脱壳Themida v1.9.5.0(All Protection Options)
【文章标题】: 脱壳Themida v1.9.5.0(All Protection Options)
【文章作者】: hxqlky
【作者邮箱】: zmunlky@gmail.com
【作者主页】: http://www.x5dj.com/hxqlky
【下载地址】: 自己搜索下载
【加壳方式】: Themida v1.9.5
【编写语言】: vc++6.0
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】
00514014 > /E9 B4360000 jmp Level#4.005176CD入口
00514019 |0000 add byte ptr ds:[eax],al
0051401B |0000 add byte ptr ds:[eax],al
0051401D |0000 add byte ptr ds:[eax],al
0051401F |0000 add byte ptr ds:[eax],al
00514021 |0000 add byte ptr ds:[eax],al
alt+M 内存写入401000
005AD708 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[> f8
005AD70A C685 59337906 5>mov byte ptr ss:[ebp+6793359],56 f9
005AD711 68 396D1FD4 push D41F6D39
005AD716 FFB5 B92A7906 push dword ptr ss:[ebp+6792AB9]
005AD71C 8D85 62307D06 lea eax,dword ptr ss:[ebp+67D3062]
005AD722 FFD0 call eax
005BF94A 8928 mov dword ptr ds:[eax],ebp ; winmm.mmioRead
005BF94C 5D pop ebp
005BF94D 60 pushad
005BF94E 57 push edi
005BFC8C AA stos byte ptr es:[edi]
005BFC8D F9 stc
005BFC8E E9 14000000 jmp Level#4.005BFCA7
005BFC93 ^ 7D F7 jge short Level#4.005BFC8C
005BFC95 183A sbb byte ptr ds:[edx],bh
二进制搜索3D 00000100
005BD1A8 3D 00000100 cmp eax,10000 向上 ; UNICODE "ALLUSERSPROFILE=C:\Documents and Settings\All Users"
005BD1AD 0F83 A8010000 jnb Level#4.005BD35B
005BD1B3 0F88 0A000000 js Level#4.005BD1C3
005BD1B9 E9 05000000 jmp Level#4.005BD1C3
005BD1BE 6C ins byte ptr es:[edi],dx
二进制搜索3985553179060F84
005BCF4C 3985 55317906 cmp dword ptr ss:[ebp+6793155],eax
005BCF52 0F84 88000000 je Level#4.005BCFE0 >>>>>>>>> jmp
005BCF58 60 pushad
005BCF59 66:81F7 D590 xor di,90D5
005BCF5E 0FB7FF movzx edi,di
005BCF61 61 popad
005BCF62 68 00000000 push 0
005BCF67 8B0424 mov eax,dword ptr ss:[esp]
005BCF6A 81C4 04000000 add esp,4
二进制搜索4b0f84
0057B176 /0F85 0C000000 jnz Level#4.0057B188
0057B17C |3B85 15077906 cmp eax,dword ptr ss:[ebp+6790715]
0057B182 |0F84 36000000 je Level#4.0057B1BE
0057B188 \3B85 191D7906 cmp eax,dword ptr ss:[ebp+6791D19]
0057B18E 0F84 2A000000 je Level#4.0057B1BE
0057B194 3B85 2D1E7906 cmp eax,dword ptr ss:[ebp+6791E2D]
0057B19A 0F84 1E000000 je Level#4.0057B1BE
0057B1A0 3B85 69087906 cmp eax,dword ptr ss:[ebp+6790869]
0057B1A6 0F84 12000000 je Level#4.0057B1BE
0057B1AC 83BD 99317906 0>cmp dword ptr ss:[ebp+6793199],1
0057B1B3 0F84 05000000 je Level#4.0057B1BE
0057B1B9 E9 5F000000 jmp Level#4.0057B21D
0057B1BE 8BD0 mov edx,eax
0057B1C0 0352 3C add edx,dword ptr ds:[edx+3C]
005BD7FE /0F84 EE000000 je Level#4.005BD8F2 nop
005BD804 |F9 stc
005BD805 |8B9D 191D7906 mov ebx,dword ptr ss:[ebp+6791D19]
005BD80B |0F8F 01000000 jg Level#4.005BD812
005BD811 |FC cld
005BD812 |2BD9 sub ebx,ecx
005BD814 |0F84 D8000000 je Level#4.005BD8F2 nop
005BD81A |0F8A 1F000000 jpe Level#4.005BD83F
005BD820 |0F88 19000000 js Level#4.005BD83F
005BD826 |E9 14000000 jmp Level#4.005BD83F
005BD85B 2BD9 sub ebx,ecx
005BD85D 0F84 8F000000 je Level#4.005BD8F2 nop
005BD863 FC cld
005BD864 8D9D 5EBF8306 lea ebx,dword ptr ss:[ebp+683BF5E]
删除内存断点
bp ZwFreeVirtualMemory
