浅谈SVKP 1.3X SDK stolen code 的找回
浅谈SVKP 1.3X SDK stolen code 的找回
【目 标】:Download Accelerator Plus v7.1
【工 具】:Olydbg1.1(diy版)
【任 务】:找回壳所抽的代码
【操作平台】:WINDOWS 2000 ADV SP2
【作 者】:loveboom[DFCG][FCG]
【相关链接】: www.skycn.com(自己去那里搜搜吧)
【简要说明】：本来不是很想写，只因这个软件是我看到svkp1.3x抽代码最多的（足足抽了6A字节），所以"厚着脸皮"，灌上一贴，只写了一下壳所抽代码的找回，不足或失误之处，还请各位大虾指点一二。建议如果你是新手，就先不要去试这样的壳，因为有点难度，当然这并不是说我很厉害，其实我也很菜的。
【详细过程】:
设置：忽略全部异常。隐藏你OD。
OD载入目标停在这里:
00598000 > 60 PUSHAD ;停在这里
00598001 E8 00000000 CALL DAP.00598006
00598006 5D POP EBP
00598007 81ED 06000000 SUB EBP,6
按f9一次，发生异常，异常位置:
0012E3B6 6285 20220000 BOUND EAX,QWORD PTR SS:[EBP+2220] ;这里异常
0012E3BC EB 02 JMP SHORT 0012E3C0
0012E3BE 0FE88B D1EB02CD PSUBSB MM1,QWORD PTR DS:[EBX+CD02EBD1]
0012E3C5 208B C2EB02CD AND BYTE PTR DS:[EBX+CD02EBC2],CL
异常后在code段下f2断点.
Memory map, item 13
Address=00401000
Size=000F0000 (983040.)
Owner=DAP 00400000
Section=
Contains=code
Type=Imag 01001002
Access=R
Initial access=RWE
下断后,SHIFT+F9这样来到了这里.
0394F14F 8A06 MOV AL,BYTE PTR DS:[ESI]
0394F151 46 INC ESI
0394F152 47 INC EDI
0394F153 8843 0F MOV BYTE PTR DS:[EBX+F],AL
0394F156 8A46 FF MOV AL,BYTE PTR DS:[ESI-1]
0394F159 55 PUSH EBP
0394F15A E8 00000000 CALL 0394F15F
0394F15F 5D POP EBP
0394F160 81ED 0D470000 SUB EBP,470D
0394F166 8A8D 50030000 MOV CL,BYTE PTR SS:[EBP+350]
0394F16C 5D POP EBP
0394F16D 32C1 XOR AL,CL
0394F16F 8847 FF MOV BYTE PTR DS:[EDI-1],AL
0394F172 8BC5 MOV EAX,EBP
0394F174 4D DEC EBP
0394F175 85C0 TEST EAX,EAX
0394F177 ^ 75 A4 JNZ SHORT 0394F11D ;这里跳回去循环解压代码
0394F179 33C0 XOR EAX,EAX
0394F17B 5D POP EBP
0394F17C 5F POP EDI
0394F17D 5E POP ESI
0394F17E 5B POP EBX
0394F17F C2 1400 RETN 14 ;直接在这里下F4
在0394f17f处下F4,因解压要一定的时间，所以如果你的机子配置较低的话可能等的时间比较长。f4停下后，我们再次在code段下f2断点，这里来到了这里：
039499AE 66:813E 4A43 CMP WORD PTR DS:[ESI],434A
039499B3 0F85 23010000 JNZ 03949ADC
039499B9 83C6 0A ADD ESI,0A
现在在12FFB0处下硬件访问断点(也就是hr 12ffb0)，为什么在这里下呢，这个看官你自己想想吧，如果要在这里下断的原因也不知道的话，建议你先看一下基础知识。
第一次断这里：
0012FC40 60 PUSHAD
0012FC41 E8 03000000 CALL 0012FC49
……
0012FC54 E8 01000000 CALL 0012FC5A ;第二次
0012FC59 E8 E8020000 CALL 0012FF46
0012FC5E 00CD ADD CH,CL
0012FC60 2083 04240B83 AND BYTE PTR DS:[EBX+830B2404],AL
……
0012FCFB E8 00000000 CALL 0012FD00 ;第三次
0012FD00 5D POP EBP
0012FD01 E8 02000000 CALL 0012FD08
第三次中断后hd 12ffb0取消断点。再下tc ebp==12ffc0(start esp value-4，谢谢tDasm),这样在这里断下:
03AD0647 0AAF BB010424 OR CH,BYTE PTR DS:[EDI+240401BB]
03AD064D 5D POP EBP
03AD064E E9 A10A0000 JMP 03AD10F4 ;断在这里
现在先清掉run trace window里的内容，并选择log file，记录到文件。做完准备工作后，下tc eip<03000000,这样到了fake oep处.
