OE载入
设置Ollydbg忽略除了“内存访问异常”之外的所有其它异常选项。老规矩：用IsDebug 插件去掉Ollydbg的调试器标志。
载入后弹出“是压缩代码——要继续进行分析吗？”，点“否”。
00401000 > 68 01405100 push 00514001
00401005 E8 01000000 call 0040100B
0040100A C3 retn
0040100B C3 retn
0040100C 816A EB 6151907>sub dword ptr [edx-15], 7C905161
00401013 D4 F8 aam 0F8
00401015 F2: prefix repne:
00401016 08E0 or al, ah
00401018 50 push eax
00401019 B2 59 mov dl, 59
0040101B 6963 DE CA275F9>imul esp, dword ptr [ebx-22], 985F27CA
00401022 46 inc esi
00401023 86C3 xchg bl, al
00401025 3E:45 inc ebp
00401027 2167 71 and dword ptr [edi+71], esp
0040102A 19045B sbb dword ptr [ebx+ebx*2], eax
0040102D 78 10 js short 0040103F
0040102F 51 push ecx
00401030 8E08 mov cs, word ptr [eax] ; 不允许段 CS
00401032 EA 735CA6E1 FA3>jmp far 3AFA:E1A65C73
00401039 F0:6B7A CC DB lock imul edi, dword ptr [edx-34], -25 ; 不允许锁定前缀
0040103E 38DF cmp bh, bl
shift+f9 28次就跳出NGA，程序运行了，所以shift+f9 27次来到最后一次异常
00F039EC 3100 xor dword ptr [eax], eax ; 最后一次异常，代码都类似,Dump出来
00F039EE 64:8F05 0000000>pop dword ptr fs:[0]
00F039F5 58 pop eax
00F039F6 833D B07EF000 0>cmp dword ptr [F07EB0], 0
00F039FD 74 14 je short 00F03A13
00F039FF 6A 0C push 0C
00F03A01 B9 B07EF000 mov ecx, 0F07EB0
00F03A06 8D45 F8 lea eax, dword ptr [ebp-8]
00F03A09 BA 04000000 mov edx, 4
00F03A0E E8 2DD1FFFF call 00F00B40
00F03A13 FF75 FC push dword ptr [ebp-4]
00F03A16 FF75 F8 push dword ptr [ebp-8]
00F03A19 8B45 F4 mov eax, dword ptr [ebp-C]
00F03A1C 8338 00 cmp dword ptr [eax], 0
00F03A1F 74 02 je short 00F03A23
00F03A21 FF30 push dword ptr [eax]
00F03A23 FF75 F0 push dword ptr [ebp-10]
00F03A26 FF75 EC push dword ptr [ebp-14]
00F03A29 C3 retn ; f2断点，shift+f9，再取消断点返回到 00F176A8
alt+m对code段下断点，f9+f7跟入到壳空间里
00F01C64 55 push ebp
00F01C65 8BEC mov ebp, esp
00F01C67 8B45 08 mov eax, dword ptr [ebp+8]
00F01C6A 85C0 test eax, eax
00F01C6C 75 13 jnz short 00F01C81
00F01C6E 813D A47AF000 0>cmp dword ptr [F07AA4], 400000 ; ASCII "MZP"
00F01C78 75 07 jnz short 00F01C81
00F01C7A A1 A47AF000 mov eax, dword ptr [F07AA4]
00F01C7F EB 06 jmp short 00F01C87
00F01C81 50 push eax
00F01C82 E8 3135FFFF call 00EF51B8 ; jmp 到 kernel32.GetModuleHandleA
00F01C87 5D pop ebp
00F01C88 C2 0400 retn 4 ：返回到 00407049
00407038 53 push ebx
00407039 8BD8 mov ebx, eax
0040703B 33C0 xor eax, eax
0040703D A3 10D74E00 mov dword ptr [4ED710], eax
00407042 6A 00 push 0
00407044 |. E8 2BFFFFFF call 00406F74
00407049 |. A3 18D74E00 mov dword ptr [4ED718], eax ; Text2Gif.00400000
0040704E |. A1 18D74E00 mov eax, dword ptr [4ED718]
00407053 |. A3 BC304E00 mov dword ptr [4E30BC], eax
00407058 |. 33C0 xor eax, eax
0040705A |. A3 C0304E00 mov dword ptr [4E30C0], eax
