[UnpackMe+CrackMe] 自写变异壳+本地验证 请各位老师实验
自写了个壳 【SinBox Protect】 ， 带有些许花指令和变异加密函数代码，然后加了个本地验证给大佬们实验由于没怎么写VJCC架构，所以就不让大佬写逆向版咋的了，很简单，想要看看能不能把壳脱掉（把区段删掉可以运行为准！）
哈勃查毒结果链接：https://habo.qq.com/file/showdetail?pk=ADcGbl1vB24IOVs4U2Q%3D#baseinfo
本帖最后由 ssjjdns 于 2022-6-16 18:45 编辑
简单分析了一下汇编指令的立即数被存放到了倒数第二个区段里,然后调用的时候多了一步: 从区段里取出来使用
即原来指令 push 0x12345678
混淆后 push [倒数第二个区段的内存地址+偏移x]
这样就可以取出使用了。call 指令也是被这样处理了
考虑到
这个倒数第二个区段会在0052CE44的地方完全解密
脱壳的话 只需要从0052CE44 这里dump出来
然后OEP设置为0052CE44即可
总结:难度不是很大。根据壳的算法还原,楼主的壳只支持易语言，不支持DLL，不支持多线程，不支持主流VS CODE 编译出来的C++以及C
楼主应该参考了我的帖子来写的这个壳
附上被混淆的代码 的还原:【没处理间接寻址】
004BC374EB06 jmp short 0x8
00000002FF158E520000 call
004BC543EB06 jmp short 0x8
00000002FF15EF080000 call
004BC73CEB06 jmp short 0x8
00000002FF1596560000 call
004BD271EB06 jmp short 0x8
00000002FF2576430000 jmp
004BD34AEB06 jmp short 0x8
00000002FF252C5D0000 jmp
004BD4E06841F54500 push dword 0x45f541
00000005C3 ret
004BD4F9EB06 jmp short 0x8
00000002FF25FB370000 jmp
004BE176FF1510B04B00 call
004BED2E89EC mov esp,ebp
004BF3295D pop ebp
004BFA6FC3 ret
004C1053FF3518B04B00 push dword
004C28E4FF3520B04B00 push dword
004C41DAFF3528B04B00 push dword
004C54C7FF3530B04B00 push dword
004C6D45FF1538B04B00 call
004C8383032540B04B00 add esp,
004C8E858945F4 mov ,eax
004C99A9FF3548B04B00 push dword
004CADC7FF3550B04B00 push dword
004CBFBA8B45F4 mov eax,
004CC8CB85C0 test eax,eax
004CD24C0F8568190000 jnz near 0x196e
004CE3DBA158B04B00 mov eax,
004CF57250 push eax
004D092CFF3560B04B00 push dword
004D24D88B1D68B04B00 mov ebx,
004D3CC4FF1570B04B00 call
004D504F032578B04B00 add esp,
004D5DBD8945F0 mov ,eax
004D68FD8B5DF4 mov ebx,
004D74F085DB test ebx,ebx
004D80E20F846D3C0000 jz near 0x3c73
004D8CD853 push ebx
004DA2C8FF1580B04B00 call
004DBB15032588B04B00 add esp,
004DC98C8B45F0 mov eax,
004DD5C68945FC mov ,eax
004DE2E2FF75FC push dword
004DF20BFF db 0xff
0000000115 db 0x15
004DF20EB04B mov al,0x4b
0000000200 db 0x00
004E02618945F8 mov ,eax
004E10C5817DF84A14A191 cmp dword ,0x91a1144a
004E1F310F85ACC40100 jnz near 0x1c4b2
004E2E4CFF75F8 push dword
004E4504FF1598B04B00 call
004E5BBF8945F0 mov ,eax
004E6C3E817DF0FE87ECD0 cmp dword ,0xd0ec87fe
004E7CC10F851C670100 jnz near 0x16722
004E99FC8B1DA0B04B00 mov ebx,
004EB9E9FF15A8B04B00 call
004ECFC2FF35B0B04B00 push dword
004EE83EFF35B8B04B00 push dword
004F047AFF35C0B04B00 push dword
004F2642FF35C8B04B00 push dword
004F480AFF35D0B04B00 push dword
004F640FFF35D8B04B00 push dword
004F7E34FF35E0B04B00 push dword
004F961D8B1DE8B04B00 mov ebx,
004FAD7FFF15F0B04B00 call
004FC9CE0325F8B04B00 add esp,
004FE3DEE9BF9E0100 jmp 0x19ec4
004FFD218B1D00B14B00 mov ebx,
00502013FF1508B14B00 call
005040B3FF3510B14B00 push dword
00506392FF3518B14B00 push dword
00508C85FF3520B14B00 push dword
0050ACE1FF3528B14B00 push dword
0050C9DCFF3530B14B00 push dword
0050EAA6FF3538B14B00 push dword
00510B44FF3540B14B00 push dword
00512ED98B1D48B14B00 mov ebx,
005157D2FF1550B14B00 call
00517D0B032558B14B00 add esp,
005198CC89EC mov esp,ebp
0051AF0E5D pop ebp
0051C54FC3 ret
0051E3BDDB4508 fild dword
0051E986DD5DF8 fstp qword
0051EFE1DD45F8 fld qword
0051F651DC0D13094800 fmul qword
