CEXE V1.0a-1.0b 脱壳——Win98的Notepad
下载页面： http://www.eskimo.com/%7Escottlu/win/cexe.exe
软件大小： 77 KB
【软件简介】：Compress any executable! With CExe, you can compress any executable and make it significantly smaller and still fully functional. This is useful for sending executables in email, downloading executables over the net, fitting executables on floppies, etc. CExe can compress Win32 executables, Win16 executables, OS/2 executables, WinNT Posix executables... the output format is *always* Win32 executable format.
【作者声明】：初学Crack，只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教！
【调试环境】：WinXP、Ollydbg1.09、PEiD、LordPE
—————————————————————————————————
【过 程】：
00401404 55 push ebp
00401405 |. 8BEC mov ebp,esp
00401407 |. 81EC 0C020000 sub esp,20C
0040140D |. 56 push esi
0040140E |. BE 04010000 mov esi,104
00401413 |. 8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-108]
00401419 |. 56 push esi
0040141A |. 50 push eax
0040141B |. 6A 00 push 0
0040141D |. FF15 54104000 call dword ptr ds:[<&KERNEL32.GetModuleFileNameA>]
00401423 |. 8A8D F8FEFFFF mov cl,byte ptr ss:[ebp-108]
00401429 |. 33D2 xor edx,edx
0040142B |. 84C9 test cl,cl
0040142D |. 8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-108]
00401433 |. 74 16 je short Notepad.0040144B
00401435 |> 80F9 5C /cmp cl,5C
00401438 |. 75 03 |jnz short Notepad.0040143D
0040143A |. 8D50 01 |lea edx,dword ptr ds:[eax+1]
0040143D |> 8A48 01 |mov cl,byte ptr ds:[eax+1]
00401440 |. 40 |inc eax
00401441 |. 84C9 |test cl,cl
00401443 |.^ 75 F0 jnz short Notepad.00401435
00401445 |. 85D2 test edx,edx
00401447 |. 74 02 je short Notepad.0040144B
00401449 |. 200A and byte ptr ds:[edx],cl
0040144B |> 8D45 FC lea eax,dword ptr ss:[ebp-4]
0040144E |. 50 push eax
0040144F |. 8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-108]
00401455 |. 50 push eax
00401456 |. E8 D0FDFFFF call Notepad.0040122B
====>F7进入
0040122B /$ 55 push ebp
0040122C |. 8BEC mov ebp,esp
0040122E |. 81EC 64030000 sub esp,364
00401234 |. 53 push ebx
00401235 |. 56 push esi
00401236 |. 8D45 FC lea eax,dword ptr ss:[ebp-4]
00401239 |. 57 push edi
0040123A |. 50 push eax
0040123B |. 6A 01 push 1
0040123D |. 33F6 xor esi,esi
0040123F |. BB 94114000 mov ebx,Notepad.00401194
00401244 |. E8 A5FEFFFF call Notepad.004010EE
00401249 |. 8BF8 mov edi,eax
0040124B |. 59 pop ecx
0040124C |. 85FF test edi,edi
0040124E |. 59 pop ecx
0040124F |. 74 56 je short Notepad.004012A7
004012A7 |> 8D45 FC lea eax,dword ptr ss:[ebp-4]
004012AA |. 50 push eax
004012AB |. 6A 02 push 2
004012AD |. E8 3CFEFFFF call Notepad.004010EE
004012B2 |. 8BF8 mov edi,eax
004012B4 |. 59 pop ecx
004012B5 |. 85FF test edi,edi
004012B7 |. 59 pop ecx
004012B8 |. 74 26 je short Notepad.004012E0
004012BA |. 8D85 9CFCFFFF lea eax,dword ptr ss:[ebp-364]
004012C0 |. 50 push eax
004012C1 |. FF75 08 push dword ptr ss:[ebp+8]
004012C4 |. E8 B5FEFFFF call Notepad.0040117E
004012C9 |. 8D85 9CFCFFFF lea eax,dword ptr ss:[ebp-364]
004012CF |. 50 push eax
004012D0 |. FF75 08 push dword ptr ss:[ebp+8]
004012D3 |. FF75 FC push dword ptr ss:[ebp-4]
