PEncrypt V4.0b<span class="pediy"><span class="postbody">——Win98的Notepad </span></span>

下载地址：  http://protools.anticrack.de/files/packers/PEncrypt.zip 
软件大小：  16 KB
【软件简介】：Multi Layer Encryptor for the Decryptor. SoftICE, ICEDump Detection code. Crashes the OS in case it is found in memory. Anti ICEDump's /TRACEX command. Win9x compatible. Includes anti-debugging, anti-tracing routines.
【作者声明】：初学Crack，只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教！
【调试环境】：WinXP、Ollydbg1.09、PEiD、LordPE
————————————————————————————————— 
【脱壳过程】：
          
设置Ollydbg不忽略所有异常。其实这种壳在98下用TRW来脱壳很是方便啦。
用Ollydbg手动脱壳,老规矩：载入后弹出“是压缩代码——要继续进行分析吗？”，点“否”。
00401000     50                   push eax
                                  ====>进入OD后断在这！
00401001     9C                   pushfd
00401002     58                   pop eax
00401003     F6C4 01              test ah,1
00401006     75 FE                jnz short Notepad.00401006
00401008     58                   pop eax
00401009     EB 01                jmp short Notepad.0040100C
0040100C     90                   nop
0040100D     90                   nop
0040100E     FC                   cld
0040100F     FC                   cld
00401010     BF C6CA4000          mov edi,Notepad.0040CAC6
00401015     FFE7                 jmp edi
0040CAC6     FC                   cld
0040CAC7     66:83EC 00           sub sp,0
0040CACB     FC                   cld
0040CACC     66:83CD 00           or bp,0
0040CAD0     FC                   cld
0040CAD1     FC                   cld
0040CAD2     E8 14000000          call Notepad.0040CAEB
0040CAEB     5D                   pop ebp 
0040CAEC     90                   nop
0040CAED     90                   nop
0040CAEE     FC                   cld
0040CAEF     FC                   cld
0040CAF0     81ED 05104000        sub ebp,Notepad.00401005
0040CAF6     8BFF                 mov edi,edi
0040CAF8     66:8BF6              mov si,si
0040CAFB     66:83C1 00           add cx,0
0040CAFF     50                   push eax
0040CB00     9C                   pushfd
0040CB01     58                   pop eax
0040CB02     F6C4 01              test ah,1
0040CB05   - 75 FE                jnz short Notepad.0040CB05
0040CB07     58                   pop eax
0040CB08     53                   push ebx
0040CB09     9C                   pushfd
0040CB0A     5B                   pop ebx
0040CB0B     F6C7 01              test bh,1
0040CB0E   - 75 FE                jnz short Notepad.0040CB0E
0040CB10     5B                   pop ebx
0040CB11     90                   nop
0040CB12     8DB5 B7104000        lea esi,dword ptr ss:[ebp+4010B7]
0040CB18     66:8BE4              mov sp,sp
0040CB1B     52                   push edx
0040CB1C     9C                   pushfd
0040CB1D     5A                   pop edx
0040CB1E     F6C6 01              test dh,1
0040CB21   - 75 FE                jnz short Notepad.0040CB21
0040CB23     5A                   pop edx
0040CB24     51                   push ecx
0040CB25     9C                   pushfd
0040CB26     59                   pop ecx
0040CB27     F6C5 01              test ch,1
0040CB2A   - 75 FE                jnz short Notepad.0040CB2A
0040CB2C     59                   pop ecx
0040CB2D     EB 01                jmp short Notepad.0040CB30
0040CB30     FC                   cld
0040CB31     FC                   cld
0040CB32     BB 22030000          mov ebx,322
0040CB37     FC                   cld
0040CB38     90                   nop
0040CB39     90                   nop
0040CB3A     FC                   cld
0040CB3B     8A16                 mov dl,byte ptr ds:[esi]
0040CB3D     66:0D 0000           or ax,0
0040CB41     FC                   cld
0040CB42     FC                   cld
0040CB43     90                   nop
0040CB44     90                   nop
0040CB45     C0C2 95              rol dl,95
0040CB48     90                   nop
0040CB49     90                   nop
0040CB4A     66:83C9 00           or cx,0
0040CB4E     FC                   cld
0040CB4F     90                   nop
0040CB50     8816                 mov byte ptr ds:[esi],dl
0040CB52     FC                   cld
0040CB53     90                   nop
0040CB54     FC                   cld
0040CB55     52                   push edx
0040CB56     9C                   pushfd
0040CB57     5A                   pop edx
0040CB58     F6C6 01              test dh,1
0040CB5B   - 75 FE                jnz short Notepad.0040CB5B
0040CB5D     5A                   pop edx
0040CB5E     90                   nop
0040CB5F     90                   nop
0040CB60     90                   nop
0040CB61     4B                   dec ebx
0040CB62     90                   nop
0040CB63     66:83F1 00           xor cx,0
0040CB67     FC                   cld
0040CB68     FC                   cld
0040CB69     EB 01                jmp short Notepad.0040CB6C
0040CB6C     FC                   cld
0040CB6D     FC                   cld
0040CB6E     90                   nop
0040CB6F     46                   inc esi
0040CB70     FC                   cld
0040CB71     8BE4                 mov esp,esp
0040CB73     50                   push eax
0040CB74     9C                   pushfd
0040CB75     58                   pop eax
0040CB76     F6C4 01              test ah,1
0040CB79   - 75 FE                jnz short Notepad.0040CB79
0040CB7B     58                   pop eax
0040CB7C     90                   nop
0040CB7D     90                   nop
0040CB7E     FC                   cld
0040CB7F     FC                   cld
