Asprotect v2.0 stolen code
One repair journey
[Objective]: Longjiu Miracle V3.6 (MU99)
[Tu]: Olydbg1.1 (DIY Version), Lordpe, ImportRec1.6F
[Renuction]: Compare the code to regenerate the shell
[Operation Platform]: Windows XP SP2
[Author]: loveboom [dfcg] [fcg] [US]
[Brief Description]: This shell should be aware of the new version of the pumping code very "serious", so I have to "voyeur".
Because it is an external, I will not put the source, the target program you go to find it.
[Detailed Procedure]:
Set OD to open the INT3 exception item, other ignore. Mainly telling how to find back Stolan Code, so I don't talk about IAT, I will find it after the last memory is abnormal.
Push [xxxxxx]
Retn
The code is the beginning of the original OEP execution of the original program code. I simplified the process with the script. I changed it with the script of the ASPR2 written:
/ *
//
Script for asprotect v2.0
Author: loveboom
Email: bmd2chen@tom.com
OS: WinXP SP2, OLLYDBG 1.1, OLLYScript v0.92
Date: 2004-11-15
Action: Stop Stolen Code
Config: Ignore All Exceptions Except 'Int 3 Breaks'
Note: if you have one or more question, email me please, thank you!
//
* /
Var Addr
lblask:
Ask "Press 1 Clear Junkcode, Press Other Key Run Script."
CMP $ Result, 1
Je lblccode
LBLSETTING:
Msgyn "Setting: IGNORE All Exceptions Except 'INT 3 BREAKS', Continue?"
CMP $ Result, 1
JE lblbp1 // This is modified
RET
// Here you start changing
LBLBP1:
GPA "LoadLibrarya", "kernel32.dll" // Get the address of LoadLibrarya
Mov Addr, $ Result
Add Addr, B // BP LoadLibrarya 0B
BP Addr
Run
LBLBC1:
BC Addr
RTU // Return to user code
RTR / / execution to return
STO
Find EIP, # e8 # // Find CALL
Go $ RESULT
STI // follow up
Find EIP, # 8b550c8b128902 # // Look for IAT code
Mov Addr, $ Result
Add Addr, 5
Mov [addr], # 891a #
// Call the original code below
Start:
DBH
Run
LBL1: Find EIP, # 5b5A59c3 # // Found Commands' POP EBX, POP EDX, POP
ECX, RETN '
CMP $ Result, 0
Je lblerr
Mov Addr, $ Result
Add Addr, 3
BP Addr
LBL2:
ESTO
LBL3:
CMP EIP, ADDR
JNE LBL2
BC Addr
LBL4:
Find EIP, # ff35 ???????? c3 #
CMP $ Result, 0
Je lblerr
Mov Addr, $ Result
Add Addr, 2
Mov addr, [addr] // Get Push Address
Mov addr, [addr] // Get Push Value (Address)
BP Addr
Run
LBL5:
CMP EIP, ADDR
JNE LBLERR
BC Addr
LBL7:
CMT EIP, "Stolen Code."
MSGYN "CLEAR JUNKCODE?" // Clear Junkcode?
CMP $ Result, 0
Je lblend
lblccode:
// jmp 01
REPL EIP, # 2eeb01 ?? #, # 90909090 #, 1000
REPL EIP, # 65eb01 ?? #, # 90909090 #, 1000
REPL EIP, # f2eb01 ?? #, # 90909090 #, 1000
REPL EIP, # f3eb01 ?? #, # 90909090 #, 1000
REPL EIP, # f3eb01 ?? #, # 90909090 #, 1000
REPL EIP, # eb01 ?? #, # 909090 #, 1000
// jmp 02
REPL EIP, # 26eb02 ???? #, # 9090909090 #,10
REPL EIP, # 3eeb02 ???? #, # 9090909090 #,1000
REPL EIP, # f3eb02 ???? #, # 9090909090 #,1000
REPL EIP, # eb02 ???? #, # 90909090 #, 1000
Lblend:
MSG "script by loveboom [DFCG] [FCG] [US], Thank you for using my scripts!"
RET
LBLERR:
Msg "Error! Script Aborted.maybe Target is Not Protect By Asprotect 2.0 OR
Your Forgot Ignore All Exceptions Except 'Int 3 Breaks'. "
RET
After finishing, use the script to run to the destination.
Note: It is necessary to take a heart to see it, because the shell writes N multi-spam code, and I may fall with it.
00f802ff 55 push ebp; ☆☆☆☆☆ stolen code. First line, first write down this address, then useful
00F80300 81E5 148A85F7 and EBP, F7858A14
00f80306 90 NOP
......
00F803F2 90 NOP
00F803F3 90 NOP
00F803F4 90 NOP
00F803F5 2BC3 SUB EAX, EBX
00f803f7 58 pop EAX00F803F8 0BF7 or ESI, EDI
00f803fa 5e POP ESI
00F803fb 90 NOP
00F803FC 90 NOP
00F803FD 90 NOP
00F803FE 90 NOP
00F803FF 2BEE SUB EBP, ESI; ☆☆☆☆ here's second line MOV EBP, ESP
00f80401 6a ff push -1; ☆☆☆☆☆ third lines of push -1
00F80403 90 NOP
00F80404 90 NOP
......
00F80408 FF7424 0C Push DWORD PTR SS: [ESP C]
00F8040C 66: 9C Pushfw
00f8040e 51 Push ECX
00F8040F 03CD Add ECX, EBP
00f80411 03cd add ECX, EBP
00F80413 034C24 18 Add ECX, DWORD PTR SS: [ESP 18]
00F80417 B9 3E064200 MOV ECX, 42063E
00F8041C 8D4C14 12 LEA ECX, DWORD PTR SS: [ESP EDX 12]
00F80420 2BCA SUB ECX, EDX
00F80422 8D4C01 EE LEA ECX, DWORD PTR DS: [ECX EAX-12]
00F80426 2BC8 SUB ECX, EAX
00F80428 64:90 NOP; Superfluous Prefix
00F8042A 90 NOP
00F8042B 90 NOP
00F8042C 90 NOP
00F8042D 8D4C39 06 Lea ECX, DWORD PTR DS: [ECX EDI 6]
00F80431 2BCF SUB ECX, EDI
00F80433 68 68A74300 PUSH 43A768
00F80438 90 NOP
00F80439 90 NOP
00F8043A 90 NOP
00F8043B 90 NOP
00f8043c 8f01 pop dword PTR DS: [ECX]; ☆☆☆☆ This is the fourth sentence, when you see this value, you know .push 43a768
-------------------------
0012ffb8 0043a768 99mu.0043a768
-------------------------
00F8043E 59 POP ECX
00F8043F 66: 9D POPFW ...
