HyperSnap-DX 5.61 汉化版主程序脱壳--第一部分

HyperSnap-DX 5.61 汉化版主程序脱壳

HyperSnap-DX 5.61汉化版主程序是Armadillo 3.7以后的版本加的壳，
使用了Armadillo的双进程＋CC＋IAT变形＋时间效验，所以脱壳分二部分进行：

第一部分：代码的获得、OEP的获得以及修复IAT

1.双进程到单进程的转换

 �牰杂谒�进程到单进程的转换我还是使用ollyScript脚本进行，脚本如下：

代码:--------------------------------------------------------------------------------
；＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

/*
arm3.75版以后的从双进程到单进程转换的Script自动运行脚本
适用于ollyScript0.92，不要勾上OD异常中的〔忽略以下范围的异常〕 选项
by fxyang
*/

dbh�牐牐牐�//隐藏OD

var address

gpa "OpenMutexA","kernel32.dll"
bp $RESULT
run

eoe code_1
code_1:
mov address,eip��//获取第一次PREFIX LOCK:异常地址
esto

lbl3:
cmp eip,address�� //自动越过异常
ja begin
esto

begin:
  exec
 �� PUSHAD

网管下载dl.bitscn.com

 �� PUSH EDX
 �� push 0
 �� push 0
 �� CALL kernel32.CreateMutexA
 �� POPAD
 �� jmp kernel32.OpenMutexA
  ende
//上面的代码就是在Script中运行从双进程到单进程的转换
 �燽c $RESULT

lbl4:
  gpa "VirtualProtect","kernel32.dll"
  bp��$RESULT�牐牐牐�//对VirtualProtect函数下中断
 
esto
// 中断后继续
esto
 
esto
 
esto
 
esto
 
rtr
sto
rtr
sto
sto
sto
sto
sto
sto
sto
sto
sti
sti

pause
//綺过了上面的代码程序会停在壳的运行代码中

；＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

--------------------------------------------------------------------------------


程序停在这里：


代码:--------------------------------------------------------------------------------
00DEF065�燩USH EBP
00DEF066�燤OV EBP,ESP
00DEF068�燩USH EBX
00DEF069�燤OV EBX,DWORD PTR SS:[EBP+8]
00DEF06C�燩USH ESI
00DEF06D�燤OV ESI,DWORD PTR SS:[EBP+C]
00DEF070�燩USH EDI
00DEF071�燤OV EDI,DWORD PTR SS:[EBP+10]
00DEF074�燭EST ESI,ESI
00DEF076�燡NZ SHORT 00DEF081
00DEF078�燙MP DWORD PTR DS:[E01AB4],0
00DEF07F�燡MP SHORT 00DEF0A7

--------------------------------------------------------------------------------


2.修改IAT存放地址

由于壳使用了临时空间存放IAT表，所以要修改到程序可见段中。

Ctrl+S打开搜索命令序列窗口，填入：

代码:--------------------------------------------------------------------------------
PUSH EBP
MOV EBP,ESP
PUSH ECX
PUSH EBX
XOR EBX,EBX
--------------------------------------------------------------------------------

这是段特征代码，要查找的第一个anti在这个代码段中，查找来到：

代码:--------------------------------------------------------------------------------
00DEBE33�燩USH EBP
00DEBE34�燤OV EBP,ESP
00DEBE36�燩USH ECX 网管下载dl.bitscn.com
00DEBE37�燩USH EBX
00DEBE38�燲OR EBX,EBX�牐牐牐� //特征代码
00DEBE3A�燙MP BYTE PTR DS:[DFFFFD],BL
00DEBE40�燩USH ESI
00DEBE41�燩USH EDI
00DEBE42�燡NZ SHORT 00DEBE5E
00DEBE44�燙MP BYTE PTR DS:[DFFC19],BL
00DEBE4A�燡NZ SHORT 00DEBE5E
00DEBE4C�燙ALL 00DC7591
00DEBE51�燭EST EAX,EAX
00DEBE53�燡E SHORT 00DEBE5E
00DEBE55�燙ALL 00DC82D5
00DEBE5A�燭EST AL,AL
 �牐牐牐牐牐�
//anti的效验，光标停在这里，F4到这个地方。修改Al值为1

00DEBE5C�燡E SHORT 00DEBE65
00DEBE5E�燲OR AL,AL
00DEBE60�燡MP 00DEBF91
--------------------------------------------------------------------------------

下面是手工活了，F8运行：

代码:--------------------------------------------------------------------------------
00DE45CC�燤OV EAX,C80F9D61
00DE45D1�燦OT ECX
00DE45D3�燘SWAP EAX
00DE45D5�燦OT ECX
00DE45D7�燩USH DWORD PTR DS:[DF0498]��; USER32.SetTimer <--注意
00DE45DD�燙ALL 00DEA2E1
00DE45E2�燩OP ECX
00DE45E3�燤OVZX EAX,AL 中国网管联盟bitsCN.com
00DE45E6�燤OV DWORD PTR SS:[EBP-134],EAX
00DE45EC�燩USH ECX
00DE45ED�燘SWAP ECX
00DE45EF�燦OT ECX
00DE45F1�燩USH EAX
00DE45F2�燦OT EAX
00DE45F4�燤OV EAX,6C65696D
00DE45F9�燲CHG EAX,ECX
--------------------------------------------------------------------------------

F8继续，第一个解码代码：

代码:--------------------------------------------------------------------------------
00DE4A21�� >CALL 00DC14AC
00DE4A26�� >ADD ESP,10
00DE4A29�� >MOV EAX,DWORD PTR DS:[DFFA1C]
00DE4A2E�� >MOV DWORD PTR SS:[EBP-399C],EAX
00DE4A34�� >CMP DWORD PTR SS:[EBP-399C],0
00DE4A3B�� >JE SHORT 00DE4A73
00DE4A3D�� >MOV EAX,DWORD PTR SS:[EBP-399C]
00DE4A43�� >CMP DWORD PTR DS:[EAX],0
00DE4A46�� >JE SHORT 00DE4A73
00DE4A48�� >MOV EAX,DWORD PTR SS:[EBP-399C]
00DE4A4E�� >MOV EAX,DWORD PTR DS:[EAX]
00DE4A50�� >MOV EAX,DWORD PTR DS:[EAX]
00DE4A52�� >ADD EAX,DWORD PTR DS:[E004F0]
00DE4A58�� >MOV ECX,DWORD PTR SS:[EBP-399C]
00DE4A5E�� >MOV ECX,DWORD PTR DS:[ECX]
00DE4A60�� >MOV DWORD PTR DS:[ECX],EAX
00DE4A62�� >MOV EAX,DWORD PTR SS:[EBP-399C]
00DE4A68�� >ADD EAX,4
00DE4A6B�� >MOV DWORD PTR SS:[EBP-399C],EAX
00DE4A71�燸>JMP SHORT 00DE4A3D
00DE4A73�� >XCHG EAX,ESI�牐牐牐牐�//这里结束，F4到这里
00DE4A74�� >XCHG CX,CX
00DE4A77�� >XCHG EAX,ESI
00DE4A78�� >INS DWORD PTR ES:[EDI],DX�牐牐牐牐牐牐牐�; I/O 命令
--------------------------------------------------------------------------------

F8继续，到申请临时空间的代码了，这个版本不再使用訽来的 VirtualAlloc 函数：

代码:--------------------------------------------------------------------------------
00DE5209�燤OV DWORD PTR DS:[DF68CC],0DF7454�牐牐牐�; ASCII "B4"
00DE5213�燤OV EAX,DWORD PTR DS:[E00030]
00DE5218�燤OV EAX,DWORD PTR DS:[EAX]
00DE521A�燤OV DWORD PTR SS:[EBP-3924],EAX
00DE5220�燤OV EAX,DWORD PTR DS:[E00030]
00DE5225�燗DD EAX,4
00DE5228�燤OV DWORD PTR DS:[E00030],EAX

网管bitscn_com

00DE522D�燙ALL 00DEB11B
00DE5232�燲OR ECX,ECX
00DE5234�燭EST EAX,EAX
00DE5236�燬ETNE CL
00DE5239�營NC ECX
00DE523A�燤OV EAX,DWORD PTR DS:[E00030]
00DE523F�燤OV EAX,DWORD PTR DS:[EAX]
00DE5241�燲OR EDX,EDX
00DE5243�燚IV ECX
00DE5245�燤OV DWORD PTR SS:[EBP-37C8],EAX
00DE524B�燤OV EAX,DWORD PTR DS:[E00030]
00DE5250�燗DD EAX,4
00DE5253�燤OV DWORD PTR DS:[E00030],EAX
00DE5258�燤OV EAX,DWORD PTR SS:[EBP-37C8]
00DE525E�燬HL EAX,2
00DE5261�燩USH EAX
00DE5262�燙ALL 00DEEF08�牐牐牐牐�; JMP to msvcrt.??2@YAPAXI@Z��//申请函数
00DE5267�燩OP ECX
00DE5268�燤OV DWORD PTR SS:[EBP+FFFFAFE8],EAX�� <--返回值，修改这个值
00DE526E�燤OV EAX,DWORD PTR SS:[EBP+FFFFAFE8]
00DE5274�燤OV DWORD PTR SS:[EBP-3928],EAX
00DE527A�燤OV EAX,DWORD PTR DS:[E00028]
00DE527F�燤OV EAX,DWORD PTR DS:[EAX+78]
00DE5282�燤OV DWORD PTR SS:[EBP+FFFFAE28],EAX
00DE5288�燤OV EAX,DWORD PTR SS:[EBP+FFFFAE28]
00DE528E�燤OV DWORD PTR SS:[EBP-39F8],EAX
00DE5294�燗ND DWORD PTR SS:[EBP-39FC],0 网管下载dl.bitscn.com
00DE529B�燡MP SHORT 00DE52AA
--------------------------------------------------------------------------------

