[转载]用OD手脱 Armadillo v4.40 DLL壳 (动画)
<P>文章作者:regkiller</P><P><FONT face=宋体><FONT color=#008000>【作者QQ】14403147<BR>【使用工具】OllyDBG汉化第二版,LordPE,ImportRECv1.6F,PEiDv0.94,PEToolsv1.5.700</FONT><BR><FONT color=#008000>【脱壳平台】WinXPSP2</FONT><BR><FONT color=#008000>【脱壳目标】Armadillov4.40加过壳的EdrLib.dll文件</FONT><BR><FONT color=#008000>【保护选项】Standardprotectiononly仅仅标准保护(单进程)</FONT><BR><FONT color=#008000>【加壳方式】Armadillov4.40</FONT><BR><BR>--------------------------------------------------------------------------------<BR><FONT color=#008000>【脱壳内容】</FONT><BR><BR><BR><FONT color=#008000>一、准备工作</FONT><BR><BR>1<FONT color=#008000>侦壳：用PEiD查壳Armadillo2.51-3.xxDLLStub->SiliconRealmsToolworks</FONT><BR><BR><FONT color=#008000>这里如何判断Arm的版本呢？记得FLY大狭说过ArmadilloV4.0新增的反跟踪手段:</FONT><BR><BR>OllyDbg<FONT color=#008000>在处理调式包含格式串的消息时存在问题，被跟踪的应用程序可以使OllyDbg崩溃，或可能以进程权限执行任意指令。OutputDebugString函数可发送字符串到调试器上，然后OllyDbg会在底端显示相关状态消息，但是如果包含格式串消息，就可能使OllyDbg崩溃。Armadillo以前的版本没有此种Anti，自V4.0始才有。</FONT><BR><BR><FONT color=#008000>有他这句话我们就可以做如下判断了：</FONT><BR><BR>OD<FONT color=#008000>载入</FONT><BR><BR><FONT color=#008000>下断点HEOutputDebugStringA</FONT><BR><BR>Shift+F9<FONT color=#008000>运行，中断下来。看堆栈：</FONT><BR><BR>0006EA9800B8580F/<FONT color=#0000d0>CALL</FONT><FONT color=#008000>到OutputDebugStringA来自00B85809</FONT><BR>0006EA9C0006F410\String=<FONT color=#808080>"%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s"</FONT><BR><BR><FONT color=#008000>出现这个说明这个DLL是经过Armadillo4.X压缩过</FONT><BR><BR>2<FONT color=#008000>判断进程：DLL文件加壳应该是不可以双进程，所以这里是单进程方式。</FONT><BR><BR><FONT color=#008000>二、脱壳</FONT><BR><BR>1<FONT color=#008000>寻找MagicJump</FONT><BR><BR><FONT color=#008000>先用LordPE看看加壳后的DLL信息：基址＝00400000，入口点＝0003FE97</FONT><BR><BR><FONT color=#008000>设置Ollydbg忽略所有的异常选项。老规矩：用IsDebug1.4插件去掉Ollydbg的调试器标志</FONT><BR><BR><FONT color=#008000>清除断点后OD重新载入</FONT><BR><BR>008AFE97>/$55<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EBP</FONT><FONT color=#008000>;停在这里</FONT><BR>008AFE98|.8BEC<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EBP</FONT>,<FONT color=#ff0000>ESP</FONT><BR>008AFE9A|.53<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EBX</FONT><BR>008AFE9B|.8B5D08<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EBX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>+8]<BR>008AFE9E|.56<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>ESI</FONT><BR><BR><FONT color=#008000>下断点BPGetModuleHandleA+5，Shift+F9运行中断后，注意看堆栈：</FONT><BR><BR><FONT color=#008000>这里用BPAPI+5是为了多过壳检查是否下过API断点，相关资料看雪论坛上面可以找到。