmp byte ptr [ebp-19], 0
711F4A21 74 1C je short 711F4A3F
711F4A23 E8 B02AF3FF call 711274D8 ; jmp 到 kernel32.GetCurrentThreadId
711F4A28 50 push eax
711F4A29 68 C91B0000 push 1BC9
711F4A2E A1 B8182371 mov eax, dword ptr [712318B8]
711F4A33 50 push eax
711F4A34 A1 BC182371 mov eax, dword ptr [712318BC]
711F4A39 50 push eax
711F4A3A E8 C936F3FF call 71128108 ; jmp 到 USER32.SendMessageA
711F4A3F 6A 01 push 1
711F4A41 6A 00 push 0
711F4A43 6A 00 push 0
711F4A45 6A 00 push 0
711F4A47 8B45 E8 mov eax, dword ptr [ebp-18]
711F4A4A E8 654FF3FF call 711299B4
711F4A4F 50 push eax
711F4A50 8D45 E0 lea eax, dword ptr [ebp-20]
711F4A53 8B55 EC mov edx, dword ptr [ebp-14]
711F4A56 E8 AD02F3FF call 71124D08
711F4A5B 8B4D E0 mov ecx, dword ptr [ebp-20]
711F4A5E 8B45 F0 mov eax, dword ptr [ebp-10]
711F4A61 5A pop edx
711F4A62 E8 4D280000 call 711F72B4
711F4A67 EB 37 jmp short 711F4AA0
711F4A69 807D E7 00 cmp byte ptr [ebp-19], 0
711F4A6D 74 09 je short 711F4A78
711F4A6F B2 01 mov dl, 1
711F4A71 33C0 xor eax, eax
711F4A73 E8 04DBFFFF call 711F257C
711F4A78 6A 01 push 1
711F4A7A 6A 00 push 0
711F4A7C 6A 00 push 0
711F4A7E 6A 00 push 0
711F4A80 8B45 E8 mov eax, dword ptr [ebp-18]
711F4A83 E8 2C4FF3FF call 711299B4
711F4A88 50 push eax
711F4A89 8D45 DC lea eax, dword ptr [ebp-24]
711F4A8C 8B55 EC mov edx, dword ptr [ebp-14]
711F4A8F E8 7402F3FF call 71124D08
711F4A94 8B4D DC mov ecx, dword ptr [ebp-24]
711F4A97 8B45 F0 mov eax, dword ptr [ebp-10]
711F4A9A 5A pop edx
711F4A9B E8 F4250000 call 711F7094
711F4AA0 C603 01 mov byte ptr [ebx], 1
711F4AA3 8D45 E8 lea eax, dword ptr [ebp-18] ; 处理过程到这里结束
711F4AA6 BA 07000000 mov edx, 7
711F4AAB E8 A406F3FF call 71125154
711F4AB0 8D45 E8 lea eax, dword ptr [ebp-18]
711F4AB3 E8 6805F3FF call 71125020
711F4AB8 BA 07000000 mov edx, 7
711F4ABD E8 F637F3FF call 711282B8
711F4AC2 837D F4 00 cmp dword ptr [ebp-C], 0
711F4AC6 7E 1C jle short 711F4AE4
711F4AC8 8D45 E8 lea eax, dword ptr [ebp-18]
711F4ACB E8 5005F3FF call 71125020
711F4AD0 8B55 F4 mov edx, dword ptr [ebp-C]
711F4AD3 8D1452 lea edx, dword ptr [edx+edx*2]
711F4AD6 0355 F0 add edx, dword ptr [ebp-10]
711F4AD9 4A dec edx
711F4ADA B9 03000000 mov ecx, 3
711F4ADF E8 C037F3FF call 711282A4
711F4AE4 8D45 E8 lea eax, dword ptr [ebp-18]
711F4AE7 E8 3405F3FF call 71125020
711F4AEC 83C0 04 add eax, 4
711F4AEF 8B55 F4 mov edx, dword ptr [ebp-C]
711F4AF2 8D1452 lea edx, dword ptr [edx+edx*2]
711F4AF5 0355 F0 add edx, dword ptr [ebp-10]
711F4AF8 83C2 02 add edx, 2
711F4AFB B9 03000000 mov ecx, 3
711F4B00 E8 9F37F3FF call 711282A4
711F4B05 807D E7 00 cmp byte ptr [ebp-19], 0
711F4B09 74 09 je short 711F4B14
711F4B0B B2 01 mov dl, 1
711F4B0D 33C0 xor eax, eax
711F4B0F E8 68DAFFFF call 711F257C
711F4B14 6A 01 push 1
711F4B16 6A 00 push 0
711F4B18 6A 00 push 0
711F4B1A 6A 00 push 0
711F4B1C 8D45 E8 lea eax, dword ptr [ebp-18]
711F4B1F E8 FC04F3FF call 71125020
711F4B24 83C0 04 add eax, 4
711F4B27 50 push eax
711F4B28 8B45 E8 mov eax, dword ptr [ebp-18]
711F4B2B E8 9804F3FF call 71124FC8
711F4B30 8BD0 mov edx, eax
711F4B32 8D45 D8 lea eax, dword ptr [ebp-28]
711F4B35 E8 CE01F3FF call 71124D08
711F4B3A 8B4D D8 mov ecx, dword ptr [ebp-28]
711F4B3D BA 03000000 mov edx, 3
711F4B42 58 pop eax
711F4B43 E8 4C250000 call 711F7094
711F4B48 8D45 E8 lea eax, dword ptr [ebp-18]
711F4B4B E8 D004F3FF call 71125020
711F4B50 8D50 06 lea edx, dword ptr [eax+6]
711F4B53 B9 01000000 mov ecx, 1
711F4B58 8B45 F8 mov eax, dword ptr [ebp-8]
711F4B5B E8 4437F3FF call 711282A4 ; 恐怕就是计算返回地址了
711F4B60 8B45 F8 mov eax, dword ptr [ebp-8]
711F4B63 8030 FF xor byte ptr [eax], 0FF
711F4B66 8B45 FC mov eax, dword ptr [ebp-4]
711F4B69 C600 01 mov byte ptr [eax], 1
711F4B6C 68 6C182271 push 7122186C
711F4B71 E8 5A2BF3FF call 711276D0 ; jmp 到 ntdll.RtlLeaveCriticalSection
711F4B76 33C0 xor eax, eax
711F4B78 5A pop edx
711F4B79 59 pop ecx
711F4B7A 59 pop ecx
711F4B7B 64:8910 mov dword ptr fs:[eax], edx
711F4B7E 68 A04B1F71 push 711F4BA0
711F4B83 8D45 D8 lea eax, dword ptr [ebp-28]
711F4B86 BA 03000000 mov edx, 3
711F4B8B E8 ACFFF2FF call 71124B3C
711F4B90 8D45 E8 lea eax, dword ptr [ebp-18]
711F4B93 E8 80FFF2FF call 71124B18
711F4B98 C3 retn
711F4B99 - E9 96F8F2FF jmp 71124434
711F4B9E ^ EB E3 jmp short 711F4B83
711F4BA0 5B pop ebx
711F4BA1 8BE5 mov esp, ebp
711F4BA3 5D pop ebp
711F4BA4 C3 retn
711F4BA5 8D40 00 lea eax, dword ptr [eax]
711F4BA8 9C pushfd
711F4BA9 60 pushad
711F4BAA E8 05000000 call 711F4BB4
711F4BAF 61 popad
711F4BB0 9D popfd
711F4BB1 C3 retn
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