修改申请返回值EAX ＝00646000 壳的第一代码段，因为壳运行时不再使用这个段。
下面是计算IAT的第一个加密表：

代码:--------------------------------------------------------------------------------
00DE529D�燤OV EAX,DWORD PTR SS:[EBP-39FC]
00DE52A3�營NC EAX
00DE52A4�燤OV DWORD PTR SS:[EBP-39FC],EAX
00DE52AA�燤OV EAX,DWORD PTR SS:[EBP-39FC]
00DE52B0�燙MP EAX,DWORD PTR SS:[EBP-37C8]
00DE52B6�燡NB 00DE5379
00DE52BC�燤OV DWORD PTR SS:[EBP+FFFFAE14],14
00DE52C6�燩USH 1DF5E0D
00DE52CB�燩USH DWORD PTR SS:[EBP-39F8]
00DE52D1�燣EA ECX,DWORD PTR SS:[EBP-39F8]
00DE52D7�燙ALL 00DC1071
00DE52DC�營NC EAX
00DE52DD�燲OR EDX,EDX
00DE52DF�燤OV ECX,5F5E100
00DE52E4�燚IV ECX
00DE52E6�燤OV DWORD PTR SS:[EBP-39F8],EDX
00DE52EC�燤OV DWORD PTR SS:[EBP+FFFFAE00],100
00DE52F6�燩USH 1DF5E0D
00DE52FB�燩USH DWORD PTR SS:[EBP-39F8]
00DE5301�燣EA ECX,DWORD PTR SS:[EBP-39F8] 网管u家u.bitsCN.com
00DE5307�燙ALL 00DC1071
00DE530C�營NC EAX
00DE530D�燲OR EDX,EDX
00DE530F�燤OV ECX,5F5E100
00DE5314�燚IV ECX
00DE5316�燤OV DWORD PTR SS:[EBP-39F8],EDX
00DE531C�燤OV EAX,DWORD PTR SS:[EBP-39F8]
00DE5322�燲OR EDX,EDX
00DE5324�燤OV ECX,2710
00DE5329�燚IV ECX
00DE532B�營MUL EAX,DWORD PTR SS:[EBP+FFFFAE14]
00DE5332�燲OR EDX,EDX
00DE5334�燤OV ECX,2710
00DE5339�燚IV ECX
00DE533B�燤OV ECX,EAX
00DE533D�燤OV EAX,DWORD PTR SS:[EBP-39F8]
00DE5343�燲OR EDX,EDX
00DE5345�燤OV ESI,2710
00DE534A�燚IV ESI
00DE534C�營MUL EAX,DWORD PTR SS:[EBP+FFFFAE00]
00DE5353�燲OR EDX,EDX
00DE5355�燤OV ESI,2710
00DE535A�燚IV ESI
00DE535C�燤OV ECX,DWORD PTR SS:[EBP+ECX*4-3978]
00DE5363�燗DD ECX,EAX
00DE5365�燤OV EAX,DWORD PTR SS:[EBP-39FC]
00DE536B�燤OV EDX,DWORD PTR SS:[EBP-3928]
00DE5371�燤OV DWORD PTR DS:[EDX+EAX*4],ECX��//值放到上面修改的地址中
00DE5374�燡MP 00DE529D
00DE5379�燤OV EAX,DWORD PTR DS:[E00030]�� //这是出口，F4到这里 网管联盟bitsCN_com
--------------------------------------------------------------------------------

这个表与后面的IAT加密可能有关系，或许可以从这里辟开iat的加密，我没有看懂。

3.获得程序代码

F8继续运行程序，到第二个代码解码的地方：

代码:--------------------------------------------------------------------------------
00DE5963�燙ALL 00DC14AC
00DE5968�燗DD ESP,10
00DE596B�燤OV EAX,DWORD PTR DS:[DFFA20]
00DE5970�燤OV DWORD PTR SS:[EBP-3A34],EAX
00DE5976�燙MP DWORD PTR SS:[EBP-3A34],0
00DE597D�燡E SHORT 00DE59B5
00DE597F�燤OV EAX,DWORD PTR SS:[EBP-3A34]
00DE5985�燙MP DWORD PTR DS:[EAX],0
00DE5988�燡E SHORT 00DE59B5
00DE598A�燤OV EAX,DWORD PTR SS:[EBP-3A34]
00DE5990�燤OV EAX,DWORD PTR DS:[EAX]
00DE5992�燤OV EAX,DWORD PTR DS:[EAX]
00DE5994�燗DD EAX,DWORD PTR DS:[E004F0]
00DE599A�燤OV ECX,DWORD PTR SS:[EBP-3A34]
00DE59A0�燤OV ECX,DWORD PTR DS:[ECX]
00DE59A2�燤OV DWORD PTR DS:[ECX],EAX
00DE59A4�燤OV EAX,DWORD PTR SS:[EBP-3A34]
00DE59AA�燗DD EAX,4

网管网www.bitscn.com

00DE59AD�燤OV DWORD PTR SS:[EBP-3A34],EAX
00DE59B3�燡MP SHORT 00DE597F
00DE59B5�燲CHG EAX,EDI�牐牐牐牐�//这里结束，F4到这里
00DE59B6�燲CHG CX,CX
00DE59B9�燲CHG EAX,EDI
00DE59BA�燨R ESI,DWORD PTR DS:[ECX+EBX*2]
--------------------------------------------------------------------------------

F8继续，到这里：

代码:--------------------------------------------------------------------------------
00DE5A9F�燤OV EAX,DWORD PTR SS:[EBP-3A48]
00DE5AA5�燗ND EAX,7FFFFFFF
00DE5AAA�燤OV ECX,DWORD PTR SS:[EBP-3910]
00DE5AB0�燗DD EAX,DWORD PTR DS:[ECX+88]
00DE5AB6�燤OV DWORD PTR SS:[EBP-3A48],EAX
00DE5ABC�燤OV EAX,DWORD PTR DS:[E00030]
00DE5AC1�燤OV EAX,DWORD PTR DS:[EAX]
00DE5AC3�燲OR EAX,DWORD PTR DS:[E00034]
00DE5AC9�燤OV DWORD PTR SS:[EBP-3A44],EAX
00DE5ACF�燤OV EAX,DWORD PTR DS:[E00030]
00DE5AD4�燗DD EAX,4
00DE5AD7�燤OV DWORD PTR DS:[E00030],EAX
00DE5ADC�燤OV EAX,DWORD PTR SS:[EBP-3A44]
00DE5AE2�燗DD EAX,10000�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; UNICODE "=::=::\"

中国网管联盟bitsCN.com

00DE5AE7�燩USH EAX
00DE5AE8�燙ALL 00DEEF08�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; JMP to msvcrt.??2@YAPAXI@Z
00DE5AED�燩OP ECX
00DE5AEE�燤OV DWORD PTR SS:[EBP+FFFFAFDC],EAX
00DE5AF4�燤OV EAX,DWORD PTR SS:[EBP+FFFFAFDC]
00DE5AFA�燤OV DWORD PTR SS:[EBP-3A40],EAX
00DE5B00�燤OV EAX,DWORD PTR SS:[EBP-3A40]
00DE5B06�燤OV DWORD PTR SS:[EBP-3A38],EAX
00DE5B0C�燤OV EAX,DWORD PTR SS:[EBP-3A44]
00DE5B12�燗DD EAX,10000�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; UNICODE "=::=::\"
00DE5B17�燩USH EAX
00DE5B18�燩USH 0
00DE5B1A�燩USH DWORD PTR SS:[EBP-3A40]
00DE5B20�燙ALL 00DEEF14�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; JMP to msvcrt.memset
00DE5B25�燗DD ESP,0C
00DE5B28�燩USH 1
00DE5B2A�燩OP EAX
00DE5B2B�燭EST EAX,EAX
00DE5B2D�燡E 00DE5BBC
--------------------------------------------------------------------------------

