aspack的脱壳 -电脑资料

1. 完全解析各个程序部分的功能以及脱壳关键点;

2. 指出还原文件的大小的关键数据地址;

其实没有必要写了, aspack的壳就那么简单, 没有seh, 没有anti

分析按照程序流程来, 可以顺着顺序看

====================================================

01010001> 60 pushad

01010002 e8 03000000 call notepad.0101000a

01010007 e9 db e9 <========花指令

01010008 eb 04 jmp short notepad.0101000e

0101000a 5d pop ebp

0101000b 45 inc ebp

0101000c 55 push ebp

0101000d c3 retn

0101000e e8 01000000 call notepad.01010014

01010013 eb db eb <========花指令

01010014 5d pop ebp

01010015 bb edffffff mov ebx,-13

0101001a 03dd add ebx,ebp

0101001c 81eb 00000100 sub ebx,10000

01010022 83bd 22040000 >cmp [dword ss:ebp+422],0

01010029 899d 22040000 mov [dword ss:ebp+422],ebx<=========保存imagebase, 后面会用到的

0101002f 0f85 65030000 jnz notepad.0101039a

01010035 8d85 2e040000 lea eax,[dword ss:ebp+42e]

0101003b 50 push eax

0101003c ff95 4d0f0000 call [dword ss:ebp+f4d]<===getmodulehandlea('kernel32.dll')

01010042 8985 26040000

01010048 8bf8 mov edi,eax

0101004a 8d5d 5e lea ebx,[dword ss:ebp+5e]

0101004d 53 push ebx

0101004e 50 push eax

0101004f ff95 490f0000 call [dword ss:ebp+f49]<===getprocaddress(hkernel,'virtualalloc');

01010055 8985 4d050000 mov [dword ss:ebp+54d],eax

0101005b 8d5d 6b lea ebx,[dword ss:ebp+6b]

0101005e 53 push ebx

0101005f 57 push edi

01010060 ff95 490f0000 call [dword ss:ebp+f49]<===getprocaddress(hkernel,'virtualfree');

01010066 8985 51050000 mov [dword ss:ebp+551],eax

0101006c 8d45 77 lea eax,[dword ss:ebp+77]

0101006f ffe0 jmp eax

0101008a 8b9d 31050000 mov ebx,[dword ss:ebp+531]

01010090 0bdb or ebx,ebx

01010092 74 0a je short notepad.0101009e

01010094 8b03 mov eax,[dword ds:ebx]

01010096 8785 35050000 xchg [dword ss:ebp+535],eax

0101009c 8903 mov [dword ds:ebx],eax

0101009e 8db5 69050000 lea esi,[dword ss:ebp+569]

010100a4 833e 00 cmp [dword ds:esi],0<=======这个地方是比较重要的数据

<==============================是还原文件源大小的重要数据

<=====================================数据格式为:

<=================================rva (相对虚拟地址)

<==============================size(解码后的大小, 也就是物理大小)

<=========================这是在还原原大小时可以用到, 否则也没用

010100a7 0f84 21010000 je notepad.010101ce

010100ad 6a 04 push 4

010100af 68 00100000 push 1000

010100b4 68 00180000 push 1800

010100b9 6a 00 push 0

010100bb ff95 4d050000 call [dword ss:ebp+54d]====>分配解码缓冲区

010100c1 8985 56010000 mov [dword ss:ebp+156],eax

010100c7 8b46 04 mov eax,[dword ds:esi+4]

010100ca 05 0e010000 add eax,10e

010100cf 6a 04 push 4

010100d1 68 00100000 push 1000

010100d6 50 push eax

010100d7 6a 00 push 0

010100d9 ff95 4d050000 call [dword ss:ebp+54d]====>分配输出缓冲区

010100df 8985 52010000 mov [dword ss:ebp+152],eax

010100e5 56 push esi

010100e6 8b1e mov ebx,[dword ds:esi]

010100e8 039d 22040000 add ebx,[dword ss:ebp+422]

010100ee ffb5 56010000 push [dword ss:ebp+156]

010100f4 ff76 04 push [dword ds:esi+4]

010100f7 50 push eax

010100f8 53 push ebx

010100f9 e8 6e050000 call notepad.0101066c<===

==解码数据decode(outbuf,inbuf,size,buf)

