ASProtect 脱壳后的软件如何重新加壳

最新推荐文章于 2022-02-25 19:38:17 发布

shueasy

最新推荐文章于 2022-02-25 19:38:17 发布

阅读量803

点赞数

分类专栏：逆向工程文章标签： c dos

本文链接：https://blog.csdn.net/shueasy/article/details/1772424

版权

逆向工程专栏收录该内容

2 篇文章 0 订阅

订阅专栏

把一个 Asprotect 壳脱了后，想重新加壳

却发现怎么都加不上，再加Asprotect,或者upx都不行

后来看了fly大虾的帖子才知道

要把第一个节表名前的2个字节清零就OK了。

如下图所示：

00 00 2E 74 65 78

2E 74 65 78 就是第一个节表名 .text 的16进制码

--------------------------------------------

00000000 4D 5A 90 00 03 00 00 00  04 00 00 00 FF FF 00 00 MZ?..........
00000010 B8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00 ?......@.......
00000020 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00  00 00 00 00 80 00 00 00 ............€...
00000040 0E 1F BA 0E 00 B4 09 CD  21 B8 01 4C CD 21 54 68 ..?.???L?Th
00000050 69 73 20 70 72 6F 67 72  61 6D 20 63 61 6E 6E 6F is program canno
00000060 74 20 62 65 20 72 75 6E  20 69 6E 20 44 4F 53 20 t be run in DOS
00000070 6D 6F 64 65 2E 0D 0D 0A  24 00 00 00 00 00 00 00 mode....$.......
00000080 50 45 00 00 4C 01 05 00  65 91 46 35 00 00 00 00 PE..L...e慒5....
00000090 00 00 00 00 E0 00 0E 01  0B 01 03 0A 00 40 00 00 ....?.......@..
000000A0 00 74 00 00 00 00 00 00  CC 10 00 00 00 10 00 00 .t......?......
000000B0 00 50 00 00 00 00 40 00  00 10 00 00 00 10 00 00 .P....@.........
000000C0 04 00 00 00 00 00 00 00  04 00 00 00 00 00 00 00 ................
000000D0 00 D0 00 00 00 04 00 00  16 BE 01 00 02 00 00 00 .?......?.....
000000E0 00 00 10 00 00 10 00 00  00 00 10 00 00 10 00 00 ................
000000F0 00 00 00 00 10 00 00 00  00 00 00 00 00 00 00 00 ................
00000100 00 60 00 00 8C 00 00 00  00 70 00 00 B8 4F 00 00 .`..?...p..窸..
00000110 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ................
00000120 00 C0 00 00 3C 09 00 00  00 00 00 00 00 00 00 00 .?.<...........
00000130 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ................
00000140 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ................
00000150 00 00 00 00 00 00 00 00  E0 62 00 00 40 02 00 00 ........郻..@...
00000160 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ................
00000170 00 00 00 00 00 00 00 00  2E 74 65 78 74 00 12 00 .........text...
00000180 00 40 00 00 00 10 00 00  00 40 00 00 00 10 00 00 .@.......@......
00000190 00 00 00 00 00 00 00 00  00 00 00 00 20 00 00 60 ............ ..`
000001A0 2E 64 61 74 61 00 12 00  00 10 00 00 00 50 00 00 .data........P..
000001B0 00 10 00 00 00 50 00 00  00 00 00 00 00 00 00 00 .....P..........
000001C0 00 00 00 00 40 00 00 C0  2E 69 64 61 74 61 00 00 ....@..?idata..
000001D0 00 10 00 00 00 60 00 00  00 10 00 00 00 60 00 00 .....`.......`..
000001E0 00 00 00 00 00 00 00 00  00 00 00 00 40 00 00 40 ............@..@
000001F0 2E 72 73 72 63 00 12 00  00 50 00 00 00 70 00 00 .rsrc....P...p..
00000200 00 50 00 00 00 70 00 00  00 00 00 00 00 00 00 00 .P...p..........
00000210 00 00 00 00 40 00 00 40  2E 72 65 6C 6F 63 00 00 ....@..@.reloc..
00000220 00 10 00 00 00 C0 00 00  00 10 00 00 00 C0 00 00 .....?......?.
00000230 00 00 00 00 00 00 00 00  00 00 00 00 40 00 00 42 ............@..B