手动脱壳之-胡乱一脱

最新推荐文章于 2024-07-06 19:24:24 发布

原创最新推荐文章于 2024-07-06 19:24:24 发布 · 657 阅读

CC 4.0 BY-SA版权

文章标签：

我是胡乱脱壳，胡乱写出来的，如果有不对的地方请你笑过我以后，告诉学生啊！
前些天朋友发来一个程序让我帮着破解一下，我就答应了，发过来看了一下是vb写的一个顶贴器。真的没有当会事，于是用OD载入看了一下，直觉告诉我这东西一定加了壳，因为以前从来没有手动脱过，于是又点郁闷了，用peid看了一下什么也没查出来。既然答应朋友了怎么也要试一下。毕竟看过很多关于脱壳的文章姑且试试吧。
用OD加载程序如下
00409EF1 >/$ 0FB7FD        movzx   edi, bp
00409EF4 |. 4D            dec     ebp
00409EF5 |. C7C3 51D053CA mov     ebx, CA53D051
00409EFB |. 4D            dec     ebp
00409EFC |. F7D3          not     ebx
00409EFE |. 69C8 FCCF56C1 imul    ecx, eax, C156CFFC
00409F04 |. FEC8          dec     al
00409F06 |. 11EE          adc     esi, ebp
00409F08 |. 0FAFEF        imul    ebp, edi
00409F0B |. FFC3          inc     ebx
00409F0D |. 0FA5C1        shld    ecx, eax, cl
00409F10 |. 85C3          test    ebx, eax
00409F12 |. 0FA3FD        bt      ebp, edi
00409F15 |. 3E:0FA4C1 7C shld    ecx, eax, 7C
00409F1A |. 8BF5          mov     esi, ebp
00409F1C |. 84F1          test    cl, dh
00409F1E |. 0FC1DA        xadd    edx, ebx
00409F21 |. 85DA          test    edx, ebx
00409F23 |. 13F5          adc     esi, ebp
00409F25 |. 69EF 53CA6594 imul    ebp, edi, 9465CA53
00409F2B |. C7C6 352457BE mov     esi, BE572435
00409F31 |. 23CF          and     ecx, edi
00409F33 |. D1D6          rcl     esi, 1
00409F35 |. C6C4 93       mov     ah, 93
00409F38 |. 86D5          xchg    ch, dl
00409F3A |. C1E1 AC       shl     ecx, 0AC
00409F3D |. D1D6          rcl     esi, 1
00409F3F |. F3:           prefix rep:
00409F40 |. 0FA4D3 39     shld    ebx, edx, 39
00409F44 |. 84D5          test    ch, dl
00409F46 |. EB 01         jmp     short runskydt.00409F49
00409F48 |   85            db      85
00409F49 |> 87F1          xchg    ecx, esi
00409F4B |. 8D2D 138A2554 lea     ebp, dword ptr ds:[54258A13]
00409F51 |. 8BF5          mov     esi, ebp
00409F53 |. 0FA3FD        bt      ebp, edi
00409F56 |. 35 814003BA   xor     eax, BA034081
00409F5B |. 80DC 53       sbb     ah, 53
00409F5E |. EB 01         jmp     short runskydt.00409F61
00409F60 |   21            db      21                               ; CHAR '!'
00409F61 |> B0 7F         mov     al, 7F
00409F63 |. C6C6 ED       mov     dh, 0ED