7C9570FD > B8 57000000 mov eax,57
7C957102 BA 0003FE7F mov edx,7FFE0300
7C957107 FF12 call dword ptr ds:[edx]
7C957109 C2 1000 retn 10
7C95710C 90 nop
7C95710D > B8 58000000 mov eax,58
EAX 0012FF58
ECX 0012FF2C
EDX 7C95860C ntdll.KiFastSystemCallRet
EBX 003E0024
ESP 0012FF30
EBP 0012FF4C
ESI 7C9570FD ntdll.ZwFreeVirtualMemory
EDI 0042E739 Level#4.0042E739
EIP 7C9570FD ntdll.ZwFreeVirtualMemory
取消断点ZwFreeVirtualMemory
alt+M 内存访问401000
0052187B FF32 push dword ptr ds:[edx] ; kernel32.GetVersion
0052187D ^ E9 49D1FFFF jmp Level#4.0051E9CB
00521882 5A pop edx
00521883 68 79190000 push 1979
00521888 893424 mov dword ptr ss:[esp],esi
0052188B 813424 2841174B xor dword ptr ss:[esp],4B174128
00521892 5B pop ebx
00521893 ^ E9 5AEBFFFF jmp Level#4.005203F2
00411C8C ? A3 14184400 mov dword ptr ds:[441814],eax
00411C91 . 33C0 xor eax,eax
00411C93 A0 db A0
00411C94 15 db 15
00411C95 18 db 18
00411C96 44 db 44 ; CHAR 'D'
00411C97 00 db 00
00411C60 . 07 pop es oep
00411C61 .^ 71 AA jno short Level#4.00411C0D
00411C63 ? B8 75C7D29E mov eax,9ED2C775
00411C68 ? 97 xchg eax,edi
00411C69 > A6 cmps byte ptr ds:[esi],byte ptr es:[edi]
00411C6A ? C7 ??? ; 未知命令
00411C6B . 8DA5 CDA4F6C7 lea esp,dword ptr ss:[ebp+C7F6A4CD]
00411C71 . 5D pop ebp
00411C72 ? 1318 adc ebx,dword ptr ds:[eax]
55 8B EC 6A FF 68 60 0E 45 00 68 C8 92 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8
53 56 57 89 65 E8 E8 40 7B 41 7C 90 33 D2 8A D4 89 15 34 E6 45 00 8B C8 81 E1 FF 00 00 A1
oep 贴上代码
0012FF84 0012FFE0 指向下一个 SEH 记录的指针
0012FF88 00415E94 SE处理程序 push
0012FF8C 004398A0 Level#4.004398A0 push
00411C60 55 push ebp oep
00411C61 8BEC mov ebp,esp
00411C63 6A FF push -1
00411C65 68 A0984300 push Level#4.004398A0
00411C6A 68 945E4100 push Level#4.00415E94
00411C6F 64:A1 0000000>mov eax,dword ptr fs:[0]
00411C75 50 push eax
00411C76 64:8925 00000>mov dword ptr fs:[0],esp
00411C7D 83C4 A8 add esp,-58
00411C80 53 push ebx
00411C81 56 push esi
00411C82 57 push edi
00411C83 8965 E8 mov dword ptr ss:[ebp-18],esp
00411C86 FF15 54305100 call dword ptr ds:[513054] ; kernel32.GetVersion
00411C8C 33D2 xor edx,edx
00411C8E 8AD4 mov dl,ah
00411C90 8915 34E64500 mov dword ptr ds:[45E634],edx
00411C96 8BC8 mov ecx,eax
00411C98 81E1 FF0000A1 and ecx,A10000FF
00411C9E 90 nop
00411C9F 90 nop
00411CA0 90 nop
00411CA1 90 nop
00411CA2 90 nop
00411CA3 90 nop
00411CA4 90 nop
00411CA5 90 nop
00411CA6 90 nop
00411CA7 90 nop
00411CA8 90 nop
00411CA9 90 nop
00411CAA 90 nop
00411CAB 90 nop
00411CAC 90 nop
00411CAD 90 nop
00411CAE 90 nop
00411CAF 90 nop
00411CB0 90 nop
00411CB1 90 nop
00411CB2 90 nop
00411CB3 90 nop
00411CB4 90 nop
00411CB5 90 nop
00411CB6 90 nop
00411CB7 90 nop
00411CB8 90 nop
00411CB9 90 nop
00411CBA 90 nop
00411CBB 90 nop
00411CBC 90 nop
00411CBD 90 nop
00411CBE 90 nop
00411CBF 90 nop
00411CC0 90 nop
00411CC1 ? E8 5A300000 call Level#4.00414D20
00411CC6 ? E8 252F0000 call Level#4.00414BF0
00411CCB . 85C0 test eax,eax
UIF修复IAT
ImportREC dump
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