</FONT><BR><BR>0006E458/0006E574<BR>0006E45C|74683BEE<FONT color=#008000>返回到74683BEE来自kernel32.GetModuleHandleA</FONT><BR>0006E460|0006E464ASCII<FONT color=#808080>"D:\WINDOWS\system32\ntdll.dll"</FONT><BR><BR>0006E460/0006E57C<BR>0006E464|74683BEE<FONT color=#008000>返回到74683BEE来自kernel32.GetModuleHandleA</FONT><BR>0006E468|0006E46CASCII<FONT color=#808080>"D:\WINDOWS\system32\imm32.dll"</FONT><BR><BR>0006E3AC/0006E4C8<BR>0006E3B0|74683BEE<FONT color=#008000>返回到74683BEE来自kernel32.GetModuleHandleA</FONT><BR>0006E3B4|0006E3B8ASCII<FONT color=#808080>"D:\WINDOWS\system32\KERNEL32"</FONT><BR><BR>0006E504/0006E620<BR>0006E508|7365D4A4<FONT color=#008000>返回到msctfime.7365D4A4来自kernel32.GetModuleHandleA</FONT><BR>0006E50C|0006E510ASCII<FONT color=#808080>"D:\WINDOWS\system32\ntdll.dll"</FONT><BR><BR>0006ED60/0006ED7C<BR>0006ED64|77F45BD8<FONT color=#008000>返回到77F45BD8来自kernel32.GetModuleHandleA</FONT><BR>0006ED68|77F4501CASCII<FONT color=#808080>"KERNEL32.DLL"</FONT><BR><BR>00069364/0006EAAC<BR>00069368|00B86DF3<FONT color=#008000>返回到00B86DF3来自kernel32.GetModuleHandleA</FONT><BR>0006936C|00B9BC1CASCII<FONT color=#808080>"kernel32.dll"</FONT><BR>00069370|00B9CEC4ASCII<FONT color=#808080>"VirtualAlloc"</FONT><BR><BR>00069364/0006EAAC<BR>00069368|00B86E10<FONT color=#008000>返回到00B86E10来自kernel32.GetModuleHandleA</FONT><BR>0006936C|00B9BC1CASCII<FONT color=#808080>"kernel32.dll"</FONT><BR>00069370|00B9CEB8ASCII<FONT color=#808080>"VirtualFree"</FONT><BR><BR>000690C8/00069368<BR>000690CC|00B75CE1<FONT color=#008000>返回到00B75CE1来自kernel32.GetModuleHandleA</FONT><BR>000690D0|0006921CASCII<FONT color=#808080>"kernel32.dll"</FONT><FONT color=#008000>;★注意！在这里清除断点后Alt+F9返回程序</FONT><BR><BR><FONT color=#008000>这里说下我判断返回的经验，我的经验是一般出现下面这两句就快到返回点了</FONT><BR><BR>00069364/0006EAAC<BR>00069368|00B86DF3<FONT color=#008000>返回到00B86DF3来自kernel32.GetModuleHandleA</FONT><BR>0006936C|00B9BC1CASCII<FONT color=#808080>"kernel32.dll"</FONT><BR>00069370|00B9CEC4ASCII<FONT color=#808080>"VirtualAlloc"</FONT><FONT color=#008000>;★注意这句</FONT><BR><BR><BR>00069364/0006EAAC<BR>00069368|00B86E10<FONT color=#008000>返回到00B86E10来自kernel32.GetModuleHandleA</FONT><BR>0006936C|00B9BC1CASCII<FONT color=#808080>"kernel32.dll"</FONT><BR>00069370|00B9CEB8ASCII<FONT color=#808080>"VirtualFree"</FONT><FONT color=#008000>;★注意这句</FONT><BR><BR><BR>00B75CE18B0DAC40BA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>ECX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA40AC]<FONT color=#008000>;返回到这里</FONT><BR>00B75CE789040E<FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>ESI</FONT>+<FONT color=#ff0000>ECX</FONT>],<FONT color=#ff0000>EAX</FONT><BR>00B75CEAA1AC40BA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA40AC]<BR>00B75CEF391C06<FONT color=#0000d0>CMP</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>ESI</FONT>+<FONT color=#ff0000>EAX</FONT>],<FONT color=#ff0000>EBX</FONT><BR>00B75CF27516<FONT color=#0000d0>JNZ</FONT>SHORT00B75D0A<BR>00B75CF48D85B4FEFFFF<FONT