📄 chap8-5-5-3.htm.primary
字号:
<html>
<head>
<title>Crack Tutorial</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link rel="stylesheet" href="style/css.css" type="text/css">
<link rel="stylesheet" href="../STYLE/Css.css" type="text/css">
</head>
<body bgcolor="white" text="#000000" link="#004080" vlink="#004080" background="../image/Back.gif">
<p><a href="../catalog.htm">目录</a>＞＞第8章</p>
<p align="center" class="shadow1Copy"><b class="p3">第8章 压缩与脱壳</b></p>
<table width="80%" border="0" cellspacing="0" cellpadding="3" align="center" bgcolor="#bcbcbc" bordercolor="#111111" class="shadow1">
<tr>
<td class="shadow1" width="20%">
<div align="center"><a href="Chap8-1.htm"><font color="#FFFFFF">第一节 PE文件格式</font></a></div>
</td>
<td class="shadow1" width="20%">
<div align="center"><a href="Chap8-2.htm"><font color="#FFFFFF">第二节 认识脱壳</font></a></div>
</td>
<td class="shadow1" width="20%">
<div align="center"><a href="Chap8-3-1.htm"><font color="#FFFFFF">第三节 自动脱壳</font></a></div>
</td>
<td class="shadow1" width="20%">
<div align="center"><a href="Chap8-4.htm"><font color="#FFFFFF">第四节 手动脱壳</font></a></div>
</td>
<td class="shadow1" width="20%">
<div align="center"><a href="Chap8-5.htm"><font color="#FFFFFF">第五节 脱壳高级篇</font></a></div>
</td>
</tr>
</table>
<p align="center"><span class="p9"><b>第五节 脱壳高级篇</b></span></p>
<p align="center"><b> 5、ASProtect保护</b></p>
<table border="1" width="80%" cellpadding="5" bordercolor="#111111" bgcolor="#efefef" align="center" cellspacing="0">
<tr>
<td width="33%" valign="middle" align="center" class="p9" height="23">
<div align="left"><span class="p9"><span class="p9"> <span class="p9">1、<span class="p9"><span class="p9"><a href="Chap8-5-5-1.htm"><span class="p9"><span class="p9"><span class="p9"><span class="p9">ASProtect
v0.95</span></span></span></span>保护</a></span></span></span></span></span></div>
</td>
<td valign="middle" align="center" class="p9" height="23" width="34%">
<div align="left"><span class="p9"><span class="p9"><span class="p9"> </span>2、<span class="p9"><a href="Chap8-5-5-2.htm">ASProtect
v0.94b保护</a></span></span></span></div>
</td>
<td valign="middle" align="center" class="p9" height="23" width="33%">
<div align="left"><span class="p9"><span class="p9"> 3、<a href="Chap8-5-5-3.htm"><span class="p9"><span class="p9">ASProtect
v0.9x</span></span></a></span></span></div>
</td>
</tr>
<tr>
<td width="33%" valign="middle" align="center" class="p9" height="23">
<div align="left"><span class="p9"><span class="p9"> </span></span>4、ASProtect
1.1x </div>
</td>
<td valign="middle" align="center" class="p9" height="23" width="34%">
<div align="left"><span class="p9"><span class="p9"><span class="p9"> </span>5、ASProtect
1.2x </span></span></div>
</td>
<td valign="middle" align="center" class="p9" height="23" width="33%">
<div align="left"><span class="p9"><span class="p9"> 6、</span>ASProtect
1.3x </span></div>
</td>
</tr>
</table>
<p align="center"><b>3、ASProtect v0.9x保护</b><span class="p9"><br>
</span></p>
<p><span class="p9"> Advanced Zip Password Recovery 3.0的脱壳 <br>
<br>
教程写作: 冰毒 <br>
作者信箱: break_ice@hotmail.com <br>
写作日期: 2000年3月25日 <br>
版权声明: 本文没有版权,允许任意转贴和修改. 但如果只引用文中部分内容时,请最好注明原文出处,以表示对一位Cracker同行的劳动的尊重. <br>
<br>
使用工具: <br>
TRW2000 1.03 <br>
ProcDump 1.6.2 <br>
Hexworkshop 3.02 </span></p>
<p><span class="p9">下载：<a href="Exercise/chap8-5-5-3.zip">Advanced Zip Password
Recovery 3.0</a><br>
<br>
比起其Beta版来,AZPR 3.0正式版的保护更为加强. 1. 对Softice的多处Check,用FrogsICE不能完全骗过; 2. CRC的校验;
3. 动态地址(好象是这个名吧?); 4.对Loader的防范,这回用Process Patch不行了. <br>
<br>
用Softice跟踪它会是一种痛苦 (当然完全可以用Softice,只是你要了解程序的Anti-debugger技巧,在关键的Check后改变跳转方向).
