ACProtect1.23的stolen code處理
一 stolen code分析
ollydbg除int3異常外全部忽略。硬體斷點設定仍然按原來不變即在入口ESP-4=12FFC0處。F9執行。出現第一次int3異常後，不是按shift-f9而是F9,這是該程式的特例。
到硬體斷點斷下,以後見到pushad就察看esp,然後相應在esp-4處設定硬體斷點(有些行尾部有stolen code說明)
006F00CE PUSH EDX
006F00CF MOV EDX,ACProtec.006DBEED
006F00D4 MOV DWORD PTR DS:[EDX],EDI
006F00D6 POP EDX
006F00D7 PUSH DWORD PTR DS:[6DBEED] ; ACProtec.004DED6B
006F00DD PUSH EDX
006F00DE MOV DWORD PTR SS:[ESP],ACProtec.006DBF15
006F00E5 POP DWORD PTR DS:[6DBEB5] ; ACProtec.006DBF15
006F00EB MOV EDI,DWORD PTR DS:[6DBEB5] ; ACProtec.006DBF15
006F00F1 MOV DWORD PTR DS:[EDI],EBX
006F00F3 POP DWORD PTR DS:[6DBEE9] ; ACProtec.004DED6B
006F00F9 PUSH DWORD PTR DS:[6DBEE9] ; ACProtec.004DED6B
006F00FF POP EDI
006F0100 PUSH DWORD PTR DS:[6DBF15]
006F0106 MOV DWORD PTR SS:[ESP],EBP //1.push ebp
006F0109 MOV DWORD PTR DS:[6DBF19],ESP //儲存esp,準備付給EBP
006F010F PUSH EDI
006F0110 MOV EDI,ACProtec.006DBEE5
006F0115 MOV DWORD PTR DS:[EDI],ESI
006F0117 POP EDI
006F0118 PUSH DWORD PTR DS:[6DBEE5]
006F08BB MOV DWORD PTR SS:[ESP],EDI
006F08BE MOV DWORD PTR DS:[6DBEB1],ACProtec.006DBF19
006F08C8 PUSH DWORD PTR DS:[6DBEB1]
006F08CE POP DWORD PTR DS:[6DBEF5]
006F08D4 PUSH EDX
006F08D5 MOV DWORD PTR SS:[ESP],ESI
006F08D8 PUSH ECX
006F08D9 MOV ECX,ACProtec.006DBEF5
006F08DE MOV ESI,ECX
006F08E0 POP ECX
006F08E1 MOV EDI,DWORD PTR DS:[ESI]
006F08E3 POP DWORD PTR DS:[6DBEAD]
006F08E9 MOV ESI,DWORD PTR DS:[6DBEAD]
006F08EF MOV EBP,DWORD PTR DS:[EDI] //2.mov ebp,esp
006F08F1 POP DWORD PTR DS:[6DBEF1]
006F08F7 MOV DWORD PTR DS:[6DBEA9],EDX
006F08FD PUSH DWORD PTR DS:[6DBEA9]
006F1085 MOV DWORD PTR DS:[6DBEA5],ACProtec.006DBEF1
006F108F MOV EDX,DWORD PTR DS:[6DBEA5] ; ACProtec.006DBEF1
006F1095 MOV EDI,DWORD PTR DS:[EDX]
006F1097 MOV EDX,DWORD PTR SS:[ESP]
006F109A POP DWORD PTR DS:[6DBEA1]
006F10A0 MOV DWORD PTR DS:[6DBE9D],EDX
006F10A6 PUSH DWORD PTR DS:[6DBE9D]
006F10AC MOV DWORD PTR SS:[ESP],EBX
006F10AF PUSH EBX
006F10B0 MOV DWORD PTR SS:[ESP],ACProtec.006DBF11
006F10B7 MOV EBX,DWORD PTR SS:[ESP]
006F10BA POP DWORD PTR DS:[6DBE99]
006F10C0 MOV DWORD PTR DS:[EBX],EDX
006F10C2 POP DWORD PTR DS:[6DBEE1]
006F10C8 PUSH EAX
006F10C9 MOV EAX,ACProtec.006DBEE1
006F10CE MOV EBX,DWORD PTR DS:[EAX]
006F10D0 POP EAX
006F10D1 NOP
006F10D2 NOP
006F188B PUSH DWORD PTR DS:[6DBF11]
006F1891 PUSH EDI ; ACProtec.004DED6B
006F1892 POP DWORD PTR DS:[6DBEDD]
006F1898 PUSH DWORD PTR DS:[6DBEDD]
006F189E MOV DWORD PTR DS:[6DBE95],ECX
006F18A4 PUSH DWORD PTR DS:[6DBE95]
006F18AA PUSH ACProtec.006DBF0D
006F18AF POP ECX
006F18B0 PUSH ESI
006F18B1 MOV ESI,ECX
006F18B3 MOV EDI,ESI
006F18B5 POP ESI
006F18B6 POP DWORD PTR DS:[6DBE91]
006F18BC MOV ECX,DWORD PTR DS:[6DBE91]
006F18C2 MOV DWORD PTR DS:[EDI],ECX
006F18C4 MOV EDI,DWORD PTR SS:[ESP]
006F18C7 POP DWORD PTR DS:[6DBED9]