color=#0000d0>LEA</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-14C]<BR>00B75CFA50<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EAX</FONT><BR>00B75CFBFF15BC62B900<FONT color=#0000d0>CALL</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[B962BC]<FONT color=#008000>;kernel32.LoadLibraryA</FONT><BR>00B75D018B0DAC40BA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>ECX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA40AC]<BR>00B75D0789040E<FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>ESI</FONT>+<FONT color=#ff0000>ECX</FONT>],<FONT color=#ff0000>EAX</FONT><BR>00B75D0AA1AC40BA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA40AC]<BR>00B75D0F391C06<FONT color=#0000d0>CMP</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>ESI</FONT>+<FONT color=#ff0000>EAX</FONT>],<FONT color=#ff0000>EBX</FONT><BR>00B75D120F842F010000<FONT color=#0000d0>JE</FONT>00B75E47<FONT color=#008000>;MagicJump改JE为JMP避开IAT加密</FONT><BR>00B75D1833C9<FONT color=#0000d0>XOR</FONT><FONT color=#ff0000>ECX</FONT>,<FONT color=#ff0000>ECX</FONT><BR>00B75D1A8B07<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EDI</FONT>]<BR>00B75D1C3918<FONT color=#0000d0>CMP</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>],<FONT color=#ff0000>EBX</FONT><BR>00B75D1E7406<FONT color=#0000d0>JE</FONT>SHORT00B75D26<BR>00B75D2041<FONT color=#0000d0>INC</FONT><FONT color=#ff0000>ECX</FONT><BR>00B75D2183C00C<FONT color=#0000d0>ADD</FONT><FONT color=#ff0000>EAX</FONT>,0C<BR>00B75D24^EBF6<FONT color=#0000d0>JMP</FONT>SHORT00B75D1C<BR><BR><FONT color=#008000>把00B75D12这句的JE00B75E47改成JMP00B75E47</FONT><BR><BR>2<FONT color=#008000>获得重定位信息</FONT><BR><BR><FONT color=#008000>下断点bpGetTickCount，Shift+F9运行中断后，注意看堆栈：</FONT><BR><BR>0006937000B8C009/<FONT color=#0000d0>CALL</FONT><FONT color=#008000>到GetTickCount来自00B8C003</FONT><BR><BR>0006937000B8C3C8/<FONT color=#0000d0>CALL</FONT><FONT color=#008000>到GetTickCount来自00B8C3C2;★注意！在这里清除断点后Alt+F9返回程序</FONT><BR><BR><BR>00B8C3C82B85A4D4FFFF<FONT color=#0000d0>SUB</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-2B5C]<FONT color=#008000>;返回到这里</FONT><BR>00B8C3CE8B8DA8D4FFFF<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>ECX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-2B58]<BR>00B8C3D46BC932<FONT color=#0000d0>IMUL</FONT><FONT color=#ff0000>ECX</FONT>,<FONT color=#ff0000>ECX</FONT>,32<BR>00B8C3D781C1D0070000<FONT color=#0000d0>ADD</FONT><FONT color=#ff0000>ECX</FONT>,7D0<BR>00B8C3DD3BC1<FONT color=#0000d0>CMP</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#ff0000>ECX</FONT><BR>00B8C3DF7607<FONT color=#0000d0>JBE</FONT>SHORT00B8C3E8<BR>00B8C3E1C68534D9FFFF0><FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>BYTE</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-26CC],1<BR>00B8C3E883BDE4D7FFFF0><FONT