一.OEP 通常壓縮殼加殼的DLL找OEP是比較簡(jiǎn)單的
DLL卸載時(shí)會(huì)再次從EP處運(yùn)行，幾個(gè)跳轉(zhuǎn)后就會(huì)到OEP了 0094BEA0 807C24 08 01 cmp byte ptr ss:[esp 8],1
//進(jìn)入OllyDBG后暫停在EP
0094BEA5 0F85 7E010000 jnz 0094C029
//這里在DLL卸載時(shí)會(huì)跳轉(zhuǎn)，就是去OEP的捷徑了 0094C029 E9 BE3AFAFF jmp 008EFAEC
//這里就是跳OEP了
_____________________________________________
二.輸入表 RLPack V1.1X Full Edition加殼exe文件會(huì)加密某些輸入表，而加殼DLL則很少加密輸入表的
BP GetProcAddress
Shift F9，中斷后取消斷點(diǎn)，Alt F9返回 0094BF57 56 push esi
0094BF58 FF95 E3090000 call near dword ptr ss:[ebp 9E3] ; kernel32.LoadLibraryA
0094BF5E 8985 4E0A0000 mov dword ptr ss:[ebp A4E],eax
0094BF64 85C0 test eax,eax
0094BF66 0F84 C2000000 je 0094C02E
0094BF6C 8BC6 mov eax,esi
0094BF6E EB 5F jmp short 0094BFCF
0094BF70 8B85 520A0000 mov eax,dword ptr ss:[ebp A52]
0094BF76 8B00 mov eax,dword ptr ds:[eax]
0094BF78 A9 00000080 test eax,80000000
0094BF7D 74 14 je short 0094BF93
0094BF7F 35 00000080 xor eax,80000000
0094BF84 50 push eax
0094BF85 8B85 520A0000 mov eax,dword ptr ss:[ebp A52]
0094BF8B C700 20202000 mov dword ptr ds:[eax],202020 ; UNICODE " Hercegovina"
0094BF91 EB 06 jmp short 0094BF99
0094BF93 FFB5 520A0000 push dword ptr ss:[ebp A52]
0094BF99 FFB5 4E0A0000 push dword ptr ss:[ebp A4E]
0094BF9F FF95 E7090000 call near dword ptr ss:[ebp 9E7] ; kernel32.GetProcAddress
0094BFA5 85C0 test eax,eax
//返回這里
0094BFA7 0F84 81000000 je 0094C02E
0094BFAD 8907 mov dword ptr ds:[edi],eax ; ntdll.RtlDeleteCriticalSection
//填充系統(tǒng)函數(shù)地址
//EDI=008F3154 注意觀察這個(gè)地址
0094BFAF 83C7 04 add edi,4
0094BFB2 8B85 520A0000 mov eax,dword ptr ss:[ebp A52]
0094BFB8 EB 01 jmp short 0094BFBB
0094BFBA 40 inc eax
0094BFBB 8038 00 cmp byte ptr ds:[eax],0
0094BFBE 75 FA jnz short 0094BFBA
0094BFC0 40 inc eax
0094BFC1 8985 520A0000 mov dword ptr ss:[ebp A52],eax
0094BFC7 66:8178 02 0080 cmp word ptr ds:[eax 2],8000
0094BFCD 74 A1 je short 0094BF70
0094BFCF 8038 00 cmp byte ptr ds:[eax],0
0094BFD2 75 9C jnz short 0094BF70
0094BFD4 EB 01 jmp short 0094BFD7
0094BFD6 46 inc esi
0094BFD7 803E 00 cmp byte ptr ds:[esi],0
0094BFDA 75 FA jnz short 0094BFD6
0094BFDC 46 inc esi
0094BFDD 40 inc eax
0094BFDE 8B38 mov edi,dword ptr ds:[eax]
0094BFE0 E8 4B000000 call 0094C030
0094BFE5 83C0 04 add eax,4
0094BFE8 8985 520A0000 mov dword ptr ss:[ebp A52],eax
0094BFEE 803E 01 cmp byte ptr ds:[esi],1
0094BFF1 0F85 60FFFFFF jnz 0094BF57
//循環(huán)處理輸入表 現(xiàn)在來(lái)手動(dòng)確定輸入表的RVA和Size
在左下角的數(shù)據(jù)窗口Ctrl G:008F3154，點(diǎn)右鍵->Long->Address
008F3150 00000000
008F3154 7C93188A ntdll.RtlDeleteCriticalSection
008F3158 7C9210ED ntdll.RtlLeaveCriticalSection
……
008F37E0 7D610EC0 shell32.ShellExecuteA
008F37E4 00000000
008F37E8 76337CD8
008F37EC 7632311E
008F37F0 00000000 輸入表開(kāi)始RVA=008F3154-00870000=00083154
輸入表Size=008F37F0-008F3154=0000069C 三.重定位表 其實(shí)寫這篇教程的價(jià)值就在于這部分了
經(jīng)過(guò)跟蹤發(fā)現(xiàn)RLPack沒(méi)有加密重定位表，這就為我們脫殼減少了麻煩 0094BFF7 68 00400000 push 4000
0094BFFC 68 54180000 push 1854
