今天脱了一个软件的壳，发现是多重壳，分别是ASPack 2.12和UPX压缩的，手动脱壳修复后发现是用VB编写的，脱壳后文件能正常运行，但脱壳后的文件用Ollydbg载入后发现该文件还是有压缩或加密的东西存在，载入后是以下代码：
004016F4 2> 68 1C184000 push 2.0040181C
004016F9 E8 EEFFFFFF call <jmp.&msvbvm50.ThunRTMain>
004016FE 0000 add byte ptr ds:[eax],al
00401700 0000 add byte ptr ds:[eax],al
00401702 0000 add byte ptr ds:[eax],al
00401704 3000 xor byte ptr ds:[eax],al
00401706 0000 add byte ptr ds:[eax],al
00401708 3800 cmp byte ptr ds:[eax],al
0040170A 0000 add byte ptr ds:[eax],al
0040170C 0000 add byte ptr ds:[eax],al
0040170E 0000 add byte ptr ds:[eax],al
00401710 9A 391F5379 F68>call far 8CF6:79531F39
00401717 49 dec ecx
00401718 93 xchg eax,ebx
00401719 5C pop esp
0040171A DD90 628C5A28 fst qword ptr ds:[eax+285A8C62]
00401720 0000 add byte ptr ds:[eax],al
00401722 0000 add byte ptr ds:[eax],al
00401724 0000 add byte ptr ds:[eax],al
从以上代码看肯定是有问题，F8步过004016F9 E8 EEFFFFFF call <jmp.&msvbvm50.ThunRTMain>就发现访问违反，出现异常，请问大家是不是壳没有脱干净还是干啥，是不是软件在其他地方动了手脚，请赐教。
以下把脱壳的过程阐述 一下
用Ollydbg原文件后进行脱壳
00598001 k> 60 pushad 载入后地方 这个是ASPack 2.12的壳
00598002 E8 03000000 call kjcyzg.0059800A
00598007 - E9 EB045D45 jmp 45B684F7
用F7步过进入00598002 E8 03000000 call kjcyzg.0059800A 不然就飞了
0059800A 5D pop ebp 来到这里
0059800B 45 inc ebp
0059800C 55 push ebp
0059800D C3 retn 返回
0059800E E8 01000000 call kjcyzg.00598014
来到这里：
00598008 /EB 04 jmp short kjcyzg.0059800E
0059800A |5D pop ebp
0059800B |45 inc ebp
0059800C |55 push ebp
0059800D |C3 retn
0059800E \E8 01000000 call kjcyzg.00598014 F7进入，不然飞了
00598013 EB 5D jmp short kjcyzg.00598072
00598015 BB EDFFFFFF mov ebx,-13
0059801A 03DD add ebx,ebp
来到这里：
00598014 5D pop ebp 来到这里
00598015 BB EDFFFFFF mov ebx,-13
0059801A 03DD add ebx,ebp
0059801C 81EB 00801900 sub ebx,198000
00598022 83BD 22040000 0>cmp dword ptr ss:[ebp+422],0
00598029 899D 22040000 mov dword ptr ss:[ebp+422],ebx
0059802F 0F85 65030000 jnz kjcyzg.0059839A
00598035 8D85 2E040000 lea eax,dword ptr ss:[ebp+42E]
0059803B 50 push eax
0059803C FF95 4D0F0000 call dword ptr ss:[ebp+F4D]
00598042 8985 26040000 mov dword ptr ss:[ebp+426],eax
00598048 8BF8 mov edi,eax
0059804A 8D5D 5E lea ebx,dword ptr ss:[ebp+5E]
0059804D 53 push ebx
0059804E 50 push eax
0059804F FF95 490F0000 call dword ptr ss:[ebp+F49]
00598055 8985 4D050000 mov dword ptr ss:[ebp+54D],eax
0059805B 8D5D 6B lea ebx,dword ptr ss:[ebp+6B]
0059805E 53 push ebx
0059805F 57 push edi
00598060 FF95 490F0000 call dword ptr ss:[ebp+F49]
00598066 8985 51050000 mov dword ptr ss:[ebp+551],eax
0059806C 8D45 77 lea eax,dword ptr ss:[ebp+77]
0059806F FFE0 jmp eax
00598071 56 push esi
00598072 6972 74 75616C4>imul esi,dword ptr ds:[edx+74],416C6175
00598079 6C ins byte ptr es:[edi],dx
0059807A 6C ins byte ptr es:[edi],dx
0059807B 6F outs dx,dword ptr es:[edi]
0059807C 6300 arpl word ptr ds:[eax],ax
0059807E 56 push esi
0059807F 6972 74 75616C4>imul esi,dword ptr ds:[edx+74],466C6175
00598086 72 65 jb short kjcyzg.005980ED