00f8062e 64: ff35 0000000> Push DWORD PTR fs: [0]
00f80635 66: 9c pushfw
00F80637 53 Push EBX
00F80638 90 NOP
00F80639 90 NOP
00F8063A 90 NOP
00F8063B 90 NOP
00F8063c 90 NOP
00f8063d 81d3 4efb8179 ADC EBX, 7981FB4E
00F80643 8BDC MOV EBX, ESP
00F80645 90 NOP
00F80646 90 NOP
00F80647 90 NOP
00F80648 90 NOP
00F80649 8D5B 06 Lea EBX, DWORD PTR DS: [EBX 6]
00F8064C 52 Push EDX
00F8064D 8D940B AE784500 Lea EDX, DWORD PTR DS: [EBX ECX 4578AE]
00F80654 8D9427 AA1B4300 LEA EDX, DWORD PTR DS: [EDI 431BAA]
00F8065B 2BD7 SUB EDX, EDI
00F8065D 8913 MOV DWORD PTR DS: [EBX], EDX; ☆☆☆☆☆ Push 431baa
00F8065F 5A POP EDX
00F80660 5B POP EBX
00F80661 90 NOP
00f80662 90 NOP
00f80663 90 NOP
00F80664 90 NOP
00F80665 66: 9D POPFW
00F80667 64: A1 00000000 MOV EAX, DWORD PTR FS: [0]; ☆☆☆☆☆
00f8066d 50 push eax; ☆☆☆☆☆
00f8066e 64: 8925 0000000> MOV DWORD PTR FS: [0], ESP; ☆☆☆☆☆
00F80675 36:90 NOP; Superfluous Prefix
00F80677 90 NOP
00F80678 90 NOP
00f80679 83ec 68 SUB ESP, 68; ☆☆☆☆☆
00f8067c 53 push ebx; ☆☆☆☆☆
00f8067d 56 push eSI; ☆☆☆☆☆ 00f8067e 57 push edi; ☆☆☆☆☆
00F8067F 8965 E8 MOV DWORD PTR SS: [EBP-18], ESP; ☆☆☆☆☆
00F80682 33dB xor EBX, EBX; ☆☆☆☆☆
00F80684 895D FC MOV DWORD PTR SS: [EBP-4], EBX; ☆☆☆☆☆
00f80687 6a 02 push 2; ☆☆☆☆☆
00f80689 ff15 94644300 Call DWORD PTR DS: [436494]; ☆☆☆☆☆
00F8068F 59 POP ECX; ☆☆☆☆☆
00F80690 830D 10874500 f> OR DWORD PTR DS: [458710], fffffff; ☆☆☆☆☆
00F80697 830D 14874500 f> OR DWORD PTR DS: [458714], fffffff; ☆☆☆☆☆
00F8069E FF15 BC644300 Call DWORD PTR DS: [4364BC]; ☆☆☆☆☆
00F806A4 90 NOP
00F806A5 90 NOP
00F806A6 90 NOP
00F806A7 90 NOP
00F806A8 334C24 28 xor ECX, DWORD PTR SS: [ESP 28]; here is garbage code
00f806ac 83c9 71 or ECX, 71
00F806AF 90 NOP
00F806B0 90 NOP
00F806B1 90 NOP
00F806B2 90 NOP
00F806B3 FF35 04874500 Push DWORD PTR DS: [458704]
00F806B9 034C24 38 Add ECX, DWORD PTR SS: [ESP 38]; Junk Code
00F806BD 034C24 18 Add ECX, DWORD PTR SS: [ESP 18]
00F806C1 59 POP ECX;
☆☆☆☆☆ Here is Mov ECX, [458704]
00F806C2 8908 MOV DWORD PTR DS: [EAX], ECX;
☆☆☆☆☆
00F806C4 FF15 5C644300 Call DWORD PTR DS: [43645C];
☆☆☆☆☆ msvcrt .__ p__commode
00F806CA 83E9 33 SUB ECX, 3300F806CD 83D9 8F SBB ECX, -71
00F806D0 90 NOP
00F806D1 90 NOP
00F806D2 90 NOP
00F806D3 90 NOP
00F806D4 90 NOP
00f806d5 ff35 00874500 Push DWORD PTR DS: [458700]
00f806db 334c24 28 xor ECX, DWORD PTR SS: [ESP 28]
00F806DF 83D9 89 SBB ECX, -77
00F806E2 59 POP ECX;
☆☆☆☆☆ MOV ECX, [458700]
00F806E3 8908 MOV DWORD PTR DS: [EAX], ECX;
☆☆☆☆☆
00F806E5 64:90 NOP; Superfluous Prefix
00F806E7 90 NOP
00F806E8 90 NOP
00F806E9 90 NOP
00F806EA 8D440B 36 Lea Eax, DWORD PTR DS: [EBX ECX 36]
00f806ee ff35 50644300 Push DWORD PTR DS: [436450]; MSVCRT._ADJUST_FDIV
00f806f4 81c8 fa2d991f or eax, 1F992DFA
00F806FA 58 POP EAX;
☆☆☆☆☆ Mov Eax, [436450]
00f806fb ^ E9 88Feffff JMP 00F80588
00F80588 8B00 MOV EAX, DWORD PTR DS: [EAX]; ☆☆☆☆☆
00F8058A A3 0C874500 MOV DWORD PTR DS: [45870C], EAX; ☆☆☆☆☆
00f8058f 68 9d08f800 push 0f8089d; here is the first CALL code
00f 80594 E8 67fa1000 call 01090000; Follow up
Come in and see:
There is more garbage code after you come in, but you don't have to be afraid, it is actually right.
01090000 64:90 NOP; follow up, here
01090002 90 NOP
01090003 90 NOP
01090004 90 NOP
01090005 51 PUSH ECX
01090006 9C Pushfd
01090007 90 NOP01090008 90 NOP
01090009 90 NOP
0109000A 90 NOP
0109000B 81C1 9F3A8AB8 ADD ECX, B88A3A9F
01090011 64:90 NOP; Superfluous Prefix
......
Always find a CALL register
0109010D 0BD1 or EDX, ECX
0109010F C1D9 23 RCR ECX, 23; SHIFT Constant Out of Range 1..31
01090112 034C24 38 Add ECX, DWORD PTR SS: [ESP 38]
01090116 68 A429D600 PUSH 0D629A4
0109011B 81E1 D82E9C40 and ECX, 409C2ED8
01090121 59 POP ECX
01090122 FFD1 CALL ECX; find it down, continue to follow up
01090124 FF7424 10 Push DWORD PTR SS: [ESP 10]
01090128 8D4C0B 06 LEA ECX, DWORD PTR DS: [EBX ECX 6]
Come here again here:
00D629A4 55 Push EBP
00D629A5 8BEC MOV EBP, ESP
00D629A7 83C4 F8 Add ESP, -8
00D629AA 53 Push EBX
00D629AB 56 Push ESI
00d629ac 57 Push EDI
00D629AD 8B5D 08 MOV EBX, DWORD PTR SS: [EBP 8]
Here is a lot of garbage code.
......
00D62A12 8B45 14 MOV EAX, DWORD PTR SS: [EBP 14]
00d62a15 50 push eax
00D62A16 E8 CDF3FFFF CALL 00D61DE8
00d62a1b 50 push eax
00D62A1C 8BCE MOV ECX, ESI
00D62A1E 8B55 18 MOV EDX, DWORD PTR SS: [EBP 18]
00D62A21 8BC3 MOV EAX, EBX
00d62a23 e8 8cfdffff Call 00d627b4; continue to follow up here
00D62A28 4F DEC EDI
00D62A29 0373 70 Add ESI, DWORD PTR DS: [EBX 70]
00D62A2C 85FF Test EDI, EDI
00d62a2e ^ 77 CB Ja Short 00D629FB and then follow
00d627b4 55 push ebp;
00d627b5 8bec MOV EBP, ESP
00d627b7 83c4 f0 Add ESP, -10
00d627ba 53 Push EBX
00D627BB 56 Push ESI
00D627BC 57 Push EDI
......
