Aspack2.12 用OllyDbg配合ollyDump手动脱壳

使用工具：ollydbg、LordPE脱壳对象：用ASPack212加壳的记事本程序运行平台：win2k脱ASPack212版压缩的程序方法：01010374 EB 4A JMP SHORT NOTEPAD.010103C001010376 8907 MOV DWORD PTR DS:[EDI],EAX01010378 8385 49050000 04 ADD DWORD PTR SS:[EBP+549],40101037F ^E9 32FFFFFF JMP NOTEPAD.010102B601010384 8906 MOV DWORD PTR DS:[ESI],EAX01010386 8946 0C MOV DWORD PTR DS:[ESI+C],EAX01010389 8946 10 MOV DWORD PTR DS:[ESI+10],EAX0101038C 83C6 14 ADD ESI,140101038F 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]0101038F 8B95 22040000 MOV EDX,DWORD PTR SS:[EBP+422]01010395 ^E9 EBFEFFFF JMP NOTEPAD.010102850101039A B8 20640000 MOV EAX,6420====》此处移入EAX的其实就是入口值。0101039F 50 PUSH EAX010103A0 0385 22040000 ADD EAX,DWORD PTR SS:[EBP+422]====》程序入口地址01006420移入EAX。010103A6 59 POP ECX010103A7 0BC9 OR ECX,ECX010103A9 8985 A8030000 MOV DWORD PTR SS:[EBP+3A8],EAX010103AF 61 POPAD===》标志。010103B0 75 08 JNZ SHORT NOTEPAD.010103BA010103B2 B8 01000000 MOV EAX,1010103B7 C2 0C00 RETN 0C010103BA 68 00000000 PUSH 0====》程序运行到此处时，此处值将改变为入口地址值（见下面的代码）。010103BF C3 RETN=====》返回程序入口处。应在此中断，然后单步到程序真正入口处，再DUMP。010103C0 8B85 26040000 MOV EAX,DWORD PTR SS:[EBP+426]010103C6 8D8D 3B040000 LEA ECX,DWORD PTR SS:[EBP+43B]010103CC 51 PUSH ECX010103CD 50 PUSH EAX010103CE FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]010103D4 8985 55050000 MOV DWORD PTR SS:[EBP+555],EAX010103DA 8D85 47040000 LEA EAX,DWORD PTR SS:[EBP+447]010103E0 50 PUSH EAX010103E1 FF95 510F0000 CALL DWORD PTR SS:[EBP+F51]010103E7 8985 2A040000 MOV DWORD PTR SS:[EBP+42A],EAX程序运行后：01010395 ^E9 EBFEFFFF JMP NOTEPAD.010102850101039A B8 20640000 MOV EAX,64200101039F 50 PUSH EAX010103A0 0385 22040000 ADD EAX,DWORD PTR SS:[EBP+422]010103A6 59 POP ECX010103A7 0BC9 OR ECX,ECX010103A9 8985 A8030000 MOV DWORD PTR SS:[EBP+3A8],EAX010103AF 61 POPAD=====》标志。010103B0 75 08 JNZ SHORT NOTEPAD.010103BA010103B2 B8 01000000 MOV EAX,1010103B7 C2 0C00 RETN 0C010103BA 68 20640001 PUSH NOTEPAD.01006420====》程序真正入口地址。010103BF C3 RETN====>返回到程序真正入口处。010103C0 8B85 26040000 MOV EAX,DWORD PTR SS:[EBP+426]010103C6 8D8D 3B040000 LEA ECX,DWORD PTR SS:[EBP+43B]010103CC 51 PUSH ECX010103CD 50 PUSH EAX010103CE FF95 490F0000 CALL DWORD PTR SS:[EBP+F49]010103D4 8985 55050000 MOV DWORD PTR SS:[EBP+555],EAX010103DA 8D85 47040000 LEA EAX,DWORD PTR SS:[EBP+447]010103E0 50 PUSH EAX010103E1 FF95 510F0000 CALL DWORD PTR SS:[EBP+F51]程序跳到：01006419 C2 0800 RETN 80100641C 33C0 XOR EAX,EAX0100641E ^EB F5 JMP SHORT NOTEPAD.0100641501006420 55 PUSH EBP====》此处为真正入口。01006421 8BEC MOV EBP,ESP01006423 6A FF PUSH -101006425 68 88180001 PUSH NOTEPAD.010018880100642A 68 D0650001 PUSH NOTEPAD.010065D0 ; JMP to msvcrt._except_handler30100642F 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]01006435 50 PUSH EAXDUMP出来以后，修改入口点为00006420，然后重建PE。OK！（DUMP工具为LordPE）