上面的代码是先申请一个空间，然后设置这个空间的准备解码程序的代码。

F8继续，到了还訽程序代码段：

代码:-------------------------------------------------------------------------------- 中国网管论坛bbs.bitsCN.com
00DE5F3D�燣EA EAX,DWORD PTR SS:[EBP-3A4C]
00DE5F43�燩USH EAX
00DE5F44�燩USH 4
00DE5F46�燩USH DWORD PTR SS:[EBP-3A44]
00DE5F4C�燤OV EAX,DWORD PTR SS:[EBP-3900]
00DE5F52�燗DD EAX,DWORD PTR SS:[EBP-3A48]
00DE5F58�燩USH EAX
00DE5F59�燙ALL DWORD PTR DS:[DF0148]�牐牐牐牐牐牐牐牐� ; kernel32.VirtualProtect
00DE5F5F�燩USH DWORD PTR SS:[EBP-3A44]
00DE5F65�燩USH DWORD PTR SS:[EBP-3A40]
00DE5F6B�燤OV EAX,DWORD PTR SS:[EBP-3900]
00DE5F71�燗DD EAX,DWORD PTR SS:[EBP-3A48]
00DE5F77�燩USH EAX
00DE5F78�燙ALL 00DEEF02�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; JMP to msvcrt.memcpy
00DE5F7D�燗DD ESP,0C�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐� //内存数据复制
00DE5F80�燣EA EAX,DWORD PTR SS:[EBP-3A4C]
00DE5F86�燩USH EAX
00DE5F87�燩USH DWORD PTR SS:[EBP-3A4C]
00DE5F8D�燩USH DWORD PTR SS:[EBP-3A44]
00DE5F93�燤OV EAX,DWORD PTR SS:[EBP-3900]
00DE5F99�燗DD EAX,DWORD PTR SS:[EBP-3A48]
00DE5F9F�燩USH EAX
00DE5FA0�燙ALL DWORD PTR DS:[DF0148]�牐牐牐牐牐牐牐牐� ; kernel32.VirtualProtect

网管网www.bitscn.com

00DE5FA6�燤OV EAX,DWORD PTR SS:[EBP-3A40]
00DE5FAC�燤OV DWORD PTR SS:[EBP+FFFFAFD8],EAX
00DE5FB2�燩USH DWORD PTR SS:[EBP+FFFFAFD8]
00DE5FB8�燙ALL 00DEEEFC�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; JMP to msvcrt.??3@YAXPAX@Z
00DE5FBD�燩OP ECX
00DE5FBE�燡MP 00DE5A57
--------------------------------------------------------------------------------

可以看出来，壳不断的修改程序的各个段的属性，然后复制数据，这个裚环就是解码这个程序。

5.还訽IAT

上面的解码完成后到这里：

代码:--------------------------------------------------------------------------------
00DE5FC3�燗ND DWORD PTR DS:[E00034],0
00DE5FCA�燙MP DWORD PTR SS:[EBP-379C],0
00DE5FD1�燡E SHORT 00DE6006
--------------------------------------------------------------------------------

F8继续，第三个代码解码：

代码:--------------------------------------------------------------------------------
00DE637D�燙ALL 00DC14AC
00DE6382�燗DD ESP,10
00DE6385�燤OV EAX,DWORD PTR DS:[DFFA24]

网管网www_bitscn_com

00DE638A�燤OV DWORD PTR SS:[EBP-3AA0],EAX
00DE6390�燙MP DWORD PTR SS:[EBP-3AA0],0
00DE6397�燡E SHORT 00DE63CF
00DE6399�燤OV EAX,DWORD PTR SS:[EBP-3AA0]
00DE639F�燙MP DWORD PTR DS:[EAX],0
00DE63A2�燡E SHORT 00DE63CF
00DE63A4�燤OV EAX,DWORD PTR SS:[EBP-3AA0]
00DE63AA�燤OV EAX,DWORD PTR DS:[EAX]
00DE63AC�燤OV EAX,DWORD PTR DS:[EAX]
00DE63AE�燗DD EAX,DWORD PTR DS:[E004F0]
00DE63B4�燤OV ECX,DWORD PTR SS:[EBP-3AA0]
00DE63BA�燤OV ECX,DWORD PTR DS:[ECX]
00DE63BC�燤OV DWORD PTR DS:[ECX],EAX
00DE63BE�燤OV EAX,DWORD PTR SS:[EBP-3AA0]
00DE63C4�燗DD EAX,4
00DE63C7�燤OV DWORD PTR SS:[EBP-3AA0],EAX
00DE63CD�燡MP SHORT 00DE6399
00DE63CF�燩USH EDI�牐牐�//这里结束，F4到这里
00DE63D0�燲CHG BX,BX
00DE63D3�燩OP EDI
--------------------------------------------------------------------------------

F8继续，到这里：

代码:--------------------------------------------------------------------------------
00DE68DC�燙ALL 00DC14AC
00DE68E1�燗DD ESP,10

网管联盟bitsCN@com

00DE68E4�燤OV EAX,DWORD PTR DS:[DFFA2C]
00DE68E9�燤OV DWORD PTR SS:[EBP-3B64],EAX
00DE68EF�燙MP DWORD PTR SS:[EBP-3B64],0
00DE68F6�燡E SHORT 00DE692E
00DE68F8�燤OV EAX,DWORD PTR SS:[EBP-3B64]
00DE68FE�燙MP DWORD PTR DS:[EAX],0
00DE6901�燡E SHORT 00DE692E
00DE6903�燤OV EAX,DWORD PTR SS:[EBP-3B64]
00DE6909�燤OV EAX,DWORD PTR DS:[EAX]
00DE690B�燤OV EAX,DWORD PTR DS:[EAX]
00DE690D�燗DD EAX,DWORD PTR DS:[E004F0]
00DE6913�燤OV ECX,DWORD PTR SS:[EBP-3B64]
00DE6919�燤OV ECX,DWORD PTR DS:[ECX]
00DE691B�燤OV DWORD PTR DS:[ECX],EAX
00DE691D�燤OV EAX,DWORD PTR SS:[EBP-3B64]
00DE6923�燗DD EAX,4
00DE6926�燤OV DWORD PTR SS:[EBP-3B64],EAX
00DE692C�燡MP SHORT 00DE68F8
00DE692E�燲CHG AX,CX�牐�//这里结束，F4到这里
00DE6930�燦OP
00DE6931�燲CHG AX,CX
--------------------------------------------------------------------------------

开始处理IAT表了，注意：

代码:-------------------------------------------------------------------------------- 中国网管联盟bitsCN.com
00DE6B32�燩USH DWORD PTR SS:[EBP-3B70]
00DE6B38�燙ALL 00DC9950
00DE6B3D�燩OP ECX
00DE6B3E�燗ND DWORD PTR SS:[EBP-3B74],0
00DE6B45�燩USH 0
00DE6B47�燙ALL DWORD PTR DS:[DF00D4]�牐牐牐牐� ; kernel32.GetModuleHandleA
00DE6B4D�燙MP DWORD PTR SS:[EBP-3B70],EAX�牐牐�//可以对上面的函数下中断到这里
00DE6B53�燡NZ SHORT 00DE6B64
00DE6B55�燤OV DWORD PTR SS:[EBP-3B74],0DF5180
00DE6B5F�燡MP 00DE6C28
00DE6B64�燗ND DWORD PTR SS:[EBP-3D98],0
00DE6B6B�燤OV DWORD PTR SS:[EBP-3D9C],0DF57C0
00DE6B75�燡MP SHORT 00DE6B93
00DE6B77�燤OV EAX,DWORD PTR SS:[EBP-3D9C]
00DE6B7D�燗DD EAX,0C
00DE6B80�燤OV DWORD PTR SS:[EBP-3D9C],EAX
00DE6B86�燤OV EAX,DWORD PTR SS:[EBP-3D98]
00DE6B8C�營NC EAX
00DE6B8D�燤OV DWORD PTR SS:[EBP-3D98],EAX
00DE6B93�燤OV EAX,DWORD PTR SS:[EBP-3D9C]
00DE6B99�燙MP DWORD PTR DS:[EAX],0�牐牐牐牐牐� <--这个就是Magic jmp�牐牐牐牐牐�
00DE6B9C�燡E 00DE6C28�牐牐牐牐牐牐牐牐牐牐牐牐�//修改为JMP 00DE6C28
00DE6BA2�燤OV EAX,DWORD PTR SS:[EBP-3D9C]

网管网www_bitscn_com

00DE6BA8�燤OV EAX,DWORD PTR DS:[EAX+8]
00DE6BAB�燗ND EAX,1
00DE6BAE�燭EST EAX,EAX
00DE6BB0�燡E SHORT 00DE6BD7
--------------------------------------------------------------------------------

