目标程序：某一游戏 mir.exe
0058A000 90 NOP
0058A001 > 60 PUSHAD //程序停留在此处
0058A002 E8 03000000 CALL mir.0058A00A //F7跟进
0058A007 -E9 EB045D45 JMP 45B5A4F7
0058A00C 55 PUSH EBP
0058A00D C3 RETN
0058A00E E8 01000000 CALL mir.0058A014 //F7跟进
---------------- 0058A00A CALL子程序---------------
0058A00A 5D POP EBP ; mir.0058A007
0058A00B 45 INC EBP
0058A00C 55 PUSH EBP
0058A00D C3 RETN //返回 005800A8
-------------- 0058A014 CALL子程序-------------------
0058A014 5D POP EBP ; mir.0058A013
0058A015 BB EDFFFFFF MOV EBX,-13
0058A01A 03DD ADD EBX,EBP
0058A01C 81EB 00A01800 SUB EBX,18A000
0058A022 83BD 22040000 00 CMP DWORD PTR SS:[EBP+422],0
0058A029 899D 22040000 MOV DWORD PTR SS:[EBP+422],EBX
0058A02F 0F85 65030000 JNZ mir.0058A39A
0058A035 8D85 2E040000 LEA EAX,DWORD PTR SS:[EBP+42E]
0058A03B 50 PUSH EAX
0058A03C FF95 4D0F0000 CALL DWORD PTR SS:[EBP+F4D]
0058A042 8985 26040000 MOV DWORD PTR SS:[EBP+426],EAX
0058A048 8BF8 MOV EDI,EAX
0058A04A 8D5D 5E LEA EBX,DWORD PTR SS:[EBP+5E]
0058A04D 53 PUSH EBX
0058A04E 50 PUSH EAX
0058A04F FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]
0058A055 8985 4D050000 MOV DWORD PTR SS:[EBP+54D],EAX
0058A05B 8D5D 6B LEA EBX,DWORD PTR SS:[EBP+6B]
0058A05E 53 PUSH EBX
0058A05F 57 PUSH EDI
0058A060 FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]
0058A066 8985 51050000 MOV DWORD PTR SS:[EBP+551],EAX
0058A06C 8D45 77 LEA EAX,DWORD PTR SS:[EBP+77]
0058A06F FFE0 JMP EAX //F8 转跳到 0058A015
-----------------------------------------------------------------------------
0058A015 BB EDFFFFFF MOV EBX,-13
0058A01A 03DD ADD EBX,EBP
0058A01C 81EB 00A01800 SUB EBX,18A000
0058A022 83BD 22040000 00 CMP DWORD PTR SS:[EBP+422],0
0058A029 899D 22040000 MOV DWORD PTR SS:[EBP+422],EBX
0058A02F 0F85 65030000 JNZ mir.0058A39A
0058A035 8D85 2E040000 LEA EAX,DWORD PTR SS:[EBP+42E]
0058A03B 50 PUSH EAX
0058A03C FF95 4D0F0000 CALL DWORD PTR SS:[EBP+F4D]
0058A042 8985 26040000 MOV DWORD PTR SS:[EBP+426],EAX
0058A048 8BF8 MOV EDI,EAX
0058A04A 8D5D 5E LEA EBX,DWORD PTR SS:[EBP+5E]
0058A04D 53 PUSH EBX
0058A04E 50 PUSH EAX
0058A04F FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]
0058A055 8985 4D050000 MOV DWORD PTR SS:[EBP+54D],EAX
0058A05B 8D5D 6B LEA EBX,DWORD PTR SS:[EBP+6B]
0058A05E 53 PUSH EBX
0058A05F 57 PUSH EDI
0058A060 FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]
0058A066 8985 51050000 MOV DWORD PTR SS:[EBP+551],EAX
0058A06C 8D45 77 LEA EAX,DWORD PTR SS:[EBP+77]
0058A06F FFE0 JMP EAX
0058A071 56 PUSH ESI
0058A072 6972 74 75616C41 IMUL ESI,DWORD PTR DS:[EDX+74],416C6175
0058A079 6C INS BYTE PTR ES:[EDI],DX ; I/O 命令
0058A07A 6C INS BYTE PTR ES:[EDI],DX ; I/O 命令
0058A07B 6F OUTS DX,DWORD PTR ES:[EDI] ; I/O 命令
