-
-
[原创]压缩壳之dePACK壳分析
-
发表于: 2009-3-10 23:17
-
前面已经有过几篇压缩壳的文章，接下来还是对于压缩壳的一点个人分析,
壳开始代码的其中一部分
从这段代码中我们可以看到，这个壳是分区段分别压缩和解压的（注释）,进入depack的解压函数
loc_46B053:
add ebx, 200h
push ebx ; 46b24d
push edi ; 401000
发现其实壳是将压缩后的区块放到46b24d中进行处理的
DataCopy: ; 将数据段中数据转移出来,到：46b24d
mov eax, [edi]
mov [ebx], eax
add edi, 4 ; 下一DWORD
add ebx, 4
dec esi ; a181
jnz short DataCopy ; 将数据段中数据转移出来,到：46b24d
; ---------------------------------------------------------------------------
.depack:0046B11B
.depack:0046B11B loc_46B11B: ; CODE XREF: DePack+B4j
.depack:0046B11B dec eax
.depack:0046B11C shl eax, 8 ; offs <<= 8;
.depack:0046B11F mov al, [esi] ; offs += *ud.source;
.depack:0046B121 inc esi ; *ud.source++
.depack:0046B122 mov ebp, eax
.depack:0046B124 mov ecx, 1
.depack:0046B129
.depack:0046B129 loc_46B129: ; CODE XREF: DePack:loc_46B13Dj
.depack:0046B129 add dl, dl
.depack:0046B12B jnz short loc_46B132
.depack:0046B12D mov dl, [esi]
.depack:0046B12F inc esi
.depack:0046B130 adc dl, dl
.depack:0046B132
.depack:0046B132 loc_46B132: ; CODE XREF: DePack+EEj
.depack:0046B132 adc ecx, ecx
.depack:0046B134 add dl, dl
.depack:0046B136 jnz short loc_46B13D
.depack:0046B138 mov dl, [esi]
.depack:0046B13A inc esi
.depack:0046B13B adc dl, dl
.depack:0046B13D
.depack:0046B13D loc_46B13D: ; CODE XREF: DePack+F9j
.depack:0046B13D jb short loc_46B129
.depack:0046B13F cmp eax, 7D00h ; 32000
.depack:0046B144 jnb short loc_46B160 ; if (offs >= 32000) len++;
.depack:0046B146 cmp eax, 500h ; if (offs >= 1280) len++;
.depack:0046B14B jb short loc_46B15B ; if (offs < 128) len += 2;
.depack:0046B14D inc ecx
.depack:0046B14E push esi
.depack:0046B14F mov esi, edi
.depack:0046B151 sub esi, eax
.depack:0046B153 rep movsb
.depack:0046B155 pop esi
.depack:0046B156 jmp nexttag ; call getbit
.depack:0046B15B ; ---------------------------------------------------------------------------
.depack:0046B15B
.depack:0046B15B loc_46B15B: ; CODE XREF: DePack+10Ej
.depack:0046B15B cmp eax, 7Fh ; if (offs < 128) len += 2;
.depack:0046B15E ja short loc_46B163
.depack:0046B160
.depack:0046B160 loc_46B160: ; CODE XREF: DePack+107j
.depack:0046B160 add ecx, 2 ; len += 2;
.depack:0046B163
.depack:0046B163 loc_46B163: ; CODE XREF: DePack+121j
.depack:0046B163 push esi
.depack:0046B164 mov esi, edi
.depack:0046B166 sub esi, eax
.depack:0046B168 rep movsb
.depack:0046B16A pop esi
.depack:0046B16B jmp nexttag ; call getbit
.depack:0046B170 ; ---------------------------------------------------------------------------
.depack:0046B170
.depack:0046B170 loc_46B170: ; CODE XREF: DePack:loc_46B094j
.depack:0046B170 mov al, [esi]
.depack:0046B172 inc esi
.depack:0046B173 xor ecx, ecx
.depack:0046B175 shr al, 1
.depack:0046B178 jz short loc_46B18C
.depack:0046B17A adc ecx, 2
.depack:0046B17D mov ebp, eax
.depack:0046B17F push esi ; domatch
.depack:0046B180 mov esi, edi
.depack:0046B182 sub esi, eax
.depack:0046B184 rep movsb
.depack:0046B186 pop esi
.depack:0046B187 jmp nexttag ; call getbit
.depack:0046B18C ; ---------------------------------------------------------------------------
.depack:0046B18C
.depack:0046B18C loc_46B18C: ; CODE XREF: DePack+13Bj
.depack:0046B18C pop ebp
.depack:0046B18D sub edi, [ebp+arg_4]
.depack:0046B190 mov [ebp+var_4], edi
.depack:0046B193 popa
.depack:0046B194 pop ebp
.depack:0046B195 retn
一个和经典压缩算法了
getbit：
---------------------------------------------------------------------------
以上的几个壳都是很“规矩”的壳，以后将对反调试 复杂变换等的壳进行学习
好好学习，天天进步！
壳开始代码的其中一部分