解码IAT表：

代码:--------------------------------------------------------------------------------
00DE6D62�燗ND DWORD PTR SS:[EBP-3B68],0
00DE6D69�燙ALL DWORD PTR DS:[DF029C]�牐牐牐�; kernel32.GetTickCount
00DE6D6F�燤OV DWORD PTR SS:[EBP-3B6C],EAX�牐�//时间效验开始
00DE6D75�燩USH 1
00DE6D77�燩OP EAX
00DE6D78�燭EST EAX,EAX
00DE6D7A�燡E 00DE70A7
00DE6D80�燗ND WORD PTR SS:[EBP-3DA4],0
00DE6D88�燗ND DWORD PTR SS:[EBP-3DAC],0
00DE6D8F�燗ND DWORD PTR SS:[EBP-3DA8],0
00DE6D96�燤OV EAX,DWORD PTR SS:[EBP-3790]
00DE6D9C�燤OVSX EAX,BYTE PTR DS:[EAX]
00DE6D9F�燭EST EAX,EAX
00DE6DA1�燡NZ SHORT 00DE6DE7
00DE6DA3�燣EA ECX,DWORD PTR SS:[EBP-37D4]
00DE6DA9�燙ALL 00DC1040
00DE6DAE�燤OVZX EAX,AL
00DE6DB1�燙DQ
00DE6DB2�燩USH 14
00DE6DB4�燩OP ECX
00DE6DB5�營DIV ECX
00DE6DB7�燤OV EAX,DWORD PTR SS:[EBP-37FC]
00DE6DBD�燤OV ECX,DWORD PTR SS:[EBP+EDX*4-3978] //模块分界加密，修改为 XOR ECX,ECX
00DE6DC4�燤OV DWORD PTR DS:[EAX],ECX
00DE6DC6�燤OV EAX,DWORD PTR SS:[EBP-37FC]
00DE6DCC�燗DD EAX,4
00DE6DCF�燤OV DWORD PTR SS:[EBP-37FC],EAX
00DE6DD5�燤OV EAX,DWORD PTR SS:[EBP-3790]
00DE6DDB�營NC EAX
00DE6DDC�燤OV DWORD PTR SS:[EBP-3790],EAX
00DE6DE2�燡MP 00DE70A7
00DE6DE7�燤OV EAX,DWORD PTR SS:[EBP-3790]
00DE6DED�燤OVZX EAX,BYTE PTR DS:[EAX]
00DE6DF0�燙MP EAX,0FF
00DE6DF5�燡NZ 00DE6E92
00DE6DFB�燤OV EAX,DWORD PTR SS:[EBP-3790]
00DE6E01�營NC EAX
00DE6E02�燤OV DWORD PTR SS:[EBP-3790],EAX
00DE6E08�燤OV EAX,DWORD PTR SS:[EBP-3790]
00DE6E0E�燤OV AX,WORD PTR DS:[EAX]
00DE6E11�燤OV WORD PTR SS:[EBP-3DA4],AX
00DE6E18�燤OV EAX,DWORD PTR SS:[EBP-3790]
00DE6E1E�營NC EAX
00DE6E1F�營NC EAX
00DE6E20�燤OV DWORD PTR SS:[EBP-3790],EAX
00DE6E26�燙MP DWORD PTR SS:[EBP-3B74],0
00DE6E2D�燡E SHORT 00DE6E80 网管u家u.bitscn@com
00DE6E2F�燤OV EAX,DWORD PTR SS:[EBP-3B74]
00DE6E35�燤OV DWORD PTR SS:[EBP-3DB0],EAX
00DE6E3B�燡MP SHORT 00DE6E4C
00DE6E3D�燤OV EAX,DWORD PTR SS:[EBP-3DB0]
00DE6E43�燗DD EAX,0C
00DE6E46�燤OV DWORD PTR SS:[EBP-3DB0],EAX
00DE6E4C�燤OV EAX,DWORD PTR SS:[EBP-3DB0]
00DE6E52�燙MP DWORD PTR DS:[EAX+8],0
00DE6E56�燡E SHORT 00DE6E80
00DE6E58�燤OVZX EAX,WORD PTR SS:[EBP-3DA4]
00DE6E5F�燤OV ECX,DWORD PTR SS:[EBP-3DB0]
00DE6E65�燤OVZX ECX,WORD PTR DS:[ECX+4]
00DE6E69�燙MP EAX,ECX
00DE6E6B�燡NZ SHORT 00DE6E7E
00DE6E6D�燤OV EAX,DWORD PTR SS:[EBP-3DB0]
00DE6E73�燤OV EAX,DWORD PTR DS:[EAX+8]
00DE6E76�燤OV DWORD PTR SS:[EBP-3DA8],EAX
00DE6E7C�燡MP SHORT 00DE6E80
00DE6E7E�燡MP SHORT 00DE6E3D
00DE6E80�燤OV EAX,DWORD PTR SS:[EBP-3B68]
00DE6E86�營NC EAX
00DE6E87�燤OV DWORD PTR SS:[EBP-3B68],EAX
00DE6E8D�燡MP 00DE6F3C
00DE6E92�燤OV EAX,DWORD PTR SS:[EBP-3790]
00DE6E98�燤OV DWORD PTR SS:[EBP-3DAC],EAX
00DE6E9E�燩USH 0
00DE6EA0�燩USH DWORD PTR SS:[EBP-3790]
00DE6EA6�燙ALL DWORD PTR DS:[DF02F0]�牐牐牐牐牐牐牐牐� ; msvcrt.strchr
00DE6EAC�燩OP ECX
00DE6EAD�燩OP ECX
00DE6EAE�營NC EAX
00DE6EAF�燤OV DWORD PTR SS:[EBP-3790],EAX
00DE6EB5�燙MP DWORD PTR SS:[EBP-3B74],0
00DE6EBC�燡E SHORT 00DE6F2F
00DE6EBE�燤OV EAX,DWORD PTR SS:[EBP-3B74]
00DE6EC4�燤OV DWORD PTR SS:[EBP-3DB4],EAX
00DE6ECA�燡MP SHORT 00DE6EDB
00DE6ECC�燤OV EAX,DWORD PTR SS:[EBP-3DB4]
00DE6ED2�燗DD EAX,0C
00DE6ED5�燤OV DWORD PTR SS:[EBP-3DB4],EAX
00DE6EDB�燤OV EAX,DWORD PTR SS:[EBP-3DB4]
00DE6EE1�燙MP DWORD PTR DS:[EAX+8],0
00DE6EE5�燡E SHORT 00DE6F2F
00DE6EE7�燩USH 100
00DE6EEC�燣EA EAX,DWORD PTR SS:[EBP-3EB4]
00DE6EF2�燩USH EAX
00DE6EF3�燤OV EAX,DWORD PTR SS:[EBP-3DB4]
00DE6EF9�燩USH DWORD PTR DS:[EAX]
00DE6EFB�燙ALL 00DC8092
00DE6F00�燗DD ESP,0C
00DE6F03�燣EA EAX,DWORD PTR SS:[EBP-3EB4]
00DE6F09�燩USH EAX
00DE6F0A�燩USH DWORD PTR SS:[EBP-3DAC]
00DE6F10�燙ALL DWORD PTR DS:[DF035C]�牐牐牐牐牐牐牐牐� ; msvcrt._stricmp
00DE6F16�燩OP ECX
00DE6F17�燩OP ECX
00DE6F18�燭EST EAX,EAX
00DE6F1A�燡NZ SHORT 00DE6F2D
00DE6F1C�燤OV EAX,DWORD PTR SS:[EBP-3DB4]
00DE6F22�燤OV EAX,DWORD PTR DS:[EAX+8]
00DE6F25�燤OV DWORD PTR SS:[EBP-3DA8],EAX
00DE6F2B�燡MP SHORT 00DE6F2F
00DE6F2D�燡MP SHORT 00DE6ECC
00DE6F2F�燤OV EAX,DWORD PTR SS:[EBP-3B68]
00DE6F35�營NC EAX
00DE6F36�燤OV DWORD PTR SS:[EBP-3B68],EAX
00DE6F3C�燙MP DWORD PTR SS:[EBP-3DA8],0
00DE6F43�燡NZ SHORT 00DE6F87
00DE6F45�燤OVZX EAX,WORD PTR SS:[EBP-3DA4]
00DE6F4C�燭EST EAX,EAX
00DE6F4E�燡E SHORT 00DE6F5F
00DE6F50�燤OVZX EAX,WORD PTR SS:[EBP-3DA4]
00DE6F57�燤OV DWORD PTR SS:[EBP+FFFFAD5C],EAX
00DE6F5D�燡MP SHORT 00DE6F6B
00DE6F5F�燤OV EAX,DWORD PTR SS:[EBP-3DAC]
00DE6F65�燤OV DWORD PTR SS:[EBP+FFFFAD5C],EAX
00DE6F6B�燩USH 1
00DE6F6D�燩USH DWORD PTR SS:[EBP+FFFFAD5C]
00DE6F73�燩USH DWORD PTR SS:[EBP-3B70]
00DE6F79�燙ALL 00DCA113
00DE6F7E�燗DD ESP,0C
00DE6F81�燤OV DWORD PTR SS:[EBP-3DA8],EAX 网管论坛bbs_bitsCN_com
00DE6F87�燙MP DWORD PTR SS:[EBP-3DA8],0
00DE6F8E�燡NZ SHORT 00DE6FD2
00DE6F90�燤OVZX EAX,WORD PTR SS:[EBP-3DA4]
00DE6F97�燭EST EAX,EAX
00DE6F99�燡E SHORT 00DE6FAA
00DE6F9B�燤OVZX EAX,WORD PTR SS:[EBP-3DA4]
00DE6FA2�燤OV DWORD PTR SS:[EBP+FFFFAD58],EAX
00DE6FA8�燡MP SHORT 00DE6FB6
00DE6FAA�燤OV EAX,DWORD PTR SS:[EBP-3DAC]
00DE6FB0�燤OV DWORD PTR SS:[EBP+FFFFAD58],EAX
00DE6FB6�燩USH 0
00DE6FB8�燩USH DWORD PTR SS:[EBP+FFFFAD58]
00DE6FBE�燩USH DWORD PTR SS:[EBP-3B70]
00DE6FC4�燙ALL 00DCA113
00DE6FC9�燗DD ESP,0C
00DE6FCC�燤OV DWORD PTR SS:[EBP-3DA8],EAX
00DE6FD2�燙MP DWORD PTR SS:[EBP-3DA8],0
00DE6FD9�燡NZ 00DE7077
00DE6FDF�燤OVZX EAX,WORD PTR SS:[EBP-3DA4]
00DE6FE6�燭EST EAX,EAX
00DE6FE8�燡E SHORT 00DE703E
00DE6FEA�燙ALL DWORD PTR DS:[DF00E4]�牐牐牐牐牐牐牐牐� ; ntdll.RtlGetLastWin32Error
00DE6FF0�燙MP EAX,32
00DE6FF3�燡NZ SHORT 00DE7001
00DE6FF5�燤OV DWORD PTR SS:[EBP-3DA8],0DCA108
00DE6FFF�燡MP SHORT 00DE703C 网管网www_bitscn_com
00DE7001�燤OV EAX,DWORD PTR SS:[EBP+8]
00DE7004�燤OV EAX,DWORD PTR DS:[EAX]
00DE7006�燤OV DWORD PTR DS:[EAX],3
00DE700C�燙ALL DWORD PTR DS:[DF00E4]�牐牐牐牐牐牐牐牐� ; ntdll.RtlGetLastWin32Error
00DE7012�燩USH EAX
00DE7013�燤OVZX EAX,WORD PTR SS:[EBP-3DA4]
00DE701A�燩USH EAX
00DE701B�燩USH DWORD PTR SS:[EBP-3C8C]
00DE7021�燩USH 0DF73B0�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐� ; ASCII "File "%s", ordinal %d (error %d)"
00DE7026�燤OV EAX,DWORD PTR SS:[EBP+8]
00DE7029�燩USH DWORD PTR DS:[EAX+4]
00DE702C�燙ALL DWORD PTR DS:[DF02EC]�牐牐牐牐牐牐牐牐� ; msvcrt.sprintf
00DE7032�燗DD ESP,14
00DE7035�燲OR EAX,EAX
00DE7037�燡MP 00DE81EF
00DE703C�燡MP SHORT 00DE7077
00DE703E�燤OV EAX,DWORD PTR SS:[EBP+8]
00DE7041�燤OV EAX,DWORD PTR DS:[EAX]
00DE7043�燤OV DWORD PTR DS:[EAX],3
00DE7049�燙ALL DWORD PTR DS:[DF00E4]�牐牐牐牐牐牐牐牐� ; ntdll.RtlGetLastWin32Error
00DE704F�燩USH EAX
00DE7050�燩USH DWORD PTR SS:[EBP-3DAC]
00DE7056�燩USH DWORD PTR SS:[EBP-3C8C]
00DE705C�燩USH 0DF738C�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐� ; ASCII "File "%s", function "%s" (error %d)"
00DE7061�燤OV EAX,DWORD PTR SS:[EBP+8]
00DE7064�燩USH DWORD PTR DS:[EAX+4]
00DE7067�燙ALL DWORD PTR DS:[DF02EC]�牐牐牐牐牐牐牐牐� ; msvcrt.sprintf
00DE706D�燗DD ESP,14
00DE7070�燲OR EAX,EAX
00DE7072�燡MP 00DE81EF
00DE7077�燤OV EAX,DWORD PTR SS:[EBP-37FC]
00DE707D�燙MP EAX,DWORD PTR SS:[EBP-37A8]
00DE7083�燡NB SHORT 00DE70A2
00DE7085�燤OV EAX,DWORD PTR SS:[EBP-37FC]
00DE708B�燤OV ECX,DWORD PTR SS:[EBP-3DA8]
00DE7091�燤OV DWORD PTR DS:[EAX],ECX�牐牐牐牐牐� //写入IAT表，可以看到写入到我们修改的地址中了
00DE7093�燤OV EAX,DWORD PTR SS:[EBP-37FC]
00DE7099�燗DD EAX,4
00DE709C�燤OV DWORD PTR SS:[EBP-37FC],EAX
00DE70A2�燡MP 00DE6D75
00DE70A7�燙ALL DWORD PTR DS:[DF029C]�牐牐牐牐牐� ; kernel32.GetTickCount
00DE70AD�燬UB EAX,DWORD PTR SS:[EBP-3B6C]�牐牐牐�//获得上面代码运行的时间差�牐牐�
00DE70B3�燤OV ECX,DWORD PTR SS:[EBP-3B68]

