1.è±å£³ç ´è§£
è±å£³ç ´è§£
ODè½½å ¥ éèOD 忽ç¥ææå¼å¸¸
è¿ä¸ªå£³æ¯ç©¿å±±ç²4.0ç 软件å®æ¹è¯´æ¯åå±å 壳 è¿ä¸ªæèªå·±ä¹ä¸ç¥éæä¹ç å ¨å½æ¯å§ï¼ï¼
ç 究ä¸æä¸åç°ä¸ä¸ä¸ªæç¹å°±å¯ä»¥ç´æ¥æ¾å°OEPäºï¼å 为è¿ä¸ªè½¯ä»¶æ¯åè¿ç¨å è¦è½¬æ¢ä¸ºåè¿ç¨ï¼
ä¸æbp OpenMutexA SHIFT+F9
7CEC1B > 8BFF MOV EDI,脱壳脱壳溯源码绿码EDI ; ntdll.7C//æå¨è¿é
7CEC1D PUSH EBP
7CEC1E 8BEC MOV EBP,ESP
7CEC PUSH ECX
7CEC PUSH ECX
7CEC D CMP DWORD PTR SS:[EBP+],0
7CEC PUSH ESI
7CEC 0F 7A JE kernel.7CCA7
æ¤æ¶å æ
F DB8 /CALL å° OpenMutexA æ¥èª 游æèå.DB2
FC F |Access = 1F
F7A0 |Inheritable = FALSE
F7A4 FDD8 \MutexName = "C:A5EDE6" //FDD8
CTRL+G è¾å ¥ä»£ç
9C D8 FD C0 E8 2F DB 7C 9D E9 DC 7C
å¨å¤å¶ç代ç å¤ æ°å»ºEIP SHIFT+F9 å次æä¸ F2åæ¶æç¹ CTRL+G-> æ¤æ¶ä¿®æ¹
è¿æ ·åè¿ç¨å°±è½¬æ¢ä¸ºåè¿ç¨äºï¼
æ¤æ¶ ALT+M æå¼å åæ 象 å¨ç¬¬ä¸ä¸ª.RSRCä¸ F2ä¸æç¹ SHIFT+F9
æå¨è¿é ä¸ç®¡ä» åALT+M å¨ F2ä¸æç¹ SHIFT+F9
7CD :8B 0C MOV DX,WORD PTR DS:[EAX+C] //
7C : B0 MOV WORD PTR SS:[EBP-],DX
7C 8D LEA ESI,DWORD PTR DS:[EAX+]
7C MOV DWORD PTR SS:[EBP-],ESI
7CB 8B 0C MOV EDX,DWORD PTR SS:[EBP+C]
7CE :F FFFF TEST WORD PTR DS:[EDX+2],0FFFF
7C JNZ SHORT ntdll.7C
æå¨è¿é ç°å¨å°±æ¯è¦ç¨F8æ ¢æ ¢è·äº
D8FF 8B MOV EDX,DWORD PTR DS:[EDX]
D8F DC MOV DWORD PTR SS:[EBP-],EDX
D8F D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
D8F EB JMP SHORT D8F6AB //è·³
D8FA 6A PUSH 1
D8FC POP EAX
D8FD C3 RETN
D8FE 8B E8 MOV ESP,DWORD PTR SS:[EBP-]
D8F6A1 D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
D8F6A5 8B7D MOV EDI,DWORD PTR SS:[EBP+8]
D8F6A8 8B DC MOV EDX,DWORD PTR SS:[EBP-]
D8F6AB A1 EDA MOV EAX,DWORD PTR DS:[DAE4]
D8F6B0 XOR DWORD PTR DS:[EAX+],EDX
D8F6B6 A1 EDA MOV EAX,DWORD PTR DS:[DAE4]
D8F6BB XOR DWORD PTR DS:[EAX+],EDX
D8F6C1 A1 EDA MOV EAX,DWORD PTR DS:[DAE4]
D8F6C6 8B MOV ECX,DWORD PTR DS:[EAX+]
D8F6CC 2C XOR ECX,DWORD PTR DS:[EAX+2C]
D8F6CF XOR ECX,DWORD PTR DS:[EAX+]
D8F6D2 D FCDA ADD ECX,DWORD PTR DS:[DAFC] ; 游æèå.