004D6214 90 NOP
004D6215 90 NOP
004D6216 E8 6183F5FF CALL DAP.0042E57C ;停在这里
004D621B 391D 380E5400 CMP DWORD PTR DS:[540E38],EBX
004D6221 75 0C JNZ SHORT DAP.004D622F
004D6223 68 5E634D00 PUSH DAP.004D635E
向上看一下，晕倒，壳抽了这么多的代码。要命呀，有点苦了。现在我们要开始分析代码了，
看看程序的"模样"，就知道它应该是用C写的程序。所以现在要"联想"一下C的oep的大概样子，当然，其实是要分析代码得出壳所抽的代码。先静态分析出轮廓。也因为这篇文章就是讲怎么找代码，所以个人认为应该详细一点（所以把大部分的代码都copy过来），
03AD10F4 Main POP EAX ◆这里典型的SVKP的代码，所以这里应该是push ebp
03AD10F5 Main NOP◆因为一般C的开始处都不变，也就是说，第二句应该是mov ebp,esp
03AD10F6 Main PUSH ADEDF13D
03AD10FB Main PUSH EAX
03AD10FC Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1101 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD1105 Main POP EAX ; EAX=03AD05B3
03AD1106 Main ADD EAX,52120FAB ; EAX=55BF155E
03AD110B Main ADD EAX,52120FAB ; EAX=A7D12509
03AD1110 Main JMP 03AD195B
03AD195B Main PUSH EAX
03AD195C Main JMP 03AD0B7A
03AD0B7A Main MOV EAX,52120FAB ; EAX=52120FAB
03AD0B7F Main SUB DWORD PTR SS:[ESP],EAX
03AD0B82 Main JMP 03AD124F
03AD124F Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=55BF155E
03AD1252 Main JMP 03AD1FAE
03AD1FAE Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1FB3 Main SUB DWORD PTR SS:[ESP],EAX
03AD1FB6 Main JMP 03AD10A6
03AD10A6 Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=03AD05B3
03AD10A9 Main PUSH ADEDF06C
03AD10AE Main PUSH EAX
03AD10AF Main MOV EAX,52120FAB ; EAX=52120FAB
03AD10B4 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD10B8 Main JMP 03AD1CA5
03AD1CA5 Main POP EAX ; EAX=03AD05B3
03AD1CA6 Main JMP 03AD2175
03AD2175 Main POP EAX ; EAX=00000017
03AD2176 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD217A Main POP EAX ; EAX=03AD05B3
03AD217B Main PUSH AF7D04C0
03AD2180 Main ADD EAX,52120FAB ; EAX=55BF155E
03AD2185 Main PUSH EAX
03AD2186 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD218B Main SUB DWORD PTR SS:[ESP],EAX
03AD218E Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=03AD05B3
03AD2191 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD2196 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD219A Main POP EAX ; EAX=03AD05B3
03AD219B Main ADD EAX,52120FAB ; EAX=55BF155E
03AD21A0 Main PUSH EAX
03AD21A1 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD21A6 Main JMP 03AD1AC5
03AD1AC5 Main SUB DWORD PTR SS:[ESP],EAX
03AD1AC8 Main JMP 03AD0D5A
03AD0D5A Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=03AD05B3
03AD0D5D Main JMP 03AD15CB
03AD15CB Main PUSH ACAF316A
03AD15D0 Main ADD EAX,52120FAB ; EAX=55BF155E
03AD15D5 Main PUSH EAX
03AD15D6 Main JMP 03AD2370
03AD2370 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD2375 Main JMP 03AD06B7
03AD06B7 Main SUB DWORD PTR SS:[ESP],EAX
03AD06BA Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=03AD05B3
03AD06BD Main MOV EAX,52120FAB ; EAX=52120FAB
03AD06C2 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD06C6 Main POP EAX ; EAX=03AD05B3