网管网www.bitscn.com

00DE70B9�營MUL ECX,ECX,32
00DE70BC�燗DD ECX,7D0
00DE70C2�燙MP EAX,ECX
00DE70C4�燡BE SHORT 00DE70CD�牐牐牐牐牐牐牐牐牐�//效验时间，这里要修改为JMP 00DE70CD
00DE70C6�燤OV BYTE PTR SS:[EBP-37D8],1�牐牐牐牐�<--修改标准
00DE70CD�燙MP DWORD PTR SS:[EBP-3928],0�牐牐� ｛说明：如果这个标准修改，就会修改下面排列IAT表的参数值｝
00DE70D4�燡NZ 00DE7164
00DE70DA�燤OVZX EAX,BYTE PTR SS:[EBP-3B7C]
00DE70E1�燭EST EAX,EAX
00DE70E3�燡E SHORT 00DE7164
00DE70E5�燩USH 0
00DE70E7�燤OV EAX,DWORD PTR SS:[EBP-3B78]
00DE70ED�燬HL EAX,2
00DE70F0�燩USH EAX
00DE70F1�燤OV EAX,DWORD PTR SS:[EBP-3900]
00DE70F7�燗DD EAX,DWORD PTR SS:[EBP-3B80]
00DE70FD�燩USH EAX
00DE70FE�燙ALL 00DE8C74
00DE7103�燗DD ESP,0C
00DE7106�燤OV EAX,DWORD PTR SS:[EBP-3B78]
00DE710C�燬HL EAX,2
00DE710F�燩USH EAX
00DE7110�燩USH DWORD PTR SS:[EBP-37A0]
00DE7116�燤OV EAX,DWORD PTR SS:[EBP-3900]
00DE711C�燗DD EAX,DWORD PTR SS:[EBP-3B80]
00DE7122�燩USH EAX
00DE7123�燙ALL 00DEEF02�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; JMP to msvcrt.memcpy 网管论坛bbs_bitsCN_com
00DE7128�燗DD ESP,0C
00DE712B�燩USH 1
00DE712D�燤OV EAX,DWORD PTR SS:[EBP-3B78]
00DE7133�燬HL EAX,2
00DE7136�燩USH EAX
00DE7137�燤OV EAX,DWORD PTR SS:[EBP-3900]
00DE713D�燗DD EAX,DWORD PTR SS:[EBP-3B80]
00DE7143�燩USH EAX
00DE7144�燙ALL 00DE8C74
00DE7149�燗DD ESP,0C
00DE714C�燤OV EAX,DWORD PTR SS:[EBP-37A0]
00DE7152�燤OV DWORD PTR SS:[EBP+FFFFAFC8],EAX
00DE7158�燩USH DWORD PTR SS:[EBP+FFFFAFC8]
00DE715E�燙ALL 00DEEEFC�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; JMP to msvcrt.??3@YAXPAX@Z
00DE7163�燩OP ECX
00DE7164�燙MP DWORD PTR SS:[EBP-3928],0
00DE716B�燡NZ SHORT 00DE7197
00DE716D�燣EA EAX,DWORD PTR SS:[EBP-3B84]
00DE7173�燩USH EAX
00DE7174�燩USH DWORD PTR SS:[EBP-3B84]
00DE717A�燤OV EAX,DWORD PTR SS:[EBP-3B78]
00DE7180�燬HL EAX,2
00DE7183�燩USH EAX
00DE7184�燤OV EAX,DWORD PTR SS:[EBP-3900]
00DE718A�燗DD EAX,DWORD PTR SS:[EBP-3B80]
00DE7190�燩USH EAX
00DE7191�燙ALL DWORD PTR DS:[DF0148]�牐牐牐牐牐牐牐牐� ; kernel32.VirtualProtect 网管u家u.bitscn@com
00DE7197�燡MP 00DE697F
00DE719C�燤OV EAX,DWORD PTR SS:[EBP-391C]�牐牐� <--到这里完成IAT表
--------------------------------------------------------------------------------