0058A07C 6300 ARPL DWORD PTR DS:[EAX],EAX
0058A07E 56 PUSH ESI
0058A07F 6972 74 75616C46 IMUL ESI,DWORD PTR DS:[EDX+74],466C6175
0058A086 72 65 JB SHORT mir.0058A0ED
0058A088 65:008B 9D310500 ADD BYTE PTR GS:[EBX+5319D],CL
0058A08F 000B ADD BYTE PTR DS:[EBX],CL
0058A091 DB ??? ; 未知命令
0058A092 74 0A JE SHORT mir.0058A09E
0058A094 8B03 MOV EAX,DWORD PTR DS:[EBX]
0058A096 8785 35050000 XCHG DWORD PTR SS:[EBP+535],EAX
0058A09C 8903 MOV DWORD PTR DS:[EBX],EAX
0058A09E 8DB5 69050000 LEA ESI,DWORD PTR SS:[EBP+569]
0058A0A4 833E 00 CMP DWORD PTR DS:[ESI],0
0058A0A7 0F84 21010000 JE mir.0058A1CE
0058A0AD 6A 04 PUSH 4
0058A0AF 68 00100000 PUSH 1000
0058A0B4 68 00180000 PUSH 1800
0058A0B9 6A 00 PUSH 0
0058A0BB FF95 4D050000 CALL DWORD PTR SS:[EBP+54D]
0058A0C1 8985 56010000 MOV DWORD PTR SS:[EBP+156],EAX
0058A0C7 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
0058A0CA 05 0E010000 ADD EAX,10E
0058A0CF 6A 04 PUSH 4
0058A0D1 68 00100000 PUSH 1000
0058A0D6 50 PUSH EAX
0058A0D7 6A 00 PUSH 0
0058A0D9 FF95 4D050000 CALL DWORD PTR SS:[EBP+54D]
0058A0DF 8985 52010000 MOV DWORD PTR SS:[EBP+152],EAX
0058A0E5 56 PUSH ESI
0058A0E6 8B1E MOV EBX,DWORD PTR DS:[ESI]
0058A0E8 039D 22040000 ADD EBX,DWORD PTR SS:[EBP+422]
0058A0EE FFB5 56010000 PUSH DWORD PTR SS:[EBP+156]
0058A0F4 FF76 04 PUSH DWORD PTR DS:[ESI+4]
0058A0F7 50 PUSH EAX
0058A0F8 53 PUSH EBX
0058A0F9 E8 6E050000 CALL mir.0058A66C
0058A0FE B3 00 MOV BL,0
0058A100 80FB 00 CMP BL,0
0058A103 75 5E JNZ SHORT mir.0058A163
0058A105 FE85 EC000000 INC BYTE PTR SS:[EBP+EC]
0058A10B 8B3E MOV EDI,DWORD PTR DS:[ESI]
0058A10D 03BD 22040000 ADD EDI,DWORD PTR SS:[EBP+422]
0058A113 FF37 PUSH DWORD PTR DS:[EDI]
0058A115 C607 C3 MOV BYTE PTR DS:[EDI],0C3
0058A118 FFD7 CALL EDI
0058A11A 8F07 POP DWORD PTR DS:[EDI]
0058A11C 50 PUSH EAX
0058A11D 51 PUSH ECX
0058A11E 56 PUSH ESI
0058A11F 53 PUSH EBX
0058A120 8BC8 MOV ECX,EAX
0058A122 83E9 06 SUB ECX,6
0058A125 8BB5 52010000 MOV ESI,DWORD PTR SS:[EBP+152]
0058A12B 33DB XOR EBX,EBX
0058A12D 0BC9 OR ECX,ECX
0058A12F 74 2E JE SHORT mir.0058A15F
0058A131 78 2C JS SHORT mir.0058A15F
0058A133 AC LODS BYTE PTR DS:[ESI]
0058A134 3C E8 CMP AL,0E8
0058A136 74 0A JE SHORT mir.0058A142
0058A138 EB 00 JMP SHORT mir.0058A13A
0058A13A 3C E9 CMP AL,0E9
0058A13C 74 04 JE SHORT mir.0058A142
0058A13E 43 INC EBX
0058A13F 49 DEC ECX
0058A140 ^EB EB JMP SHORT mir.0058A12D
0058A142 8B06 MOV EAX,DWORD PTR DS:[ESI]
0058A144 EB 00 JMP SHORT mir.0058A146
0058A146 803E 1F CMP BYTE PTR DS:[ESI],1F
0058A149 ^75 F3 JNZ SHORT mir.0058A13E
0058A14B 24 00 AND AL,0
0058A14D C1C0 18 ROL EAX,18
0058A150 2BC3 SUB EAX,EBX
0058A152 8906 MOV DWORD PTR DS:[ESI],EAX
