手脱EXE32Pack v1.39

1.PEID查壳

EXE32Pack v1.39

2.载入OD，先F8跟一下

0040A00C >  3BC0            cmp eax,eax                       ; //程序入口点
0040A00E                je short sticker.0040A012
0040A010     553BC074 >add dword ptr ds:[ebx+0x74C03B55]>
0040A01A    3BC9            cmp ecx,ecx
0040A01C                je short sticker.0040A01F
0040A01E    BC 563BD274     mov esp,0x74D23B56

3.直到这里，我们看到一个push入栈，ESP跟一下，下硬件访问断点，然后shift+F9

0040A012                  push ebp
0040A013    3BC0            cmp eax,eax                       ; //ESP定律
0040A015                je short sticker.0040A019
0040A017     533BC974 >add dword ptr ds:[ebx+0x74C93B53]>
0040A021    D27402        sal byte ptr ds:[edx+eax-0x7F],cl
0040A025     E8         test dword ptr ds:[edi-0x18],edx
0040A028                add byte ptr ds:[eax],al

4.ESP落脚点，然后继续F8单步跟一下

0040EE6F    3BE4            cmp esp,esp                       ; //ESP落脚点
0040EE71                je short sticker.0040EE74
0040EE73    BF FFE0B801     mov edi,0x1B8E0FF
0040EE78                add byte ptr ds:[eax],al
0040EE7A    003B            add byte ptr ds:[ebx],bh
0040EE7C    C9              leave
0040EE7D                je short sticker.0040EE81
0040EE7F    81845F 3BD27401>add dword ptr ds:[edi+ebx*+0x174>

5.OK，找到指向OEP的关键跳

0040EE74  - FFE0            jmp eax                           ; //指向OEP的关键跳
0040EE76    B8      mov eax,0x1
0040EE7B    3BC9            cmp ecx,ecx
0040EE7D                je short sticker.0040EE81
0040EE7F    81845F 3BD27401>add dword ptr ds:[edi+ebx*+0x174>
0040EE8A                je short sticker.0040EE8E
0040EE8C     5B3BDB74 >add dword ptr ds:[esi+0x74DB3B5B]>

6.来到OEP

0040535F                  push ebp                          ; //来到OEP
    8BEC            mov ebp,esp
    6A FF           push -0x1
     D0124000     push sticker.004012D0
          push sticker.
0040536E    :A1   mov eax,dword ptr fs:[]
                  push eax
    : >mov dword ptr fs:[],esp
0040537C    83EC          sub esp,0x68

7.loadPE+ImportREC脱壳，运行，查壳

OK，可以运行，查壳：Microsoft Visual C++ v6.0 (16 ms)