0051FD34DD5DF0 fstp qword
0052041EDD45F0 fld qword
00520B31DC251B094800 fsub qword
00521251DD5DE8 fstp qword
00521996DD45E8 fld qword
005229CBFF1560B14B00 call
00523A03EB00 jmp short 0x2
0052420389EC mov esp,ebp
00524A035D pop ebp
0052520EC20400 ret 0x4
005260FCDB4508 fild dword
00526638DD5DF8 fstp qword
00526B74DD45F8 fld qword
005270B0DC0D23094800 fmul qword
0052766EDD5DF0 fstp qword
00527C69DD45F0 fld qword
00528264DC252B094800 fsub qword
00528862DD5DE8 fstp qword
00528E5DDD45E8 fld qword
00529DB7FF1568B14B00 call
0052AD2FEB00 jmp short 0x2
0052B35289EC mov esp,ebp
0052B9755D pop ebp
0052BF97C20400 ret 0x4
0052CE4455 push ebp
0052D49B89E5 mov ebp,esp
0052E09DFF3570B14B00 push dword
0052F83DFF3578B14B00 push dword
00530B96FF3580B14B00 push dword
0053135E64A153135E mov eax,
005319FA50 push eax
00532091648925532091 mov ,esp
00532F532B2588B14B00 sub esp,
00533E1453 push ebx
005344AB56 push esi
00534BFD57 push edi
005353EC8965E8 mov ,esp
00535C58FF153CF34700 call
005364C731D2 xor edx,edx
00536D3288E2 mov dl,ah
005375AF891510334B00 mov ,edx
00537E3C89C1 mov ecx,eax
005387D681E1FF000000 and ecx,0xff
005391DE890D0C334B00 mov ,ecx
00539C52C1E108 shl ecx,byte 0x8
0053A6C301D1 add ecx,edx
0053B1AE890D08334B00 mov ,ecx
0053BCA7C1E810 shr eax,byte 0x10
0053C7B3A304334B00 mov ,eax
0053D802FF db 0xff
0000000135 db 0x35
0053D805B14B mov cl,0x4b
0000000200 db 0x00
0053E9F6FF1598B14B00 call
0053F7C359 pop ecx
005403E785C0 test eax,eax
0054100C0F8576330000 jnz near 0x337c
005421D0FF35A0B14B00 push dword
00543565FF15A8B14B00 call
0054438759 pop ecx
00545094FF15B0B14B00 call
00545DA685C0 test eax,eax
00546A220F853B400000 jnz near 0x4041
005477CEFF35B8B14B00 push dword
005491ABFF15C0B14B00 call
0054AA6259 pop ecx
0054B8ED31F6 xor esi,esi
0054C7798975FC mov ,esi
0054E157FF15C8B14B00 call
0054FB38FF1558F34700 call
00550A30A3E4494B00 mov ,eax
00551B12FF15D0B14B00 call
00552BF5A380324B00 mov ,eax
00553CB0FF15D8B14B00 call
0055584EFF15E0B14B00 call
00557A92FF15E8B14B00 call
0055937D8975D0 mov ,esi
0055A8008D45A4 lea eax,
0055BC8350 push eax
0055D104FF15E8F24700 call
0055F115FF15F0B14B00 call
0056112689 db 0x89
0000000145 inc ebp
005625CEF645D001 test byte ,0x1
00563B720F84632B0000 jz near 0x2b69
005651250FB745D4 movzx eax,word
005666D6E95B3A0000 jmp 0x3a60
005683B1FF35F8B14B00 push dword
0056A13558 pop eax
0056B9B150 push eax
0056D236FF db 0xff
0000000175 db 0x75
0056EB2B56 push esi
0057041E56 push esi
00571D1FFF1528F34700 call
0057367950 push eax
0057548DFF1500B24B00 call
005772A68945A0 mov ,eax
00578C1750 push eax
0057A69CFF1508B24B00 call
0057C1448B45EC mov eax,
0057DB518B08 mov ecx,
0057F55D8B09 mov ecx,
00580FB4894D98 mov ,ecx
00582A0C50 push eax
0058446251 push ecx
0058685EFF1510B24B00 call
00588C5F59 pop ecx
0058A6FB59 pop ecx
0058C1FAC3 ret
楼主写的很好不加入StarrySky Team可惜了 ssjjdns 发表于 2022-6-16 18:35
简单分析了一下汇编指令的立即数被存放到了倒数第二个区段里,然后调用的时候多了一步: 从区段里取出来使用
...
大佬威武！ {:5_121:}我就是之前问你要nasm反汇编的那个人哈哈哈 没想到大佬来看我CM了 感谢感谢 ssjjdns 发表于 2022-6-16 18:35
简单分析了一下汇编指令的立即数被存放到了倒数第二个区段里,然后调用的时候多了一步: 从区段里取出来使用
...
我这个的特点就是
1.混淆库
2.指令变异
3.伪call
4.wow64转换检测
因为变异+多字节等价代换了指令 所以很多想要装逼的人 都不能完美的还原出来
页:
[1]