<======================使用的aplib的解码库

010100fe b3 00 mov bl,0

01010100 80fb 00 cmp bl,0

01010103 75 5e jnz short notepad.01010163<===是否为第一次解码

01010105 fe85 ec000000 inc [byte ss:ebp+ec]

0101010b 8b3e mov edi,[dword ds:esi]

0101010d 03bd 22040000 add edi,[dword ss:ebp+422]

01010113 ff37 push [dword ds:edi]

01010115 c607 c3 mov [byte ds:edi],0c3

01010118 ffd7 call edi

0101011a 8f07 pop [dword ds:edi]

0101011c 50 push eax

0101011d 51 push ecx

0101011e 56 push esi

0101011f 53 push ebx

01010120 8bc8 mov ecx,eax

01010122 83e9 06 sub ecx,6

01010125 8bb5 52010000 mov esi,[dword ss:ebp+152]

0101012b 33db xor ebx,ebx

0101012d 0bc9 or ecx,ecx

0101012f 74 2e je short notepad.0101015f

01010131 78 2c js short notepad.0101015f

01010133 ac lods [byte ds:esi]

01010134 3c e8 cmp al,0e8

01010136 74 0a je short notepad.01010142

01010138 eb 00 jmp short notepad.0101013a

0101013a 3c e9 cmp al,0e9

0101013c 74 04 je short notepad.01010142

0101013e 43 inc ebx

0101013f 49 dec ecx

01010140 ^eb eb jmp short notepad.0101012d

01010142 8b06 mov eax,[dword ds:esi]

01010144 eb 00 jmp short notepad.01010146

01010146 803e 07 cmp [byte ds:esi],7

01010149 ^75 f3 jnz short notepad.0101013e

0101014b 24 00 and al,0

0101014d c1c0 18 rol eax,18

01010150 2bc3 sub eax,ebx

01010152 8906 mov [dword ds:esi],eax

01010154 83c3 05 add ebx,5

01010157 83c6 04 add esi,4

0101015a 83e9 05 sub ecx,5

0101015d ^eb ce jmp short notepad.0101012d

0101015f 5b pop ebx

01010160 5e pop esi

01010161 59 pop ecx

01010162 58 pop eax

01010163 eb 08 jmp short notepad.0101016d

0101016d 8bc8 mov ecx,eax

0101016f 8b3e mov edi,[dword ds:esi]

01010171 03bd 22040000 add edi,[dword ss:ebp+422]

01010177 8bb5 52010000 mov esi,[dword ss:ebp+152]

0101017d c1f9 02 sar ecx,2

01010180 f3:a5 rep movs [dword es:edi],[dword ds:esi]<====将解码后的数据写回

01010182 8bc8 mov ecx,eax

01010184 83e1 03 and ecx,3

01010187 f3:a4 rep movs [byte es:edi],[byte ds:esi]<====将解码后的数据写回

01010189 5e pop esi

0101018a 68 00800000 push 8000

0101018f 6a 00 push 0

01010191 ffb5 52010000 push [dword ss:ebp+152]

01010197 ff95 51050000 call [dword ss:ebp+551]<====释放输出缓冲区

0101019d 83c6 08 add esi,8

010101a0 833e 00 cmp [dword ds:esi],0<=======esi重要数据哟!

010101a3 ^0f85 1effffff jnz notepad.010100c7<=======循环解码

010101a9 68 00800000 push 8000

010101ae 6a 00 push 0

010101b0 ffb5 56010000 push [dword ss:ebp+156]

010101b6 ff95 51050000 call [dword ss:ebp+551]<====释放解码缓冲区

010101bc 8b9d 31050000 mov ebx,[dword ss:ebp+531]

010101c2 0bdb or ebx,ebx

010101c4 74 08 je short notepad.010101ce

010101c6 8b03 mov eax,[dword ds:ebx]

010101c8 8785 35050000 xchg [dword ss:ebp+535],eax

010101ce 8b95 22040000 mov edx,[dword ss:ebp+422]

010101d4 8b85 2d050000 mov eax,[dword ss:ebp+52d]

010101da 2bd0 sub edx,eax

010101dc 74 79 je short notepad.01010257

<=======================下面这一段不知道干什么的, 到如今还没执行过=========>

010101de 8bc2 mov eax,edx

010101e0 c1e8 10 shr eax,10

010101e3 33db xor ebx,ebx

010101e5 8bb5 39050000 mov esi,[dword ss:ebp+539]

010101eb 03b5 22040000 add esi,[dword ss:ebp+422]