loc_46B003: [color=#008000]; CODE XREF: startj[/color] .depack:0046B003 [color=#0000FF]pusha[/color] .depack:0046B004 [color=#0000FF]push[/color] [color=#FF0000]offset[/color] dword_401000 [color=#008000]; .text[/color] .depack:0046B009 [color=#0000FF]push[/color] 0A181h .depack:0046B00E [color=#0000FF]call[/color] DePack .depack:0046B013 [color=#0000FF]push[/color] [color=#FF0000]offset[/color] unk_44B000 [color=#008000]; .rdata[/color] .depack:0046B018 [color=#0000FF]push[/color] 0C81h .depack:0046B01D [color=#0000FF]call[/color] DePack .depack:0046B022 [color=#0000FF]push[/color] [color=#FF0000]offset[/color] unk_457000 [color=#008000]; .data[/color] .depack:0046B027 [color=#0000FF]push[/color] 581h .depack:0046B02C [color=#0000FF]call[/color] DePack .depack:0046B031 [color=#0000FF]nop[/color] .depack:0046B032 [color=#0000FF]jmp[/color] [color=#FF0000]short[/color] loc_46B035
从这段代码中我们可以看到，这个壳是分区段分别压缩和解压的（注释）,进入depack的解压函数
[color=#0000FF]push[/color] [color=#808000]ebp[/color] [color=#0000FF]mov[/color] [color=#808000]ebp[/color], [color=#808000]esp[/color] [color=#0000FF]pusha[/color] [color=#0000FF]push[/color] [color=#808000]ebp[/color] [color=#0000FF]mov[/color] [color=#808000]esi[/color], [[color=#808000]ebp[/color]+arg_0] [color=#0000FF]mov[/color] [color=#808000]edi[/color], [[color=#808000]ebp[/color]+arg_4] [color=#008000]; 401000[/color] [color=#0000FF]call[/color] sub_46B04F [color=#0000FF]jmp[/color] [color=#FF0000]short[/color] loc_46B053 DePack [color=#FF0000]endp[/color]
loc_46B053:
add ebx, 200h
push ebx ; 46b24d
push edi ; 401000
发现其实壳是将压缩后的区块放到46b24d中进行处理的
DataCopy: ; 将数据段中数据转移出来,到：46b24d
mov eax, [edi]
mov [ebx], eax
add edi, 4 ; 下一DWORD
add ebx, 4
dec esi ; a181
jnz short DataCopy ; 将数据段中数据转移出来,到：46b24d
; ---------------------------------------------------------------------------
.depack:0046B11B
.depack:0046B11B loc_46B11B: ; CODE XREF: DePack+B4j
.depack:0046B11B dec eax
.depack:0046B11C shl eax, 8 ; offs <<= 8;
.depack:0046B11F mov al, [esi] ; offs += *ud.source;
.depack:0046B121 inc esi ; *ud.source++
.depack:0046B122 mov ebp, eax
.depack:0046B124 mov ecx, 1
.depack:0046B129
.depack:0046B129 loc_46B129: ; CODE XREF: DePack:loc_46B13Dj
.depack:0046B129 add dl, dl
.depack:0046B12B jnz short loc_46B132
.depack:0046B12D mov dl, [esi]
.depack:0046B12F inc esi
.depack:0046B130 adc dl, dl
.depack:0046B132
.depack:0046B132 loc_46B132: ; CODE XREF: DePack+EEj
.depack:0046B132 adc ecx, ecx
.depack:0046B134 add dl, dl
.depack:0046B136 jnz short loc_46B13D
.depack:0046B138 mov dl, [esi]
.depack:0046B13A inc esi
.depack:0046B13B adc dl, dl
.depack:0046B13D
.depack:0046B13D loc_46B13D: ; CODE XREF: DePack+F9j
.depack:0046B13D jb short loc_46B129
.depack:0046B13F cmp eax, 7D00h ; 32000
.depack:0046B144 jnb short loc_46B160 ; if (offs >= 32000) len++;
.depack:0046B146 cmp eax, 500h ; if (offs >= 1280) len++;
.depack:0046B14B jb short loc_46B15B ; if (offs < 128) len += 2;
.depack:0046B14D inc ecx
.depack:0046B14E push esi
.depack:0046B14F mov esi, edi
.depack:0046B151 sub esi, eax
.depack:0046B153 rep movsb
.depack:0046B155 pop esi
.depack:0046B156 jmp nexttag ; call getbit
.depack:0046B15B ; ---------------------------------------------------------------------------
.depack:0046B15B
.depack:0046B15B loc_46B15B: ; CODE XREF: DePack+10Ej
.depack:0046B15B cmp eax, 7Fh ; if (offs < 128) len += 2;
.depack:0046B15E ja short loc_46B163
.depack:0046B160
.depack:0046B160 loc_46B160: ; CODE XREF: DePack+107j
.depack:0046B160 add ecx, 2 ; len += 2;
.depack:0046B163