0040705F |. 33C0 xor eax, eax
00407061 |. A3 C4304E00 mov dword ptr [4E30C4], eax
00407066 |. E8 C1FFFFFF call 0040702C
0040706B |. BA B8304E00 mov edx, 004E30B8
00407070 |. 8BC3 mov eax, ebx
00407072 |. E8 D5D5FFFF call 0040464C ：eax=004e27e0，根据资料是mov eax, ####的值
00407077 |. 5B pop ebx
00407078 \. C3 retn ：返回到004E2A75
004E2A38 \FC254D00 dd Text2Gif.004D25FC
004E2A3C 94254D00 dd Text2Gif.004D2594
004E2A40 8C294D00 dd Text2Gif.004D298C
004E2A44 5C294D00 dd Text2Gif.004D295C
004E2A48 F8314D00 dd Text2Gif.004D31F8
004E2A4C C8314D00 dd Text2Gif.004D31C8
004E2A50 B0274E00 dd Text2Gif.004E27B0
004E2A54 60274E00 dd Text2Gif.004E2760
004E2A58 00 db 00
004E2A59 00 db 00
004E2A5A 00 db 00
004E2A5B 00 db 00
004E2A5C B8274E00 dd Text2Gif.004E27B8
004E2A60 00 db 00
004E2A61 00 db 00
004E2A62 00 db 00
004E2A63 00 db 00
004E2A64 00 db 00
004E2A65 00 db 00
004E2A66 00 db 00
004E2A67 00 db 00
004E2A68 00 db 00
004E2A69 00 db 00
004E2A6A 00 db 00
004E2A6B 00 db 00
004E2A6C 00 db 00
004E2A6D 00 db 00
004E2A6E 00 db 00
004E2A6F 00 db 00
004E2A70 . E8 C345F2FF call 00407038
004E2A75 . 33C0 xor eax, eax ：返回到这里
004E2A77 . 55 push ebp
004E2A78 . 68 3D2B4E00 push 004E2B3D
004E2A7D . 64:FF30 push dword ptr fs:[eax]
004E2A80 . 64:8920 mov dword ptr fs:[eax], esp
004E2A83 . E8 0800F2FF call 00402A90
004E2A88 . 48 dec eax
004E2A89 . 75 54 jnz short 004E2ADF
004E2A8B . 8D55 EC lea edx, dword ptr [ebp-14]
004E2A8E . B8 01000000 mov eax, 1
004E2A93 . E8 5800F2FF call 00402AF0
004E2A98 . 8B45 EC mov eax, dword ptr [ebp-14]
004E2A9B . BA 542B4E00 mov edx, 004E2B54 ; ASCII "CHECKREG"
004E2AA0 . E8 BB22F2FF call 00404D60
004E2AA5 . 75 38 jnz short 004E2ADF
004E2AA7 . E8 0455FEFF call 004C7FB0
004E2AAC . 84C0 test al, al
004E2AAE . 74 09 je short 004E2AB9
004E2AB0 . 6A 01 push 1 ; /ExitCode = 1
004E2AB2 . E8 5147F2FF call 00407208 ; \ExitProcess
004E2AB7 . EB 26 jmp short 004E2ADF
004E2AB9 > A1 70C24E00 mov eax, dword ptr [4EC270]
004E2ABE . 8338 00 cmp dword ptr [eax], 0
004E2AC1 . 77 09 ja short 004E2ACC
004E2AC3 . 6A 02 push 2 ; /ExitCode = 2
004E2AC5 . E8 3E47F2FF call 00407208 ; \ExitProcess
可是又不像这样
004833D4 0000 ADD BYTE PTR DS:[EAX],AL
004833D6 0000 ADD BYTE PTR DS:[EAX],AL
004833D8 0000 ADD BYTE PTR DS:[EAX],AL
004833DA 0000 ADD BYTE PTR DS:[EAX],AL
004833DC 0000 ADD BYTE PTR DS:[EAX],AL
004833DE 0000 ADD BYTE PTR DS:[EAX],AL
我只好照猫画虎。程序是用Delphi写的, 入口代码应该是 11字节
push ebp
mov ebp, esp
add esp, -10
mov eax, #### eax=004e27e0
认为oep=004E2A60，去填偷去的代码，多出5字节就nop掉
后面用RecImport修复抓取文件，再补偷去代码，可是还是不能够运行
我搞的都头晕了，希望高手能够指出错误的地方，让我能够脱掉这个壳
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
