upx加壳-出题过程的学习笔记

gcc -static xxx.c -o xxx

upx为压缩壳，将可执行文件进行压缩，当可执行文件过小时加壳会失败，所以此处采用了静态链接的方式进行编译；

附上设计的源码：

#include<stdio.h>
#include<string.h>
#include<windows.h>

int main(){
 int a,b,c,d;
 int i;
 char answer[27];
 char seq1[]="are you a student at AEU?";
 char seq2[]="enter 1 or 0:";
 char seq3[]="welcome to the competition,do you want any hints?";
 char seq4[]="do you think the examiner is handsome?";
 char seq5[]="you are right!";
 char seq6[]="I modified the spack,You should try to remove the pack manually";
 char seq7[]="Listen!the flag is ";
 char seq00[]=" AEU{eeAmi3_";
 char flag[27]="AEU{eeAmi3_6e74rt_handi43}";
 char seq02[]="This is the first time for us to hold the competition,Looking forward to your performance\nHere's a present for you:";
 char seq03[]="Never give up\nNever lose hope.\nAlways have faith,\nIt allows you to cope.\nTrying times will pass,\nAs they always do.";
 char seq04[]="Just have patience,\nYour dreams will come true. \nSo put on a smile,\nYou'll live through your pain.\nKnow it will pass, \nAnd strength you will gain";
 

	 for(i=0;i<strlen(seq1);i++){
		 printf("%c",seq1[i]);
		 Sleep(90);
	 }
	printf("\n");
	puts("enter 1 or 0:");
	scanf("%d",&a);


	if(a){
		for(i=0;i<strlen(seq3);i++){
			printf("%c",seq3[i]);
			Sleep(90);
		}
		printf("\n");

		puts("enter 1 or 0:");
		scanf("%d",&b);
		if(b){
		 	for(i=0;i<strlen(seq4);i++){
				printf("%c",seq4[i]);
				Sleep(90);
			}
			printf("\n");
			puts("enter 1 or 0:");
			scanf("%d",&c);
			if(c){
				for(i=0;i<strlen(seq5);i++){
				printf("%c",seq5[i]);
				Sleep(90);
				}
				printf("\n");
				
				for(i=0;i<strlen(seq6);i++){
				printf("%c",seq6[i]);
				Sleep(90);
				}
				printf("\n");
				for(i=0;i<strlen(seq7);i++){
				printf("%c",seq7[i]);
				Sleep(200);
				}
				for(i=0;i<strlen(seq00);i++){
				printf("%c",seq00[i]);
				Sleep(500);
				}
				Sleep(6000);
				puts(" (*^_^*)");
				puts("are you really want the flag?");
				
				for(i=0;i<strlen(seq02);i++){
				printf("%c",seq02[i]);
				Sleep(80);
				}
				printf("\n");
				for(i=0;i<strlen(seq03);i++){
				printf("%c",seq03[i]);
				Sleep(80);
				}
				printf("\n");
				for(i=0;i<strlen(seq04);i++){
				printf("%c",seq04[i]);
				Sleep(80);
				}
				printf("\n");
				
				for(i=0;i<strlen(seq7);i++){
				printf("%c",seq7[i]);
				Sleep(200);
				}
				for(i=0;i<strlen(flag);i++){
				printf("%c",flag[i]);
				Sleep(900);
				}
				printf("\n");
				
				puts("now,input your answer:");
				scanf("%s",answer);
				
				for(i=0;i<strlen(flag);i++){
					if(flag[i]=='e') flag[i]+=1;
					else if(flag[i]=='r') flag[i]-=1;
				}
				if(!strcmp(answer,flag))
					puts("right!");
				else puts("wrong,Is it really that simple?");
			
				Sleep(6000);

				
			}
			else{
				puts("You can't solve the problem");
			}
		}
		else{
			puts("I can't give you a hint");
			
		}
	}
	else{
		puts("sorry,identity failed");
	}
 return 0;
}

upx xxx.exe -o xxx.exe

使用upx工具完成加壳，正常情况下upx工具可以顺利完成脱壳

upx -d xxx.exe

但对壳进行修改后该工具便失效。

一，首先认识upx:

upx的作用是压缩程序代码，比如可执行文件中的123456用a代替，还会在程序的开头插入一段代码（用来解压缩）；当执行该文件时插入的代码会起作用，将文件解压，但解压只能在内存中完成，采用静态的方式是没办法看到解压后的可执行代码的。所以通用方法是动态调试，一直追踪到解压后的可执行代码，完成转储后也就是脱壳成功。

二、修改upx

本题设计采用修改upx的标志：