006F18CD PUSH DWORD PTR DS:[6DBF0D]
006F18D3 PUSH ECX
006F18D4 MOV ECX,ACProtec.006DBED5
006F18D9 MOV DWORD PTR DS:[ECX],EBX
006F3932 PUSH ESI
006F3933 MOV DWORD PTR SS:[ESP],ECX
006F3936 PUSH ACProtec.00406EDC
006F393B POP ECX
006F393C PUSH EDX
006F393D MOV EDX,ACProtec.006DBF19
006F3942 MOV DWORD PTR DS:[EDX],ECX
006F3944 POP EDX
006F3945 MOV ECX,DWORD PTR SS:[ESP]
006F3948 POP DWORD PTR DS:[6DBF09]
006F394E CALL DWORD PTR DS:[6DBF19] //call 00406EDC
006F3954 MOV EAX,DWORD PTR DS:[4F85E4] //mov eax,[4f85e4]
006F3959 MOV EAX,DWORD PTR DS:[EAX] //mov eax,[eax]
006F395B PUSH EDI
006F395C MOV DWORD PTR SS:[ESP],ACProtec.0046261C
006F3963 POP DWORD PTR DS:[6DBF15]
006F3969 CALL DWORD PTR DS:[6DBF15] //call 0046261c
006F396F PUSH DWORD PTR DS:[4F83A0] ; ACProtec.004FAD14
006F3975 MOV ECX,DWORD PTR SS:[ESP] //mov ecx,[4f83a0]
006F3978 POP DWORD PTR DS:[6DBF05]
006F4122 MOV EAX,DWORD PTR DS:[4F85E4] //mov eax,[4f85e4]
006F4127 MOV EAX,DWORD PTR DS:[EAX] //mov eax,[eax]
006F4129 PUSH DWORD PTR DS:[47FEA4] ; ACProtec.0047FEF0
006F412F POP DWORD PTR DS:[6DBF01] ; ACProtec.0047FEF0
006F4135 MOV EDX,DWORD PTR DS:[6DBF01] //mov edx,[47fea4]
006F413B MOV DWORD PTR DS:[6DBEFD],EDX
006F4141 PUSH DWORD PTR DS:[6DBEFD] ; ACProtec.004D1078
006F4147 MOV DWORD PTR DS:[6DBEF9],ACProtec.00462634
006F4151 MOV EDX,DWORD PTR DS:[6DBEF9]
006F4157 PUSH EDX
006F4158 POP DWORD PTR DS:[6DBF11]
006F415E POP DWORD PTR DS:[6DBEF5] ; ACProtec.006DBF19
006F4164 MOV EDX,DWORD PTR DS:[6DBEF5] ; ACProtec.006DBF19
006F416A CALL DWORD PTR DS:[6DBF11] //call 00462634
006F4170 NOP
006F4171 NOP
006F4988 PUSH DWORD PTR DS:[4F82D0] ; ACProtec.004FAD0C
006F498E POP DWORD PTR DS:[6DBEF1] ; ACProtec.004FAD0C
006F4994 MOV ECX,DWORD PTR DS:[6DBEF1] //mov ecx,[4f82d0]
006F499A MOV EAX,DWORD PTR DS:[4F85E4] //mov eax,[4f85e4]
006F499F MOV EAX,DWORD PTR DS:[EAX] //mov eax,[eax]
006F49A1 PUSH DWORD PTR DS:[47FB14] ; ACProtec.0047FB60
006F49A7 MOV EDX,DWORD PTR SS:[ESP] //mov edx,[47fb14]
006F49AA POP DWORD PTR DS:[6DBEED] ; ACProtec.004DED6B
006F49B0 PUSH EDI
006F49B1 MOV DWORD PTR SS:[ESP],ESI
006F49B4 PUSH ACProtec.00462634
006F49B9 POP ESI
006F49BA PUSH ESI
006F49BB POP DWORD PTR DS:[6DBF0D]
006F49C1 POP ESI
006F49C2 CALL DWORD PTR DS:[6DBF0D] //call 00462634
006F49C8 MOV EAX,DWORD PTR DS:[4F85E4] //mov eax,[4f85e4]
006F49CD MOV EAX,DWORD PTR DS:[EAX] //mov eax,[eax]
006F49CF NOP
fake OEP:
004D12E3 CALL ACProtec.004626B4
004D12E8 CALL ACProtec.004049D8
二 整理修復OEP
push ebp
mov ebp,esp
sub esp,10
mov eax,04d1078
call 00406edc
mov eax,[4f85e4]
mov eax,[eax]
call 0046261c
mov ecx,[4f83a0]
mov eax,[4f85e4]
mov eax,[eax]
mov edx,[47fea4]
call 00462634
mov ecx,[04f82d0]
mov eax,[4f85e4]
mov eax,[eax]
mov edx,[047fb14]
call 00462634
mov eax,[4f85e4]
mov eax,[eax]