0040CB80     FC                   cld
0040CB81     85DB                 test ebx,ebx
0040CB83   ^ 0F85 B2FFFFFF        jnz Notepad.0040CB3B
                                  ====>F4下去跳出循环！
0040CB89     60                   pushad
0040CB8A     BE 00104000          mov esi,Notepad.<ModuleEntryPoint>
0040CB8F     B8 3F0E3481          mov eax,81340E3F
0040CB94     8906                 mov dword ptr ds:[esi],eax
0040CB96     B8 48675AE5          mov eax,E55A6748
0040CB9B     8946 04              mov dword ptr ds:[esi+4],eax
0040CB9E     B8 50794781          mov eax,81477950
0040CBA3     8946 08              mov dword ptr ds:[esi+8],eax
0040CBA6     B8 5B6B42E8          mov eax,E8426B5B
0040CBAB     8946 0C              mov dword ptr ds:[esi+C],eax
0040CBAE     B8 5C6B3481          mov eax,81346B5C
0040CBB3     8946 10              mov dword ptr ds:[esi+10],eax
0040CBB6     B8 707B40A1          mov eax,A1407B70
0040CBBB     8946 14              mov dword ptr ds:[esi+14],eax
0040CBBE     B8 506814D3          mov eax,D3146850
0040CBC3     8946 18              mov dword ptr ds:[esi+18],eax
0040CBC6     61                   popad
0040CBC7     E8 00000000          call Notepad.0040CBCC
0040CBCC     5D                   pop ebp
0040CBCD     81ED 05104000        sub ebp,Notepad.00401005
0040CBD3     8CC9                 mov cx,cs
0040CBD5     32C9                 xor cl,cl
0040CBD7     E3 02                jecxz short Notepad.0040CBDB
0040CBDB     64:67:A1 3000        mov eax,dword ptr fs:[30]
0040CBE0     0FB640 02            movzx eax,byte ptr ds:[eax+2]
0040CBE4     0AC0                 or al,al
0040CBE6     74 08                je short Notepad.0040CBF0
0040CBF0     33F6                 xor esi,esi  
0040CBF2     8D85 49104000        lea eax,dword ptr ss:[ebp+401049]
0040CBF8     50                   push eax
0040CBF9     64:FF36              push dword ptr fs:[esi]
0040CBFC     8BC4                 mov eax,esp
0040CBFE     64:8906              mov dword ptr fs:[esi],eax
0040CC01     EB 1C                jmp short Notepad.0040CC1F
0040CC1F     33C0                 xor eax,eax
0040CC21     8618                 xchg byte ptr ds:[eax],bl
                                  ====>异常!注意在堆栈区第2条地址处下断
0040CC10     8B6424 08            mov esp,dword ptr ss:[esp+8]
                                  ====>堆栈区第2条地址，Shift+F9断在这
0040CC14     64:67:8F06 0000      pop dword ptr fs:[0]
0040CC1A     83C4 04              add esp,4
0040CC1D     EB 0E                jmp short Notepad.0040CC2D
0040CC2D     E8 00000000          call Notepad.0040CC32
0040CC32     5D                   pop ebp  
0040CC33     81ED 6B104000        sub ebp,Notepad.0040106B
0040CC39     8D85 93104000        lea eax,dword ptr ss:[ebp+401093]
0040CC3F     50                   push eax
0040CC40     64:67:FF36 0000      push dword ptr fs:[0]
0040CC46     8BC4                 mov eax,esp
0040CC48     64:67:A3 0000        mov dword ptr fs:[0],eax
0040CC4D     9C                   pushfd
0040CC4E     804C24 01 01         or byte ptr ss:[esp+1],1
0040CC53     9D                   popfd
0040CC54     90                   nop
0040CC55     4B                   dec ebx
0040CC56     6F                   outs dx,dword ptr es:[edi]
                                  ====>异常!注意在堆栈区第2条地址处下断
0040CC5A     8B4424 04            mov eax,dword ptr ss:[esp+4]
                                  ====>堆栈区第2条地址，Shift+F9断在这
0040CC5E     8B00                 mov eax,dword ptr ds:[eax]
0040CC60     3D 04000080          cmp eax,80000004
0040CC65     74 06                je short Notepad.0040CC6D
0040CC67     4B                   dec ebx
0040CC68     65:72 61             jb short Notepad.0040CCCC
0040CC6B     6C                   ins byte ptr es:[edi],dx
                                  ====>异常!把这里NOP掉！
0040CC6B     90                   nop
0040CC6C     61                   popad
0040CC6D     EB 02                jmp short Notepad.0040CC71
0040CC71     60                   pushad
0040CC72     9C                   pushfd
0040CC73     BE 00104000          mov esi,Notepad.<ModuleEntryPoint>
0040CC78     8BFE                 mov edi,esi
0040CC7A     B9 00100000          mov ecx,1000
0040CC7F     BB 3F0E3481          mov ebx,81340E3F
0040CC84     AD                   lods dword ptr ds:[esi]
0040CC85     33C3                 xor eax,ebx
0040CC87     AB                   stos dword ptr es:[edi]
0040CC88   ^ E2 FA                loopd short Notepad.0040CC84
                                  ====>F4跳出LOOP
0040CC8A     9D                   popfd
0040CC8B     61                   popad
0040CC8C     EB 02                jmp short Notepad.0040CC90
0040CC90     60                   pushad
0040CC91     9C                   pushfd
0040CC92     BE 00504000          mov esi,Notepad.00405000
0040CC97     8BFE                 mov edi,esi
0040CC99     B9 00040000          mov ecx,400
0040CC9E     BB 3F0E3481          mov ebx,81340E3F
0040CCA3     AD                   lods dword ptr ds:[esi]
0040CCA4     33C3                 xor eax,ebx
0040CCA6     AB                   stos dword ptr es:[edi]
0040CCA7   ^ E2 FA                loopd short Notepad.0040CCA3
                                  ====>F4跳出LOOP
0040CCA9     9D                   popfd
0040CCAA     61                   popad
0040CCAB     B8 CC104000          mov eax,Notepad.004010CC
                                  ====>EAX=004010CC   这就是OEP值  
0040CCB0     50                   push eax
0040CCB1     C3                   retn
                                  ====>飞向光明之巅！