03AD06C7 Main JMP 03AD19F3
03AD19F3 Main POP EAX ; EAX=FEC14115
03AD19F4 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD19F8 Main JMP 03AD0740
03AD0740 Main POP EAX ; EAX=03AD05B3
03AD0741 Main PUSH 18C221F
03AD0746 Main PUSH EAX
03AD0747 Main PUSH 0
03AD074C Main MOV EAX,52120FAB ; EAX=52120FAB
03AD0751 Main ADD DWORD PTR SS:[ESP],EAX
03AD0754 Main MOV EDX,EDX
03AD0756 Main POP EAX
03AD0757 Main ADD DWORD PTR SS:[ESP],EAX
03AD075A Main POP EAX ; EAX=55BF155E
03AD075B Main PUSH EAX
03AD075C Main PUSH 0
03AD0761 Main PUSH EAX
03AD0762 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD0767 Main JMP 03AD1F8D
03AD1F8D Main ADD DWORD PTR SS:[ESP+4],EAX
03AD1F91 Main JMP 03AD1040
03AD1040 Main POP EAX ; EAX=55BF155E
03AD1041 Main POP EAX ; EAX=52120FAB
03AD1042 Main SUB DWORD PTR SS:[ESP],EAX
03AD1045 Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=03AD05B3
03AD1048 Main MOV EAX,FEC14115 ; EAX=FEC14115
03AD104D Main ADD DWORD PTR SS:[ESP+4],EAX
03AD1051 Main POP EAX ; EAX=03AD05B3
03AD1052 Main XCHG EBP,EBP
03AD1054 Main PUSH 5A9D21BF
03AD1059 Main PUSH EAX
03AD105A Main MOV EAX,52120FAB ; EAX=52120FAB
03AD105F Main ADD DWORD PTR SS:[ESP+4],EAX
03AD1063 Main POP EAX ; EAX=03AD05B3
03AD1064 Main MOV ESP,ESP
03AD1066 Main PUSH EAX
03AD1067 Main PUSH 0
03AD106C Main JMP 03AD19B7
03AD19B7 Main PUSH EAX
03AD19B8 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD19BD Main JMP 03AD1F6C
03AD1F6C Main ADD DWORD PTR SS:[ESP+4],EAX
03AD1F70 Main JMP 03AD0C6B
03AD0C6B Main POP EAX ; EAX=03AD05B3
03AD0C6C Main JMP 03AD0C43
03AD0C43 Main POP EAX ; EAX=52120FAB
03AD0C44 Main JMP 03AD07FC
03AD07FC Main ADD DWORD PTR SS:[ESP+4],EAX
03AD0800 Main JMP 03AD1D77
03AD1D77 Main POP EAX ; EAX=03AD05B3
03AD1D78 Main POP EAX ; EAX=FEC14115
03AD1D79 Main JMP 03AD23AA
03AD23AA Main PUSH DWORD PTR FS:[0] ◆这里也是变形的，看它无端端来一个push fs:[0]也可以看到，肯定有动作.
03AD23B1 Main SUB DWORD PTR SS:[ESP],EAX
03AD23B4 Main POP EAX ; EAX=0151BECB
03AD23B5 Main PUSH EAX ;分析结果，上面的是mov eax,fs:[0]
03AD23B6 Main PUSH 5A9D21BF
03AD23BB Main PUSH EAX
03AD23BC Main MOV EAX,EAX
03AD23BE Main MOV EAX,52120FAB ; EAX=52120FAB
03AD23C3 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD23C7 Main POP EAX ; EAX=0151BECB
03AD23C8 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD23CD Main ADD DWORD PTR SS:[ESP],EAX
03AD23D0 Main POP EAX ; EAX=FEC14115
03AD23D1 Main ADD DWORD PTR SS:[ESP],EAX
03AD23D4 Main JMP 03AD24B4
03AD24B4 Main POP EAX ; EAX=0012FFE0
03AD24B5 Main JMP 03AD1424
03AD1424 Main PUSH EAX
03AD1425 Main PUSH ACAF316A
03AD142A Main JMP 03AD1366
03AD1366 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD136B Main ADD DWORD PTR SS:[ESP],EAX
03AD136E Main POP EAX ; EAX=FEC14115
03AD136F Main ADD DWORD PTR SS:[ESP],EAX
03AD1372 Main POP EAX ; EAX=FED440F5
03AD1373 Main ADD EAX,52120FAB ; EAX=50E650A0