00598088 65:008B 9D31050>add byte ptr gs:[ebx+5319D],cl
0059808F 000B add byte ptr ds:[ebx],cl
00598091 DB ??? ; 未知命令
00598092 74 0A je short kjcyzg.0059809E
00598094 8B03 mov eax,dword ptr ds:[ebx]
00598096 8785 35050000 xchg dword ptr ss:[ebp+535],eax
0059809C 8903 mov dword ptr ds:[ebx],eax
0059809E 8DB5 69050000 lea esi,dword ptr ss:[ebp+569]
005980A4 833E 00 cmp dword ptr ds:[esi],0
005980A7 0F84 21010000 je kjcyzg.005981CE
005980AD 6A 04 push 4
005980AF 68 00100000 push 1000
005980B4 68 00180000 push 1800
005980B9 6A 00 push 0
005980BB FF95 4D050000 call dword ptr ss:[ebp+54D]
005980C1 8985 56010000 mov dword ptr ss:[ebp+156],eax
005980C7 8B46 04 mov eax,dword ptr ds:[esi+4]
005980CA 05 0E010000 add eax,10E
005980CF 6A 04 push 4
005980D1 68 00100000 push 1000
005980D6 50 push eax
005980D7 6A 00 push 0
005980D9 FF95 4D050000 call dword ptr ss:[ebp+54D]
005980DF 8985 52010000 mov dword ptr ss:[ebp+152],eax
005980E5 56 push esi
005980E6 8B1E mov ebx,dword ptr ds:[esi]
005980E8 039D 22040000 add ebx,dword ptr ss:[ebp+422]
005980EE FFB5 56010000 push dword ptr ss:[ebp+156]
005980F4 FF76 04 push dword ptr ds:[esi+4]
005980F7 50 push eax
005980F8 53 push ebx
005980F9 E8 6E050000 call kjcyzg.0059866C
005980FE B3 01 mov bl,1
00598100 80FB 00 cmp bl,0
00598103 75 5E jnz short kjcyzg.00598163
00598105 FE85 EC000000 inc byte ptr ss:[ebp+EC]
0059810B 8B3E mov edi,dword ptr ds:[esi]
0059810D 03BD 22040000 add edi,dword ptr ss:[ebp+422]
00598113 FF37 push dword ptr ds:[edi]
00598115 C607 C3 mov byte ptr ds:[edi],0C3
00598118 FFD7 call edi
0059811A 8F07 pop dword ptr ds:[edi]
0059811C 50 push eax
0059811D 51 push ecx
0059811E 56 push esi
0059811F 53 push ebx
00598120 8BC8 mov ecx,eax
00598122 83E9 06 sub ecx,6
00598125 8BB5 52010000 mov esi,dword ptr ss:[ebp+152]
0059812B 33DB xor ebx,ebx
0059812D 0BC9 or ecx,ecx
0059812F 74 2E je short kjcyzg.0059815F
00598131 78 2C js short kjcyzg.0059815F
00598133 AC lods byte ptr ds:[esi]
00598134 3C E8 cmp al,0E8
00598136 74 0A je short kjcyzg.00598142
00598138 EB 00 jmp short kjcyzg.0059813A
0059813A 3C E9 cmp al,0E9
0059813C 74 04 je short kjcyzg.00598142
0059813E 43 inc ebx
0059813F 49 dec ecx
00598140 ^ EB EB jmp short kjcyzg.0059812D
00598142 8B06 mov eax,dword ptr ds:[esi] F4到这里
00598144 EB 0A jmp short kjcyzg.00598150
00598146 803E 00 cmp byte ptr ds:[esi],0
00598149 ^ 75 F3 jnz short kjcyzg.0059813E
0059814B 24 00 and al,0
0059814D C1C0 18 rol eax,18
00598150 2BC3 sub eax,ebx
00598152 8906 mov dword ptr ds:[esi],eax
00598154 83C3 05 add ebx,5
00598157 83C6 04 add esi,4
0059815A 83E9 05 sub ecx,5
0059815D ^ EB CE jmp short kjcyzg.0059812D
0059815F 5B pop ebx
00598160 5E pop esi
00598161 59 pop ecx
00598162 58 pop eax
00598163 EB 08 jmp short kjcyzg.0059816D
00598165 0000 add byte ptr ds:[eax],al
00598167 ED in eax,dx
00598168 0000 add byte ptr ds:[eax],al
0059816A 00EC add ah,ch
0059816C 008B C88B3E03 add byte ptr ds:[ebx+33E8BC8],cl
