-
-
[求助]ASPack 2.12 -> Alexey Solodovnikov [Overlay]脱壳后无法运行
-
发表于: 2014-4-11 08:37
-
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
1. 脱壳
我是写脚本脱的。应该感谢楼主，发现原来的脚本在还原资源数据时犯了一个低级的严重错误！貌视《UPX完美脱壳脚本》也存在同样的BUG。  这样，两个ASPack的区段就完全去掉了，对比脱壳前后的文件大小和区段信息： [FONT="Courier"]2013-09-11 22:18 947,872 1.exe
2014-04-11 17:02 2,902,016 1_UnPacked.exe
Number Name VirtSize RVA PhysSize Offset Flag
1 .text 0015E000 00001000 0008F800 00000400 E0000060
2 .rdata 0004F000 0015F000 00012E00 0008FC00 C0000040
3 .data 0001E000 001AE000 00005600 000A2A00 C0000040
4 .rsrc 000E1000 001CC000 00023200 000A8000 C0000040
5 .reloc 00028000 002AD000 0000CC00 000CB200 C2000040
6 .aspack 0000E000 002D5000 0000DE00 000D7E00 E0000060
7 .adata 00001000 002E3000 00000000 000E5C00 E0000040
Number Name VirtSize RVA PhysSize Offset Flag
1 .text 0015E000 00001000 0015DE00 00000400 60000020
2 .rdata 0004F000 0015F000 0004E800 0015E200 40000040
3 .data 0001E000 001AE000 0000F800 001ACA00 C0000040
4 .rsrc 000E1000 001CC000 000E0A00 001BC200 C0000040
5 .reloc 00028000 002AD000 00027C00 0029CC00 C2000040[/FONT]2. 修补文件自校验 原程序是经数字签名的，有自校验的代码： [FONT="Courier"]0041AFCA 68 04010000 PUSH 0x104 ; /BufSize = 104 (260.) 0041AFCF 8D4C24 58 LEA ECX, DWORD PTR [ESP+0x58] ; | 0041AFD3 51 PUSH ECX ; |PathBuffer 0041AFD4 6A 00 PUSH 0x0 ; |hModule = NULL 0041AFD6 FF15 1CF45500 CALL NEAR DWORD PTR [<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA 0041AFDC 8D5424 54 LEA EDX, DWORD PTR [ESP+0x54] 0041AFE0 52 PUSH EDX ; /Arg1 0041AFE1 E8 BACB0000 CALL 00427BA0 ; \1_UnPack.00427BA0 0041AFE6 A1 BC9E5C00 MOV EAX, DWORD PTR [0x5C9EBC] 0041AFEB 83C4 04 ADD ESP, 0x4 0041AFEE 68 A08C5800 PUSH 00588CA0 ; /Arg2 = 00588CA0 ASCII "2E3E39164832021EA8FE7DDB0C732E4D" 0041AFF3 50 PUSH EAX ; |Arg1 => 00000000 0041AFF4 E8 C9DA1000 CALL 00528AC2 ; \1_UnPack.00528AC2 0041AFF9 83C4 08 ADD ESP, 0x8 0041AFFC 85C0 TEST EAX, EAX 0041AFFE 0F95C0 SETNE AL 0041B001 84C0 TEST AL, AL 0041B003 0F84 1C010000 JE 0041B125 ; <- *** JUST Patch this!!! 0041B009 6A 00 PUSH 0x0 ; /Arg3 = 00000000 0041B00B 6A 00 PUSH 0x0 ; |Arg2 = 00000000 0041B00D 68 C48C5800 PUSH 00588CC4 ; |Arg1 = 00588CC4 0041B012 E8 0B4C0100 CALL 0042FC22 ; \1_UnPack.0042FC22 0041B017 6A 01 PUSH 0x1 ; /IsShown = 0x1 0041B019 6A 00 PUSH 0x0 ; |DefDir = NULL 0041B01B 6A 00 PUSH 0x0 ; |Parameters = NULL 0041B01D 68 F88C5800 PUSH 00588CF8 ; |FileName = "bc6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4g2H3j5h3&6Q4x3X3g2U0j5#2)9J5c8Y4c8G2L8$3I4K6i4K6u0r3N6r3g2K6N6q4)9J5c8V1y4Z5K9i4m8q4j5i4y4&6i4K6u0W2K9s2c8E0L8l9`.`." 0041B022 68 248D5800 PUSH 00588D24 ; |Operation = "open" 0041B027 6A 00 PUSH 0x0 ; |hWnd = NULL 0041B029 FF15 0CF55500 CALL NEAR DWORD PTR [<&SHELL32.ShellExecuteA>] ; \ShellExecuteA ...[/FONT] CALL 00528AC2会出对话框，提示“程序已被非法篡改,运行失败...”，点“确定”后，SHELL32.ShellExecuteA将打开程序下载页面。 将0041B003处修改半个字节就OK了。 [FONT="Courier"]0041B003 0F85 1C010000 JNZ 0041B125[/FONT] |
|
|
|
|
|
|
|
|
|
|
|
|