I will find JMP DWORD PTR DS: [EAX 24]. Find here:
00D62959 FF75 0C Push DWORD PTR SS: [EBP C]
00D6295C 8B45 F8 MOV EAX, DWORD PTR SS: [EBP-8]
00D6295F FF60 24 JMP DWORD PTR DS: [EAX 24] After finding it, directly f4 here. Press F8 once finally arrived at the place we think:
010A0000 64:90 NOP; go directly to POPFD
010A0002 90 NOP
010A0003 90 NOP
010A0004 90 NOP
010A0005 90 NOP
010A0006 90 NOP
010A0007 90 NOP
010A0008 C1D9 D7 RCR ECX, 0D7; Shift Constant Out of Range 1..31
010A000B 36:90 NOP; Superfluous Prefix
010A000D 90 NOP
010A000E 90 NOP
010A000F 8B4C24 10 MOV ECX, DWORD PTR SS: [ESP 10]
010A0013 59 POP ECX
010A0014 035424 18 Add Edx, DWORD PTR SS: [ESP 18]
After arriving here, directly ctrl s
POPFD
POP ESP
JMP [ESP-4]
Find here:
010A00BA 59 POP ECX
010A00BB 9D POPFD
010A00BC 5C POP ESP
010A00BD - FF6424 FC JMP DWORD PTR SS: [ESP-4]; 99MU.00431BDD
After found, you will be disconnected directly at 010A00BD. Next, you don't have to repeat the above work (of course this address, not necessarily the same). After executing the 010A00BD, see the value of the jump is the original procedure, so our code here is:
☆☆☆☆☆ Call 431BDD
Continue to return to the shell code and continue to follow up the code.
00F8089D 391D 781C4400 CMP DWORD PTR DS: [441C78], EBX; ☆☆☆☆ Jump.
00F808A9 64: FF35 0000000> Push DWORD PTR FS: [0]
00F808B0 90 NOP
00F808B1 90 NOP
00F808B2 90 NOP
00F808B3 66: 9C PUSHFW
00F808B5 57 Push EDI
00F808B6 1BFB SBB EDI, EBX
00F808B8 90 NOP
00F808B9 90 NOP
00F808BA 90 NOP
00F808BB 90 NOP
00F808BC 90 NOP
00F808BD 90 NOP
00F808BE 90 NOP
00F808BF C1C7 8D ROL EDI, 8D; Shift Constant Out of Range 1..31
00f808c2 90 NOP
00F808c3 90 NOP
00f808c4 90 NOP
00F808c5 90 NOP
00f808c6 83e7 40 and edi, 40
00f808c9 90 NOP
00F808CA 90 NOP
00F808cb 90 NOP
00f808cc 90 NOP
00F808CD 2BFD SUB EDI, EBP
00F808CF 8D7C0C 36 LEA EDI, DWORD PTR SS: [ESP ECX 36]
00F808D3 2BF9 SUB EDI, ECX
00F808D5 8D7C2F CA LEA EDI, DWORD PTR DS: [EDI EBP-36]
00F808D9 90 NOP
00F808DA 90 NOP
00F808DB 90 NOP
00F808DC 90 NOP
00F808DD 2BFD SUB EDI, EBP
00F808DF 36:90 NOP; Superfluous Prefix
00F808E1 90 NOP
00F808E2 90 NOP
00F808E3 8D7C27 06 Lea EDI, DWORD PTR DS: [EDI 6]
00F808E7 55 Push EBP00F808E8 C1C5 97 ROL EBP, 97; Shift Constant Out of Range 1..31
00F808EB C1C5 B3 ROL EBP, 0B3; Shift Constant Out of Range 1..31
00f808ee 8DAC26 DA1B4300 LEA EBP, DWORD PTR DS: [ESI 431BDA]
00F808F5 90 NOP
00F808F6 90 NOP
00F808F7 90 NOP
00F808F8 90 NOP
00F808F9 90 NOP
00F808FA 2BEE SUB EBP, ESI
00F808FC 55 Push EBP
00f808fd 8f07 pop dword PTR DS: [EDI]; ☆☆☆☆☆ push 431bda
00F808FF 5D POP EBP
00F80900 5F POP EDI
00F80901 66: 9D POPFW
00F80903 FF15 54644300 Call DWORD PTR DS: [436454]; ☆☆☆☆☆
00F80909 59 POP ECX; ☆☆☆☆☆
00f8090a 68 7b04f800 push 0f8047b; not equal, jump here
00f8090f e8 ECF61000 Call 01090000; follow up here, here is another CALL,
00f80914 68 b6134800 push 4813b6
Ok, the code above is organized in this way:
CMP [441C78], EBX
JNZ @f
Push 431BDA
Call [436454]
POP ECX
@@:
Call @ c1
After entering the CALL above, it will find that the first time that many garbage code is first, remember that we will go off at 010A00BD, yes, and interrupt to the destination after running directly.
00f80599 68 72ec4400 push 44ec72; after the interruption, F8 is here
00F8059E 66: 9C Pushfw
00F805A0 50 Push EAX
00f805a1 334424 08 xor Eax, DWORD PTR SS: [ESP 8]
00F805A5 83E8 ED SUB EAX, -13
00F805A8 90 NOP
00F805A9 90 NOP
00F805AA 90 NOP
00F805AB 90 NOP
00F805AC 8D8435 584E4300 LEA EAX, DWORD PTR SS: [EBP ESI 434E58]
00F805B3 90 NOP
00F805B4 90 NOP
00F805B5 90 NOP
00F805B6 90 NOP
00F805B7 8D4424 52 Lea Eax, DWORD PTR SS: [ESP 52]
00F805BB 8D4428 AE LEA EAX, DWORD PTR DS: [EAX EBP-52]
00F805BF 90 NOP
00F805c0 90 NOP
00F805C1 90 NOP
00f805c2 90 NOP
00F805c3 90 NOP
00F805C4 2BC5 SUB EAX, EBP
00F805C6 8D40 06 Lea Eax, DWORD PTR DS: [EAX 6]
00F805c9 52 Push EDX
00F805CA 81DA 8CB4B73D SBB EDX, 3DB7B48C
00F805D0 8D97 00000300 Lea EDX, DWORD PTR DS: [EDI 30000]
00F805D6 2BD7 SUB EDX, EDI
00F805D8 90 NOP
00F805D9 90 NOP
00F805DA 90 NOP
00F805DB 52 Push EDX
00F805DC 90 NOP
00F805DD 90 NOP
00F805DE 90 NOP
00F805DF 90 NOP
00F805E0 8F00 Pop DWORD PTR DS: [EAX]; ☆☆☆☆ Push 30000
00F805E2 5A POP EDX
00F805E3 58 POP EAX
00f805e4 90 NOP
00f805e5 90 NOP
00f805e6 90 NOP
00F805E7 66: 9D POPFW
......