把上面修改的代码全部还訽，一定要还訽！

代码:--------------------------------------------------------------------------------
完整的表：
00646000��4D 22 DB 77 68 6A DB 77�燤"踳hj踳
00646008��8B 6F DB 77 F4 6C DB 77�爧o踳鬺踳
00646010��10 24 DA 77 9A 22 DA 77��$趙?趙
00646018�燚8 17 DA 77 D4 65 DB 77��?趙詄踳
00646020�燘1 63 DB 77 BB 28 DA 77�牨c踳?趙
00646028��99 4E DA 77 5B 66 DB 77�牂N趙[f踳
00646030��27 67 DB 77 D9 23 DA 77��'g踳?趙
00646038�燛2 68 DB 77 D6 27 DA 77�犫h踳?趙
�_�_�_�_
00646B38��15 88 AC 7C 2D C1 B8 7C��埇|-粮|
00646B40��63 4A AC 7C A6 F2 AD 7C�燾J瑋︱_|
00646B48��11 F0 AD 7C 7B 85 AC 7C��餩|{叕|
00646B50��91 05 AC 7C F5 1F AC 7C��?瑋?瑋
00646B58�燜A 49 AC 7C 16 49 AC 7C�狕I瑋I瑋
00646B60��16 72 B0 7C 5F 86 B0 7C��r皘_啺| 中国网管论坛bbs.bitsCN.com
00646B68�燚B 8A B0 7C AF F3 AD 7C�犤姲|�骭|
00646B70�燙F 9E B1 7C 0F B3 B1 7C�犗灡|潮|
00646B78��1D CD B1 7C 31 CC B1 7C��捅|1瘫|
00646B80��5B 46 B4 7C D7 48 B4 7C�燵F磡譎磡
00646B88��00 00 00 00 F3 F0 C9 74��....箴蓆
00646B90��00 00 00 00�牐牐牐牐牐牐�....
--------------------------------------------------------------------------------



二进制复制上面的表，保留这个表用于后面的恢复

代码:--------------------------------------------------------------------------------
4D 22 DB 77 68 6A DB 77 8B 6F DB 77 F4 6C DB 77 10 24 DA 77 9A 22 DA 77 D8 17 DA 77 D4 65 DB 77
B1 63 DB 77 BB 28 DA 77 99 4E DA 77 5B 66 DB 77 27 67 DB 77 D9 23 DA 77 E2 68 DB 77 D6 27 DA 77
69 6D DC 77 8E 5B DC 77 00 00 00 00 B1 38 31 77 13 B3 31 77 3D 51 31 77 B7 4E 31 77 A4 7F 33 77
�_�_�_�_
00 00 00 00 A3 05 AC 7C 11 B2 B0 7C 2C 88 AE 7C 4E 8C AC 7C 70 97 AC 7C 9A 3E AC 7C 1E 04 AF 7C
CA E6 AD 7C 78 12 AD 7C 3C 12 B2 7C 72 83 AF 7C CE 88 AC 7C C7 80 AF 7C 15 88 AC 7C 2D C1 B8 7C
63 4A AC 7C A6 F2 AD 7C 11 F0 AD 7C 7B 85 AC 7C 91 05 AC 7C F5 1F AC 7C FA 49 AC 7C 16 49 AC 7C
16 72 B0 7C 5F 86 B0 7C DB 8A B0 7C AF F3 AD 7C CF 9E B1 7C 0F B3 B1 7C 1D CD B1 7C 31 CC B1 7C
5B 46 B4 7C D7 48 B4 7C 00 00 00 00 F3 F0 C9 74 00 00 00 00
--------------------------------------------------------------------------------

下面是壳对IAT的重新加密：

代码:--------------------------------------------------------------------------------
00DE719C�燤OV EAX,DWORD PTR SS:[EBP-391C]
00DE71A2�燤OV DWORD PTR SS:[EBP+FFFFAFC4],EAX
00DE71A8�燩USH DWORD PTR SS:[EBP+FFFFAFC4]
00DE71AE�燙ALL 00DEEEFC�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�; JMP to msvcrt.??3@YAXPAX@Z
00DE71B3�燩OP ECX
00DE71B4�燙MP DWORD PTR SS:[EBP-3928],0
00DE71BB�燡E 00DE731A
00DE71C1�燤OV EAX,DWORD PTR DS:[E00028]
00DE71C6�燤OV EAX,DWORD PTR DS:[EAX+60]
00DE71C9�燤OV DWORD PTR SS:[EBP+FFFFADD4],EAX
00DE71CF�燤OV EAX,DWORD PTR SS:[EBP+FFFFADD4]
00DE71D5�燤OV DWORD PTR SS:[EBP-3EBC],EAX
00DE71DB�燙ALL 00DEA85B
00DE71E0�燦EG EAX
00DE71E2�燬BB EAX,EAX
00DE71E4�燗ND EAX,100
00DE71E9�燗DD EAX,100
00DE71EE�燤OV DWORD PTR SS:[EBP+FFFFADC0],EAX
00DE71F4�燩USH 1DF5E0D
00DE71F9�燩USH DWORD PTR SS:[EBP-3EBC]
00DE71FF�燣EA ECX,DWORD PTR SS:[EBP-3EBC]
00DE7205�燙ALL 00DC1071
00DE720A�營NC EAX
00DE720B�燲OR EDX,EDX
00DE720D�燤OV ECX,5F5E100
00DE7212�燚IV ECX
00DE7214�燤OV DWORD PTR SS:[EBP-3EBC],EDX
00DE721A�燤OVZX ECX,BYTE PTR SS:[EBP-37D8]
00DE7221�燦EG ECX
00DE7223�燬BB ECX,ECX
00DE7225�燗ND ECX,100
00DE722B�燗DD ECX,200
00DE7231�燤OV EAX,DWORD PTR SS:[EBP-3EBC]
00DE7237�燲OR EDX,EDX
00DE7239�燤OV ESI,2710
00DE723E�燚IV ESI
00DE7240�營MUL EAX,DWORD PTR SS:[EBP+FFFFADC0]
00DE7247�燲OR EDX,EDX
00DE7249�燤OV ESI,2710
00DE724E�燚IV ESI
00DE7250�燗DD ECX,EAX
00DE7252�燤OV DWORD PTR SS:[EBP-3EB8],ECX
00DE7258�燗ND DWORD PTR SS:[EBP-3EC0],0
00DE725F�燡MP SHORT 00DE726E
00DE7261�燤OV EAX,DWORD PTR SS:[EBP-3EC0]
00DE7267�營NC EAX
00DE7268�燤OV DWORD PTR SS:[EBP-3EC0],EAX
00DE726E�燤OV EAX,DWORD PTR SS:[EBP-3EC0]
00DE7274�燙MP EAX,DWORD PTR SS:[EBP-3EB8]�牐� <--就是这个参数会被上面的时间效验修改
00DE727A�燡NB 00DE731A
00DE7280�燩USH 1DF5E0D
00DE7285�燩USH DWORD PTR SS:[EBP-3EBC]
00DE728B�燣EA ECX,DWORD PTR SS:[EBP-3EBC]
00DE7291�燙ALL 00DC1071
00DE7296�營NC EAX
00DE7297�燲OR EDX,EDX
00DE7299�燤OV ECX,5F5E100
00DE729E�燚IV ECX
00DE72A0�燤OV DWORD PTR SS:[EBP-3EBC],EDX
00DE72A6�燤OV EAX,DWORD PTR SS:[EBP-3EBC]
00DE72AC�燲OR EDX,EDX
00DE72AE�燤OV ECX,2710
00DE72B3�燚IV ECX
00DE72B5�營MUL EAX,DWORD PTR SS:[EBP-37C8]
00DE72BC�燲OR EDX,EDX
00DE72BE�燤OV ECX,2710
00DE72C3�燚IV ECX
00DE72C5�燤OV DWORD PTR SS:[EBP-3EC8],EAX
00DE72CB�燤OV EAX,DWORD PTR SS:[EBP-3928]
00DE72D1�燤OV EAX,DWORD PTR DS:[EAX]
00DE72D3�燤OV DWORD PTR SS:[EBP-3EC4],EAX
00DE72D9�燤OV EAX,DWORD PTR SS:[EBP-3EC8]
00DE72DF�燣EA EAX,DWORD PTR DS:[EAX*4+4]
00DE72E6�燩USH EAX
00DE72E7�燤OV EAX,DWORD PTR SS:[EBP-3928]
00DE72ED�燗DD EAX,4
00DE72F0�燩USH EAX
00DE72F1�燩USH DWORD PTR SS:[EBP-3928]
00DE72F7�燙ALL DWORD PTR DS:[DF0300]�牐牐牐牐牐牐牐牐� ; msvcrt.memmove
00DE72FD�燗DD ESP,0C
00DE7300�燤OV EAX,DWORD PTR SS:[EBP-3EC8]
00DE7306�燤OV ECX,DWORD PTR SS:[EBP-3928]
00DE730C�燤OV EDX,DWORD PTR SS:[EBP-3EC4]
00DE7312�燤OV DWORD PTR DS:[ECX+EAX*4],EDX
00DE7315�燡MP 00DE7261
00DE731A�燩USH DWORD PTR SS:[EBP-37C4]�� <--到这里结束
--------------------------------------------------------------------------------

