-
-
ObscurePacker压缩壳
-
发表于: 2009-9-30 20:19
-
发个玩具压缩壳玩玩，大部分代码是瞟的，加了点自己的想法而已，请大牛多多指点
特别感谢我的诸位朋友(chenjianA,dreamzgj,machomen....)的帮忙测试和支持，现在共享下大家一起玩和学习了 呵呵
55 8B EC 6A FF 68 40 16 41 00 68 D4 CD 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 3A 53 56 57 89 65 EE E8 59 00 00 00 EB 83 C4 3A 64 8F 05 00 00 00 00 83 C4 0C 8B E5 5D 51 E8 36 00 00 00 EB 33 51 8B CA 51 E8 2B 00 00 00 65 EB 16 53 E8 22 00 00 00 60 E8 17 9C 58 25 00 01 00 00 75 11 50 E8 10 00 00 00 EB EC 3B D1 75 05 59 6A 0F EB 18 85 C0 75 0C E8 0F 31 FF 04 24 FF 04 24 C2 04 00 EB FF 04 24 C2 0C 00 61#11 VC++6.0入口随便带个anti ; 51 E8 36 00 00 00 EB 33 51 8B CA 51 E8 2B 00 00 00 65 EB 16 53 E8 22 00 00 00 60 E8 17 9C 58 25 00 01 00 00 75 11 50 E8 10 00 00 00 EB EC 3B D1 75 05 59 6A 0F EB 11 85 C0 75 0C E8 0F 31 FF 04 24 FF 04 24 C2 04 00 EB#10 时间差以及push ss/pop ss ; 50 E8 4E 00 00 00 B8 55 E8 31 00 00 00 55 8B EC 8B 45 10 8B 54 24 3C 83 C2 51 89 90 B8 00 00 00 33 D2 89 50 04 89 50 08 89 50 0C 89 50 10 C7 40 18 55 01 00 00 B8 00 00 00 00 C9 C2 10 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 BA 00 00 00 00 8B 02 E8 FF 04 24 FF 04 24 C2 04 00 E9 B8 0F 00 00 00 50#9清除硬件断点 可能不稳定 ; 6A 0F E8 0B 00 00 00 E8 08 00 00 00 85 C0 74 03 EB 08 C3 00 58 5A 03 C2 50 C3 E8 EB 01 E8 E8 49 00 00 00 B8 00 E8 17 00 00 00 64 8F 05 00 00 00 00 83 C4 04 B8 0F 00 00 00 83 EC 04 89 04 24 EB 32 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 18 00 00 00 E8 00 CD 2D E9 E8 0E 00 00 00 B8 00 64 8F 05 00 00 00 00 83 C4 04 EB 07 FF 04 24 FF 04 24 C3#8 int 2d 加无用原入口代码测试防暴力搜索 ; 60 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 61 6A 0E FF 04 24#7 非法访问 ; 60 9C E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 17 00 00 00 E9 00 9D 61 E8 0E 00 00 00 60 E9 68 88 00 00 00 58 83 E8 79 50 EB 08 FF 04 24 FF 04 24 C3 E9#6 除0 ; E8 67 00 00 00 E8 00 60 9C E8 13 00 00 00 8B 4C 24 0C FF 81 B8 00 00 00 FF 81 B8 00 00 00 33 C0 C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 74 03 75 07 9A 66 BE 47 46 EB 05 EB 01 CD EB F5 66 BF 4D 4A CC E9 90 64 8F 05 00 00 00 00 58 E8 19 00 00 00 FF B8 9D 61 E8 10 00 00 00 60 B8 B8 10 00 00 00 48 83 EC 04 89 04 24 EB 08 FF 04 24 FF 04 24 C3 E8#5 int 3 ; E8 6E 00 00 00 E8 00 60 9C E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 18 00 00 00 FF B8 9D 61 E8 0F 00 00 00 60 B8 B8 F8 00 00 00 35 F7 00 00 00 50 EB 08 FF 04 24 FF 04 24 C3 E8#4 带单步异常和加花 ; 33 C0 B8 10 00 00 00 60 48 61 48 50#3 普通实现 ; 83 EC 04 C7 04 24 0F 00 00 00#2 普通实现 ; 6A 0F#1 push 0xF ; 6A 08 E8 23 00 00 00 EB 49 60 E8 5B 00 00 00 E8 00 00 00 00 5B 83 C3 1F 8B CB 83 C1 14 6A 00 51 53 6A 00 FF D0 61 6A 0F EB 6F FF 04 24 FF 04 24 C2 04 00 49 20 61 6D 20 4F 62 73 63 75 72 65 50 61 63 6B 65 72 21 00 42 79 3A 6D 6F 6F 6E 69 66 65 00 E9 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 E8 00 00 00 00 58 50 05 FE 00 00 00 8B D0 8B 00 8B 52 20 03 C2 8B 30 8B 78 04 FF 34 24 83 2C 24 1C FF D6 FF 34 24 83 2C 24 11 50 FF D7 5A C3#0 玩玩 弹MessageBox 从里面发现有意思的东西的话 自己玩了 嘿嘿！ ;完成push 0xF 的功能就行 大小在254个字节内(6A 0F#算两个字节)，可以加花加anti 随便玩 注意保护寄存器和堆栈平衡和尽量不要硬寻址 以#表示读取结束 行前面加';'表示注意注释该行 简单的方法是在OD里面写 直接复制16进制过来就行 带anti的EP加一些有点特别的程序（如记事本）可能会出来兼容性问题 解决办法是用普通实现的EP(不带anti，userEpB也先用普通实现的一种 比如我提供的#1~#3)先加一次，然后再用带;anti的ep在加一层壳 尽量不要和UserEpB使用同一个Userep加(如A用#8 B用#9 任意两两搭配) ;主要是想玩下防静态脱壳机器和PEID等 当然还没彻底 有时间再玩了 好了 剩下的自己玩吧 自己实现好玩的ep吧 到时候别忘了给我分享下了 ---------------------------------------------By:moonife 2009-9-28--------------------------------------------------------
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
|
|
|---|---|
|
|
,支持下，呵呵
|
|
|
强有力的顶
双节快乐.. 大家一起happY 
|
|
|
|
|
|
大家国庆快乐!!
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
感谢楼主分享，谢谢了
|