03AD1378 Main ADD EAX,52120FAB ; EAX=A2F8604B
03AD137D Main PUSH EAX
03AD137E Main MOV EDI,EDI
03AD1380 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1385 Main SUB DWORD PTR SS:[ESP],EAX
03AD1388 Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=50E650A0
03AD138B Main JMP 03AD13D5
03AD13D5 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD13DA Main SUB DWORD PTR SS:[ESP],EAX
03AD13DD Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=FED440F5
03AD13E0 Main PUSH ACAF316A
03AD13E5 Main PUSH EAX
03AD13E6 Main JMP 03AD211A
03AD211A Main MOV EAX,52120FAB ; EAX=52120FAB
03AD211F Main ADD DWORD PTR SS:[ESP+4],EAX
03AD2123 Main JMP 03AD1D50
03AD1D50 Main POP EAX ; EAX=FED440F5
03AD1D51 Main JMP 03AD08CD
03AD08CD Main POP EAX ; EAX=FEC14115
03AD08CE Main SUB DWORD PTR SS:[ESP],EAX
03AD08D1 Main JMP 03AD1820
03AD1820 Main MOV EAX,DWORD PTR SS:[ESP] ◆这里就是变形的push eax
03AD1823 Main JMP 03AD152B
03AD152B Main MOV DWORD PTR FS:[0],ESP◆
03AD1532 Main SUB ESP,68 ◆
03AD1535 Main PUSH EAX
03AD1536 Main ADD EBX,52120FAB ; EBX=D20FFFAB
03AD153C Main PUSH EBX
03AD153D Main JMP 03AD0888
03AD0888 Main PUSH EAX
03AD0889 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD088E Main SUB DWORD PTR SS:[ESP+4],EAX
03AD0892 Main POP EAX ; EAX=0012FFE0
03AD0893 Main SUB EBX,52120FAB ; EBX=7FFDF000
03AD0899 Main PUSH ACAF316A
03AD089E Main PUSH 0
03AD08A3 Main PUSH EAX
03AD08A4 Main JMP 03AD173D
03AD173D Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1742 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD1746 Main JMP 03AD0E89
03AD0E89 Main POP EAX ; EAX=0012FFE0
03AD0E8A Main POP EAX ; EAX=52120FAB
03AD0E8B Main ADD DWORD PTR SS:[ESP],EAX
03AD0E8E Main POP EAX ; EAX=FEC14115
03AD0E8F Main ADD DWORD PTR SS:[ESP],EAX
03AD0E92 Main JMP 03AD1EFE
03AD1EFE Main POP EBX ; EBX=7EBF3115
03AD1EFF Main POP EAX ; EAX=0012FFE0
03AD1F00 Main ADD EBX,52120FAB ; EBX=D0D140C0
03AD1F06 Main PUSH EBX
03AD1F07 Main PUSH EAX
03AD1F08 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1F0D Main SUB DWORD PTR SS:[ESP+4],EAX
03AD1F11 Main JMP 03AD207F
03AD207F Main POP EAX ; EAX=0012FFE0
03AD2080 Main JMP 03AD1E40
03AD1E40 Main SUB EBX,52120FAB ; EBX=7EBF3115
03AD1E46 Main ADD EAX,52120FAB ; EAX=52250F8B
03AD1E4B Main ADD EAX,52120FAB ; EAX=A4371F36
03AD1E50 Main NOP
03AD1E51 Main PUSH EAX
03AD1E52 Main JMP 03AD2331
03AD2331 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD2336 Main SUB DWORD PTR SS:[ESP],EAX
03AD2339 Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=52250F8B
03AD233C Main JMP 03AD16FD
03AD16FD Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1702 Main MOV ECX,ECX
03AD1704 Main SUB DWORD PTR SS:[ESP],EAX
03AD1707 Main JMP 03AD09FB
03AD09FB Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=0012FFE0
03AD09FE Main PUSH ACAF316A
03AD0A03 Main PUSH EAX
03AD0A04 Main JMP 03AD1E78