00F8070E 56 Push ESI
00f8070f 66: 9c pushfw
00F80711 51 Push ECX
00F80712 1BCD SBB ECX, EBP
00F80714 90 NOP
00F80715 90 NOP
00F80716 90 NOP
00F80717 90 NOP
00F80718 2BCB SUB ECX, EBX
00F8071A 8D4C24 29 Lea ECX, DWORD PTR SS: [ESP 29] 00F8071E 8D4C29 D7 LEA ECX, DWORD PTR DS: [ECX EBP-29]
00F80722 90 NOP
00F80723 90 NOP
00F80724 90 NOP
00F80725 90 NOP
00F80726 90 NOP
00F80727 2BCD SUB ECX, EBP
00F80729 90 NOP
00F8072A 90 NOP
00F8072B 90 NOP
00F8072C 90 NOP
00F8072D 90 NOP
00f8072e 90 NOP
00F8072F 8D4C11 06 LEA ECX, DWORD PTR DS: [ECX EDX 6]
00F80733 2BCA SUB ECX, EDX
00f80735 36:90 NOP; Superfluous Prefix
00F80737 90 NOP
00F80738 90 NOP
00F80739 53 Push EBX
00F8073A BB 96594000 MOV EBX, 405996
00F8073F BB 4EED4500 MOV EBX, 45ED4E
00F80744 8D9C22 00000100 Lea EBX, DWORD PTR DS: [EDX 10000]
00F8074B 2BDA SUB EBX, EDX
00F8074D 8919 MOV DWORD PTR DS: [ECX], EBX; ☆☆☆☆☆ Push 10000
00F8074F 5B POP EBX
00F80750 59 POP ECX
00F80751 90 NOP
00F80752 90 NOP
00F80753 90 NOP
00F80754 90 NOP
00F80755 90 NOP
00F80756 66: 9D POPFW
00f80758 68 7504f800 push 0f80475; here again
00f8075d e8 9ef81000 call 01090000
After running again to JMP [ESP-4], F8 is here:
00431BDE - FF25 B0644300 JMP DWORD PTR DS: [4364B0]; MSVCRT._CONTROLFP
After the original program code, then f8 into the API, after entering Alt F9 returns to the housing:
00f80475 59 pop ECX; ☆☆☆☆☆ 00f80476 E9 04040000 JMP 00F8087F
......
00F8087F 59 POP ECX; ☆☆☆☆☆
00F80880 c3 RETN; ☆☆☆☆☆
00f80881 ^ E9 90ffffff jmp 00F80816
So the code of @ c1 is:
PUSH 30000
Push 10000
Call 431bde
POP ECX
POP ECX
Retn
Continue with:
00f8047b 52 push edx; return to this,
00f8047c 66: 9c pushfw; continue to follow up
00f8047e 55 Push EBP
00f8047f 81f5 4ACE18D1 XOR EBP, D118CE4A
00f80485 8bec MOV EBP, ESP
00F80487 8D6C1D 07 Lea EBP, DWORD PTR SS: [EBP EBX 7]
00F8048B 50 Push EAX
00f8048c 51 Push ECX
00F8048D 83D8 1B SBB EAX, 1B
00F80490 034424 38 Add Eax, DWORD PTR SS: [ESP 38]
00F80494 B8 01FC196F MOV EAX, 6F19FC01
00f80499 C1D9 9D RCR ECX, 9D; Shift Constant Out of Range 1..31
00f8049c 334c24 08 xor ECX, DWORD PTR SS: [ESP 8]
00F804A0 334C24 08 XOR ECX, DWORD PTR SS: [ESP 8]
00F804A4 B9 1A884800 MOV ECX, 48881A
00F804A9 8D48 41 Lea ECX, DWORD PTR DS: [EAX 41]
00F804ac 52 Push EDX
00F804AD 035424 18 Add Edx, DWORD PTR SS: [ESP 18]
00F804B1 035424 38 Add Edx, DWORD PTR SS: [ESP 38]
00F804B5 90 NOP
00F804B6 90 NOP
00F804B7 90 NOP
00F804B8 90 NOP
00F804B9 90 NOP
00f804ba ba Da1522A8 MOV EDX, A82215DA
00F804BF 83F2 C3 XOR EDX, FFFFFFC3
00F804C2 F7D2 Not EDX00F804C4 83F2 5F XOR EDX, 5F
00f804c7 f7d2 not edx
00f804c9 81f2 5beadd57 xor EDX, 57DDEA5B
00F804CF 4A DEC EDX
00F804D0 90 NOP
00F804D1 90 NOP
00F804D2 90 NOP
00F804D3 90 NOP
00F804D4 90 NOP
00F804D5 8D0C11 LEA ECX, DWORD PTR DS: [ECX EDX]
00F804D8 90 NOP
00F804D9 90 NOP
00F804DA 90 NOP
00F804DB 90 NOP
00F804DC C1DA 8F RCR EDX, 8F; SHIFT Constant Out of Range 1..31
00F804DF 90 NOP
00F804E0 90 NOP
00f804e1 90 NOP
00F804E2 83DA 51 SBB EDX, 51
00F804E5 5A POP EDX
00f804e6 83e9 5D SUB ECX, 5D
00f804e9 81c1 7becb8f7 add ECX, F7B8EC7B
00f804ef f7d9 NEG ECX
00f804f1 81e9 83172d98 SUB ECX, 982D1783
00F804F7 49 DEC ECX
00f804f8 87c1 xchg ECX, EAX
00F804FA C1C0 48 ROL Eax, 48; Shift Constant Out of Range 1..31
00F804FD 2BE8 SUB EBP, EAX
00F804FF 8D8F 9CAF4600 LEA ECX, DWORD PTR DS: [EDI 46AF9C]
00F80505 59 POP ECX
00F80506 334424 08 xor Eax, DWORD PTR SS: [ESP 8]
00F8050A B8 CA7C4100 MOV Eax, 417cca
00F8050F 58 POP EAX
00F80510 2BEB SUB EBP, EBX
00f80512 90 NOP
00F80513 90 NOP
00F80514 90 NOP
00F80515 90 NOP
00F80516 90 NOP
00F80517 56 Push ESI
00f80518 1BF7 SBB ESI, EDI00F8051A 8DB3 20F04300 LEA ESI, DWORD PTR DS: [EBX 43F020]
00F80520 2BF3 SUB ESI, EBX
00F80522 56 Push ESI
00f80523 8f45 00 pop dword PTR SS: [EBP]; ☆☆☆☆☆ Push 43F020
00F80526 5E POP ESI
00F80527 5D POP EBP
00F80528 66: 9D POPFW
00F8052A E9 E5030000 JMP 00F80914
00f80914 68 b6134800 push 4813b6
00F80919 90 NOP
00F8091A 90 NOP
00F8091B 90 NOP
00F8091C 90 NOP
00F8091D 90 NOP
00f8091e 66: 9c pushfw
00F80920 57 Push EDI
00f80921 23fb and edi, EBX
00f80923 64:90 NOP; Superfluous Prefix
00F80925 90 NOP
00F80926 90 NOP
00F80927 90 NOP
00f80928 03f9 add edi, ECX
00F8092A 2BF9 SUB EDI, ECX
00F8092C 8D7C2C 4F Lea EDI, DWORD PTR SS: [ESP EBP 4F]
00F80930 2BFD SUB EDI, EBP
00F80932 8D7C0F B1 LEA EDI, DWORD PTR DS: [EDI ECX-4F]
00F80936 2BF9 SUB EDI, ECX
00F80938 8D7C0F 06 Lea EDI, DWORD PTR DS: [EDI ECX 6]
00F8093C 2BF9 SUB EDI, ECX
00F8093E 90 NOP
00F8093F 90 NOP
00F80940 90 NOP
00F80941 50 push eax
00F80942 90 NOP
00f80943 90 NOP
00F80944 90 NOP
00F80945 90 NOP
00F80946 90 NOP
00f80947 81f0 00395087 xor Eax, 87503900
00F8094D 8D85 1CF04300 LEA EAX, DWORD PTR SS: [EBP 43F01C] 00f80953 2BC5 SUB EAX, EBP
00F80955 36:90 NOP; Superfluous Prefix
00F80957 90 NOP
00F80958 90 NOP
00F80959 8907 MOV DWORD PTR DS: [EDI], EAX; ☆☆☆☆☆ Push 43F01C
00F8095B 58 POP EAX
00F8095C 5F POP EDI
00F8095D 66: 9D POPFW
00f8095f 68 4405f800 push 0f80544
00f80964 e8 97f61000 call 01090000; Continue F9 to JMP [ESP-4]
F8 is here:
00431BC2 - FF25 58644300 JMP DWORD PTR DS: [436458]; MSVCRT._INITTERM
So this is:
Call 431bc2
......