004012D6 |. 57 push edi
004012D7 |. FFD3 call ebx
004012D9 |. 83C4 18 add esp,18
004012DC |. 85C0 test eax,eax
004012DE |. 75 21 jnz short Notepad.00401301
00401301 |> 8B1D 20104000 mov ebx,dword ptr ds:[<&KERNEL32.DeleteFileA>]
00401307 |. 85F6 test esi,esi
00401309 |. 74 10 je short Notepad.0040131B
0040131B |> FF15 40104000 call dword ptr ds:[<&KERNEL32.GetCommandLineA>]
00401321 |. 8BF8 mov edi,eax
00401323 |. 32C9 xor cl,cl
00401325 |. 803F 22 cmp byte ptr ds:[edi],22
00401328 |. 75 03 jnz short Notepad.0040132D
0040132A |. FEC1 inc cl
0040132C |> 47 inc edi
0040132D |> 8A07 mov al,byte ptr ds:[edi]
0040132F |. 84C0 test al,al
00401331 |. 74 0D je short Notepad.00401340
00401333 |. 3C 20 cmp al,20
00401335 |. 75 04 jnz short Notepad.0040133B
00401337 |. 84C9 test cl,cl
00401339 |. 74 05 je short Notepad.00401340
0040133B |> 3C 22 cmp al,22
0040133D |.^ 75 ED jnz short Notepad.0040132C
0040133F |. 47 inc edi
00401340 |> 8D85 A4FEFFFF lea eax,dword ptr ss:[ebp-15C]
00401346 |. 68 7C104000 push Notepad.0040107C
0040134B |. 50 push eax
0040134C |. FF15 3C104000 call dword ptr ds:[<&KERNEL32.lstrcpyA>]
00401352 |. 8B35 00104000 mov esi,dword ptr ds:[<&KERNEL32.lstrcatA>]
00401358 |. 8D85 9CFCFFFF lea eax,dword ptr ss:[ebp-364]
0040135E |. 50 push eax
0040135F |. 8D85 A4FEFFFF lea eax,dword ptr ss:[ebp-15C]
00401365 |. 50 push eax
00401366 |. FFD6 call esi ; lstrcatA
00401368 |. 8D85 A4FEFFFF lea eax,dword ptr ss:[ebp-15C]
0040136E |. 68 78104000 push Notepad.00401078
00401373 |. 50 push eax
00401374 |. FFD6 call esi
00401376 |. 8D85 A4FEFFFF lea eax,dword ptr ss:[ebp-15C]
0040137C |. 57 push edi
0040137D |. 50 push eax
0040137E |. FFD6 call esi
00401380 |. 8D45 A8 lea eax,dword ptr ss:[ebp-58]
00401383 |. 50 push eax
00401384 |. FF15 34104000 call dword ptr ds:[<&KERNEL32.GetStartupInfoA>]
0040138A |. 8D45 EC lea eax,dword ptr ss:[ebp-14]
0040138D |. 33FF xor edi,edi
0040138F |. 50 push eax
00401390 |. 8D45 A8 lea eax,dword ptr ss:[ebp-58]
00401393 |. 50 push eax
00401394 |. 57 push edi
00401395 |. 57 push edi
00401396 |. 6A 20 push 20
00401398 |. 6A 01 push 1
0040139A |. 57 push edi
0040139B |. 8D85 A4FEFFFF lea eax,dword ptr ss:[ebp-15C]
====>EAX=sxe8b.tmp
004013A1 |. 57 push edi
004013A2 |. 50 push eax
004013A3 |. 57 push edi
004013A4 |. FF15 30104000 call dword ptr ds:[<&KERNEL32.CreateProcessA>]
====>程序运行！
004013AA |. 85C0 test eax,eax
004013AC |. 75 0D jnz short Notepad.004013BB
————————————————————————
原来CEXE外壳通过CreateProcessA产生另外一个进程，即同目录下的sxe8b.tmp，为隐藏属性，程序退出即删之。使偶想起Armadillo壳的保护方式，不过CEXE的保护强度和Armadillo相比差距太大了。
可以在004013AA处用LordPE完全DUMP这个“E:试炼场脱壳学习cexesxe8b.tmp”进程，不用修复即可得到脱壳的程序。还有更简便的方法，完全不用任何调试工具：运行CEXE加壳的程序，在其同目录下会看到某个sxe**.tmp的隐藏文件，把这个sxe**.tmp复制出来，改后缀名.tmp为.EXE，这个就是加壳前的原程序啦。
—————————————————————————————————
, _/
/| _.-~/ _ , 青春都一饷
( /~ / ~-._ |
`\ _/ ~ ) 忍把浮名
_-~~~-.) )__/;;,. _ //'
/'_, --~ ~~~- ,;;___( (.-~~~-. 换了破解轻狂
`~ _( ,_..-- ( ,;'' / ~-- /._`
/~~//' /' `~ ) /--.._, )_ `~
" `~" " `" /~'` `\~~
" " "~' ""
Cracked By 巢水工作坊——fly [OCN][FCG]
2003-10-23 20:20