color=#0000d0>CMP</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-281C],0<BR>00B8C3EF0F858A000000<FONT color=#0000d0>JNZ</FONT>00B8C47F<BR><BR><FONT color=#008000>在CPU窗口按Ctrl+S查找如下代码</FONT><BR><BR><FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EAX</FONT><BR><FONT color=#0000d0>XCHG</FONT><FONT color=#ff0000>CX</FONT>,<FONT color=#ff0000>CX</FONT><BR><FONT color=#0000d0>POP</FONT><FONT color=#ff0000>EAX</FONT><BR><FONT color=#0000d0>STC</FONT><BR><BR><FONT color=#008000>找到代码如下：</FONT><BR><BR>00B8CF5450<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EAX</FONT><BR>00B8CF5566:87C9<FONT color=#0000d0>XCHG</FONT><FONT color=#ff0000>CX</FONT>,<FONT color=#ff0000>CX</FONT><BR>00B8CF5858<FONT color=#0000d0>POP</FONT><FONT color=#ff0000>EAX</FONT><BR>00B8CF59F9<FONT color=#0000d0>STC</FONT><BR><BR><FONT color=#008000>我们在00B8CF54行按F2设置断点，然后F9执行后取消断点到这里后窗口里出现了红色代码</FONT><BR><BR>00B8CF59C705E0C0B9006><FONT color=#008000>;MOVDWORDPTRDS:[B9C0E0],0B9CB60;★从这里开始出现红色代码</FONT><BR>00B8CF63A1E49FBA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA9FE4]<BR>00B8CF688B00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>]<FONT color=#008000>;★这个00006000就是重定位表的RVA</FONT><BR>00B8CF6A89853CD9FFFF<FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-26C4],<FONT color=#ff0000>EAX</FONT><BR>00B8CF70A1E49FBA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA9FE4]<BR>00B8CF7583C004<FONT color=#0000d0>ADD</FONT><FONT color=#ff0000>EAX</FONT>,4<BR>00B8CF78A3E49FBA00<FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA9FE4],<FONT color=#ff0000>EAX</FONT><BR>00B8CF7DA1E49FBA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA9FE4]<BR>00B8CF828B00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>]<FONT color=#008000>;★这个000003B0就是重定位表的大小</FONT><BR>00B8CF84898578D9FFFF<FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-2688],<FONT color=#ff0000>EAX</FONT><BR>00B8CF8AA1E49FBA00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA9FE4]<BR>00B8CF8F83C004<FONT color=#0000d0>ADD</FONT><FONT color=#ff0000>EAX</FONT>,4<BR>00B8CF92A3E49FBA00<FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[BA9FE4],<FONT color=#ff0000>EAX</FONT><BR>00B8CF9783BD3CD9FFFF0><FONT color=#0000d0>CMP</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-26C4],0<FONT color=#008000>;★重定位表的RVA为0吗？</FONT><BR>00B8CF9E746F<FONT color=#0000d0>JE</FONT>SHORT00B8D00F<FONT color=#008000>;★为0则重定位处理</FONT><BR>00B8CFA083BD78D9FFFF0><FONT color=#0000d0>CMP</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-2688],0<FONT color=#008000>;★重定位表的大小为0吗？