00409F66 |. 13F5          adc     esi, ebp
00409F68 |. 1C 3B         sbb     al, 3B
00409F6A |. 86D5          xchg    ch, dl
00409F6C |. 0FABC1        bts     ecx, eax
00409F6F |. EB 01         jmp     short runskydt.00409F72
00409F71 |   15            db      15
00409F72 |> 85C3          test    ebx, eax
00409F74 |. F6DC          neg     ah
00409F76 |. 0FA5D3        shld    ebx, edx, cl
00409F79 |. 0FBCC8        bsf     ecx, eax
00409F7C |. 11EE          adc     esi, ebp
00409F7E |. 0FACFD BB     shrd    ebp, edi, 0BB
00409F82 |. 0FBDD5        bsr     edx, ebp
00409F85 |. 0FC9          bswap   ecx
00409F87 |. F7C0 9504B79E test    eax, 9EB70495
00409F8D |. 0FA5C1        shld    ecx, eax, cl
00409F90 |. 0FB7FD        movzx   edi, bp
00409F93 |. EB 01         jmp     short runskydt.00409F96
00409F95 |   F3            db      F3
00409F96 |> 65:25 8C1F669>and     eax, 91661F8C
00409F9C |. 69C3 6F7661A0 imul    eax, ebx, A061766F
00409FA2 |. 0FB7D9        movzx   ebx, cx
00409FA5 |. 21F9          and     ecx, edi
00409FA7 |. 0FC1F1        xadd    ecx, esi
00409FAA |. 80DC 7B       sbb     ah, 7B
00409FAD |. 65:D1E1       shl     ecx, 1
00409FB0 |. C7C6 55C4775E mov     esi, 5E77C455
00409FB6 |. F2:           prefix repne:
00409FB7 |. F7D6          not     esi
00409FB9 |. 65:89CB       mov     ebx, ecx
00409FBC |. 81E1 4CDF2651 and     ecx, 5126DF4C
00409FC2 |. 0FADD8        shrd    eax, ebx, cl
00409FC5 |. EB 01         jmp     short runskydt.00409FC8
00409FC7 |> C3            retn
00409FC8 |> BA 709D4000   mov     edx, runskydt.00409D70
00409FCD |. 83EC 04       sub     esp, 4
00409FD0 |. 891424        mov     dword ptr ss:[esp], edx
00409FD3 |. B9 A8000000   mov     ecx, 0A8
00409FD8 |> 8132 7C1F1700 /xor     dword ptr ds:[edx], 171F7C
00409FDE |. 50            |push    eax
00409FDF |. B8 04000000   |mov     eax, 4
00409FE4 |. 50            |push    eax
00409FE5 |. 031424        |add     edx, dword ptr ss:[esp]
00409FE8 |. 58            |pop     eax
00409FE9 |. 58            |pop     eax
00409FEA |. 83E9 03       |sub     ecx, 3
00409FED |.^ E2 E9         /loopd   short runskydt.00409FD8
00409FEF /.^ EB D6         jmp     short runskydt.00409FC7