0058A154 83C3 05 ADD EBX,5
0058A157 83C6 04 ADD ESI,4
0058A15A 83E9 05 SUB ECX,5
0058A15D ^EB CE JMP SHORT mir.0058A12D
0058A15F 5B POP EBX
0058A160 5E POP ESI
0058A161 59 POP ECX
0058A162 58 POP EAX
0058A163 EB 08 JMP SHORT mir.0058A16D
0058A165 0000 ADD BYTE PTR DS:[EAX],AL
0058A167 0000 ADD BYTE PTR DS:[EAX],AL
0058A169 0000 ADD BYTE PTR DS:[EAX],AL
0058A16B 0000 ADD BYTE PTR DS:[EAX],AL
0058A16D 8BC8 MOV ECX,EAX
0058A16F 8B3E MOV EDI,DWORD PTR DS:[ESI]
0058A171 03BD 22040000 ADD EDI,DWORD PTR SS:[EBP+422]
0058A177 8BB5 52010000 MOV ESI,DWORD PTR SS:[EBP+152]
0058A17D C1F9 02 SAR ECX,2
0058A180 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0058A182 8BC8 MOV ECX,EAX
0058A184 83E1 03 AND ECX,3
0058A187 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
0058A189 5E POP ESI
0058A18A 68 00800000 PUSH 8000
0058A18F 6A 00 PUSH 0
0058A191 FFB5 52010000 PUSH DWORD PTR SS:[EBP+152]
0058A197 FF95 51050000 CALL DWORD PTR SS:[EBP+551]
0058A19D 83C6 08 ADD ESI,8
0058A1A0 833E 00 CMP DWORD PTR DS:[ESI],0
0058A1A3 ^0F85 1EFFFFFF JNZ mir.0058A0C7
0058A1A9 68 00800000 PUSH 8000
0058A1AE 6A 00 PUSH 0
0058A1B0 FFB5 56010000 PUSH DWORD PTR SS:[EBP+156]
0058A1B6 FF95 51050000 CALL DWORD PTR SS:[EBP+551]
0058A1BC 8B9D 31050000 MOV EBX,DWORD PTR SS:[EBP+531]
0058A1C2 0BDB OR EBX,EBX
0058A1C4 74 08 JE SHORT mir.0058A1CE
0058A1C6 8B03 MOV EAX,DWORD PTR DS:[EBX]
0058A1C8 8785 35050000 XCHG DWORD PTR SS:[EBP+535],EAX
0058A1CE 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]
0058A1D4 8B85 2D050000 MOV EAX,DWORD PTR SS:[EBP+52D]
0058A1DA 2BD0 SUB EDX,EAX
0058A1DC 74 79 JE SHORT mir.0058A257 //跳转
---------------------------------------------------------------------
0058A257 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422] //跳到这里
0058A25D 8BB5 41050000 MOV ESI,DWORD PTR SS:[EBP+541]
0058A263 0BF6 OR ESI,ESI
0058A265 74 11 JE SHORT mir.0058A278 ///<-1
0058A267 03F2 ADD ESI,EDX
0058A269 AD LODS DWORD PTR DS:[ESI] ///2->
0058A26A 0BC0 OR EAX,EAX
0058A26C 74 0A JE SHORT mir.0058A278 ///<-1
0058A26E 03C2 ADD EAX,EDX
0058A270 8BF8 MOV EDI,EAX
0058A272 66:AD LODS WORD PTR DS:[ESI]
0058A274 66:AB STOS WORD PTR ES:[EDI]
0058A276 ^EB F1 JMP SHORT mir.0058A269 ///<-2
0058A278 BE 00700F00 MOV ESI,0F7000 ///1->
0058A27D 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]
0058A283 03F2 ADD ESI,EDX
0058A285 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
0058A288 85C0 TEST EAX,EAX
0058A28A 0F84 0A010000 JE mir.0058A39A
0058A290 03C2 ADD EAX,EDX
0058A292 8BD8 MOV EBX,EAX
0058A294 50 PUSH EAX
0058A295 FF95 4D0F0000 CALL DWORD PTR SS:[EBP+F4D]
0058A29B 85C0 TEST EAX,EAX
0058A29D 75 07 JNZ SHORT mir.0058A2A6 ///<-3