0094C001 FFB5 560A0000 push dword ptr ss:[ebp A56]
0094C007 FF95 EF090000 call near dword ptr ss:[ebp 9EF] ; kernel32.VirtualFree
0094C00D 68 00400000 push 4000
0094C012 68 00200C00 push 0C2000
0094C017 FFB5 3A0A0000 push dword ptr ss:[ebp A3A]
0094C01D FF95 EF090000 call near dword ptr ss:[ebp 9EF] ; kernel32.VirtualFree
//清理戰(zhàn)場(chǎng)了
0094C023 E8 55000000 call 0094C07D
//重定位處理[/code][code]0094C07D 60 pushad
0094C07E 8BB5 460A0000 mov esi,dword ptr ss:[ebp A46]
//[ebp A46]=00087000 重定位表RVA ★
0094C084 0BF6 or esi,esi
0094C086 74 67 je short 0094C0EF
0094C088 8BBD 3E0A0000 mov edi,dword ptr ss:[ebp A3E]
//[ebp A3E]=00400000 文件基址
0094C08E 8B4424 48 mov eax,dword ptr ss:[esp 48]
//[esp 48]=00870000 映像基址
0094C092 8985 420A0000 mov dword ptr ss:[ebp A42],eax
0094C098 3BC7 cmp eax,edi
//比較是否相同
0094C09A 74 53 je short 0094C0EF
//不同不跳就需要重定位處理了
//注意：此時(shí)程序沒(méi)有重定位，可以現(xiàn)在Dump，這樣脫殼后就不需要修改dump文件基址了 ★
0094C09C 03F0 add esi,eax
//ESI=00087000 00870000=008F7000 重定位表VA
0094C09E EB 4A jmp short 0094C0EA
0094C0A0 8B16 mov edx,dword ptr ds:[esi]
0094C0A2 8B46 04 mov eax,dword ptr ds:[esi 4]
0094C0A5 8985 4A0A0000 mov dword ptr ss:[ebp A4A],eax
0094C0AB 01B5 4A0A0000 add dword ptr ss:[ebp A4A],esi
0094C0B1 83C6 08 add esi,8
0094C0B4 EB 2C jmp short 0094C0E2
0094C0B6 0FB706 movzx eax,word ptr ds:[esi]
0094C0B9 8BD8 mov ebx,eax
0094C0BB C1EB 0C shr ebx,0C
0094C0BE 8BCB mov ecx,ebx
0094C0C0 69DB 00100000 imul ebx,ebx,1000
0094C0C6 2BC3 sub eax,ebx
0094C0C8 03C2 add eax,edx
0094C0CA 0385 420A0000 add eax,dword ptr ss:[ebp A42]
0094C0D0 83F9 03 cmp ecx,3
0094C0D3 75 0A jnz short 0094C0DF
0094C0D5 2938 sub dword ptr ds:[eax],edi
0094C0D7 8B8D 420A0000 mov ecx,dword ptr ss:[ebp A42]
0094C0DD 0108 add dword ptr ds:[eax],ecx
0094C0DF 83C6 02 add esi,2
0094C0E2 3BB5 4A0A0000 cmp esi,dword ptr ss:[ebp A4A]
0094C0E8 72 CC jb short 0094C0B6
0094C0EA 833E 00 cmp dword ptr ds:[esi],0
0094C0ED 75 B1 jnz short 0094C0A0
//循環(huán)重定位處理
0094C0EF 61 popad
//處理完后ESI=009000F8
//Relocation Table Size=009000F8-008F7000=000090F8 ★
0094C0F0 C3 retn
_____________________________________________
四.完成脫殼 0094C028 61 popad
0094C029 E9 BE3AFAFF jmp 008EFAEC
//飛向光明之巔
0094C02E 61 popad
0094C02F C3 retn 008EFAEC 55 push ebp
//OEP RVA=008EFAEC-00870000=0007FAEC
008EFAED 8BEC mov ebp,esp
008EFAEF 83C4 C4 add esp,-3C
008EFAF2 B8 04F98E00 mov eax,008EF904
008EFAF7 E8 CC6DF8FF call 008768C8
008EFAFC 33C0 xor eax,eax
008EFAFE A3 442C8F00 mov dword ptr ds:[8F2C44],eax
008EFB03 E8 DC4BF8FF call 008746E4 運(yùn)行ImportREC，由于此DLL加載后已經(jīng)進(jìn)行重定位處理，所以去掉“Use PE Header From Disk”選項(xiàng)
選擇OllyDbg的loaddll.exe進(jìn)程，Pick DLL選擇iBox.dll
填入OEP RVA=0007FAEC，輸入表RVA=00083154，輸入表Size=0000069C，Get Imports
可以新增區(qū)段修復(fù)，也可以把輸入表放在程序無(wú)用的空白處。 使用LordPE修改dumped_.dll的Relocation Table RVA=00087000，Relocation Table Size=000090F8
附件中iBox.UnPacKed.dll只是簡(jiǎn)單優(yōu)化，如果想優(yōu)化的完美點(diǎn)那就要多費(fèi)時(shí)間了。
脫殼完成