这次祭出我们中国人的骄傲TRW2000来对付它. <br>
<br>
先用Procdump的PE Editor查看一下程序的.idata section记下数值. Virtual size=2000, Virtual offset=21000.
另外,记下程序的Image Base: 400000. <br>
<br>
1. 运行TRW, Load程序. 程序中断在入口处. 但接下来无论是否BPX设断只要G继续运行程序,便会出错. 下Faults off, G, OK程序退出.
<br>
2. 试BPM 421000 (.idata的offset), 再Load程序. G, 程序可以被正常中断, COOL! <br>
3. G,当程序第三次(? 记不清了. 原则是d 421000显示的data区见到XXXX0200 000000字样)中断时,BD*,F10直到下面的语句
<br>
<br>
********************************* <br>
注意: 程序每次Load时Offset都不一样,你的机器中的XXXX:YYYYYYYY肯定和下面的不同. 下Code on指令,这样才好参照下面的代码.
另外,下面所摘的几段代码是引用高手tiamath的.因为我不清楚在TRW下如何dump屏幕 (谁能指教一下:);而用ICEDump的pagein n命令来Dump
Softice的屏幕,我的机器会死机. :( <br>
********************************* <br>
<br>
0167:004F34CD 50 PUSH EAX <br>
0167:004F34CE B890274F00 MOV EAX,004F2790 <br>
0167:004F34D3 50 PUSH EAX <br>
0167:004F34D4 B8A4274F00 MOV EAX,004F27A4 <br>
0167:004F34D9 50 PUSH EAX <br>
0167:004F34DA B8A0284F00 MOV EAX,004F28A0 <br>
0167:004F34DF 50 PUSH EAX <br>
0167:004F34E0 B8AC274F00 MOV EAX,004F27AC <br>
0167:004F34E5 50 PUSH EAX <br>
0167:004F34E6 B8646C4E00 MOV EAX,004E6C64 <br>
0167:004F34EB 50 PUSH EAX <br>
0167:004F34EC 8B4508 MOV EAX,[EBP+08]
<br>
0167:004F34EF 8D4824 LEA ECX,[EAX+24]
<br>
0167:004F34F2 8B4508 MOV EAX,[EBP+08]
<br>
0167:004F34F5 8B500C MOV EDX,[EAX+0C]
<br>
0167:004F34F8 8B4508 MOV EAX,[EBP+08]
<br>
0167:004F34FB 8B4008 MOV EAX,[EAX+08]
<br>
0167:004F34FE E899F4FFFF CALL 004F299C <br>
0167:004F3503 33C0 XOR EAX,EAX <--在这里Dump
.idata <br>
<br>
下指令 W 421000 L 2000 azprdata.bin <br>
<br>
OK. 再往下,直到 <br>
<br>
0167:004F3637 8D4818 LEA ECX,[EAX+18]
<br>
0167:004F363A 8B4508 MOV EAX,[EBP+08]
<br>
0167:004F363D 8B10 MOV EDX,[EAX] <br>
0167:004F363F 8B4508 MOV EAX,[EBP+08]
<br>
0167:004F3642 8B401C MOV EAX,[EAX+1C]
<br>
0167:004F3645 E8EAF6FFFF CALL 004F2D34 <--F8进入 <br>
0167:004F364A 5F POP EDI <br>
0167:004F364B 5E POP ESI <br>
<br>
到了 <br>
<br>
0167:004F2D72 E9148B1DA8 JMP A86CB88B <br>
0167:004F2D77 8E4F00 MOV CS,[EDI+00] <br>
0167:004F2D7A EB01 JMP 004F2D7D <br>
0167:004F2D7C EB89 JMP 004F2D07 <br>
0167:004F2D7E 041C ADD AL,1C <br>
0167:004F2D80 EB02 JMP 004F2D84 <br>
0167:004F2D82 EBE8 JMP 004F2D6C <br>
0167:004F2D84 61 POPAD <br>
0167:004F2D85 EB01 JMP 004F2D88 <br>
0167:004F2D87 E850EB02E9 CALL E95218DC <br>
0167:004F2D8C 17 POP SS <br>