03AD1E78 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1E7D Main ADD DWORD PTR SS:[ESP+4],EAX
03AD1E81 Main POP EAX ; EAX=0012FFE0
03AD1E82 Main POP EAX ; EAX=FEC14115
03AD1E83 Main SUB DWORD PTR SS:[ESP+4],EAX
03AD1E87 Main POP EAX ; EAX=0012FFE0
03AD1E88 Main PUSH EAX
03AD1E89 Main ADD EBX,52120FAB ; EBX=D0D140C0
03AD1E8F Main JMP 03AD1DEE
03AD1DEE Main PUSH EBX
03AD1DEF Main JMP 03AD189B
03AD189B Main PUSH EAX
03AD189C Main JMP 03AD1C65
03AD1C65 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1C6A Main SUB DWORD PTR SS:[ESP+4],EAX
03AD1C6E Main XCHG EDI,EDI
03AD1C70 Main POP EAX ; EAX=0012FFE0
03AD1C71 Main SUB EBX,52120FAB ; EBX=7EBF3115
03AD1C77 Main PUSH 50D350C0
03AD1C7C Main PUSH 0
03AD1C81 Main PUSH EAX
03AD1C82 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD1C87 Main JMP 03AD240E
03AD240E Main ADD DWORD PTR SS:[ESP+4],EAX
03AD2412 Main JMP 03AD20B4
03AD20B4 Main POP EAX ; EAX=0012FFE0
03AD20B5 Main POP EAX ; EAX=52120FAB
03AD20B6 Main SUB DWORD PTR SS:[ESP],EAX
03AD20B9 Main JMP 03AD22B8
03AD22B8 Main POP EAX ; EAX=FEC14115
03AD22B9 Main SUB DWORD PTR SS:[ESP],EAX
03AD22BC Main POP EBX◆ ; EBX=7FFDF000
03AD22BD Main POP EAX ; EAX=0012FFE0
03AD22BE Main PUSH EAX
03AD22BF Main XCHG EAX,EAX
03AD22C1 Main PUSH ESI◆
03AD22C2 Main JMP 03AD0A52
03AD0A52 Main PUSH ACAF316A
03AD0A57 Main JMP 03AD2508
03AD2508 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD250D Main ADD DWORD PTR SS:[ESP],EAX
03AD2510 Main POP EAX ; EAX=FEC14115
03AD2511 Main JMP 03AD084E
03AD084E Main ADD DWORD PTR SS:[ESP],EAX
03AD0851 Main XCHG EBX,EBX
03AD0853 Main JMP 03AD12F4
03AD12F4 Main POP ESI ; ESI=FEC14115
03AD12F5 Main POP EAX ; EAX=0012FFE0
03AD12F6 Main JMP 03AD24DB
03AD24DB Main ADD ESI,52120FAB ; ESI=50D350C0
03AD24E1 Main ADD ESI,52120FAB ; ESI=A2E5606B
03AD24E7 Main PUSH ESI
03AD24E8 Main PUSH EAX
03AD24E9 Main JMP 03AD0FF9
03AD0FF9 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD0FFE Main SUB DWORD PTR SS:[ESP+4],EAX
03AD1002 Main POP EAX ; EAX=0012FFE0
03AD1003 Main JMP 03AD0901
03AD0901 Main SUB ESI,52120FAB ; ESI=50D350C0
03AD0907 Main PUSH EAX
03AD0908 Main PUSH 0
03AD090D Main PUSH EAX
03AD090E Main MOV EAX,52120FAB ; EAX=52120FAB
03AD0913 Main ADD DWORD PTR SS:[ESP+4],EAX
03AD0917 Main POP EAX ; EAX=0012FFE0
03AD0918 Main POP EAX ; EAX=52120FAB
03AD0919 Main SUB DWORD PTR SS:[ESP+4],EAX
03AD091D Main POP EAX ; EAX=0012FFE0
03AD091E Main JMP 03AD22F6
03AD22F6 Main SUB ESI,52120FAB ; ESI=FEC14115
03AD22FC Main ADD EAX,52120FAB ; EAX=52250F8B
03AD2301 Main PUSH EAX
03AD2302 Main MOV EAX,52120FAB ; EAX=52120FAB
03AD2307 Main SUB DWORD PTR SS:[ESP],EAX
03AD230A Main MOV EAX,DWORD PTR SS:[ESP] ; EAX=0012FFE0
03AD230D Main PUSH ACAF316A
03AD2312 Main MOV EAX,EAX
03AD2314 Main JMP 03AD1479
03AD1479 Main ADD EAX,52120FAB ; EAX=52250F8B
03AD147E Main PUSH EAX
03AD147F Main JMP 03AD179C