010101f1 833e 00 cmp [dword ds:esi],0

010101f4 74 61 je short notepad.01010257

010101f6 8b4e 04 mov ecx,[dword ds:esi+4]

010101f9 83e9 08 sub ecx,8

010101fc d1e9 shr ecx,1

010101fe 8b3e mov edi,[dword ds:esi]

01010200 03bd 22040000 add edi,[dword ss:ebp+422]

01010206 83c6 08 add esi,8

01010209 66:8b1e mov bx,[word ds:esi]

0101020c c1eb 0c shr ebx,0c

0101020f 83fb 01 cmp ebx,1

01010212 74 0c je short notepad.01010220

01010214 83fb 02 cmp ebx,2

01010217 74 16 je short notepad.0101022f

01010219 83fb 03 cmp ebx,3

0101021c 74 20 je short notepad.0101023e

0101021e eb 2c jmp short notepad.0101024c

01010220 66:8b1e mov bx,[word ds:esi]

01010223 81e3 ff0f0000 and ebx,0fff

01010229 66:01041f add [word ds:edi+ebx],ax

0101022d eb 1d jmp short notepad.0101024c

0101022f 66:8b1e mov bx,[word ds:esi]

01010232 81e3 ff0f0000 and ebx,0fff

01010238 66:01141f add [word ds:edi+ebx],dx

0101023c eb 0e jmp short notepad.0101024c

0101023e 66:8b1e mov bx,[word ds:esi]

01010241 81e3 ff0f0000 and ebx,0fff

01010247 01141f add [dword ds:edi+ebx],edx

0101024a eb 00 jmp short notepad.0101024c

0101024c 66:830e ff or [word ds:esi],0ffff

01010250 83c6 02 add esi,2

01010253 ^e2 b4 loopd short notepad.01010209

01010255 ^eb 9a jmp short notepad.010101f1

01010257 8b95 22040000 mov edx,[dword ss:ebp+422]

0101025d 8bb5 41050000 mov esi,[dword ss:ebp+541]

01010263 0bf6 or esi,esi

01010265 74 11 je short notepad.01010278

01010267 03f2 add esi,edx

01010269 ad lods [dword ds:esi]

0101026a 0bc0 or eax,eax

0101026c 74 0a je short notepad.01010278

0101026e 03c2 add eax,edx

01010270 8bf8 mov edi,eax

01010272 66:ad lods [word ds:esi]

01010274 66:ab stos [word es:edi]

01010276 ^eb f1 jmp short notepad.01010269

01010278 be 50660000 mov esi,6650<===============import table

<========================这个是原始导入表的入口

<========================在程序入口的这个偏移, 肯定没错

<========================乘现在导入表还没覆盖dumper之

0101027d 8b95 22040000 mov edx,[dword ss:ebp+422]

01010283 03f2 add esi,edx

01010285 8b46 0c mov eax,[dword ds:esi+c]

01010288 85c0 test eax,eax

0101028a 0f84 0a010000 je notepad.0101039a

01010290 03c2 add eax,edx

01010292 8bd8 mov ebx,eax

01010294 50 push eax

01010295 ff95 4d0f0000 call [dword ss:ebp+f4d]

0101029b 85c0 test eax,eax

0101029d 75 07 jnz short notepad.010102a6

0101029f 53 push ebx

010102a0 ff95 510f0000 call [dword ss:ebp+f51]

010102a6 8985 45050000 mov [dword ss:ebp+545],eax

010102ac c785 49050000 >mov [dword ss:ebp+549],0

010102b6 8b95 22040000 mov edx,[dword ss:ebp+422]

010102bc 8b06 mov eax,[dword ds:esi]

010102be 85c0 test eax,eax

010102c0 75 03 jnz short notepad.010102c5

010102c2 8b46 10 mov eax,[dword ds:esi+10]

010102c5 03c2 add eax,edx

010102c7 0385 49050000 add eax,[dword ss:ebp+549]

010102cd 8b18 mov ebx,[dword ds:eax]

010102cf 8b7e 10 mov edi,[dword ds:esi+10]

010102d2 03fa add edi,edx

010102d4 03bd 49050000 add edi,[dword ss:ebp+549]