</FONT><BR>00B8CFA77466<FONT color=#0000d0>JE</FONT>SHORT00B8D00F<FONT color=#008000>;★为0则重定位处理</FONT><BR>00B8CFA98B85FCD7FFFF<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-2804]<BR>00B8CFAF8B8D0CD8FFFF<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>ECX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-27F4]<BR>00B8CFB53B4834<FONT color=#0000d0>CMP</FONT><FONT color=#ff0000>ECX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>+34]<BR>00B8CFB87455<FONT color=#0000d0>JE</FONT>SHORT00B8D00F<FONT color=#008000>;★如与映像基址不符则重定位处理！</FONT><BR>00B8CFBAFFB578D9FFFF<FONT color=#0000d0>PUSH</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-2688]<BR>00B8CFC08B850CD8FFFF<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-27F4]<BR>00B8CFC603853CD9FFFF<FONT color=#0000d0>ADD</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-26C4]<BR>00B8CFCC50<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EAX</FONT><BR>00B8CFCD8B85FCD7FFFF<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-2804]<BR>00B8CFD3FF7034<FONT color=#0000d0>PUSH</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>+34]<BR>00B8CFD6FFB50CD8FFFF<FONT color=#0000d0>PUSH</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>-27F4]<BR>00B8CFDCE83C150000<FONT color=#0000d0>CALL</FONT>00B8E51D<FONT color=#008000>;★重定位处理CALL</FONT><BR>00B8CFE183C410<FONT color=#0000d0>ADD</FONT><FONT color=#ff0000>ESP</FONT>,10<BR>00B8CFE40FB6C0<FONT color=#0000d0>MOVZX</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#ff0000>AL</FONT><BR>00B8CFE785C0<FONT color=#0000d0>TEST</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#ff0000>EAX</FONT><BR>00B8CFE97524<FONT color=#0000d0>JNZ</FONT>SHORT00B8D00F<BR>00B8CFEB8B4508<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>+8]<BR>00B8CFEE8B00<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>]<BR>00B8CFF0C70007000000<FONT color=#0000d0>MOV</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>],7<BR>00B8CFF66850CBB900<FONT color=#0000d0>PUSH</FONT>0B9CB50<FONT color=#008000>;ASCII"LocationCPG"</FONT><BR>00B8CFFB8B4508<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>+8]<BR>00B8CFFEFF7004<FONT color=#0000d0>PUSH</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[<FONT color=#ff0000>EAX</FONT>+4]<BR>00B8D001E824800000<FONT color=#0000d0>CALL</FONT>00B9502A<FONT color=#008000>;JMP到msvcrt.strcpy</FONT><BR>00B8D00659<FONT color=#0000d0>POP</FONT><FONT color=#ff0000>ECX</FONT><BR>00B8D00759<FONT color=#0000d0>POP</FONT><FONT color=#ff0000>ECX</FONT><BR>00B8D00833C0<FONT color=#0000d0>XOR</FONT><FONT color=#ff0000>EAX</FONT>,<FONT color=#ff0000>EAX</FONT><BR>00B8D00AE9A5070000<FONT color=#0000d0>JMP</FONT>00B8D7B4<BR><BR><FONT color=#008000>我们把00B8CFB8的JE00B8D00F改成JMP00B8D00F跳过重定位处理，这样就不需要修改DLL的基址了，否则修改基址为OEP处看到的基址，如这里为00870000</FONT><BR><BR><FONT color=#008000>现在我们Alt+M打开内存查看窗口，看到这个DLL的给个区段</FONT><BR><BR>0087000000001000EdrLibPE<FONT color=#008000>文件头ImagRRWE</FONT><BR>0087100000003000EdrLib.textImagRRWE<BR>0087400000001000EdrLib.rdata<FONT