00f80544 b8 EA064700 MOV EAX, 4706EA; again to the shell code,
00F80549 90 NOP
00F8054A 90 NOP
00F8054B 90 NOP
00F8054C 90 NOP
00F8054D 034424 38 Add Eax, DWORD PTR SS: [ESP 38]; Junk code
00F80551 90 NOP
00F80552 90 NOP
00f80553 90 NOP
00F80554 90 NOP
00F80555 FF35 FC864500 Push DWORD PTR DS: [4586FC]
00f8055b 334424 28 xor Eax, DWORD PTR SS: [ESP 28]
00f8055f 334424 08 xor Eax, DWORD PTR SS: [ESP 8]
00f80563 58 pop EAX; ☆☆☆☆☆ Mov Eax, [4586FC]
00F80564 8945 94 MOV DWORD PTR SS: [EBP-6C], EAX; ☆☆☆☆☆
00F80567 8D45 94 Lea Eax, DWORD PTR SS: [EBP-6C]; ☆☆☆☆☆
00f8056a 50 push eax; ☆☆☆☆☆
00F8056B FF35 F8864500 Push DWORD PTR DS: [4586F8]; ☆☆☆☆☆
00F80571 8D45 9C LEA EAX, DWORD PTR SS: [EBP-64]; ☆☆☆☆☆ 00f80574 50 push eax; ☆☆☆☆☆
00F80575 8D45 90 Lea Eax, DWORD PTR SS: [EBP-70]; ☆☆☆☆☆
00f80578 50 push eax; ☆☆☆☆☆☆
00F80579 8D45 A0 LEA EAX, DWORD PTR SS: [EBP-60]; ☆☆☆☆☆
00f8057c 50 push eax; ☆☆☆☆☆
00F8057D FF15 60644300 Call DWORD PTR DS: [436460]; ☆☆☆☆☆
00f80583 E9 49020000 JMP 00F807D1
......
00f807d1 68 da08370c push 0c3708da
00F807D6 66: 9c pushfw
00F807D8 55 Push EBP
00F807D9 2BE9 SUB EBP, ECX
00F807DB 90 NOP
00F807DC 90 NOP
00F807DD 90 NOP
00F807DE 90 NOP
00F807DF 90 NOP
00f807e0 81e5 18ebdd3e and ebp, 3eddeb18
00f807e6 8D6C24 38 Lea EBP, DWORD PTR SS: [ESP 38]
00F807EA 8D6D C8 LEA EBP, DWORD PTR SS: [EBP-38]
00F807ED 8D6D 06 LEA EBP, DWORD PTR SS: [EBP 6]
00F807F0 52 Push EDX
00F807F1 81DA 5463F448 SBB EDX, 48F46354
00F807F7 36:90 NOP; Superfluous Prefix
00F807F9 90 NOP
00f807fa 90 NOP
00F807FB 8D9427 18F04300 Lea EDX, DWORD PTR DS: [EDI 43F018]
00F80802 2BD7 SUB EDX, EDI
00F80804 90 NOP
00F80805 90 NOP
00F80806 90 NOP
00F80807 90 NOP
00F80808 90 NOP
00F80809 52 Push EDX
00F8080A 8F45 00 Pop DWORD PTR SS: [EBP]; ☆☆☆☆☆ Push 43F01800F8080D 5A POP EDX
00F8080E 5D POP EBP
00F8080F 66: 9D POPFW
00F80811 ^ E9 4cffffff jmp 00f80762
00F80763 90 NOP
00F80764 90 NOP
00F80765 90 NOP
00F80766 FF7424 10 Push DWORD PTR SS: [ESP 10]
00F8076A 66: 9C PUSHFW
00F8076C 55 Push EBP
00F8076D 0BE9 or EBP, ECX
00F8076F 90 NOP
00F80770 90 NOP
00F80771 90 NOP
00F80772 90 NOP
00F80773 8D6C11 F7 LEA EBP, DWORD PTR DS: [ECX EDX-9]
00F80777 2BEA SUB EBP, EDX
00F80779 8D6C24 7B Lea EBP, DWORD PTR SS: [ESP 7B]
00F8077D 8D6C35 85 Lea EBP, DWORD PTR SS: [EBP ESI-7B]
00F80781 90 NOP
00f80782 90 NOP
00F80783 90 NOP
00F80784 2BEE SUB EBP, ESI
00F80786 8D6C1D 06 Lea EBP, DWORD PTR SS: [EBP EBX 6]
00F8078A 90 NOP
00F8078B 90 NOP
00F8078C 90 NOP
00F8078D 90 NOP
00f8078e 90 NOP
00F8078F 2Beb Sub EBP, EBX
00F80791 51 Push ECX
00f80792 83e9 EB SUB ECX, -15
00F80795 034C24 38 Add ECX, DWORD PTR SS: [ESP 38]
00F80799 8D8C22 00F04300 LEA ECX, DWORD PTR DS: [EDX 43F000]
00F807A0 2BCA SUB ECX, EDX
00F807A2 90 NOP
00F807A3 90 NOP
00F807A4 90 NOP
00F807A5 90 NOP
00F807A6 51 Push ECX
00f807a7 64:90 nop; superfluous prefix00f807a9 90 NOP
00F807AA 90 NOP
00F807AB 90 NOP
00F807AC 8F45 00 Pop DWORD PTR SS: [EBP]; ☆☆☆☆☆ Push 43F000
00F807AF 59 POP ECX
00F807B0 5D POP EBP
00F807B1 66: 9D POPFW
Continue F9 to JMP [ESP-4], then f8 once, here:
00431BC2 - FF25 58644300 JMP DWORD PTR DS: [436458]; MSVCRT._INITTERM
So here is: ☆☆☆☆☆ Call 431BC2
In the case:
00F80703 90 NOP
00F80704 90 NOP
00F80705 90 NOP
00F80706 83C4 24 Add ESP, 24; ☆☆☆☆☆
00f80709 E9 49010000 JMP 00F80857
......
