破文作者: cyto
发表时间: 2007-4-2 14:11
链接地址: http://www.unpack.cn/viewthread.php?tid=11579
得到修复CC的程序Enjoy,小试一把,感觉真好!
目标程序:Managed Switch Port Mapping Tool v1.50
PEiD:Armadillo 3.78 - 4.xx -> Silicon Realms Toolworks [Overlay]
Armadillo_Find_Protected:
!- Protected Armadillo
Protection system (Professional)
!-
Debug-Blocker
Enable Import Table Elimination
Enable Nanomites Processing
!-
Variable Backup Keys
!-
Better/Slower Compression
!-
!- Version 4.48
脚本:转单进程+Armadillo V4.0-V4.4.Standard.Protection.osc
来到oep:
00479D7C E8 B3040000 call spmap.0047A234 ; This is the OEP! Found By: fly
00479D81 ^ E9 35FDFFFF jmp spmap.00479ABB
00479D86 CC int3
00479D87 CC int3
查看IAT范围:010DD008-010DDFE0
010DD000 000001F1
010DD004 00080101
010DD008 78233C85 MFC80.78233C85
010DD00C 78239CD5 MFC80.78239CD5
010DD010 78239B1B MFC80.78239B1B
010DD014 78239C1C MFC80.78239C1C
...
010DDFD8 78F90000 offset SHELL32.#561
010DDFDC 77990000 offset OLEAUT32.#345
010DDFE0 7C420000
010DDFE4 00000000
ArmInline:将IAT放置于空地49F800,修复。
LordPE:dump得到dumped.exe
ImportREC:Refix dump得到dumped_.exe
Enjoy:修复得到FixCC_dumped_.exe
运行ok,感叹工具的神奇!
站在牛人的肩膀上真是爽啊。
附带上脱壳修复后的程序。
附件下载:http://www.unpack.cn/attachment.php?aid=7472
|