color=#008000>输出表ImagRRWE</FONT><BR>0087500000001000EdrLib<FONT color=#b000b0>.data</FONT><FONT color=#008000>数据ImagRRWE</FONT><BR>0087600000001000EdrLib.relocImagRRWE<BR>0087700000040000EdrLib.text1<FONT color=#008000>代码ImagRRWE</FONT><BR>008B700000010000EdrLib.adata<FONT color=#008000>代码ImagRRWE</FONT><BR>008C700000010000EdrLib.data1ImagRRWE<BR>008D700000010000EdrLib.reloc1<FONT color=#008000>重定位ImagRRWE</FONT><BR>008E700000030000EdrLib.pdata<FONT color=#008000>输入表ImagRRWE</FONT><BR><BR><FONT color=#008000>在0087100000003000EdrLib.text★这里设置内存访问断点F9运行，中断在OEP</FONT><BR><BR>008711C955<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EBP</FONT><FONT color=#008000>;等待已久的OEP终于出现了</FONT><BR>008711CA8BEC<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EBP</FONT>,<FONT color=#ff0000>ESP</FONT><BR>008711CC53<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EBX</FONT><BR>008711CD8B5D08<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EBX</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>+8]<BR>008711D056<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>ESI</FONT><BR>008711D18B750C<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>ESI</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>+C]<BR>008711D457<FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EDI</FONT><BR>008711D58B7D10<FONT color=#0000d0>MOV</FONT><FONT color=#ff0000>EDI</FONT>,<FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>SS</FONT>:[<FONT color=#ff0000>EBP</FONT>+10]<BR>008711D885F6<FONT color=#0000d0>TEST</FONT><FONT color=#ff0000>ESI</FONT>,<FONT color=#ff0000>ESI</FONT><BR>008711DA7509<FONT color=#0000d0>JNZ</FONT>SHORTEdrLib.008711E5<BR><BR><FONT color=#008000>用LordPE选中Ollydbg的loaddll.exe的进程，在下面的列表里选择EdrLib.dll，然后完整脱壳，得到dumped.dll。</FONT><BR><BR><FONT color=#008000>我们用LordPE打开dumped.dll到目录中修改重定位:RVA=6000大小=3B0然后保存修改</FONT><BR><BR>3<FONT color=#008000>搞定输入表</FONT><BR><BR><FONT color=#008000>因为已经修改了MagicJump，所以现在可以得到完整的输入表。随便从程序找个API调用：</FONT><BR><BR>00871383FF1524404000<FONT color=#0000d0>CALL</FONT><FONT color=#b000b0>DWORD</FONT><FONT color=#b000b0>PTR</FONT><FONT color=#ff0000>DS</FONT>:[404024]<BR><BR><FONT color=#008000>由于我们刚才已经跳过了重定位处理所以这里是未经过重定位处理的地址</FONT><BR><FONT color=#008000>我们在命令行里输入D874024上下看到许多函数地址，很明显的可以找到IAT开始和结束的地址：</FONT><BR><BR>00874024A2CA817C161E807C0DE0807C3797807C...|...|...|7..|<BR>00874034F59B807C0F2B817C5334817C5097807C...|.+.|S4.|P..|<BR>00874044CFC6807CA92C817C6910817CEE1E807C...|?.|i..|...|<BR>008740548A18937C57B3807C3FDC817CE0C6807C...|W..|?..|...