手动脱UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo+修复

[声明]:纯属技术交流

[对象]:flyODBG

查壳 UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo

OD载入.flyODBG,也就是对flyODBG脱壳,

00581ED0 >  60                 pushad
00581ED1    BE 00304F00        mov esi,flyODBG.004F3000
00581ED6    8DBE 00E0F0FF      lea edi,dword ptr ds:[esi+FFF0E>
00581EDC    57                 push edi
00581EDD    83CD FF            or ebp,FFFFFFFF
00581EE0    EB 10              jmp short flyODBG.00581EF2
00581EE2    90                 nop
00581EE3    90                 nop

用Esp定律.走到00581ED1,在命令行中输入hr 12ffa4

然后F9

00582048  - E9 B3EFE7FF        jmp flyODBG.00401000      //OEP
0058204D    0000               add byte ptr ds:[eax],al
0058204F    0068 20            add byte ptr ds:[eax+20],ch
00582052    58                 pop eax
00582053    000421             add byte ptr ds:[ecx],al
00582056    58                 pop eax
00582057    001B               add byte ptr ds:[ebx],bl
00582059    014B 00            add dword ptr ds:[ebx],ecx
0058205C    0000               add byte ptr ds:[eax],al

00401000这就是OEP.再F8 一次,到了,脱壳.

00401000   /EB 10              jmp short flyODBG.00401012                 //在这脱壳
00401002   |66:623A            bound di,dword ptr ds:[edx]
00401005   |43                 inc ebx
00401006   |2B2B               sub ebp,dword ptr ds:[ebx]
00401008   |48                 dec eax
00401009   |4F                 dec edi
0040100A   |4F                 dec edi
0040100B   |4B                 dec ebx
0040100C   |90                 nop
0040100D  -|E9 28014B00        jmp 008B113A
00401012   /A1 1B014B00        mov eax,dword ptr ds:[4B011B]
00401017    C1E0 02            shl eax,2
0040101A    A3 1F014B00        mov dword ptr ds:[4B011F],eax
0040101F    52                 push edx
00401020    6A 00              push 0
00401022    E8 4BE00A00        call flyODBG.004AF072           ; jmp to kernel32.GetModuleHandleA
00401027    8BD0               mov edx,eax
00401029    E8 DA240A00        call flyODBG.004A3508

脱壳之后休要修复的.用鼠标点到00401022 ,然后回车.

来到004AF072  - FF25 30D35000      jmp dword ptr ds:[50D330]       ; kernel32.GetModuleHandleA

我们向上走.

找到所有的函数.

004AEF94  - FF25 E4D05000      jmp dword ptr ds:[50D0E4]       ; ADVAPI32.RegCloseKey
004AEF9A  - FF25 E8D05000      jmp dword ptr ds:[50D0E8]       ; ADVAPI32.RegCreateKeyA
004AEFA0  - FF25 ECD05000      jmp dword ptr ds:[50D0EC]       ; ADVAPI32.RegDeleteKeyA
004AEFA6  - FF25 F0D05000      jmp dword ptr ds:[50D0F0]       ; ADVAPI32.RegOpenKeyA

004AEF94这是最上面的,我们记下   jmp dword ptr ds:[50D0E4]    这里面的地址50D0E4

add1=50D0E4-8=50D0DC

然后往下走,走到末尾.

004AF606  - FF25 9CD95000      jmp dword ptr ds:[50D99C]       ; USER32.wsprintfA
004AF60C  - FF25 A0D95000      jmp dword ptr ds:[50D9A0]       ; USER32.wsprintfW
004AF612    CC                 int3
004AF613    CC                 int3
004AF614  - FF25 B8D95000      jmp dword ptr ds:[50D9B8]       ; OLE32.CoCreateInstance
004AF61A  - FF25 BCD95000      jmp dword ptr ds:[50D9BC]       ; OLE32.CoInitialize
004AF620  - FF25 C0D95000      jmp dword ptr ds:[50D9C0]       ; OLE32.CoUninitialize

走到004AF620,记下jmp dword ptr ds:[50D9C0] 中的地址50D9C0

add2=50D9C0+8=50D9C7

然后修复OEP填1000,RVA=add1-400000.也就是10D0DC

大小是add2-add1=8EB

然后获取输入表,抓取文件.OK,修复成功,文件也能用..