00598172 BD 22040000 mov ebp,422
00598177 8BB5 52010000 mov esi,dword ptr ss:[ebp+152]
0059817D C1F9 02 sar ecx,2
00598180 F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
00598182 8BC8 mov ecx,eax
00598184 83E1 03 and ecx,3
00598187 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
00598189 5E pop esi
0059818A 68 00800000 push 8000
0059818F 6A 00 push 0
00598191 FFB5 52010000 push dword ptr ss:[ebp+152]
00598197 FF95 51050000 call dword ptr ss:[ebp+551]
0059819D 83C6 08 add esi,8
005981A0 833E 00 cmp dword ptr ds:[esi],0
005981A3 ^ 0F85 1EFFFFFF jnz kjcyzg.005980C7
005981A9 68 00800000 push 8000
005981AE 6A 00 push 0
005981B0 FFB5 56010000 push dword ptr ss:[ebp+156]
005981B6 FF95 51050000 call dword ptr ss:[ebp+551]
005981BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531]
005981C2 0BDB or ebx,ebx
005981C4 74 08 je short kjcyzg.005981CE
005981C6 8B03 mov eax,dword ptr ds:[ebx]
005981C8 8785 35050000 xchg dword ptr ss:[ebp+535],eax
005981CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422] ; kjcyzg.00400000
005981D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D]
005981DA 2BD0 sub edx,eax
接下去省略,用F8和F4键顺利来到以下地方
。。。。。。。
。。。。。。。
0059839A B8 90291900 mov eax,192990
0059839F 50 push eax
005983A0 0385 22040000 add eax,dword ptr ss:[ebp+422]
005983A6 59 pop ecx
005983A7 0BC9 or ecx,ecx
005983A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],eax ; kjcyzg.00592990
005983AF 61 popad 看到这个说明快来到了入口
005983B0 75 08 jnz short kjcyzg.005983BA
005983B2 B8 01000000 mov eax,1
005983B7 C2 0C00 retn 0C
005983BA 68 00000000 push 0
005983BF C3 retn 来到这里返回了
返回后来到这里：
00592990 60 pushad 晕，又是一个，一看就是UPX的
00592991 BE 15F04900 mov esi,kjcyzg.0049F015
00592996 8DBE EB1FF6FF lea edi,dword ptr ds:[esi+FFF61FEB]
0059299C 57 push edi
0059299D 83CD FF or ebp,FFFFFFFF
005929A0 EB 10 jmp short kjcyzg.005929B2
005929A2 90 nop
005929A3 90 nop
005929A4 90 nop
005929A5 90 nop
005929A6 90 nop
005929A7 90 nop
005929A8 8A06 mov al,byte ptr ds:[esi]
005929AA 46 inc esi
005929AB 8807 mov byte ptr ds:[edi],al
005929AD 47 inc edi
005929AE 01DB add ebx,ebx
005929B0 75 07 jnz short kjcyzg.005929B9
以下省略，这里比较容易，就是用F8和F4就可以了
。。。。。。。。
。。。。。。
来到这里
00592ACF 55 push ebp
00592AD0 FF96 A8631900 call dword ptr ds:[esi+1963A8]
00592AD6 09C0 or eax,eax
00592AD8 74 07 je short kjcyzg.00592AE1
00592ADA 8903 mov dword ptr ds:[ebx],eax
00592ADC 83C3 04 add ebx,4
00592ADF ^ EB D8 jmp short kjcyzg.00592AB9 这里向上跳
00592AE1 FF96 AC631900 call dword ptr ds:[esi+1963AC]这个很古怪，我用鼠标点到这里，用F4点到这里就直接飞了，出现访问违法了，后来我这里用了F4直接有00592ADF跳入00592AE7，（这样做是不是错了？）我先还是用我自己的，跳到00592AE7，请大侠赐教。我看来UPX脱壳的实例，也是这样跳的
00592AE7 83C7 04 add edi,4
00592AEA 8D5E FC lea ebx,dword ptr ds:[esi-4]
接下去很正常的来到了
。。。。。。
。。。。。。
00592B16 ^\EB E2 jmp short kjcyzg.00592AFA
00592B18 61 popad 看见了把
00592B19 - E9 D6EBE6FF jmp kjcyzg.004016F4 大跳也，进入入口，最上面的就是进入后的代码。
请大侠赐教，
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
