卡巴斯基技术论坛 » 入侵防护交流 » PECompact的OEP的简易查找方法

李釗濠 发表于 2008-8-18 12:43

PECompact的OEP的简易查找方法

该方法试用于PECompactV1.71,V1.76,V1.82&nbsp; <BR><BR>具体看下面的示例&nbsp; <BR><BR>&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>这是98的Calc.exe使用PECompact1.82压缩过的结果&nbsp; <BR><BR>&nbsp; <BR><BR>010153A0 &gt;EB 06&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP SHORT CALC.010153A8&lt;==第一条指令&nbsp; <BR><BR>010153A2&nbsp; 68 E0190100&nbsp; &nbsp; &nbsp; PUSH 119E0&lt;======这就是程序的原始OEP的RVA地址&nbsp; <BR><BR>010153A7&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RETN&nbsp; <BR><BR>010153A8&nbsp; 9C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHFD&nbsp; <BR><BR>010153A9&nbsp; 60&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHAD&nbsp; <BR><BR>010153AA&nbsp; E8 02000000&nbsp; &nbsp; &nbsp; CALL CALC.010153B1&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>这是98的Notepad.exe使用PECompact1.82压缩过的结果&nbsp; <BR><BR>0040AB20 &gt;EB 06&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP SHORT NOTEPAD.0040AB28&lt;==第一条指令&nbsp; <BR><BR>0040AB22&nbsp; 68 CC100000&nbsp; &nbsp; &nbsp; PUSH 10CC&lt;======这就是程序的原始OEP的RVA地址&nbsp; <BR><BR>0040AB27&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RETN&nbsp; <BR><BR>0040AB28&nbsp; 9C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHFD&nbsp; <BR><BR>0040AB29&nbsp; 60&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHAD&nbsp; <BR><BR>0040AB2A&nbsp; E8 02000000&nbsp; &nbsp; &nbsp; CALL NOTEPAD.0040AB31&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>这是使用PECompact1.82压缩过LordPE.exe [rts]的结果&nbsp; <BR><BR>004239A0 &gt;EB 06&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP SHORT X.004239A8&lt;==第一条指令&nbsp; <BR><BR>004239A2&nbsp; 68 103E0000&nbsp; &nbsp; &nbsp; PUSH 3E10&lt;======这就是程序的原始OEP的RVA地址&nbsp; <BR><BR>004239A7&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RETN&nbsp; <BR><BR>004239A8&nbsp; 9C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHFD&nbsp; <BR><BR>004239A9&nbsp; 60&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHAD&nbsp; <BR><BR>004239AA&nbsp; E8 02000000&nbsp; &nbsp; &nbsp; CALL X.004239B1&nbsp; <BR><BR>004239AF&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XOR EAX,EAX&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>这是PECompact1.82自身的结果&nbsp; <BR><BR>&nbsp; <BR><BR>0043E760 &gt;EB 06&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP SHORT PECOMPAC.0043E768&lt;==第一条指令&nbsp; <BR><BR>0043E762&nbsp; 68 00E00300&nbsp; &nbsp; &nbsp; PUSH 3E000&lt;======这就是程序的原始OEP的RVA地址&nbsp; <BR><BR>0043E767&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RETN&nbsp; <BR><BR>0043E768&nbsp; 9C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHFD&nbsp; <BR><BR>0043E769&nbsp; 60&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHAD&nbsp; <BR><BR>0043E76A&nbsp; E8 02000000&nbsp; &nbsp; &nbsp; CALL PECOMPAC.0043E771&nbsp; <BR><BR>0043E76F&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XOR EAX,EAX&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>这是ODBG1.06的结果&nbsp; <BR><BR>&nbsp; <BR><BR>004F8200 &gt;EB 06&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JMP SHORT X.004F8208&lt;==第一条指令&nbsp; <BR><BR>004F8202&nbsp; 68 00100000&nbsp; &nbsp; &nbsp; PUSH 1000&lt;======这就是程序的原始OEP的RVA地址&nbsp; <BR><BR>004F8207&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RETN&nbsp; <BR><BR>004F8208&nbsp; 9C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHFD&nbsp; <BR><BR>004F8209&nbsp; 60&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSHAD&nbsp; <BR><BR>004F820A&nbsp; E8 02000000&nbsp; &nbsp; &nbsp; CALL X.004F8211&nbsp; <BR><BR>004F820F&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XOR EAX,EAX&nbsp; <BR><BR>004F8211&nbsp; 8BC4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV EAX,ESP&nbsp; <BR><BR>==============================================&nbsp; <BR><BR>&nbsp; <BR><BR>很明显,原始程序入口为&nbsp; <BR><BR>VA=ImageBase+RVA&nbsp; <BR><BR>;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;&nbsp; <BR><BR>下面是使用TRW2000手动脱PECompact的壳&nbsp; <BR><BR>&nbsp; <BR><BR>&nbsp; <BR><BR>(标准TRW2000 V1.22,我想修改版也应该可以吧)&nbsp; <BR><BR>&nbsp; <BR><BR>Load PECompact V1.82&nbsp; <BR><BR>&lt;F8&gt;&nbsp; <BR><BR>看上面的指令,0043E762&nbsp; 68 00E00300&nbsp; &nbsp; &nbsp; PUSH 3E000&nbsp; <BR><BR>由于ImageBas=400000,所以OEP=43E000&nbsp; <BR><BR>所以&nbsp; <BR><BR>bp if(EIP==43E000)&nbsp; <BR><BR>g&nbsp; <BR><BR>pedump c:\xx.exe&nbsp; <BR><BR>g&nbsp; <BR><BR>&nbsp; <BR><BR>好了,看看C:\xx.exe是不是正常了&nbsp; <BR>

ngc0717 发表于 2008-8-18 23:25

汇编的东西，有点头晕............:@7#

查看完整版本: PECompact的OEP的简易查找方法