00F80857 0BC5 or EAX, EBP
00F80859 90 NOP
00F8085A 90 NOP
00F8085B 90 NOP
00F8085C 81D8 D4487ABE SBB EAX, BE7A48D4
00F80862 8D87 64644300 Lea EAX, DWORD PTR DS: [EDI 436464]
00F80868 2BC7 SUB EAX, EDI
00f8086a 90 nop; here should pay attention, slightly a bit different.
00F8086B 90 NOP
00F8086C 90 NOP
00F8086D 90 NOP
00f8086e ff30 push dword PTR DS: [EAX]; Note the value of EAX
00F80870 034424 18 Add Eax, DWORD PTR SS: [ESP 18]; spam code
00f80874 b8 1e84600 MOV Eax, 46A81E
00f80879 58 pop eax; ☆☆☆☆ ☆ Restore is MOV Eax, [436464]
00f8087a ^ E9 C4ffffff jmp 00F80843
00F80843 90 NOP
00F80844 90 NOP
00F80845 90 NOP
00F80846 be 0e3f4000 MOV ESI, 403F0E; garbage code 00F8084B be 46a74100 MOV ESI, 41A746
00F80850 8B30 MOV ESI, DWORD PTR DS: [EAX]; ☆☆☆☆☆
00f80852 E9 34010000 JMP 00F8098B
00F8098B 8975 8C MOV DWORD PTR SS: [EBP-74], ESI; ☆☆☆☆☆
00f8098e e8 6df61000 call 01090000
00f80836 46 inc ESI; ☆☆☆☆☆
00F80837 8975 8C MOV DWORD PTR SS: [EBP-74], ESI; ☆☆☆☆☆
00F8083A 8A06 MOV Al, Byte PTR DS: [ESI]; ☆☆☆☆☆
00F8083C 3ac3 CMP Al, BL; ☆☆☆☆☆
00f8083e e8 bdf71000 call 01090000
After seeing the Call 01090000, the F9àf8 is pressed in the past.
00F807C4> 3C 22 CMP Al, 22; ☆☆☆☆☆
00f807c6 0f85 6a000000 jnz 00F80836
As long as you care, you can get the probably code:
@@:
Inc ESI
MOV DWORD PTR SS: [EBP-74], ESI
Mov Al, Byte PTR DS: [ESI]
CMP AL, BL
JE @f
CMP AL, 22
JNZ @B
@@:
The code here now can't see, I don't know if she is handled.
@@:
Because here is to cycle a few times, I set the condition interrupt BREAK IF Al == 22.
00F807C4 3C 22 CMP Al, 22; ☆☆☆☆☆
......
00f80999 46 inc ESI; ☆☆☆☆☆
00F8099A 8975 8C MOV DWORD PTR SS: [EBP-74], ESI; ☆☆☆☆☆
00F8099D 8A06 MOV Al, Byte Ptr DS: [ESI]; ☆☆☆☆☆
00F8099F 3ac3 CMP Al, BL; ☆☆☆☆☆
00f809a1 ^ 0f84 47fcffff je 00f805ee; ☆☆☆☆☆, the jump value here can not copy directly, record the first
00F809A7 3C 20 CMP AL, 20; ☆☆☆☆☆
00F809A9 E8 52F61000 Call 01090000
......
00F805EE 895D D0 MOV DWORD PTR SS: [EBP-30], EBX; ☆☆☆☆☆
00F805F1 8D45 A4 LEA EAX, DWORD PTR SS: [EBP-5C]; ☆☆☆☆☆
00f805f4 50 push eax; ☆☆☆☆☆
00f805f5 ff15 68604300 Call DWORD PTR DS: [436068]; ☆☆☆☆☆
00F805FB F645 D0 01 TEST BYTE PTR SS: [EBP-30], 1; ☆☆☆☆☆
00F805FF 0F84 8D020000 JE 00F80892; ☆☆☆☆☆
00f80605 0fb745 d4 Movzx Eax, Word PTR SS: [EBP-2C]; ☆☆☆☆☆
00F80609 E9 87020000 JMP 00F80895
......
00f80892 6a 0a push 0a; ☆☆☆☆☆
00f80894 58 pop EAX; ☆☆☆☆☆
00f80895 50 push eax; ☆☆☆☆☆
00f80896 56 push eSI; ☆☆☆☆☆
00f80897 53 push ebx; ☆☆☆☆☆
00f80898 ^ E9 E9ffffff jmp 00F80886
00f80886 53 push ebx; ☆☆☆☆☆
00F80887 FF15 6C604300 Call DWORD PTR DS: [43606C]; ☆☆☆☆☆ getModuleHandlea
00f8088d ^ E9 D8FBFFFFFFFFFFFFFFF8046A
After you come here, we sort out:
@@:
Inc ESI
MOV DWORD PTR SS: [EBP-74], ESI
Mov Al, Byte PTR DS: [ESI]
CMP AL, BL
JE @f
CMP AL, 20
JNE @B
@@:
MOV DWORD PTR SS: [EBP-30], EBX
Lea Eax, DWORD PTR SS: [EBP-5C]
Push EAX
Call dword Ptr DS: [436068]
TEST BYTE PTR SS: [EBP-30], 1
Je
Movzx Eax, Word PTR SS: [EBP-2C]
JMP P1
Push 0a
POP EAX
P1:
Push EAX
PUSH ESI
Push EBX
Push EBX
Call [43606c]; getModuleHandlea
00f8046a 50 push eax; ☆☆☆☆ ☆ 00f8046b 68 6204f800 push 0f80462; here is Call ...
00F80470 E8 8BFB1000 Call 01090000; Continue to JMP [ESP-4]
00F80816 FF7424 10 Push DWORD PTR SS: [ESP 10]; ☆☆☆☆☆
00F8081A E9 4A010000 JMP 00F80969
00f80969 ff7424 10 push dword PTR SS: [ESP 10]; ☆☆☆☆☆
00f8096d ^ e9 e3faffff jmp 00f80455
00F80455 FF7424 10 Push DWORD PTR SS: [ESP 10]; ☆☆☆☆☆
00F80459 FF7424 10 Push DWORD PTR SS: [ESP 10]; ☆☆☆☆☆
00F8045D E9 B1010000 JMP 00F80613
00F80613 68 0007F800 PUSH 0F80700; Call address
00f80618 e8 e3f91000 call 01090000
F9-> f8 to here:
00431C6C - FF25 48644300 JMP DWORD PTR DS: [436448]; MFC42. # 1576_? Afxwinmain @@ yghpauhinstance __ @@ 0Padh @ z
So here is Call 431C6C
Take a look at the value of the ESP, then it will be broken at the [ESP], because the program is run here, do not press Alt F9, then it is easy to respond.
00F80700 C2 1000 RETN 10; ☆☆☆☆☆
00F80703 90 NOP
00F80704 90 NOP
Summary @ c2 is:
@ C2:
Push [ESP 10]
Push [ESP 10]
Push [ESP 10]
Push [ESP 10]
Call 431C6C
Retn 10
After returning, continue to retrieve the code, to find the drawn code is almost the same:
00F80462 8945 98 MOV DWORD PTR SS: [EBP-68], EAX; ☆☆☆☆☆
00f80465 e9 b3010000 jmp 00F8061D
00F8061D 50 push eax; ☆☆☆☆☆
00f8061e ff15 b8644300 Call DWORD PTR DS: [4364B8]; ☆☆☆☆☆, I have exited it here.
