第一种:
1.OD载入后停留在这里:
代码如下:
0040B001 > 60 PUSHAD
0040B002 E8 03000000 CALL 工程1.0040B00A
0040B007 - E9 EB045D45 JMP 459DB4F7
0040B00C 55 PUSH EBP
0040B00D C3 RETN
>>>>>>>>>>>>>>>>
2.按下F8后,esp高亮
ESP 0012FFA4
3.在数据窗口中跟随0012FFA4
数据如下:
0012FFA4 7C930228 ntdll.7C930228
0012FFA8 FFFFFFFF
0012FFAC 0012FFF0
0012FFB0 0012FFC4
0012FFB4 7FFDF000
0012FFB8 7C92E514 ntdll.KiFastSystemCallRet
4.在0012FFA4下一个word类型的硬件断点
断在以下代码处:
0040B3B0 /75 08 JNZ SHORT 工程1.0040B3BA
0040B3B2 |B8 01000000 MOV EAX,1
0040B3B7 |C2 0C00 RETN 0C
0040B3BA /68 C4134000 PUSH 工程1.004013C4
0040B3BF C3 RETN
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
5.在0040B3BA处将004013C4压栈后紧接retn,这里是很大一个跳转,故由此可知004013C4为程序入口点
6.按F8一直到004013C4处停下,代码如下:
004013C4 68 581F4000 PUSH 工程1.00401F58
004013C9 E8 F0FFFFFF CALL 工程1.004013BE ; JMP 到 msvbvm60.ThunRTMain
004013CE 0000 ADD BYTE PTR DS:[EAX],AL
004013D0 0000 ADD BYTE PTR DS:[EAX],AL
在此处用OD插件脱壳并修复即可
第二种:
1.OD载入,入口如下:
0040B001 > 60 PUSHAD
0040B002 E8 03000000 CALL 工程1.0040B00A
0040B007 - E9 EB045D45 JMP 459DB4F7
0040B00C 55 PUSH EBP
>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2.在0040B002处按下F7进入CALL,代码如下:
0040B00A 5D POP EBP ; 工程1.0040B007
0040B00B 45 INC EBP
0040B00C 55 PUSH EBP
0040B00D C3 RETN
0040B00E E8 01000000 CALL 工程1.0040B014
>>>>>>>>>>>>>>>>>>>>>>>>>>>>
3.一直F8向下并在0040B00E处按下F7跟进
0040B014 5D POP EBP ; 工程1.0040B013
0040B015 BB EDFFFFFF MOV EBX,-13
0040B01A 03DD ADD EBX,EBP
0040B01C 81EB 00B00000 SUB EBX,0B000
0040B022 83BD 22040000 0>CMP DWORD PTR SS:[EBP+422],0
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
4.一直F8向下,遇到向上的跳转则F4强行往下
0040B13E 43 INC EBX
0040B13F 49 DEC ECX
0040B140 ^ EB EB JMP SHORT 工程1.0040B12D //此处强行向下
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B144 /EB 00 JMP SHORT 工程1.0040B146
0040B146 /803E 02 CMP BYTE PTR DS:[ESI],2
0040B149 ^ 75 F3 JNZ SHORT 工程1.0040B13E //此处强行向下
0040B14B 24 00 AND AL,0
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B154 83C3 05 ADD EBX,5
0040B157 83C6 04 ADD ESI,4
0040B15A 83E9 05 SUB ECX,5
0040B15D ^ EB CE JMP SHORT 工程1.0040B12D //此处强行向下
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B197 FF95 51050000 CALL DWORD PTR SS:[EBP+551]
0040B19D 83C6 08 ADD ESI,8
0040B1A0 833E 00 CMP DWORD PTR DS:[ESI],0
0040B1A3 ^ 0F85 1EFFFFFF JNZ 工程1.0040B0C7 //此处强行向下
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B376 8907 MOV DWORD PTR DS:[EDI],EAX
0040B378 8385 49050000 0>ADD DWORD PTR SS:[EBP+549],4
0040B37F ^ E9 32FFFFFF JMP 工程1.0040B2B6 //此处强行向下
0040B384 8906 MOV DWORD PTR DS:[ESI],EAX
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B389 8946 10 MOV DWORD PTR DS:[ESI+10],EAX
0040B38C 83C6 14 ADD ESI,14
0040B38F 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]
0040B395 ^ E9 EBFEFFFF JMP 工程1.0040B285 //此处强行向下
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B3AF 61 POPAD
0040B3B0 75 08 JNZ SHORT 工程1.0040B3BA
0040B3B2 B8 01000000 MOV EAX,1
0040B3B7 C2 0C00 RETN 0C
0040B3BA 68 C4134000 PUSH 工程1.004013C4
0040B3BF C3 RETN //在此处F8跟进之后可直接到达程序OEP
5.OEP代码如下:
004013C4 68 581F4000 PUSH 工程1.00401F58
004013C9 E8 F0FFFFFF CALL 工程1.004013BE ; JMP 到 msvbvm60.ThunRTMain
004013CE 0000 ADD BYTE PTR DS:[EAX],AL
004013D0 0000 ADD BYTE PTR DS:[EAX],AL
004013D2 0000 ADD BYTE PTR DS:[EAX],AL
第三种:
1.OD载入,代码如下:
0040B001 > 60 PUSHAD
0040B002 E8 03000000 CALL 工程1.0040B00A
0040B007 - E9 EB045D45 JMP 459DB4F7
0040B00C 55 PUSH EBP
>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2.按下ALT+M打开内存窗口,找到程序的代码段,如图:
3.在.rsrc区段处F2下一个断点,按下Shift+F9运行,中断在如下代码处
0040B75F 8A18 MOV BL,BYTE PTR DS:[EAX]
0040B761 40 INC EAX
0040B762 885C24 0C MOV BYTE PTR SS:[ESP+C],BL
0040B766 8902 MOV DWORD PTR DS:[EDX],EAX
0040B768 8B42 08 MOV EAX,DWORD PTR DS:[EDX+8]
4.再按下ALT+M打开内存窗口,在.text区段处,即00401000处按F2下一个断点,F9运行
0040B285 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
0040B288 85C0 TEST EAX,EAX
0040B28A 0F84 0A010000 JE 工程1.0040B39A
0040B290 03C2 ADD EAX,EDX
5.一直F8往下,遇到向上的跳转就强行向下运行,代码如下:
0040B376 8907 MOV DWORD PTR DS:[EDI],EAX
0040B378 8385 49050000 0>ADD DWORD PTR SS:[EBP+549],4
0040B37F ^ E9 32FFFFFF JMP 工程1.0040B2B6 //强行向下
0040B384 8906 MOV DWORD PTR DS:[ESI],EAX
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B38C 83C6 14 ADD ESI,14
0040B38F 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]
0040B395 ^ E9 EBFEFFFF JMP 工程1.0040B285
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
0040B3B7 C2 0C00 RETN 0C
0040B3BA 68 C4134000 PUSH 工程1.004013C4
0040B3BF C3 RETN //在这里按下F8可到达程序OEP
本次脱壳实例文件下载地址:http://u.115.com/file/f46143190b
Aspack加壳工具下载地址:http://u.115.com/file/f45d75eddc