手脱EXE32Pack v1.39

1.PEID查壳

EXE32Pack v1.39

2.载入OD，先F8跟一下

0040A00C >  3BC0            cmp eax,eax                       ; //程序入口点
0040A00E    74 02           je short sticker.0040A012
0040A010    8183 553BC074 0>add dword ptr ds:[ebx+0x74C03B55]>
0040A01A    3BC9            cmp ecx,ecx
0040A01C    74 01           je short sticker.0040A01F
0040A01E    BC 563BD274     mov esp,0x74D23B56

 

3.直到这里，我们看到一个push入栈，ESP跟一下，下硬件访问断点，然后shift+F9

0040A012    55              push ebp
0040A013    3BC0            cmp eax,eax                       ; //ESP定律
0040A015    74 02           je short sticker.0040A019
0040A017    8183 533BC974 0>add dword ptr ds:[ebx+0x74C93B53]>
0040A021    D27402 81       sal byte ptr ds:[edx+eax-0x7F],cl
0040A025    8557 E8         test dword ptr ds:[edi-0x18],edx  
0040A028    0000            add byte ptr ds:[eax],al

 

4.ESP落脚点，然后继续F8单步跟一下

0040EE6F    3BE4            cmp esp,esp                       ; //ESP落脚点
0040EE71    74 01           je short sticker.0040EE74
0040EE73    BF FFE0B801     mov edi,0x1B8E0FF
0040EE78    0000            add byte ptr ds:[eax],al
0040EE7A    003B            add byte ptr ds:[ebx],bh
0040EE7C    C9              leave
0040EE7D    74 02           je short sticker.0040EE81
0040EE7F    81845F 3BD27401>add dword ptr ds:[edi+ebx*2+0x174>

 

5.OK，找到指向OEP的关键跳

0040EE74  - FFE0            jmp eax                           ; //指向OEP的关键跳
0040EE76    B8 01000000     mov eax,0x1
0040EE7B    3BC9            cmp ecx,ecx
0040EE7D    74 02           je short sticker.0040EE81
0040EE7F    81845F 3BD27401>add dword ptr ds:[edi+ebx*2+0x174>
0040EE8A    74 02           je short sticker.0040EE8E
0040EE8C    8186 5B3BDB74 0>add dword ptr ds:[esi+0x74DB3B5B]>

 

6.来到OEP

0040535F    55              push ebp                          ; //来到OEP
00405360    8BEC            mov ebp,esp
00405362    6A FF           push -0x1
00405364    68 D0124000     push sticker.004012D0
00405369    68 20534000     push sticker.00405320
0040536E    64:A1 00000000  mov eax,dword ptr fs:[0]
00405374    50              push eax                          
00405375    64:8925 0000000>mov dword ptr fs:[0],esp
0040537C    83EC 68         sub esp,0x68

 

7.loadPE+ImportREC脱壳，运行，查壳

OK，可以运行，查壳：Microsoft Visual C++ v6.0 (16 ms)