010102da 85db test ebx,ebx

010102dc 0f84 a2000000 je notepad.01010384

010102e2 f7c3 00000080 test ebx,80000000

010102e8 75 04 jnz short notepad.010102ee

010102ea 03da add ebx,edx

010102ec 43 inc ebx

010102ed 43 inc ebx

010102ee 53 push ebx

010102ef 81e3 ffffff7f and ebx,7fffffff

010102f5 53 push ebx

010102f6 ffb5 45050000 push [dword ss:ebp+545]

010102fc ff95 490f0000 call [dword ss:ebp+f49]

01010302 85c0 test eax,eax

01010304 5b pop ebx

01010305 75 6f jnz short notepad.01010376

01010307 f7c3 00000080 test ebx,80000000

0101030d 75 19 jnz short notepad.01010328

0101030f 57 push edi

01010310 8b46 0c mov eax,[dword ds:esi+c]

01010313 0385 22040000 add eax,[dword ss:ebp+422]

01010319 50 push eax

0101031a 53 push ebx

0101031b 8d85 75040000 lea eax,[dword ss:ebp+475]

01010321 50 push eax

01010322 57 push edi

01010323 e9 98000000 jmp notepad.010103c0

01010328 81e3 ffffff7f and ebx,7fffffff

0101032e 8b85 26040000 mov eax,[dword ss:ebp+426]

01010334 3985 45050000 cmp [dword ss:ebp+545],eax

0101033a 75 24 jnz short notepad.01010360

0101033c 57 push edi

0101033d 8bd3 mov edx,ebx

0101033f 4a dec edx

01010340 c1e2 02 shl edx,2

01010343 8b9d 45050000 mov ebx,[dword ss:ebp+545]

01010349 8b7b 3c mov edi,[dword ds:ebx+3c]

0101034c 8b7c3b 78 mov edi,[dword ds:ebx+edi+78]

01010350 035c3b 1c add ebx,[dword ds:ebx+edi+1c]

01010354 8b0413 mov eax,[dword ds:ebx+edx]

01010357 0385 45050000 add eax,[dword ss:ebp+545]

0101035d 5f pop edi

0101035e eb 16 jmp short notepad.01010376

01010360 57 push edi

01010361 8b46 0c mov eax,[dword ds:esi+c]

01010364 0385 22040000 add eax,[dword ss:ebp+422]

0101036a 50 push eax

0101036b 53 push ebx

0101036c 8d85 c6040000 lea eax,[dword ss:ebp+4c6]

01010372 50 push eax

01010373 57 push edi

01010374 eb 4a jmp short notepa

01010374 eb 4a jmp short notepad.010103c0

01010376 8907 mov [dword ds:edi],eax

01010378 8385 49050000 >add [dword ss:ebp+549],4

0101037f ^e9 32ffffff jmp notepad.010102b6

01010384 8906 mov [dword ds:esi],eax

01010386 8946 0c mov [dword ds:esi+c],eax

01010389 8946 10 mov [dword ds:esi+10],eax

0101038c 83c6 14 add esi,14

0101038f 8b95 22040000 mov edx,[dword ss:ebp+422]

01010395 ^e9 ebfeffff jmp notepad.01010285

0101039a b8 20640000 mov eax,6420

<========================这个是原始程序的入口, 也就是oep了

<========================在程序入口的这个偏移, 肯定没错

<========================好了, 到此你已经没事了, 唯一需要的就是修复导入表入口和ep了

0101039f 50 push eax

010103a0 0385 22040000 add eax,[dword ss:ebp+422]<====修改oep的rva程va

010103a6 59 pop ecx

010103a7 0bc9 or ecx,ecx

010103a9 8985 a8030000 mov [dword ss:ebp+3a8],eax<====+写入

010103af 61 popad +

010103b0 75 08 jnz short notepad.010103ba +

010103b2 b8 01000000 mov eax,1 +

010103b7 c2 0c00 retn 0c +

010103ba 68 00000000 push 0=========================+

010103bf c3 retn<==========================返回原始程序

=====================================

enjoy it:)

diken/ipb

====================================================

我相信, 看了这篇文章, 你应该会了aspack的脱壳了.

关于完全修复, 我就不做赘述, 精通pe结构的人可以修复, 新手没有必要修复了

==================================================

结束语:

标准aspack的壳, 就这样简单. 都是这样, 要还原成原样也没问题，

aspack的脱壳

电脑资料

telock的壳, 也使用了aplib作为其压缩引擎, 不过它有一次加密/解密

upx也使用了aplib这个压缩引擎.

aplib引擎, 以前的版本没有了.