找到程序真正入口并进行脱壳
现在, 希望你没有关闭symbol loader. 假如你关掉的话,重新运行它,打开并装入已压缩的notepad.exe
当你这次点击"Yes"时, 你会发现你已在进入Softice中了...
我把下面的代码贴出来并加上注解.
************************* 你在SICE中所见到的 *************************
**Softice中断时,你会在这儿. 一直按F10走过这部分代码0041454F FFFF INVALID00414556 55 PUSH EBP00414557 8BEC MOV EBP,ESP00414559 56 PUSH ESI0041455A 57 PUSH EDI0041455B 756B JNZ 004145C8 (NO JUMP)0041455D 6800010000 PUSH 0000010000414562 E8D60B0000 CALL 0041513D00414567 83C404 ADD ESP,040041456A 8B7508 MOV ESI,[EBP+08]0041456D A3B4F14000 MOV [0040F1B4],EAX00414572 85F6 TEST ESI,ESI00414574 7423 JZ 00414599 (JUMP)00414599 33FF XOR EDI,EDI0041459B 57 PUSH EDI0041459C 893D8C184100 MOV [0041188C],EDI004145A2 FF1510224100 CALL [KERNEL32!GetModuleHandleA]004145A8 8BF0 MOV ESI,EAX004145AA 68FF000000 PUSH 000000FF004145AF A1B4F14000 MOV EAX,[0040F1B4]004145B4 897D10 MOV [EBP+10],EDI004145B7 C7450C01000000 MOV DWORD PTR [EBP+0C],00000001004145BE 50 PUSH EAX004145BF 56 PUSH ESI004145C0 FF15F4214100 CALL [KERNEL32!GetModuleFileNameA]004145C6 EB03 JMP 004145CB (JUMP)004145CB E830EAFFFF CALL 00413000004145D0 FF7510 PUSH DWORD PTR [EBP+10]004145D3 FF750C PUSH DWORD PTR [EBP+0C]004145D6 56 PUSH ESI004145D7 E806000000 CALL 004145E2
**当你走过这个位于004145D7的CALL, 压缩过的notepad.exe就自由运行了. 再次用symbol loader装入.
再次来到这个CALL时, 按F8追进去. 你将看到以下代码. 不过记着先BPX 004145D7.004145E2 64A100000000 MOV EAX,FS:[00000000]004145E8 55 PUSH EBP004145E9 8BEC MOV EBP,ESP004145EB 6AFF PUSH FF004145ED 6810E04000 PUSH 0040E010004145F2 68EC5D4100 PUSH 00415DEC004145F7 50 PUSH EAX004145F8 64892500000000 MOV FS:[00000000],ESP004145FF 83EC14 SUB ESP,1400414602 C745E401000000 MOV DWORD PTR [EBP-1C],0000000100414609 53 PUSH EBX0041460A 56 PUSH ESI0041460B 57 PUSH EDI0041460C 8965E8 MOV [EBP-18],ESP0041460F C745FC00000000 MOV DWORD PTR [EBP-04],0000000000414616 8B450C MOV EAX,[EBP+0C]00414619 83F801 CMP EAX,010041461C 7510 JNZ 0041462E (NO JUMP)0041461E E886030000 CALL 004149A900414623 FF05C0F14000 INC DWORD PTR [0040F1C0]00414629 E882F6FFFF CALL 00413CB00041462E 8B35C0F14000 MOV ESI,[0040F1C0]00414634 85F6 TEST ESI,ESI00414636 0F848D000000 JZ 004146C9 (NO JUMP)0041463C 833DC4F1400000 CMP DWORD PTR [0040F1C4],0000414643 7526 JNZ 0041466B (NO JUMP)00414645 833D6417410000 CMP DWORD PTR [00411764],000041464C 741D JZ 0041466B (NO JUMP)0041464E A164174100 MOV EAX,[00411764]
**EAX现在的值是000010CC