0058A29F 53 PUSH EBX
0058A2A0 FF95 510F0000 CALL DWORD PTR SS:[EBP+F51]
0058A2A6 8985 45050000 MOV DWORD PTR SS:[EBP+545],EAX ///3->
0058A2AC C785 49050000 00>MOV DWORD PTR SS:[EBP+549],0
0058A2B6 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]
0058A2BC 8B06 MOV EAX,DWORD PTR DS:[ESI]
0058A2BE 85C0 TEST EAX,EAX
0058A2C0 75 03 JNZ SHORT mir.0058A2C5
0058A2C2 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10]
0058A2C5 03C2 ADD EAX,EDX
0058A2C7 0385 49050000 ADD EAX,DWORD PTR SS:[EBP+549]
0058A2CD 8B18 MOV EBX,DWORD PTR DS:[EAX]
0058A2CF 8B7E 10 MOV EDI,DWORD PTR DS:[ESI+10]
0058A2D2 03FA ADD EDI,EDX
0058A2D4 03BD 49050000 ADD EDI,DWORD PTR SS:[EBP+549]
0058A2DA 85DB TEST EBX,EBX
0058A2DC 0F84 A2000000 JE mir.0058A384
0058A2E2 F7C3 00000080 TEST EBX,80000000
0058A2E8 75 04 JNZ SHORT mir.0058A2EE
0058A2EA 03DA ADD EBX,EDX
0058A2EC 43 INC EBX
0058A2ED 43 INC EBX
0058A2EE 53 PUSH EBX
0058A2EF 81E3 FFFFFF7F AND EBX,7FFFFFFF
0058A2F5 53 PUSH EBX
0058A2F6 FFB5 45050000 PUSH DWORD PTR SS:[EBP+545]
0058A2FC FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]
0058A302 85C0 TEST EAX,EAX
0058A304 5B POP EBX
0058A305 75 6F JNZ SHORT mir.0058A376
0058A307 F7C3 00000080 TEST EBX,80000000
0058A30D 75 19 JNZ SHORT mir.0058A328
0058A30F 57 PUSH EDI
0058A310 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
0058A313 0385 22040000 ADD EAX,DWORD PTR SS:[EBP+422]
0058A319 50 PUSH EAX
0058A31A 53 PUSH EBX
0058A31B 8D85 75040000 LEA EAX,DWORD PTR SS:[EBP+475]
0058A321 50 PUSH EAX
0058A322 57 PUSH EDI
0058A323 E9 98000000 JMP mir.0058A3C0
0058A328 81E3 FFFFFF7F AND EBX,7FFFFFFF
0058A32E 8B85 26040000 MOV EAX,DWORD PTR SS:[EBP+426]
0058A334 3985 45050000 CMP DWORD PTR SS:[EBP+545],EAX
0058A33A 75 24 JNZ SHORT mir.0058A360
0058A33C 57 PUSH EDI
0058A33D 8BD3 MOV EDX,EBX
0058A33F 4A DEC EDX
0058A340 C1E2 02 SHL EDX,2
0058A343 8B9D 45050000 MOV EBX,DWORD PTR SS:[EBP+545]
0058A2D4 03BD 49050000 ADD EDI,DWORD PTR SS:[EBP+549]
0058A2DA 85DB TEST EBX,EBX
0058A2DC 0F84 A2000000 JE mir.0058A384
0058A2E2 F7C3 00000080 TEST EBX,80000000
0058A2E8 75 04 JNZ SHORT mir.0058A2EE
0058A2EA 03DA ADD EBX,EDX
0058A2EC 43 INC EBX
0058A2ED 43 INC EBX
0058A2EE 53 PUSH EBX
0058A2EF 81E3 FFFFFF7F AND EBX,7FFFFFFF
0058A2F5 53 PUSH EBX
0058A2F6 FFB5 45050000 PUSH DWORD PTR SS:[EBP+545]
0058A2FC FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]
0058A302 85C0 TEST EAX,EAX
0058A304 5B POP EBX
0058A305 75 6F JNZ SHORT mir.0058A376
0058A307 F7C3 00000080 TEST EBX,80000000
0058A30D 75 19 JNZ SHORT mir.0058A328
0058A30F 57 PUSH EDI
0058A310 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
0058A313 0385 22040000 ADD EAX,DWORD PTR SS:[EBP+422]
