1. 主程式的脫殼
014F:00990B35 8B10
MOV EDX,[EAX]
014F:00990B37 8B4508 MOV
EAX,[EBP+08]
014F:00990B3A 035018 ADD
EDX,[EAX+18]
014F:00990B3D 8B4508 MOV
EAX,[EBP+08]
014F:00990B40 8B401C MOV
EAX,[EAX+1C]
014F:00990B43 E880F9FFFF CALL
009904C8 <-這裡! F8進入
014F:009904C8 89C4
MOV ESP,EAX
014F:009904CA 89D0
MOV EAX,EDX
014F:009904CC 8B1D34569900 MOV
EBX,[00995634]
014F:009904D2 89041C MOV
[EBX+ESP],EAX
014F:009904D5 61
POPAD
014F:009904D6 50
PUSH EAX <-記下EAX的值(61C528)
014F:009904D7 C3
RET <-這裡用Procdump脫殼
2. 獲得完整的.idata section
如上得到的脫殼後的程式,在你改過EIP後仍無法執行. 還有工作要做,你得用Icedump.
014F:009909FF 8B4508 MOV
EAX,[EBP+08]
014F:00990A02 8D4824 LEA
ECX,[EAX+24]
014F:00990A05 8B4508 MOV
EAX,[EBP+08]
014F:00990A08 8B500C MOV
EDX,[EAX+0C]
014F:00990A0B 8B4508 MOV
EAX,[EBP+08]
014F:00990A0E 8B4008 MOV
EAX,[EAX+08]
014F:00990A11 E8FAF6FFFF CALL
00990110
014F:00990A16 33C0
XOR EAX,EAX <-這裡!
014F:00990A18 5A
POP EDX
014F:00990A19 59
POP ECX
014F:00990A1A 59
POP ECX
014F:00990A1B 648910 MOV
FS:[EAX],EDX
014F:00990A1E EB13
JMP 00990A33
在00990A16行, Pagein D 62e000 3000 c:\thebat.bin
3. 執行Hex編輯程式,用完整的.idata替換掉脫殼後主程式中.idata部分. Job done.