|<BR><BR><FONT color=#008000>我们在数据窗口中用长型地址的方式显示数据将看到许多函数</FONT><BR><BR>008740247C81CAA2kernel32.ExitProcess<BR>008740287C801E16kernel32.TerminateProcess<BR>0087402C7C80E00Dkernel32.GetCurrentProcess<BR>008740307C809737kernel32.GetCurrentThreadId<BR>008740347C809BF5kernel32.TlsSetValue<BR>008740387C812B0Fkernel32.TlsAlloc<BR>0087403C7C813453kernel32.TlsFree<BR>008740407C809750kernel32.TlsGetValue<BR>008740447C80C6CFkernel32.SetHandleCount<BR>008740487C812CA9kernel32.GetStdHandle<BR>0087404C7C811069kernel32.GetFileType<BR>008740507C801EEEkernel32.GetStartupInfoA<BR><BR><FONT color=#008000>现在上下滚动窗口就可以很容易的找到IAT的开始和结束的地址</FONT><BR><BR><FONT color=#008000>开始地址＝00874000</FONT><BR><FONT color=#008000>结束地址＝008740CB</FONT><BR><BR><FONT color=#008000>但是现在直接用ImportREC选取EdrLib.dll,填入RVA=00004000、大小＝CB，却提示“不能载入当前进程相关数据信息!”</FONT><BR><FONT color=#008000>看看ImportREC的日志：</FONT><BR><FONT color=#008000>映像基地址:00400000大小:00097000</FONT><BR>->><FONT color=#008000>模块被选择!:e:\试炼场\脱壳学习\dll脱壳\armadillo\edrlib.dll\edrlib.dll</FONT><BR><FONT color=#008000>原来ImportREC显示EdrLib.dll的基址还是00400000，呵呵</FONT><BR><BR><FONT color=#008000>如果填入RVA=00474000、大小＝CB，可以得到输入表，却无法完成修复抓取文件。为何？都是重定位惹的祸啦。</FONT><BR><FONT color=#008000>于是利用FLY大狭的移花接木的办法：再打开一个Ollydbg，载入Win98的NotePad.EXE，然后把00874000－008740CB的数据复制、粘贴进NotePad.EXE的00404000－004040CB，然后用ImportREC选择NotePad.EXE进程，填入RVA=00004000、大小＝CB，得到输入表，CUT掉垃圾指针，改OEP=000011C9，就可以FixDump啦！</FONT><BR><BR><FONT color=#008000>三善后工作</FONT><BR><BR>1<FONT color=#008000>优化</FONT><BR><BR><FONT color=#008000>用LordPE删除dumped_.dll的text1、adata、data1、reloc1、pdata共5个区段，然后去掉“转存修正”和“清除重定位表”选项，重建PE简单优化一下脱壳后的文件，672K->16.9K，比加壳前的原文件还小了。</FONT><BR><BR>2<FONT color=#008000>修复查壳显示错误</FONT><BR><BR><FONT color=#008000>脱壳后的DLL用PEiD看依旧显示“Armadillo2.51-3.xxDLLStub->SiliconRealmsToolworks”，用FI看显示“MSVC++v6.0{DLL}”。用PETools打开dumped_.dll在可选头部中修改主连接器版本为06副连接器版本00，现在再用PEiD查看显示为：MicrosoftVisualC++6.0DLL</FONT><BR><BR>3<FONT color=#008000>测试脱壳文件</FONT><BR><BR><FONT color=#008000>把dumped_.dll名字改成EdrLib.dll然后运行EdrTest.exe看是否正确调用脱壳后的DLL文件</FONT><BR><BR>--------------------------------------------------------------------------------<BR><FONT color=#008000>【脱壳总结】</FONT><BR><BR>Armadillov4.40<FONT color=#008000>这个版本的获得重定位信息的位置与以前的版本有点出入，我的获得方法是在修改了MagicJump后对00870000段设置内存访问断点中断1次后一步步手动跟踪后才发现用bpGetTickCount这个断点断2次后返回并F8单步向下走到下面这个特征码</FONT><BR><BR><FONT color=#0000d0>PUSH</FONT><FONT color=#ff0000>EAX</FONT><BR><FONT color=#0000d0>XCHG</FONT><FONT color=#ff0000>CX</FONT>,<FONT color=#ff0000>CX</FONT><BR><FONT color=#0000d0>POP</FONT><FONT color=#ff0000>EAX</FONT><BR><FONT color=#0000d0>STC</FONT><BR><BR><FONT color=#008000>这里教大家一个判断重定位位置和大小的方法。不知道是否通用。</FONT><BR><BR><FONT color=#008000>我们可以把DUMP后的文件用LoadPE打开。然后在区段里查看reloc的VOffset来确定重定位的RAV，然后在目录->重定位里点"H"按钮。把从6000开始到后面全是00000000的这段全部选中后看状态行提示的大小就可以了。</FONT><BR><BR>--------------------------------------------------------------------------------<BR><FONT color=#008000>【版权声明】本文纯属技术交流,转载请注明作者并保持文章的完整,谢谢!</FONT></FONT><BR></P>
页:
[1]