这次我脱壳的是最新版本的
Windows木马清道夫
peid检测他的壳是PECompact 2.x -> Jeremy Collake
OD载入 来到
00401398 > B8 18F06400 MOV EAX,FygTClea.0064F018
0040139D 50 PUSH EAX
0040139E 64:FF35 00000000 PUSH DWORD PTR FS:[0]
004013A5 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
004013AC 33C0 XOR EAX,EAX
004013AE 8908 MOV DWORD PTR DS:[EAX],ECX
004013B0 50 PUSH EAX
004013B1 45 INC EBP
004013B2 43 INC EBX
单步到
004013A5 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
用ESP定律,OD命令行 hr 0012FFBC F9运行,shift+f9
0064F047 83C4 04 ADD ESP,4
0064F04A 55 PUSH EBP
0064F04B 53 PUSH EBX
0064F04C 51 PUSH ECX
0064F04D 57 PUSH EDI
0064F04E 56 PUSH ESI
0064F04F 52 PUSH EDX
0064F050 8D98 68110010 LEA EBX,DWORD PTR DS:[EAX+10001168]
0064F056 8B53 18 MOV EDX,DWORD PTR DS:[EBX+18]
0064F059 52 PUSH EDX
0064F05A 8BE8 MOV EBP,EAX
0064F05C 6A 40 PUSH 40
0064F05E 68 00100000 PUSH 1000
0064F063 FF73 04 PUSH DWORD PTR DS:[EBX+4]
0064F066 6A 00 PUSH 0
hd 0012FFBC取消断点
搜索jmp eax
0064F0E5 FFE0 JMP EAX // f4
0064F0E7 0000 ADD BYTE PTR DS:[EAX],AL
0064F0E9 0000 ADD BYTE PTR DS:[EAX],AL
0064F0EB 0000 ADD BYTE PTR DS:[EAX],AL
0064F0ED 0000 ADD BYTE PTR DS:[EAX],AL
0064F0EF 0000 ADD BYTE PTR DS:[EAX],AL
0064F0F1 0000 ADD BYTE PTR DS:[EAX],AL
0064F0E5 -FFE0 JMP EAX ; FygTClea.<ModuleEntryPoint>
0064F0E7 98 CWDE
0064F0E8 1340 00 ADC EAX,DWORD PTR DS:[EAX]
0064F0EB 0000 ADD BYTE PTR DS:[EAX],AL
f8运行
00401398 > 68 1C224500 PUSH FygTClea.0045221C ; ASCII "VB5!6&vb6chs.dll"
0040139D E8 EEFFFFFF CALL FygTClea.00401390 ; JMP to MSVBVM60.ThunRTMain
004013A2 0000 ADD BYTE PTR DS:[EAX],AL
004013A4 50 PUSH EAX
004013A5 0000 ADD BYTE PTR DS:[EAX],AL
004013A7 0030 ADD BYTE PTR DS:[EAX],DH
004013A9 0000 ADD BYTE PTR DS:[EAX],AL
004013AB 0048 00 ADD BYTE PTR DS:[EAX],CL
在00401398 > 68 1C224500 PUSH FygTClea.0045221C ; ASCII "VB5!
DUMP出来
再用Ir修复，但是怎么还是运行不起啊?????
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