估计要是牛人看了这个就知道是什么壳了，不过我真的不知道从哪里下手，不过希望还是有的，脱不好还脱不坏吗？忽然想起来一些普通壳的加壳原理，总是把程序加密后放在一个程序段里，然后从程序段里解密出来于是在OD中按了一下[M]看到程序有如下段。
看到这个程序有个MYXy段挺可疑的，就在该段上下了访问断点。程序停在下面代码处。

00409D88   > /8A06          mov     al, byte ptr ds:[esi]  ‘程序停在该处
00409D8A   . |46            inc     esi
00409D8B   . |8807          mov     byte ptr ds:[edi], al
00409D8D   . |47            inc     edi
00409D8E   > |01DB          add     ebx, ebx
00409D90   . |75 07         jnz     short runskydt.00409D99
00409D92   > |8B1E          mov     ebx, dword ptr ds:[esi]
00409D94   . |83EE FC       sub     esi, -4
00409D97   . |11DB          adc     ebx, ebx
00409D99   >^/72 ED         jb      short runskydt.00409D88
00409D9B   . B8 01000000   mov     eax, 1
00409DA0   > 01DB          add     ebx, ebx
00409DA2   . 75 07         jnz     short runskydt.00409DAB
00409DA4   . 8B1E          mov     ebx, dword ptr ds:[esi]
00409DA6   . 83EE FC       sub     esi, -4
00409DA9   . 11DB          adc     ebx, ebx
00409DAB   > 11C0          adc     eax, eax
00409DAD   . 01DB          add     ebx, ebx
00409DAF   .^ 73 EF         jnb     short runskydt.00409DA0
00409DB1   . 75 09         jnz     short runskydt.00409DBC
00409DB3   . 8B1E          mov     ebx, dword ptr ds:[esi]
00409DB5   . 83EE FC       sub     esi, -4
00409DB8   . 11DB          adc     ebx, ebx
00409DBA   .^ 73 E4         jnb     short runskydt.00409DA0
00409DBC   > 31C9          xor     ecx, ecx
00409DBE   . 83E8 03       sub     eax, 3
00409DC1   . 72 0D         jb      short runskydt.00409DD0
00409DC3   . C1E0 08       shl     eax, 8
00409DC6   . 8A06          mov     al, byte ptr ds:[esi]
00409DC8   . 46            inc     esi
00409DC9   . 83F0 FF       xor     eax, FFFFFFFF
00409DCC   . 74 74         je      short runskydt.00409E42
00409DCE   . 89C5          mov     ebp, eax
00409DD0   > 01DB          add     ebx, ebx
00409DD2   . 75 07         jnz     short runskydt.00409DDB
00409DD4   . 8B1E          mov     ebx, dword ptr ds:[esi]
00409DD6   . 83EE FC       sub     esi, -4
00409DD9   . 11DB          adc     ebx, ebx
00409DDB   > 11C9          adc     ecx, ecx
00409DDD   . 01DB          add     ebx, ebx
00409DDF   . 75 07         jnz     short runskydt.00409DE8
00409DE1   . 8B1E          mov     ebx, dword ptr ds:[esi]
00409DE3   . 83EE FC       sub     esi, -4
00409DE6   . 11DB          adc     ebx, ebx
00409DE8   > 11C9          adc     ecx, ecx
00409DEA   . 75 20         jnz     short runskydt.00409E0C
00409DEC   . 41            inc     ecx
00409DED   > 01DB          add     ebx, ebx
00409DEF   . 75 07         jnz     short runskydt.00409DF8
00409DF1   . 8B1E          mov     ebx, dword ptr ds:[esi]
00409DF3   . 83EE FC       sub     esi, -4
00409DF6   . 11DB          adc     ebx, ebx
00409DF8   > 11C9          adc     ecx, ecx
00409DFA   . 01DB          add     ebx, ebx
00409DFC   .^ 73 EF         jnb     short runskydt.00409DED
00409DFE   . 75 09         jnz     short runskydt.00409E09
00409E00   . 8B1E          mov     ebx, dword ptr ds:[esi]
00409E02   . 83EE FC       sub     esi, -4
00409E05   . 11DB          adc     ebx, ebx
00409E07   .^ 73 E4         jnb     short runskydt.00409DED
00409E09   > 83C1 02       add     ecx, 2
00409E0C   > 81FD 00F3FFFF cmp     ebp, -0D00
00409E12   . 83D1 01       adc     ecx, 1
00409E15   . 8D142F        lea     edx, dword ptr ds:[edi+ebp]
00409E18   . 83FD FC       cmp     ebp, -4
00409E1B   . 76 0F         jbe     short runskydt.00409E2C
00409E1D   > 8A02          mov     al, byte ptr ds:[edx]
00409E1F   . 42            inc     edx
00409E20   . 8807          mov     byte ptr ds:[edi], al
00409E22   . 47            inc     edi
00409E23   . 49            dec     ecx
00409E24   .^ 75 F7         jnz     short runskydt.00409E1D
00409E26   .^ E9 63FFFFFF   jmp     runskydt.00409D8E
00409E2B      90            nop