00f80624 e9 f6010000 jmp 00F8081F
When the exit program is over, don't press F8 here, we can see the code directly (of course you can do it here, because the following code does not seem to be executed):
00F8081F 8B45 EC MOV EAX, DWORD PTR SS: [EBP-14]; ☆☆☆☆☆
00f80822 81d1 6C64A1C4 ADC ECX, C4A1646C
00F80828 FF30 PUSH DWORD PTR DS: [EAX]
00f8082a 83c9 59 or ECX, 59
00F8082D 83E9 55 SUB ECX, 55
00F80830 59 POP ECX; ☆☆☆☆☆ Mov ECX, [EAX]
00F80972 FF31 Push DWORD PTR DS: [ECX]
00F80974 B9 C66E4900 MOV ECX, 496EC6
00F80979 90 NOP
00F8097A 90 NOP
00F8097B 90 NOP
00F8097C 90 NOP
00F8097D B9 8AE34800 MOV ECX, 48E38A
00F80982 59 POP ECX; ☆☆☆☆☆ Mov ECX, [ECX]
00F80983 894D 88 MOV DWORD PTR SS: [EBP-78], ECX; ☆☆☆☆☆
00f80986 ^ E9 32FEFFF JMP 00F807BD
00F807BD 50 push eax; ☆☆☆☆☆
00F807BE 51 Push ECX; ☆☆☆☆☆
00F807BF ^ E9 82FCFFFFFFFFF80F80446
I can't keep in here. The following sentences have been copied according to other programs.
Now I have retrieved the code, what is the code, I find an empty place? No Find here:
00431A46 - E9 B4E8B400 JMP 00F802FF
Why do you find here, I have already said about ASPR's article, I will not say more.
That is, the OEP of the original program is 431A46.
All sorted out such a "look":
Push EBP
MOV EBP, ESP
Push -1
Push 43A768
Push 431baa
Mov Eax, FS: [0]
Push EAX
MOV FS: [0], ESP
SUB ESP, 68
Push EBX
PUSH ESI
Push EDI
MOV DWORD PTR SS: [EBP-18], ESP
XOR EBX, EBX
MOV DWORD PTR SS: [EBP-4], EBX
Push 2
Call DWORD PTR DS: [436494]; MSVCRT .__ set_app_type
POP ECX
OR DWORD PTR DS: [458710], FFFFFFF
OR DWORD PTR DS: [458714], ffffffffffff
Call DWORD PTR DS: [4364BC]
Mov ECX, [458704]
MOV [EAX], ECX
Call [43645c]
Mov ECX, [458700]
MOV [EAX], ECX
Mov Eax, [436450]
Mov Eax, [EAX]
MOV [45870c], EAX
Call 431bdd
CMP [441C78], EBX
JNZ @f
Push 431BDA
Call [436454]
POP ECX
@@:
Call @ c1
Push 43f020
Push 43F01C
Call 431bc2
Mov Eax, [4586FC]
MOV DWORD PTR SS: [EBP-6C], EAX
LEA EAX, DWORD PTR SS: [EBP-6C]
Push EAX
Push DWORD PTR DS: [4586F8]
Lea Eax, DWORD PTR SS: [EBP-64]
Push EAX
Lea Eax, DWORD PTR SS: [EBP-70]
Push EAX
Lea Eax, DWORD PTR SS: [EBP-60]
Push EAX
Call dword PTR DS: [436460]; MSVCRT .__ getMainargs
Push 43f018
Push 43f000
Call 431bc2
Add ESP, 24
Mov Eax, [436464]
MOV ESI, [EAX]
MOV DWORD PTR SS: [EBP-74], ESI
@@:
Inc ESI
MOV DWORD PTR SS: [EBP-74], ESI
Mov Al, Byte PTR DS: [ESI]
CMP AL, BL
JE @f
CMP AL, 22
JNZ @B
@@:
@@:
Inc ESI
MOV DWORD PTR SS: [EBP-74], ESI
Mov Al, Byte PTR DS: [ESI]
CMP AL, BL
JE @f
CMP AL, 20
JNE @B
@@:
MOV DWORD PTR SS: [EBP-30], EBX
Lea Eax, DWORD PTR SS: [EBP-5C]
Push EAX
Call dword Ptr DS: [436068]
TEST BYTE PTR SS: [EBP-30], 1
Je
Movzx Eax, Word PTR SS: [EBP-2C]
JMP P1
Push 0a
POP EAX
P1:
Push EAX
PUSH ESI
Push EBX
Push EBX
Call [43606c]; getModuleHandlea
Push EAX
Call @ C2
MOV [EBP-68], EAX
Push EAX
Call DWORD PTR DS: [4364B8]; MSVCRT.exit
MOV EAX, [EBP-14]
MOV ECX, [EAX]
MOV ECX, [ECX]
MOV DWORD PTR SS: [EBP-78], ECX
Push EAX
Push ECX
Call 431bbc
POP ECX
POP ECX
Retn
The few unknown places can be easily governed.