6.还訽代码中的CALL IAt地址

F8继续，第四个代码解码：

代码:--------------------------------------------------------------------------------
00DE7614�燙ALL 00DC14AC
00DE7619�燗DD ESP,10
00DE761C�燤OV EAX,DWORD PTR DS:[DFFA30]
00DE7621�燤OV DWORD PTR SS:[EBP-3EF4],EAX
00DE7627�燙MP DWORD PTR SS:[EBP-3EF4],0
00DE762E�燡E SHORT 00DE7666
00DE7630�燤OV EAX,DWORD PTR SS:[EBP-3EF4] 中国网管论坛bbs.bitsCN.com
00DE7636�燙MP DWORD PTR DS:[EAX],0
00DE7639�燡E SHORT 00DE7666
00DE763B�燤OV EAX,DWORD PTR SS:[EBP-3EF4]
00DE7641�燤OV EAX,DWORD PTR DS:[EAX]
00DE7643�燤OV EAX,DWORD PTR DS:[EAX]
00DE7645�燗DD EAX,DWORD PTR DS:[E004F0]
00DE764B�燤OV ECX,DWORD PTR SS:[EBP-3EF4]
00DE7651�燤OV ECX,DWORD PTR DS:[ECX]
00DE7653�燤OV DWORD PTR DS:[ECX],EAX
00DE7655�燤OV EAX,DWORD PTR SS:[EBP-3EF4]
00DE765B�燗DD EAX,4
00DE765E�燤OV DWORD PTR SS:[EBP-3EF4],EAX
00DE7664�燡MP SHORT 00DE7630
00DE7666�燲CHG EBX,ECX�牐牐牐�<--这里结束，F4到这里
00DE7668�燦OP
--------------------------------------------------------------------------------


F8继续，第五个代码解码:

代码:--------------------------------------------------------------------------------
00DE7BA2�燙ALL 00DC14AC
00DE7BA7�燗DD ESP,10
00DE7BAA�燤OV EAX,DWORD PTR DS:[DFFA34]
00DE7BAF�燤OV DWORD PTR SS:[EBP+FFFFB0C4],EAX
00DE7BB5�燙MP DWORD PTR SS:[EBP+FFFFB0C4],0
00DE7BBC�燡E SHORT 00DE7BF4 网管网www_bitscn_com
00DE7BBE�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0C4]
00DE7BC4�燙MP DWORD PTR DS:[EAX],0
00DE7BC7�燡E SHORT 00DE7BF4
00DE7BC9�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0C4]
00DE7BCF�燤OV EAX,DWORD PTR DS:[EAX]
00DE7BD1�燤OV EAX,DWORD PTR DS:[EAX]
00DE7BD3�燗DD EAX,DWORD PTR DS:[E004F0]
00DE7BD9�燤OV ECX,DWORD PTR SS:[EBP+FFFFB0C4]
00DE7BDF�燤OV ECX,DWORD PTR DS:[ECX]
00DE7BE1�燤OV DWORD PTR DS:[ECX],EAX
00DE7BE3�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0C4]
00DE7BE9�燗DD EAX,4
00DE7BEC�燤OV DWORD PTR SS:[EBP+FFFFB0C4],EAX
00DE7BF2�燡MP SHORT 00DE7BBE
00DE7BF4�燲CHG EAX,EDI�牐牐� <--这里结束，F4到这里
00DE7BF5�燲CHG CX,CX
--------------------------------------------------------------------------------


F8来到恢复代码CALL 段中:

代码:--------------------------------------------------------------------------------
00DE7D7B�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0BC]��<--计数器
00DE7D81�營NC EAX
00DE7D82�燤OV DWORD PTR SS:[EBP+FFFFB0BC],EAX
00DE7D88�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0BC]

网管u家u.bitsCN.com

00DE7D8E�燤OV ECX,DWORD PTR SS:[EBP-37E8]�牐� <--CALL 地址表
00DE7D94�燙MP DWORD PTR DS:[ECX+EAX*4],0�牐� //表是以00结束的
00DE7D98�燡E 00DE7E2E
00DE7D9E�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0BC]
00DE7DA4�燤OV ECX,DWORD PTR SS:[EBP-37E8]
00DE7DAA�燤OV EDX,DWORD PTR SS:[EBP-3900]�牐�//代码段的基地址00400000
00DE7DB0�燗DD EDX,DWORD PTR DS:[ECX+EAX*4]
00DE7DB3�燤OV DWORD PTR SS:[EBP+FFFFB0AC],EDX
00DE7DB9�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0AC]
00DE7DBF�燤OV EAX,DWORD PTR DS:[EAX]
00DE7DC1�燤OV DWORD PTR SS:[EBP+FFFFB0A8],EAX
00DE7DC7�燙MP DWORD PTR SS:[EBP+FFFFB0A8],90909090
00DE7DD1�燡E SHORT 00DE7E29
00DE7DD3�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0A8]
00DE7DD9�燬UB EAX,DWORD PTR SS:[EBP+FFFFB0B8]
00DE7DDF�燤OV DWORD PTR SS:[EBP+FFFFB0A8],EAX
00DE7DE5�燩USH DWORD PTR SS:[EBP+FFFFB0A8]
00DE7DEB�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0BC]
00DE7DF1�燲OR EDX,EDX
00DE7DF3�燩USH 10
00DE7DF5�燩OP ECX
00DE7DF6�燚IV ECX
00DE7DF8�燙ALL DWORD PTR DS:[EDX*4+DF0778]�牐� <-- CALL地址偏移加密算法 网管u家u.bitscn@com
00DE7DFF�燩OP ECX
00DE7E00�燤OV DWORD PTR SS:[EBP+FFFFB0A8],EAX
00DE7E06�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0A8]
00DE7E0C�燤OV ECX,DWORD PTR SS:[EBP-3928]
00DE7E12�燣EA EAX,DWORD PTR DS:[ECX+EAX*4]
00DE7E15�燤OV DWORD PTR SS:[EBP+FFFFB0A8],EAX
00DE7E1B�燤OV EAX,DWORD PTR SS:[EBP+FFFFB0AC]
00DE7E21�燤OV ECX,DWORD PTR SS:[EBP+FFFFB0A8]
00DE7E27�燤OV DWORD PTR DS:[EAX],ECX�牐牐牐牐�<--写入CALL地址
00DE7E29�燡MP 00DE7D7B
00DE7E2E�燤OV EAX,DWORD PTR DS:[E00500]�牐牐�<--这里结束
--------------------------------------------------------------------------------

F4到结束的地方，下面来恢复乱序的IAT表：
这个是参考了 yesky1�犘值姆椒ǎ�在此感谢了！

Ctrl+G 到地址00677000 中，写入代码：

代码:--------------------------------------------------------------------------------
00677000�燩USHAD
00677001�燤OV EBX,0EE3FF8�牐牐牐牐牐牐牐牐�//CALL 表
00677006�燤OV EAX,HprSnap5.00400000
0067700B�燤OV EDX,DWORD PTR DS:[EBX]
0067700D�燗DD EAX,EDX 中国网管联盟bitsCN.com
0067700F�燤OV ECX,DWORD PTR DS:[EAX]
00677011�燤OV ECX,DWORD PTR DS:[ECX]
00677013�燤OV ESI,HprSnap5.00676000�牐牐�//新的IAT表基地址
00677018�燤OV EDI,DWORD PTR DS:[ESI]
0067701A�燙MP ECX,EDI�牐牐牐牐牐牐牐牐� <--查找新的地址
0067701C�燡E SHORT HprSnap5.00677023
0067701E�燣EA ESI,DWORD PTR DS:[ESI+4]
00677021�燡MP SHORT HprSnap5.00677018
00677023�燤OV DWORD PTR DS:[EAX],ESI�牐� <--写入新的CALL 地址
00677025�燣EA EBX,DWORD PTR DS:[EBX+4]
00677028�燙MP DWORD PTR DS:[EBX],0�牐牐� //完成后结束
0067702B�燡E SHORT HprSnap5.0067702F
0067702D�燡MP SHORT HprSnap5.00677006
0067702F�燩OPAD
00677030�燡MP 00DE7E2E�牐牐牐牐牐牐牐牐� //回到壳代码中
00677035�燦OP
--------------------------------------------------------------------------------