00409E2C   > 8B02          mov     eax, dword ptr ds:[edx]
00409E2E   . 83C2 04       add     edx, 4
00409E31   . 8907          mov     dword ptr ds:[edi], eax
00409E33   . 83C7 04       add     edi, 4
00409E36   . 83E9 04       sub     ecx, 4
00409E39   .^ 77 F1         ja      short runskydt.00409E2C
00409E3B   . 01CF          add     edi, ecx
00409E3D   .^ E9 4CFFFFFF   jmp     runskydt.00409D8E
00409E42   > 5E            pop     esi
00409E43   . 89F7          mov     edi, esi
00409E45   . B9 02000000   mov     ecx, 2
00409E4A   > 8A07          mov     al, byte ptr ds:[edi]
00409E4C   . 47            inc     edi
00409E4D   . 2C E8         sub     al, 0E8
00409E4F   > 3C 01         cmp     al, 1
00409E51   .^ 77 F7         ja      short runskydt.00409E4A
00409E53   . 803F 01       cmp     byte ptr ds:[edi], 1
00409E56   .^ 75 F2         jnz     short runskydt.00409E4A
00409E58   . 8B07          mov     eax, dword ptr ds:[edi]
00409E5A   . 8A5F 04       mov     bl, byte ptr ds:[edi+4]
00409E5D   . 66:C1E8 08    shr     ax, 8
00409E61   . C1C0 10       rol     eax, 10
00409E64   . 86C4          xchg    ah, al
00409E66   . 29F8          sub     eax, edi
00409E68   . 80EB E8       sub     bl, 0E8
00409E6B   . 01F0          add     eax, esi
00409E6D   . 8907          mov     dword ptr ds:[edi], eax
00409E6F   . 83C7 05       add     edi, 5
00409E72   . 89D8          mov     eax, ebx
00409E74   .^ E2 D9         loopd   short runskydt.00409E4F
00409E76   . 8DBE 00700000 lea     edi, dword ptr ds:[esi+7000]
00409E7C   > 8B07          mov     eax, dword ptr ds:[edi]
00409E7E   . 09C0          or      eax, eax
00409E80   . 74 45         je      short runskydt.00409EC7
00409E82   . 8B5F 04       mov     ebx, dword ptr ds:[edi+4]
00409E85   . 8D8430 D09800>lea     eax, dword ptr ds:[eax+esi+98D0]
00409E8C   . 01F3          add     ebx, esi
00409E8E   . 50            push    eax
00409E8F   . 83C7 08       add     edi, 8
00409E92   . FF96 0C990000 call    near dword ptr ds:[esi+990C]
00409E98   . 95            xchg    eax, ebp
00409E99   > 8A07          mov     al, byte ptr ds:[edi]
00409E9B   . 47            inc     edi
00409E9C   . 08C0          or      al, al
00409E9E   .^ 74 DC         je      short runskydt.00409E7C
00409EA0   . 89F9          mov     ecx, edi
00409EA2   . 79 07         jns     short runskydt.00409EAB
00409EA4   . 0FB707        movzx   eax, word ptr ds:[edi]
00409EA7   . 47            inc     edi
00409EA8   . 50            push    eax
00409EA9   . 47            inc     edi
00409EAA      B9            db      B9
00409EAB   . 57            push    edi
00409EAC   . 48            dec     eax
00409EAD   . F2:AE         repne   scas byte ptr es:[edi]
00409EAF   . 55            push    ebp
00409EB0   . FF96 10990000 call    near dword ptr ds:[esi+9910]
00409EB6   . 09C0          or      eax, eax
00409EB8   . 74 07         je      short runskydt.00409EC1
00409EBA   . 8903          mov     dword ptr ds:[ebx], eax
00409EBC   . 83C3 04       add     ebx, 4
00409EBF   .^ EB D8         jmp     short runskydt.00409E99
00409EC1   > FF96 14990000 call    near dword ptr ds:[esi+9914]
00409EC7   > 61            popad       ‘露出马脚了
00409EC8   .- E9 E371FFFF   jmp     runskydt.004010B0 ‘估计这个jmp就飞到OEP了

程序断在00409D88处时我单步跟了一下好多循环，基本都是修改MYXy段里的数据，估计应该是解密过程了，所以感到希望就在前方了，跳出几次循环后，向下拉了一下看到popad。记得以前看过popad就是指引希望的炮塔的，何况后边还真有一个jmp，跳的还挺远的，继续跟进吧。程序跳到004010B0处，我想就是传说的OEP了吧，这个代码很有标志性吧，其实我没看过vb的程序，不过感觉就应该是这样的了， ThunRTMain我还是可以理解的！直接Dump了！用peid看了一下，原型毕露了！

004010AA - FF25 3C104000   jmp     near dword ptr ds:[40103C]       ; MSVBVM60.ThunRTMain
004010B0    68 6C194000     push    runskydt.0040196C
004010B5    E8 F0FFFFFF     call    runskydt.004010AA                ; jmp 到 MSVBVM60.ThunRTMain
004010BA    0000            add     byte ptr ds:[eax], al

第一次脱这个不知道名的壳，真的是在迷茫中回忆着前人的文章就脱了。挺有意思。等我破了这个程序看看有没有什么值得写的再写些什么上来呵呵！