D8F6D8 8B MOV EDX,DWORD PTR DS:[EDI]
D8F6DA D2 TEST EDX,EDX
D8F6DC 1B JNZ SHORT D8F6F9 //è·³
D8F6DE FF PUSH DWORD PTR DS:[EDI+]
D8F6E1 FF PUSH DWORD PTR DS:[EDI+]
D8F6E4 FF PUSH DWORD PTR DS:[EDI+]
D8F6E7 8B MOV EDX,DWORD PTR DS:[EAX+]
D8F6ED XOR EDX,DWORD PTR DS:[EAX+]
D8F6F0 XOR EDX,DWORD PTR DS:[EAX+4]
D8F6F9 FA CMP EDX,1 //è·³å°è¿é åF8
D8F6FC 1E JNZ SHORT D8FC
D8F6FE FF PUSH DWORD PTR DS:[EDI+4]
D8F FF PUSH DWORD PTR DS:[EDI+8]
D8F 6A PUSH 0
D8F FF 0C PUSH DWORD PTR DS:[EDI+C]
D8F 8B MOV EDX,DWORD PTR DS:[EAX+]
D8FF XOR EDX,DWORD PTR DS:[EAX+]
D8F XOR EDX,DWORD PTR DS:[EAX+4]
D8F 2BCA SUB ECX,EDX
D8F FFD1 CALL ECX ; 游æèå.FE //è¿éå°±æ¯OEP F7
F7åå°è¿é
FE PUSH EBP //è¿å°±æ¯OEP çæ ·åæ¯DELPHIç
FE 8BEC MOV EBP,ESP
FEB C4 F0 ADD ESP,-
FEE B8 DC4F MOV EAX,游æèå.FDC
FE E8 F0FF CALL 游æèå.B0
FE A1 B MOV EAX,DWORD PTR DS:[B4]
FED 8B MOV EAX,DWORD PTR DS:[EAX]
FEF E8 9CA4F7FF CALL 游æèå.D0
ODä¸è¦å ³ ï¼ï¼ æå¼LordPEï¼ä¿®æ£æ 象大å°ï¼ï¼å®å ¨è½¬åï¼ï¼ä¿å为*.EXEæ件 好ä½å°è¿éå åç ä»æ°å è½½ä¸æ¬¡ç®æ æ件 åéå¤ä½ä¸é¢è¿ä¸ªæä½
ä¸æbp OpenMutexA SHIFT+F9
7CEC1B > 8BFF MOV EDI,EDI ; ntdll.7C//æå¨è¿é
7CEC1D PUSH EBP
7CEC1E 8BEC MOV EBP,ESP
7CEC PUSH ECX
7CEC PUSH ECX
7CEC D CMP DWORD PTR SS:[EBP+],0
7CEC PUSH ESI
7CEC 0F 7A JE kernel.7CCA7
æ¤æ¶å æ
F DB8 /CALL å° OpenMutexA æ¥èª 游æèå.DB2
FC F |Access = 1F
F7A0 |Inheritable = FALSE
F7A4 FDD8 \MutexName = "C:A5EDE6" //FDD8
CTRL+G è¾å ¥ä»£ç
9C D8 FD C0 E8 2F DB 7C 9D E9 DC 7C
å¨å¤å¶ç代ç å¤ æ°å»ºEIP SHIFT+F9 å次æä¸ F2åæ¶æç¹ CTRL+G-> æ¤æ¶ä¿®æ¹
è¿æ ·åè¿ç¨å°±è½¬æ¢ä¸ºåè¿ç¨äº
å 为第ä¸æ¬¡ä¿åçæ¯æ²¡æè·³è¿IATå å¯çæ件ä¹å°±æ¯ éæ³è·³è½¬ 没æä¿®æ¹ æ以è¿è¡æ¶ä¼åºé®é¢
ä¸é¢æ们æ¥ä¿®æ¹ éæ³è·³è½¬ 并å»è·³è¿IATå å¯ ä¸æç¹ HE GetModuleHandleA SHIFT+F9è¿è¡
ä¸æå¨
7CB > 8BFF MOV EDI,EDI ; ntdll.7C //æä¸è¿éï¼æ³¨æçå æ
7CBB PUSH EBP
7CBC 8BEC MOV EBP,ESP
7CBE D CMP DWORD PTR SS:[EBP+8],0
7CB JE SHORT kernel.7CBC
7CB FF PUSH DWORD PTR SS:[EBP+8]
7CB E8 D CALL kernel.7CE2A4
7CBC C0 TEST EAX,EAX
æ¤æ¶å æ è¿å
FF F4FB /CALL å° GetModuleHandleA æ¥èª mz.F4F5
FF3C \pModule = NULL
FF
ä¸é¢æ¯æ¯æ¬¡ F9çå æ è¿å
F9+1
E CB2 /CALL å° GetModuleHandleA æ¥èª CAC
E BEBC \pModule = "kernel.dll"
EC CA
F9+2
EC D4A4 /CALL å° GetModuleHandleA æ¥èª msctfime.DE
EC7C EC \pModule = "C:\WINDOWS\system
tdll.dll"
EC C3A
F9+3
E FBB0 /CALL å° GetModuleHandleA æ¥èª FBAA
E FFF4 \pModule = "KERNEL.DLL"
EC
F9+4
F6B8 F8D7B /CALL å° GetModuleHandleA æ¥èª mz.F8D