————————————————————————
004010CC     55                   push ebp
                                  ====>在这儿用LordPE完全DUMP这个进程
004010CD     8BEC                 mov ebp,esp
004010CF     83EC 44              sub esp,44
004010D2     56                   push esi
004010D3     FF15 E4634000        call dword ptr ds:[<&KERNEL32.GetCommandLineA>]
004010D9     8BF0                 mov esi,eax
004010DB     8A00                 mov al,byte ptr ds:[eax]
004010DD     3C 22                cmp al,22
004010DF     75 1B                jnz short Notepad.004010FC
004010E1     56                   push esi
004010E2     FF15 F4644000        call dword ptr ds:[<&USER32.CharNextA>]

———————————————————————
用LordPE把OEP改为000010CC，正常运行！  53.2K ->52K
 
—————————————————————————————————
    
                                
         ,     _/ 
        /| _.-~/            _     ,        青春都一饷
       ( /~   /              ~-._ |
       `\  _/                   ~ )          忍把浮名 
   _-~~~-.)  )__/;;,.          _  //'
  /'_,   --~    ~~~-  ,;;___(  (.-~~~-.        换了破解轻狂
 `~ _( ,_..-- (     ,;'' /    ~--   /._` 
  /~~//'   /' `~         ) /--.._, )_  `~
  "  `~"  "      `"      /~'`    `\~~   
                         "     "   "~'  ""
    
            Cracked By 巢水工作坊——fly [OCN][FCG]
                   2003-10-23  19:19