【破解作者】 clide2000[DFCG][OCN]
【使用工具】 OD
【破解平台】 Win9x/NT/2000/XP
【软件名称】 脱壳练习
附件:oep_vc.rar
【下载地址】 附件下载
【软件简介】 PeSpin1.3壳stolen code 的快速找回
【加壳方式】 PeSpin13壳
【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------------------------
【破解内容】
注：此方法对其主程序无效，只对其加壳的程序有效
先用PeSpin13给目标加壳，以作练习之用(OEP_vc.exe,练习脱壳用的小程序)
用OD载入加壳后的OEP_vc.exe后停在:
004050D4 > /EB 01 jmp short OEP_VC.004050D7
004050D6 |68 60E80000 push 0E860
004050DB 0000 add byte ptr ds:[eax], al
004050DD 8B1C24 mov ebx, dword ptr ss:[esp]
004050E0 83C3 12 add ebx, 12
004050E3 812B E8B10600 sub dword ptr ds:[ebx], 6B1E8
004050E9 FE4B FD dec byte ptr ds:[ebx-3]
004050EC 822C24 AC sub byte ptr ss:[esp], -54
004050F0 DF46 00 fild word ptr ds:[esi]
004050F3 0BE4 or esp, esp
004050F5 ^ 74 9E je short OEP_VC.00405095
004050F7 75 01 jnz short OEP_VC.004050FA
设置OD忽略所有异常，用执行隐藏OD插件（IsDebugPresent),F9运行
出现错误提示“Dont know how to bypass command at address 004001D9. Try to change EIP or pass execption to program."
记住上面的004001D9这个地址，点确定后，在内存窗口下Ctrl+G,输入004001D9，回车后会看到如下内容
此时内存区内容如下：
004001D9 FF FF FF FF FF FF FF FF ??/下内存断点的位置，可以从这里向下数6行，然后在第7和第8行上下断???
004001E1 FF FF FF FF FF FF FF FF ????
004001E9 FF FF FF FF FF FF FF FF ????
004001F1 FF FF FF FF FF FF FF FF ????
004001F9 FF FF FF FF FF FF FF FF ????
00400201 FF FF FF FF FF FF FF FF ????
00400209 FF FF FF FF FF FF FF FF ????
00400211 FF FF FF FF FF FF FF FF ????
00400219 FF FF FF FF FF FF FF FF ????
接着在00400209~00400211内存区域下内存写入断点，然后Shift+f9后，中断在:
00406ABC F3:A4 rep movs byte ptr es:[edi], byte ptr ds> //中断在此
00406ABE 60 pushad
00406ABF E8 03000000 call OEP_VC.00406AC7
00406AC4 D2EB shr bl, cl
00406AC6 0A58 EB or bl, byte ptr ds:[eax-15]
00406AC9 0148 40 add dword ptr ds:[eax+40], ecx
00406ACC EB 01 jmp short OEP_VC.00406ACF
00406ACE 1C FF sbb al, 0FF
00406AD0 E0 61 loopdne short OEP_VC.00406B33
现在，首先取消内存写入断点，然后在00406ABE一行上按f4，接下来，下hr 12ffa4硬件断点，f9后中断在：
00406AF6 49 dec ecx //中断在这里
00406AF7 F7C0 E99F94BA test eax, BA949FE9
00406AFD EB 01 jmp short OEP_VC.00406B00
00406AFF 2F das
00406B00 87D1 xchg ecx, edx
00406B02 87CA xchg edx, ecx
00406B04 0FB7C8 movzx ecx, ax
00406B07 0FBCD0 bsf edx, eax
00406B0A 0FBFC8 movsx ecx, ax
00406B0D 01C2 add edx, eax
00406B0F 8BD0 mov edx, eax
00406B11 EB 01 jmp short OEP_VC.00406B14
00406B13 3D 81D96572 cmp eax, 7265D981
00406B18 B9 544987CA mov ecx, CA874954
00406B1D EB 01 jmp short OEP_VC.00406B20
00406B1F E7 C7 out 0C7, eax ; I/O command
00406B21 C2 72DB retn 0DB72
现在取消硬件中断，f7单步执行，经过几个jmp跳转后就到了（00406B20）stolen code 处理的部分了:
以下是NOP掉花指令后的内容：
好了，我们一直用f7,一直走到00406BBE,stolen code处理结束。
00406B20 C7C2 72DBA0EE mov edx, EEA0DB72
00406B26 F3: prefix rep: ; Superfluous prefix
00406B27 FFC1 inc ecx
00406B29 8D0D F47EE111 lea ecx, dword ptr ds:[11E17EF4]
00406B2F 55 push ebp **(1)
00406B30 EB 01 jmp short OEP_VC.00406B33
00406B32 4D dec ebp
00406B33 8BEC mov ebp, esp **(2)
00406B35 EB 01 jmp short OEP_VC.00406B38
00406B37 A6 cmps byte ptr ds:[esi], byte ptr es:[ed>
00406B38 6A FF push -1 **(3)
00406B3A EB 01 jmp short OEP_VC.00406B3D
00406B3C 59 pop ecx
00406B3D 68 857C8B1B push 1B8B7C85 **(4)
00406B42 812C24 8D574B1B sub dword ptr ss:[esp], 1B4B578D
00406B49 68 6D7CF5C3 push C3F57C6D **(5)
00406B4E 810424 F99B4A3C add dword ptr ss:[esp], 3C4A9BF9
00406B55 64:A1 00000000 mov eax, dword ptr fs:[0] **(6)
00406B5B EB 01 jmp short OEP_VC.00406B5E
00406B5D 90 nop
00406B5E 50 push eax **(7)
