手脱PE Pack v1.0

时间：2023-12-15 11:27:08

1.PEID查壳

PE Pack v1.0

2.载入OD，一上来就这架势，先F8走着

 > /            je short Pepack_1.        ; //入口点

  -\E9 C49D0000     jmp Pepack_1.0040D000

0040323C                add byte ptr ds:[eax],al

0040323E                add byte ptr ds:[eax],al

                add byte ptr ds:[eax],al

                add byte ptr ds:[eax],al

                add byte ptr ds:[eax],al
 

3.走到这里，一个pushad，又是我最喜欢的ESP定律，硬件访问断点，shift+F9一次

0040D000                  pushad

0040D001    E8      call Pepack_1.0040D006            ; //ESP

0040D006    5D              pop ebp

0040D007    83ED          sub ebp,0x6

0040D00A    80BD 3E050000 >cmp byte ptr ss:[ebp+0x53E],0x1

0040D011    0F84    je Pepack_1.0040D25F

0040D017    C685 3E050000 >mov byte ptr ss:[ebp+0x53E],0x1
 

4.ESP落脚点，这个落脚点是一个大跳转，也是指向OEP的关键跳

0040D270  - FFE0            jmp eax                           ; //ESP落脚点

0040D272    8D85 CE050000   lea eax,dword ptr ss:[ebp+0x5CE]

0040D278                  push eax

0040D279    8DBD D1040000   lea edi,dword ptr ss:[ebp+0x4D1]

0040D27F                  push ebx

0040D280                  push edi

0040D281                  push eax

5.来到OEP，脱壳把

004010CC                  push ebp                        ;//OEP

004010CD    8BEC            mov ebp,esp

004010CF    83EC          sub esp,0x44

004010D2                  push esi

004010D3    FF15 E4634000   call dword ptr ds:[0x4063E4]

004010D9    8BF0            mov esi,eax

004010DB    8A00            mov al,byte ptr ds:[eax]

004010DD    3C            cmp al,0x22

004010DF     1B           jnz short Pepack_1.004010FC

6.运行，查壳

运行OK，查壳：Microsoft Visual C++ v6.0 SPx

相关文章