F6BC \pModule = NULL
F6C0 B8
F9+5
C DFF1 /CALL å° GetModuleHandleA æ¥èª DFEB //æ¤æ¶ç¼å²æ¶é´æç¹é¿
DD6C \pModule = "kernel.dll"
DD7C ASCII "VirtualAlloc" //çå°è¿ä¸ªå°±å·®ä¸å¤å¿«å°äº
F9+6
C DE /CALL å° GetModuleHandleA æ¥èª D
DD6C \pModule = "kernel.dll"
DD ASCII "VirtualFree" //çå°è¿ä¸ªä¸ä¸æ¬¡å°±æ¯è¿åæ¶æºäº
F9+7
C D /CALL å° GetModuleHandleA æ¥èª DF //å°±æ¯è¿é
\pModule = "kernel.dll"
EBA4
è°å¼ï¼ï¼ç¡¬ä»¶æç¹ï¼ï¼å é¤æç¹ï¼ï¼ALT+F9è¿å
D 8B0D CFD MOV ECX,DWORD PTR DS:[D9CF] //è¿åå°è¿é
DB E MOV DWORD PTR DS:[ESI+ECX],EAX
DE A1 CFD MOV EAX,DWORD PTR DS:[D9CF]
D C CMP DWORD PTR DS:[ESI+EAX],EDI
D JNZ SHORT DE
D 8D DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-]
DE PUSH EAX
DF FF E0D CALL DWORD PTR DS:[D8E] ; kernel.LoadLibraryA
//ä¸è®°å¾æ¯åªä½å¤§å¥è¯´è¿ å¨è¿åçLoadLibraryAä¸é¢ç第ä¸ä¸ªJEå°±æ¯MJäº åµåµ
D 8B0D CFD MOV ECX,DWORD PTR DS:[D9CF]
DB E MOV DWORD PTR DS:[ESI+ECX],EAX
DE A1 CFD MOV EAX,DWORD PTR DS:[D9CF]
D C CMP DWORD PTR DS:[ESI+EAX],EDI
D 0F 2F JE DAB //è¿ä¸ªå°±æ¯æ们è¦æ¾çMJäº JEæ¹ä¸ºJMP
DC C9 XOR ECX,ECX
DE 8B MOV EAX,DWORD PTR DS:[EBX]
D CMP DWORD PTR DS:[EAX],EDI
D JE SHORT DA
è¿æ¶æ们åä¸å¦ä¸ä¸ªæç¹ BP GetTickCount SHIFT+F9 è¿è¡
ä¸æå¨è¿é
7CAC > BA FE7F MOV EDX,7FFE //ä¸æç¹
7CB1 8B MOV EAX,DWORD PTR DS:[EDX]
7CB3 F MUL DWORD PTR DS:[EDX+4]
7CB6 0FACD0 SHRD EAX,EDX,
7CBA C3 RETN
F2åæ¶æç¹ ALT+F9 è¿åç¨åº
è¿åå°è¿é
D8C FF 7CD CALL DWORD PTR DS:[DC] ; kernel.GetTickCount
D8C A4D4FFFF MOV DWORD PTR SS:[EBP-2B5C],EAX
D8CF 6A PUSH 1
D8C POP EAX
D8C C0 TEST EAX,EAX
D8C 0F A JE D8C3C2
çå°ä»£ç
D8C FF 7CD CALL DWORD PTR DS:[DC] ; kernel.GetTickCount //è¿éäº ä¸å ±æä¸¤å¤ åä¸æ¾å¦ä¸å¤
å¦ä¸å¤ä»£ç
D8C3C2 FF 7CD CALL DWORD PTR DS:[DC] ; kernel.GetTickCount //å¦ä¸å¤
D8C3C8 2B A4D4FFFF SUB EAX,DWORD PTR SS:[EBP-2B5C]
D8C3CE 8B8D A8D4FFFF MOV ECX,DWORD PTR SS:[EBP-2B]
D8C3D4 6BC9 IMUL ECX,ECX,
D8C3D7 C1 D ADD ECX,7D0
D8C3DD 3BC1 CMP EAX,ECX
D8C3DF JBE SHORT D8C3E8 //æè¿ä¸ªæ¹ä¸º JMP åF9è¿è¡
ç¨åºåå¨
D8C 8B8D C1FFFF MOV ECX,DWORD PTR SS:[EBP-3EE8]
D8CD 8B MOV ECX,DWORD PTR DS:[ECX]
D8CF MOV DWORD PTR DS:[ECX],EAX
D8C 8B C1FFFF MOV EAX,DWORD PTR SS:[EBP-3EE8]
D8C C0 ADD EAX,4
D8CA C1FFFF MOV DWORD PTR SS:[EBP-3EE8],EAX
D8C ^ EB CA JMP SHORT D8CC
D8C XCHG EAX,ESI
D8C :C9 XCHG CX,CX
D8C XCHG EAX,ESI
ç°å¨æ们åæå¼ImportRECï¼ï¼OEPå¤å¡«åFE (FE-)--èªå¨æ¥æ¾IATï¼ï¼è·åè¾å ¥è¡¨ï¼ï¼æ¾ç¤ºæ æçï¼ï¼åªåæéï¼ï¼ä¿®å¤è½¬åæ件ï¼ï¼éä¸ä½ ç¨LORDPEä¿åçEXEæ件 OK å®æ