00406B5F EB 01 jmp short OEP_VC.00406B62
00406B61 F4 hlt ; Privileged command
00406B62 64:8925 00000000 mov dword ptr fs:[0], esp **(8)
00406B69 EB 01 jmp short OEP_VC.00406B6C
00406B6B 54 push esp
00406B6C 83EC 68 sub esp, 68 **(9)
00406B6F EB 01 jmp short OEP_VC.00406B72
00406B71 90 nop
00406B72 53 push ebx **(10)
00406B73 EB 01 jmp short OEP_VC.00406B76
00406B75 90 nop
00406B76 56 push esi **(11)
00406B77 EB 01 jmp short OEP_VC.00406B7A
00406B79 90 nop
00406B7A 57 push edi **(12)
00406B7B EB 01 jmp short OEP_VC.00406B7E
00406B7D 94 xchg eax, esp
00406B7E 8965 E8 mov dword ptr ss:[ebp-18], esp **(13)
00406B81 EB 01 jmp short OEP_VC.00406B84
00406B83 5B pop ebx
00406B84 33DB xor ebx, ebx **(14)
00406B86 EB 01 jmp short OEP_VC.00406B89
00406B88 6D ins dword ptr es:[edi], dx ; I/O command
00406B89 895D FC mov dword ptr ss:[ebp-4], ebx **(15)
00406B8C EB 01 jmp short OEP_VC.00406B8F
00406B8E 90 nop
00406B8F 6A 02 push 2 **(16)
00406B91 EB 01 jmp short OEP_VC.00406B94
00406B93 51 push ecx
00406B94 FF15 90214000 call dword ptr ds:[402190] **(17) ; MSVCRT.__set_app_type
00406B9A EB 01 jmp short OEP_VC.00406B9D
00406B9C 90 nop
00406B9D 59 pop ecx **(18)
00406B9E EB 01 jmp short OEP_VC.00406BA1
00406BA0 CC int3
00406BA1 830D 0C314000 FF or dword ptr ds:[40310C], FFFFFFFF **(19)
00406BA8 EB 01 jmp short OEP_VC.00406BAB
00406BAA 90 nop
00406BAB 830D 10314000 FF or dword ptr ds:[403110], FFFFFFFF **(20)
00406BB2 EB 01 jmp short OEP_VC.00406BB5
00406BB4 1E push ds
00406BB5 FF15 8C214000 call dword ptr ds:[40218C] **(21) ; MSVCRT.__p__fmode
00406BBB EB 01 jmp short OEP_VC.00406BBE
00406BBD 90 nop
00406BBE - E9 65ABFFFF jmp OEP_VC.00401728 //处理完毕，跳掉伪OEP继续执行
注意上面加“**”号的地方，最后stolen code内容整理如下:
push ebp
mov ebp, esp
push -1
push 004024F8
push 401866
mov eax, dword ptr fs:[0]
push eax
mov dword ptr fs:[0], esp
sub esp, 68
push ebx
push esi
push edi
mov dword ptr ss:[ebp-18], esp
xor ebx, ebx
mov dword ptr ss:[ebp-4], ebx
push 2
call dword ptr ds:[402190]
pop ecx
or dword ptr ds:[40310C], FFFFFFFF
or dword ptr ds:[403110], FFFFFFFF
call dword ptr ds:[40218C]
stolen code处理结束后，会直接跳到:
00401728 8B db 8B //直接跳到这里继续执行,伪OEP
00401729 0D db 0D
0040172A 00 db 00
0040172B 31 db 31 ; CHAR '1'
0040172C 40 db 40 ; CHAR '@'
0040172D 00 db 00
0040172E 89 db 89
0040172F 08 db 08
00401730 FF db FF
Ctrl+A分析一下，这下好看多了：
00401728 . 8B0D 00314000 mov ecx, dword ptr ds:[403100]
0040172E . 8908 mov dword ptr ds:[eax], ecx
00401730 . FF15 88214000 call dword ptr ds:[402188] ; MSVCRT.__p__commode
00401736 . 8B0D FC304000 mov ecx, dword ptr ds:[4030FC]
0040173C . 8908 mov dword ptr ds:[eax], ecx
0040173E . A1 80214000 mov eax, dword ptr ds:[402180]
00401743 . 8B00 mov eax, dword ptr ds:[eax]
00401745 . A3 08314000 mov dword ptr ds:[403108], eax
现在从上里往上看，发现上面都是00，很明显代码都是被壳偷掉了，好一直找到OO的开始处：
004016D5 \. C3 retn
004016D6 .- FF25 A4214000 jmp dword ptr ds:[4021A4] ; MSVCRT.__CxxFrameHandler
004016DC CC int3
004016DD CC int3
004016DE CC int3
004016DF CC int3
004016E0 00 db 00 //是从这里开始的，这里就是程序的OEP
004016E1 00 db 00
004016E2 00 db 00
004016E3 00 db 00
004016E4 00 db 00
现在可以在004016E0 开始补上被偷的代码
????
--------------------------------------------------------------------------------
【破解总结】
关于dump和IAT的修复还没有搞定
--------------------------------------------------------------------------------
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