0058A319 50 PUSH EAX
0058A31A 53 PUSH EBX
0058A31B 8D85 75040000 LEA EAX,DWORD PTR SS:[EBP+475]
0058A321 50 PUSH EAX
0058A322 57 PUSH EDI
0058A323 E9 98000000 JMP mir.0058A3C0
0058A328 81E3 FFFFFF7F AND EBX,7FFFFFFF
0058A32E 8B85 26040000 MOV EAX,DWORD PTR SS:[EBP+426]
0058A334 3985 45050000 CMP DWORD PTR SS:[EBP+545],EAX
0058A33A 75 24 JNZ SHORT mir.0058A360
0058A33C 57 PUSH EDI
0058A33D 8BD3 MOV EDX,EBX
0058A33F 4A DEC EDX
0058A340 C1E2 02 SHL EDX,2
0058A343 8B9D 45050000 MOV EBX,DWORD PTR SS:[EBP+545]
0058A349 8B7B 3C MOV EDI,DWORD PTR DS:[EBX+3C]
0058A34C 8B7C3B 78 MOV EDI,DWORD PTR DS:[EBX+EDI+78]
0058A350 035C3B 1C ADD EBX,DWORD PTR DS:[EBX+EDI+1C]
0058A354 8B0413 MOV EAX,DWORD PTR DS:[EBX+EDX]
0058A357 0385 45050000 ADD EAX,DWORD PTR SS:[EBP+545]
0058A35D 5F POP EDI
0058A35E EB 16 JMP SHORT mir.0058A376
0058A360 57 PUSH EDI
0058A361 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
0058A364 0385 22040000 ADD EAX,DWORD PTR SS:[EBP+422]
0058A36A 50 PUSH EAX
0058A36B 53 PUSH EBX
0058A36C 8D85 C6040000 LEA EAX,DWORD PTR SS:[EBP+4C6]
0058A372 50 PUSH EAX
0058A373 57 PUSH EDI
0058A374 EB 4A JMP SHORT mir.0058A3C0
0058A376 8907 MOV DWORD PTR DS:[EDI],EAX
0058A378 8385 49050000 04 ADD DWORD PTR SS:[EBP+549],4
0058A37F ^E9 32FFFFFF JMP mir.0058A2B6
0058A384 8906 MOV DWORD PTR DS:[ESI],EAX
0058A386 8946 0C MOV DWORD PTR DS:[ESI+C],EAX
0058A389 8946 10 MOV DWORD PTR DS:[ESI+10],EAX
0058A38C 83C6 14 ADD ESI,14
0058A38F 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]
0058A395 ^E9 EBFEFFFF JMP mir.0058A285
0058A39A B8 A48B0E00 MOV EAX,0E8BA4
0058A39F 50 PUSH EAX
0058A3A0 0385 22040000 ADD EAX,DWORD PTR SS:[EBP+422]
0058A3A6 59 POP ECX
0058A3A7 0BC9 OR ECX,ECX
0058A3A9 8985 A8030000 MOV DWORD PTR SS:[EBP+3A8],EAX
0058A3AF 61 POPAD //哈哈,看到了吗? ^O^ 附近有口
0058A3B0 75 08 JNZ SHORT mir.0058A3BA // {跳
0058A3B2 B8 01000000 MOV EAX,1
0058A3B7 C2 0C00 RETN 0C
0058A3BA 68 00000000 PUSH 0 // 到这里}
0058A3BF C3 RETN
------------------------------------------------
0058A002 E8 03000000 CALL mir.0058A00A
0058A007 -E9 EB045D45 JMP 45B5A4F7
0058A00C 55 PUSH EBP //oep, dump it
0058A00D C3 RETN
PEID 一查， Nothing found * ,奇怪了，原因自己分析是没修复IAT表的缘故，真确与否还请诸位帮忙，由于明天要考试，所以暂且弄到这里了。
这是我手脱的第一个壳，心情自然甭提有多高兴了，虽然可能在高手眼中是 张飞吃豆芽，呵呵~~
在次十分感谢fly等诸位的大力帮忙，谢谢！
顺便插一局，新手嘛，所以刚才还不知道怎么dump，说出来让大家happy一下，新年了，祝大家天天有个好心情！
About how to dump
首先光标停留在
0058A00C 55 PUSH EBP
这一行，F2，确定，F9。打开 LordPE ，注意此时不要关闭OD，选择进程，右键 dump full 选择一个保存路径和文件名称即可。
【总结】
脱 ASPack 2.12 -> Alexey Solodovnikov
用 od 载入 .exe后 ,来到程序入口点,一般后面紧跟 2个 call 指令,跟踪直到 出现了 POPAD 这一句,程序就在附近, 看见2个 RETN ,第二个处,F7,变来到了入口点,00?????? 55 push ebp 处即可dump了!
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
