part1
点击下载：附件！
part2
点击下载：附件！
附上dede1.06的简单脱壳过程，呵呵，win2k下
peid查出Neolite 2.0 -> Neoworx Inc.（没见过）
od载入后，停在这里：
005742D0 > $ E9 A6000000 JMP DeDe.0057437B*******跳转
005742D5 E05B5700 DD DeDe.00575BE0
005742D9 . F0405700 DD <&kernel32.LoadLibraryA>
005742DD . F4405700 DD <&kernel32.GetProcAddress>
005742E1 . 00000000 DD 00000000
005742E5 . E03D0000 DD 00003DE0
005742E9 92435700 DD DeDe.00574392
005742ED . 4E 65 6F 4C 69>ASCII "NeoLite Executab"
005742FD . 6C 65 20 46 69>ASCII "le File Compress"
0057430D . 6F 72 0D 0A 43>ASCII "or
Copyright (c"
0057431D . 29 20 31 39 39>ASCII ") 1998,1999 NeoW"
0057432D . 6F 72 78 20 49>ASCII "orx Inc
Portion"
0057433D . 73 20 43 6F 70>ASCII "s Copyright (c) "
0057434D . 31 39 39 37 2D>ASCII "1997-1999 Lee Ha"
0057435D . 73 69 75 6B 0D>ASCII "siuk
All Rights"
0057436D . 20 52 65 73 65>ASCII " Reserved.
",0
0057437A . 00 DB 00
0057437B > 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]****跳到这里
0057437F . 2305 E1425700 AND EAX,DWORD PTR DS:[5742E1]
00574385 . E8 71030000 CALL DeDe.005746FB*******解压文件
0057438A . FE05 7A435700 INC BYTE PTR DS:[57437A]
00574390 . FFE0 JMP EAX*******跳到oep
00574392 . 803D 7A435700 >CMP BYTE PTR DS:[57437A],0
00574399 . 75 13 JNZ SHORT DeDe.005743AE
0057439B . 90 NOP
0057439C . 90 NOP
0057439D . 90 NOP
0057439E . 90 NOP
0057439F . 50 PUSH EAX
005743A0 . 2BC0 SUB EAX,EAX
005743A2 . E8 54030000 CALL DeDe.005746FB
005743A7 . 58 POP EAX
005743A8 . FE05 7A435700 INC BYTE PTR DS:[57437A]
005743AE > C3 RETN
005743AF 94 DB 94
005743B0 9A DB 9A
005743B1 8D DB 8D
005743B2 91 DB 91
**************oep*****************
004F1D38 55 PUSH EBP
004F1D39 8BEC MOV EBP,ESP
004F1D3B 83C4 F4 ADD ESP,-0C
004F1D3E B8 30194F00 MOV EAX,DeDe.004F1930
004F1D43 E8 744DF1FF CALL DeDe.00406ABC
004F1D48 33C9 XOR ECX,ECX
004F1D4A B2 01 MOV DL,1
004F1D4C A1 14174F00 MOV EAX,DWORD PTR DS:[4F1714]
004F1D51 E8 0E8CF5FF CALL DeDe.0044A964
004F1D56 A3 08B34F00 MOV DWORD PTR DS:[4FB308],EAX
004F1D5B A1 08B34F00 MOV EAX,DWORD PTR DS:[4FB308]
004F1D60 E8 13CBF5FF CALL DeDe.0044E878
004F1D65 A1 08B34F00 MOV EAX,DWORD PTR DS:[4FB308]
004F1D6A 8B10 MOV EDX,DWORD PTR DS:[EAX]
004F1D6C FF92 84000000 CALL DWORD PTR DS:[EDX+84]
004F1D72 68 2C1F4F00 PUSH DeDe.004F1F2C ; ASCII "DeDe"
004F1D77 6A 00 PUSH 0
004F1D79 6A 00 PUSH 0
004F1D7B E8 204EF1FF CALL DeDe.00406BA0 ; JMP to kernel32.CreateMutexA
004F1D80 A3 0CB34F00 MOV DWORD PTR DS:[4FB30C],EAX
004F1D85 6A 00 PUSH 0
004F1D87 A1 0CB34F00 MOV EAX,DWORD PTR DS:[4FB30C]
004F1D8C 50 PUSH EAX
004F1D8D E8 D650F1FF CALL DeDe.00406E68 ; JMP to kernel32.WaitForSingleObject
004F1D92 3D 02010000 CMP EAX,102
004F1D97 0F84 7F010000 JE DeDe.004F1F1C
004F1D9D 33C0 XOR EAX,EAX
004F1D9F 55 PUSH EBP
dump,importREC修复。
可以运行。597k->1.49M
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
