手脱PE Pack v1.0

1.PEID查壳

PE Pack v1.0

2.载入OD，一上来就这架势，先F8走着

 > /            je short Pepack_1.        ; //入口点
  -\E9 C49D0000     jmp Pepack_1.0040D000
0040323C                add byte ptr ds:[eax],al
0040323E                add byte ptr ds:[eax],al
                add byte ptr ds:[eax],al
                add byte ptr ds:[eax],al
                add byte ptr ds:[eax],al

3.走到这里，一个pushad，又是我最喜欢的ESP定律，硬件访问断点，shift+F9一次

0040D000                  pushad
0040D001    E8      call Pepack_1.0040D006            ; //ESP
0040D006    5D              pop ebp
0040D007    83ED          sub ebp,0x6
0040D00A    80BD 3E050000 >cmp byte ptr ss:[ebp+0x53E],0x1
0040D011    0F84    je Pepack_1.0040D25F
0040D017    C685 3E050000 >mov byte ptr ss:[ebp+0x53E],0x1

4.ESP落脚点，这个落脚点是一个大跳转，也是指向OEP的关键跳

0040D270  - FFE0            jmp eax                           ; //ESP落脚点
0040D272    8D85 CE050000   lea eax,dword ptr ss:[ebp+0x5CE]
0040D278                  push eax
0040D279    8DBD D1040000   lea edi,dword ptr ss:[ebp+0x4D1]
0040D27F                  push ebx
0040D280                  push edi
0040D281                  push eax   

5.来到OEP，脱壳把

004010CC                  push ebp                        ;//OEP
004010CD    8BEC            mov ebp,esp
004010CF    83EC          sub esp,0x44
004010D2                  push esi
004010D3    FF15 E4634000   call dword ptr ds:[0x4063E4]
004010D9    8BF0            mov esi,eax
004010DB    8A00            mov al,byte ptr ds:[eax]
004010DD    3C            cmp al,0x22
004010DF     1B           jnz short Pepack_1.004010FC

6.运行，查壳

运行OK，查壳：Microsoft Visual C++ v6.0 SPx