手脱PECompact v2.xx

个人认为这个壳对于新手有那么一点点难度，所以用单步和ESP都跑一下，我觉得单步是最最基础的，所以一定要掌握

一、单步
1.PEID查壳

PECompact v2.xx (16 ms)

2.载入OD，除了以下标注的几个位置外，其他的都使用F8

0040A86D >  B8 74DE4500     mov eax,qqspirit.0045DE74         ; //入口点
0040A872    50              push eax                          
0040A873    64:FF35 0000000>push dword ptr fs:[0]
0040A87A    64:8925 0000000>mov dword ptr fs:[0],esp
0040A881    33C0            xor eax,eax                       
0040A883    8908            mov dword ptr ds:[eax],ecx
0040A885    50              push eax    

 

位置1：

778D711D    6A 00           push 0x0
778D711F    51              push ecx
778D7120    E8 2BE5FFFF     call ntdll.ZwContinue             ; //程序会跑飞F7跟进
778D7125    EB 0B           jmp short ntdll.778D7132
778D7127    5B              pop ebx                          
778D7128    59              pop ecx                           
778D7129    6A 00           push 0x0

 

位置2：

778D5650 >  B8 3C000000     mov eax,0x3C                      ; //F7落脚点
778D5655    BA 0003FE7F     mov edx,0x7FFE0300
778D565A    FF12            call dword ptr ds:[edx]           ; //程序会跑飞F7跟进
778D565C    C2 0800         retn 0x8
778D565F    90              nop
778D5660 >  B8 3D000000     mov eax,0x3D

778D71B0 >  8BD4            mov edx,esp                       ; //第二个F7落脚点
778D71B2    0F34            sysenter
778D71B4 >  C3              retn
778D71B5    8DA424 00000000 lea esp,dword ptr ss:[esp]
778D71BC    8D6424 00       lea esp,dword ptr ss:[esp]
778D71C0 >  8D5424 08       lea edx,dword ptr ss:[esp+0x8]

 

3.找到了指向OEP的跳转

0045DF34    5B              pop ebx                           
0045DF35    5D              pop ebp                           
0045DF36  - FFE0            jmp eax                           ; //指向OEP的跳转
0045DF38    6D              ins dword ptr es:[edi],dx
0045DF39    A8 40           test al,0x40
0045DF3B    0000            add byte ptr ds:[eax],al

 

4.来到OEP，脱壳吧

0040A86D >  55              push ebp                          ; //来到OEP
0040A86E    8BEC            mov ebp,esp
0040A870    6A FF           push -0x1
0040A872    68 78794200     push qqspirit.00427978
0040A877    68 F4E14000     push qqspirit.0040E1F4
0040A87C    64:A1 00000000  mov eax,dword ptr fs:[0]
0040A882    50              push eax                          
0040A883    64:8925 0000000>mov dword ptr fs:[0],esp

 

5.运行查壳

运行OK，查壳：Microsoft Visual C++ v6.0

二、ESP定律

1.载入OD，看到两个push入栈，下一行ESP定律下硬件访问断点然后shift+F9运行一次

0040A86D >  B8 74DE4500     mov eax,qqspirit.0045DE74         ; //入口点
0040A872    50              push eax                          
0040A873    64:FF35 0000000>push dword ptr fs:[0]
0040A87A    64:8925 0000000>mov dword ptr fs:[0],esp          ; //ESP定律一次
0040A881    33C0            xor eax,eax                       
0040A883    8908            mov dword ptr ds:[eax],ecx

 

2.来到ESP的落脚点，单步F8跟下去就能到OEP了

0045DEA3    83C4 04         add esp,0x4                       ; //ESP落脚点
0045DEA6    55              push ebp
0045DEA7    53              push ebx
0045DEA8    51              push ecx
0045DEA9    57              push edi

 

3.来到关键跳，这就是指向OEP的跳转

0045DF34    5B              pop ebx                           
0045DF35    5D              pop ebp                           
0045DF36  - FFE0            jmp eax                           ; //指向OEP的跳转
0045DF38    6D              ins dword ptr es:[edi],dx
0045DF39    A8 40           test al,0x40

 

4.来到OEP，脱壳、运行、查壳

0040A86D >  55              push ebp                          ; //OEP
0040A86E    8BEC            mov ebp,esp
0040A870    6A FF           push -0x1
0040A872    68 78794200     push qqspirit.00427978
0040A877    68 F4E14000     push qqspirit.0040E1F4
0040A87C    64:A1 00000000  mov eax,dword ptr fs:[0]
0040A882    50              push eax                          
0040A883    64:8925 0000000>mov dword ptr fs:[0],esp
0040A88A    83EC 58         sub esp,0x58