复制正确的IAT表的二进制数据到地址00676000处：

代码:--------------------------------------------------------------------------------
00676000��4D 22 DB 77 68 6A DB 77�燤"踳hj踳
00676008��8B 6F DB 77 F4 6C DB 77�爧o踳鬺踳

网管u家u.bitscn@com

00676010��10 24 DA 77 9A 22 DA 77��$趙?趙
00676018�燚8 17 DA 77 D4 65 DB 77��?趙詄踳
00676020�燘1 63 DB 77 BB 28 DA 77�牨c踳?趙
�_�_�_�_
00676B58�燜A 49 AC 7C 16 49 AC 7C�狕I瑋I瑋
00676B60��16 72 B0 7C 5F 86 B0 7C��r皘_啺|
00676B68�燚B 8A B0 7C AF F3 AD 7C�犤姲|�骭|
00676B70�燙F 9E B1 7C 0F B3 B1 7C�犗灡|潮|
00676B78��1D CD B1 7C 31 CC B1 7C��捅|1瘫|
00676B80��5B 46 B4 7C D7 48 B4 7C�燵F磡譎磡
00676B88��00 00 00 00 F3 F0 C9 74��....箴蓆
00676B90��00 00 00 00�牐牐牐牐牐牐�....
--------------------------------------------------------------------------------

CALL地址表：

代码:--------------------------------------------------------------------------------
00EE3FF8��4B 10 00 00 92 10 00 00�燢..?..
00EE4000�燗7 10 00 00 B8 10 00 00��?..?..
00EE4008�燛A 10 00 00 14 11 00 00��?....
00EE4010��64 11 00 00 75 11 00 00�燿..u..
00EE4018��88 11 00 00 AB 11 00 00��?..?..
00EE4020��0C 12 00 00 30 12 00 00��...0..
00EE4028�燘8 12 00 00 CB 12 00 00��?..?.. 网管u家u.bitsCN.com
00EE4030�燛8 12 00 00 37 13 00 00��?..7..
00EE4038�燗C 13 00 00 B8 14 00 00��?..?..

�_�_

00EEB598�燙E 8A 1B 00 DC 8A 1B 00�犖�.軍.
00EEB5A0�燛C 8A 1B 00 07 8B 1B 00�犾�.?.
00EEB5A8��2B 8B 1B 00 38 8B 1B 00��+?.8?.
00EEB5B0��96 8B 1B 00 09 8C 1B 00�爾�..?.
00EEB5B8��7B 8C 1B 00 70 8D 1B 00�爗?.p?.
00EEB5C0�燘0 8D 1B 00 0F 8E 1B 00�牥�.?.
--------------------------------------------------------------------------------


运行上面的代码，回到壳中：

代码:--------------------------------------------------------------------------------
00DE7E2E�燤OV EAX,DWORD PTR DS:[E00500]
00DE7E33�燤OV AL,BYTE PTR DS:[EAX+3D2F]
00DE7E39�燤OV BYTE PTR SS:[EBP+FFFFAD8C],AL
00DE7E3F�燤OVZX EAX,BYTE PTR SS:[EBP+FFFFAD8C]
--------------------------------------------------------------------------------

F8继续运行：

代码:--------------------------------------------------------------------------------
00DE81D7�燩USH 0DFFC00
00DE81DC�燙ALL DWORD PTR DS:[DF02A0]�牐牐牐牐牐牐�; ntdll.RtlLeaveCriticalSection
00DE81E2�燤OV DWORD PTR DS:[DF68CC],0DF7364
00DE81EC�燩USH 1
00DE81EE�燩OP EAX
00DE81EF�燤OV ECX,DWORD PTR SS:[EBP-10]
00DE81F2�燤OV DWORD PTR FS:[0],ECX
00DE81F9�燩OP EDI
00DE81FA�燩OP ESI
00DE81FB�燩OP EBX
00DE81FC�燣EAVE
00DE81FD�燫ETN�牐牐牐� <--从这里退出
--------------------------------------------------------------------------------

来到这里，这是到OEP的代码：

代码:--------------------------------------------------------------------------------
00DE0CBD�燤OV DWORD PTR SS:[EBP-4],EDI
00DE0CC0�燤OV DWORD PTR DS:[DF68CC],0DF72D0�牐牐� ; ASCII "LP9"
00DE0CCA�燨R EDI,FFFFFFFF
00DE0CCD�燩USH EDI
00DE0CCE�燩USH EDI
00DE0CCF�燙ALL DWORD PTR DS:[DF0130]�牐牐牐牐牐牐�; kernel32.GetCurrentProcess
00DE0CD5�燩USH EAX
00DE0CD6�燤OV ESI,DWORD PTR DS:[DF0260]�牐牐牐牐� ; kernel32.SetProcessWorkingSetSize
00DE0CDC�燙ALL ESI
00DE0CDE�燤OV DWORD PTR DS:[DF68CC],0DF72C8�牐牐� ; ASCII "LP9a"

中国网管论坛bbs.bitsCN.com

00DE0CE8�燙MP DWORD PTR DS:[E004E4],EBX
00DE0CEE�燡E SHORT 00DE0D05�牐牐牐牐牐牐牐牐牐牐� <--这里不能跳
00DE0CF0�燙ALL 00DC83E3
00DE0CF5�燭EST AL,AL
00DE0CF7�燡NZ SHORT 00DE0D05
00DE0CF9�燩USH EDI
00DE0CFA�燩USH EDI
00DE0CFB�燤OV EAX,DWORD PTR DS:[E004E4]�牐牐牐牐�<--这里不正确，可能是上面的代码引起的。
00DE0D00�燩USH DWORD PTR DS:[EAX+4]
00DE0D03�燙ALL ESI�牐牐牐牐牐牐牐牐牐牐牐牐牐牐牐�<--訽来的程序到这里是进入OEP
00DE0D05�燤OV DWORD PTR DS:[DF68CC],0DF72C0�牐牐� ; ASCII "LP9b"
00DE0D0F�燤OV DWORD PTR SS:[EBP-4],EBX
00DE0D12�燡MP SHORT 00DE0D59
00DE0D14�燩USH 1
00DE0D16�燩OP EAX
00DE0D17�燫ETN
--------------------------------------------------------------------------------

运行到00DE0D00�燩USH DWORD PTR DS:[EAX+4] 时，对程序的00400000 代码段下内存访问中断，
Shift+F9运行，停在OEP中：

代码:--------------------------------------------------------------------------------
004E9C30�燩USH EBP�牐牐牐牐牐牐牐牐牐牐牐牐� //OEP

中国网管联盟bitsCN.com

004E9C31�燤OV EBP,ESP
004E9C33�燩USH -1
004E9C35�燩USH HprSnap5.005DF7A0
004E9C3A�燩USH HprSnap5.004EDAFC
004E9C3F�燤OV EAX,DWORD PTR FS:[0]
004E9C45�燩USH EAX
004E9C46�燤OV DWORD PTR FS:[0],ESP
004E9C4D�燬UB ESP,58
004E9C50�燩USH EBX
004E9C51�燩USH ESI
004E9C52�燩USH EDI
004E9C53�燤OV DWORD PTR SS:[EBP-18],ESP
--------------------------------------------------------------------------------


重新复制正确的IAT表的二进制数据到地址00676000处：

代码:--------------------------------------------------------------------------------
00676000��4D 22 DB 77 68 6A DB 77�燤"踳hj踳
00676008��8B 6F DB 77 F4 6C DB 77�爧o踳鬺踳
00676010��10 24 DA 77 9A 22 DA 77��$趙?趙
00676018�燚8 17 DA 77 D4 65 DB 77��?趙詄踳
00676020�燘1 63 DB 77 BB 28 DA 77�牨c踳?趙
�_�_�_�_
00676B58�燜A 49 AC 7C 16 49 AC 7C�狕I瑋I瑋
00676B60��16 72 B0 7C 5F 86 B0 7C��r皘_啺|
00676B68�燚B 8A B0 7C AF F3 AD 7C�犤姲|�骭|
00676B70�燙F 9E B1 7C 0F B3 B1 7C�犗灡|潮|
00676B78��1D CD B1 7C 31 CC B1 7C��捅|1瘫|
00676B80��5B 46 B4 7C D7 48 B4 7C�燵F磡譎磡
00676B88��00 00 00 00 F3 F0 C9 74��....箴蓆
00676B90��00 00 00 00�牐牐牐牐牐牐�....
--------------------------------------------------------------------------------

终于走完了全程，完成了修复任务。dump下修改好的程序，用ImportREC修复dump的程序。

写到这里，发觉iat表的临时空间可以不要修改，在第6步中就可以自由修改存放地址。
作为方法，还是保留下来。

第二部分 待续