Finally available results:
00431A46 /. 55 Push EBP
00431a47 |. 8bec Mov EBP, ESP
00431A49 |. 6A FF PUSH-100431A4B |. 68 68A74300 PUSH 0043A768
00431A50 |. 68 AA1B4300 PUSH 00431BAA; JMP to msvcrt._except_handler3; SE Handler Installation
00431A55 |. 64: A1 0000000> MOV EAX, DWORD PTR fs: [0]
00431a5b |. 50 push eax
00431A5C |. 64: 8925 00000> MOV DWORD PTR FS: [0], ESP
00431A63 |. 83ec 68 SUB ESP, 68
00431A66 |. 53 Push EBX
00431A67 |. 56 Push ESI
00431A68 |. 57 Push EDI
00431A69 |. 8965 E8 MOV DWORD PTR SS: [EBP-18], ESP
00431A6C |. 33DB XOR EBX, EBX
00431A6E |. 895D FC MOV DWORD PTR SS: [EBP-4], EBX
00431a71 |. 6a 02 Push 2
00431A73 |. FF15 94644300 Call DWORD PTR DS: [436494]; MSVCRT .__ set_app_type
00431A79 |. 59 POP ECX
00431A7A |. 830D 10874500> OR DWORD PTR DS: [458710], FFFFFFF
00431A81 |. 830D 14874500> OR DWORD PTR DS: [458714], FFFFFFF
00431A88 |. FF15 BC644300 Call DWORD PTR DS: [4364BC]; MSVCRT .__ p__fmode
00431A8E |. 8B0D 04874500 MOV ECX, DWORD PTR DS: [458704]
00431A94 |. 8908 MOV DWORD PTR DS: [EAX], ECX
00431A96 |. FF15 5C644300 Call DWORD PTR DS: [43645C]; MSVCRT .__ p__commode
00431a9c |. 8B0D 00874500 MOV ECX, DWORD PTR DS: [458700]
00431AA2 |. 8908 MOV DWORD PTR DS: [EAX], ECX
00431AA4 |. A1 50644300 MOV EAX, DWORD PTR DS: [436450]
00431AA9 |. 8B00 MOV EAX, DWORD PTR DS: [EAX]
00431AB |. A3 0C874500 MOV DWORD PTR DS: [45870C], EAX
00431AB0 |. E8 28010000 Call 00431BDD
00431AB5 |. 391D 781C4400 CMP DWORD PTR DS: [441C78], EBX
00431ABB |. 75 0C jnz short 00431ac9
00431ABD |. 68 da1b4300 push 00431bda
00431ac2 |. FF15 54644300 Call DWORD PTR DS: [436454]; MSVCRT .__ setuserMatherR
00431ac8 |. 59 POP ECX
00431ac9 |> e8 9e380000 call 0043536C
00431ACE |. 68 20F04300 Push 0043F020
00431AD3 |. 68 1CF04300 PUSH 0043F01C
00431AD8 |. E8 E5000000 Call 00431BC2; JMP to MSVCRT._INITTERM
00431Add |. A1 FC864500 MOV EAX, DWORD PTR DS: [4586FC]
00431ae2 |. 8945 94 MOV DWORD PTR SS: [EBP-6C], EAX
00431ae5 |. 8D45 94 Lea Eax, DWORD PTR SS: [EBP-6C]
00431ae8 |. 50 push eax
00431ae9 |. FF35 F8864500 Push DWORD PTR DS: [4586F8]
00431aef |. 8D45 9C LEA EAX, DWORD PTR SS: [EBP-64]
00431AF2 |. 50 push eax
00431AF3 |. 8D45 90 Lea Eax, DWORD PTR SS: [EBP-70]
00431AF6 |. 50 push eax
00431AF7 |. 8D45 A0 Lea Eax, DWORD PTR SS: [EBP-60]
00431AFA |. 50 push eax
00431AFB |. FF15 60644300 Call DWORD PTR DS: [436460]; MSVCRT .__ getMainargs
00431B01 |. 68 18F04300 Push 0043F018
00431B06 |. 6800f04300 push 0043f000
00431B0B |. E8 B2000000 Call 00431BC2; JMP to MSVCRT._INITTERM
00431b10 |. 83c4 24 Add ESP, 24
00431b13 |. A1 64644300 MOV EAX, DWORD PTR DS: [436464]
00431B18 |. 8b30 MOV ESI, DWORD PTR DS: [EAX]
00431B1A |. 8975 8C MOV DWORD PTR SS: [EBP-74], ESI
00431B1D |. 803e 22 CMP BYTE PTR DS: [ESI], 22
00431B20 |. 75 3A JNZ SHORT 00431B5C
00431B22 |> 46 / Inc ESI
00431B23 |. 8975 8C | MOV DWORD PTR SS: [EBP-74], ESI
00431B26 |. 8A06 | MOV Al, Byte Ptr DS: [ESI]
00431B28 |. 3ac3 | CMP Al, BL
00431B2A |. 74 04 | JE SHORT 00431B3000431B2C |. 3C 22 | CMP Al, 22
00431B2E |. ^ 75 f2 / jnz short 00431b22
00431B30 |> 803e 22 CMP BYTE PTR DS: [ESI], 22
00431B33 |. 75 04 JNZ Short 00431B39
00431B35 |> 46 Inc ESI
00431B36 |. 8975 8C MOV DWORD PTR SS: [EBP-74], ESI
00431B39 |> 8A06 MOV Al, Byte PTR DS: [ESI]
00431B3B |. 3ac3 CMP Al, BL
00431B3D |. 74 04 Je Short 00431B43
00431B3F |. 3C 20 CMP AL, 20
00431B41 |. ^ 76 F2 Jbe Short 00431B35
00431B43 |> 895D D0 MOV DWORD PTR SS: [EBP-30], EBX
00431B46 |. 8D45 A4 LEA EAX, DWORD PTR SS: [EBP-5C]
00431B49 |. 50 push eax; / pstartupinfo
00431B4A |. FF15 68604300 Call DWORD PTR DS: [436068]; / GETSTARTUPINFOA
00431B50 |. F645 d0 01 test byte PTR SS: [EBP-30], 1
00431B54 |. 74 11 Je Short 00431B67
00431B56 |. 0fb745 D4 Movzx Eax, Word PTR SS: [EBP-2C]
00431B5A |. EB 0E JMP SHORT 00431B6A
00431B5C |> 803e 20 / CMP BYTE PTR DS: [ESI], 20
00431B5F |. ^ 76 D8 | Jbe Short 00431B39
00431B61 |. 46 | Inc ESI
00431B62 |. 8975 8C | MOV DWORD PTR SS: [EBP-74], ESI
00431B65 |. ^ EB F5 / JMP SHORT 00431B5C
00431B67 |> 6A 0A PUSH 0A
00431B69 |. 58 POP EAX
00431B6A |> 50 push eax
00431B6B |. 56 Push ESI
00431B6C |. 53 Push EBX
00431B6D |. 53 push ebx; / pmodule
00431B6E |. FF15 6C604300 Call DWORD PTR DS: [43606C]; / GETMODULEHANDLEA
00431B74 |. 50 push eax
00431B75 |. E8 07380000 CALL 0043538100431B7A |. 8945 98 MOV DWORD PTR SS: [EBP-68], EAX
00431B7D |. 50 push eax; / status
00431B7E |. FF15 B8644300 Call DWORD PTR DS: [4364B8]; / EXIT
00431B84 |. 8B45 EC MOV EAX, DWORD PTR SS: [EBP-14]
00431B87 |. 8B08 MOV ECX, DWORD PTR DS: [EAX]
00431B89 |. 8B09 MOV ECX, DWORD PTR DS: [ECX]
00431B8B |. 894D 88 MOV DWORD PTR SS: [EBP-78], ECX
00431B8E |. 50 Push EAX
00431B8F |. 51 Push ECX
00431B90 |. E8 27000000 Call 00431bbc; jmp to msvcrt._xcptfilter
00431B95 |. 59 POP ECX
00431B96 |. 59 POP ECX
00431B97 /. C3 RETN
The two Calls can also be found in the relevant location of the program, I will peek too lazy, put up on the air:
0043536C? 68 00000300 Push 30000
00435371? 68 00000100 Push 10000; Unicode "AlluSrsprofile = D: / documents and settings / all users"
00435376. E8 63c8fffffff Call
0043537B. 59 POP ECX
0043537c. 59 POP ECX
0043537D. C3 RETN
0043537E 00 db 00
0043537F 00 db 00
00435380 00 db 00
00435381 / $ FF7424 10 Push DWORD PTR SS: [ESP 10]
00435385 |. FF7424 10 Push DWORD PTR SS: [ESP 10]
00435389 | FF7424 10 Push DWORD PTR SS: [ESP 10]
0043538d |. Ff7424 10 Push DWORD PTR SS: [ESP 10]
00435391 |. E8 D6C8FFFF CALL <..? JMP & mfc42 # 1576_ AfxWinMain @@ YGHP>
00435396 /. C2 1000 RETN 10
Just pumped a piece of code, repair the code, Dump fixdump. This trip is over, thank you, you can stick to the end :-)
Greetz:
Fly.jingulong, Yock, Tdasm.david.ahao.ufo (brother) .alan (Sister) .all of my friends and you!
By LoveBoom [DFCG] [FCG] [US]
Email: bmd2chen@tom.com