.depack:0046B163 loc_46B163: ; CODE XREF: DePack+121j
.depack:0046B163 push esi
.depack:0046B164 mov esi, edi
.depack:0046B166 sub esi, eax
.depack:0046B168 rep movsb
.depack:0046B16A pop esi
.depack:0046B16B jmp nexttag ; call getbit
.depack:0046B170 ; ---------------------------------------------------------------------------
.depack:0046B170
.depack:0046B170 loc_46B170: ; CODE XREF: DePack:loc_46B094j
.depack:0046B170 mov al, [esi]
.depack:0046B172 inc esi
.depack:0046B173 xor ecx, ecx
.depack:0046B175 shr al, 1
.depack:0046B178 jz short loc_46B18C
.depack:0046B17A adc ecx, 2
.depack:0046B17D mov ebp, eax
.depack:0046B17F push esi ; domatch
.depack:0046B180 mov esi, edi
.depack:0046B182 sub esi, eax
.depack:0046B184 rep movsb
.depack:0046B186 pop esi
.depack:0046B187 jmp nexttag ; call getbit
.depack:0046B18C ; ---------------------------------------------------------------------------
.depack:0046B18C
.depack:0046B18C loc_46B18C: ; CODE XREF: DePack+13Bj
.depack:0046B18C pop ebp
.depack:0046B18D sub edi, [ebp+arg_4]
.depack:0046B190 mov [ebp+var_4], edi
.depack:0046B193 popa
.depack:0046B194 pop ebp
.depack:0046B195 retn
一个和经典压缩算法了
getbit：
/* check if tag is empty */
if (!ud->bitcount--)
{
/* load next tag */
ud->tag = *ud->source++[color=#008000];[/color]
ud->bitcount = 7[color=#008000];[/color]
}
/* shift bit [color=#0000FF]out[/color] of tag */
bit = (ud->tag >> 7) & 0x01[color=#008000];[/color]
ud->tag <<= 1[color=#008000];[/color]
return bit[color=#008000];
---------------------------------------------------------------------------
if (aP_getbit(&ud))
{
if (aP_getbit(&ud))
{
if (aP_getbit(&ud))
{
offs = 0[color=#008000];[/color]
for (i = 4[color=#008000]; i; i--) offs = (offs << 1) + aP_getbit(&ud);[/color]
if (offs)
{
*ud.destination = *(ud.destination - offs)[color=#008000];[/color]
ud.destination++[color=#008000];[/color]
} else {
*ud.destination++ = 0x00[color=#008000];[/color]
}
LWM = 0[color=#008000];[/color]
} else {
offs = *ud.source++[color=#008000];[/color]
len = 2 + (offs & 0x0001)[color=#008000];[/color]
offs >>= 1[color=#008000];[/color]
if (offs)
{
for ([color=#008000]; len; len--)[/color]
{
*ud.destination = *(ud.destination - offs)[color=#008000];[/color]
ud.destination++[color=#008000];[/color]
}
} else done = 1[color=#008000];[/color]
R0 = offs[color=#008000];[/color]
LWM = 1[color=#008000];[/color]
}
} else {
offs = aP_getgamma(&ud)[color=#008000];[/color]
if ((LWM == 0) && (offs == 2))
{
offs = R0[color=#008000];[/color]
len = aP_getgamma(&ud)[color=#008000];[/color]
for ([color=#008000]; len; len--)[/color]
{
*ud.destination = *(ud.destination - offs)[color=#008000];[/color]
ud.destination++[color=#008000];[/color]
}
} else {
if (LWM == 0)
offs -= 3[color=#008000]; [/color]
else
offs -= 2[color=#008000];[/color]
offs <<= 8[color=#008000];[/color]
offs += *ud.source++[color=#008000];[/color]
len = aP_getgamma(&ud)[color=#008000];[/color]
if (offs >= 32000) len++[color=#008000];[/color]
if (offs >= 1280) len++[color=#008000];[/color]
if (offs < 128) len += 2[color=#008000];[/color]
for ([color=#008000]; len; len--)[/color]
{
*ud.destination = *(ud.destination - offs)[color=#008000];[/color]
ud.destination++[color=#008000];[/color]
}
R0 = offs[color=#008000];[/color]
}
LWM = 1[color=#008000];[/color]
}
} else {
*ud.destination++ = *ud.source++[color=#008000];[/color]
LWM = 0[color=#008000];[/color]
}以上的几个壳都是很“规矩”的壳，以后将对反调试 复杂变换等的壳进行学习
好好学习，天天进步！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