0167:004F2D8D E802000000 CALL 004F2D94 <br>
0167:004F2D92 E91758C35E JMP 5F1285AE <br>
0167:004F2D97 5B POP EBX <br>
0167:004F2D98 59 POP ECX <br>
<br>
此时小心地跟踪,碰到JMP时按F8而不要按F10 <br>
<br>
直到显示变成 <br>
<br>
0167:004F2D72 E9148B1DA8 JMP A86CB88B <br>
0167:004F2D77 8E4F00 MOV CS,[EDI+00] <br>
0167:004F2D7A EB01 JMP 004F2D7D <br>
0167:004F2D7C EB89 JMP 004F2D07 <br>
0167:004F2D7E 041C ADD AL,1C <br>
0167:004F2D80 EB02 JMP 004F2D84 <br>
0167:004F2D82 EBE8 JMP 004F2D6C <br>
0167:004F2D84 61 POPAD <br>
0167:004F2D85 EB01 JMP 004F2D88 <br>
0167:004F2D87 E850EB02E9 CALL E95218DC <br>
0167:004F2D8C 17 POP SS <br>
0167:004F2D8D E802000000 CALL 004F2D94 <br>
0167:004F2D92 E91758C35E JMP 5F1285AE <br>
0167:004F2D94 58 POP EAX <-- 光标位于此行时,
EAX=401000 <br>
0167:004F2D95 C3 RET <--这里 <br>
<br>
下Suspend指令. 回到Windows. 用ProcDump来Dump(full)脱壳的程序,得到azprdump.exe. 你也可以用TRW的PEDUMP命令来得到脱壳程序,但我个人的经验很容易死机,所以我宁愿用ProcDump来做.
<br>
<br>
4. 用PE Editor修改程序的Entry Point为1000. 并查看脱壳后程序的.idata section. 此时Raw size=1670,
Raw offset=1FC00. 修改Directory中Import Table的RVA=21000,SIZE=1670. <br>
5. 用Hexworkshop打开azprdump.exe和azprdata.bin. Goto到exe文件的1FC00偏移处,Select Block大小为1670.
拷贝.bin文件的同样大小(1670)的Block,粘贴到exe文件中以替换掉不正确的.idata section. <br>
<br>
现在,再试着运行程序,应该可以正常运行了. 如果程序出错,再做一件事: 把 .bss section的raw size值改为00000000 (高手tiamath的建议).
<br>
<br>
有了脱壳的程序,大家应该会Patch它成为注册版了吧. 只需改一个字节. <br>
<br>
结语: 用本文所描述的方法,可以对绝大多数Asprotect+Aspack保护的程序进行成功的脱壳. 大家读完这篇教程,不妨找几个程序开刀. 比方说,The
Bat! 1.39现在不应该再难住大家了. <br>
<br>
好了,这次就到这儿了,下回见. <br>
<br>
致谢: <br>
<br>
感谢SV, Hobgoblin, tiamath. 没有他们的帮助,我不可能做到这一步. </span></p>
<div align="center"></div>
<p align="center"><a href="../Catalog.htm"><img src="../image/navtoc.gif" width="84" height="23" border="0"></a><a href="Chap8-5-5-2.htm"><img src="../image/Navprev.gif" width="80" height="23" border="0"></a><a href="../appen-a/append-A.htm"><img src="../image/navnext.gif" width="83" height="23" border="0"></a></p>
<hr width=735>
<div align="center"><span class="p9"><font size="2"><span class="p9"><font size="2"><span class="p9">Copyright
© 2000-2001 <a href="http://www.pediy.com/">KanXue Studio</a> All Rights
Reserved.</span></font></span></font></span></div>
</body>
</html>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -