弱壳追捕 —— PCPEC、PEncrypt V4.0b、CodeCrypt V0.164、CEXE
PCPEC 脱壳 —— Pcpec.exe 主程序
下载地址： http://www.exetools.com/files/protectors/win/pcpec.zip
软件大小： 18 KB
【软件简介】：PCPEC stands for Phrozen Crew PE header enCryptor. It has some very nice encryption features and in addition, the current version of PROCDUMP (v1.1.6) is unable to unpacked it
【作者声明】：初学Crack，只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教！
【调试环境】：Win98、Ollydbg1.09、PEiD、LordPE、ProcessENG
—————————————————————————————————
【脱壳过程】：
0040B000 53 push ebx
====>进入OD后断在这！
0040B001 51 push ecx
0040B002 52 push edx
0040B003 56 push esi
0040B004 57 push edi
0040B005 55 push ebp
0040B006 E8 00000000 call PCPEC.0040B00B
0040B00B 5D pop ebp
0040B00C 8BCD mov ecx,ebp
0040B00E 81ED 33304000 sub ebp,PCPEC.00403033
0040B014 2B8D EE324000 sub ecx,dword ptr ss:[ebp+4032EE]
0040B01A 83E9 0B sub ecx,0B
0040B01D 898D F2324000 mov dword ptr ss:[ebp+4032F2],ecx
0040B023 80BD D1324000 01 cmp byte ptr ss:[ebp+4032D1],1
0040B02A 0F84 63020000 je PCPEC.0040B293
0040B030 C685 D1324000 01 mov byte ptr ss:[ebp+4032D1],1
0040B037 83BD FE324000 00 cmp dword ptr ss:[ebp+4032FE],0
0040B03E 0F84 8F010000 je PCPEC.0040B1D3
0040B044 C785 DE324000 785634>mov dword ptr ss:[ebp+4032DE],12345678
0040B04E 83BD D2324000 00 cmp dword ptr ss:[ebp+4032D2],0
0040B055 0F84 1A010000 je PCPEC.0040B175
0040B05B C785 DA324000 FE4350>mov dword ptr ss:[ebp+4032DA],FE5043FE
0040B065 8BB5 D2324000 mov esi,dword ptr ss:[ebp+4032D2]
0040B06B 03B5 F2324000 add esi,dword ptr ss:[ebp+4032F2]
0040B071 8BFE mov edi,esi
0040B073 8B8D D6324000 mov ecx,dword ptr ss:[ebp+4032D6]
0040B079 C1E9 02 shr ecx,2
0040B07C 51 push ecx
0040B07D AD lods dword ptr ds:[esi]
0040B07E 8A5E FD mov bl,byte ptr ds:[esi-3]
0040B081 3385 DA324000 xor eax,dword ptr ss:[ebp+4032DA]
0040B087 8B8D DA324000 mov ecx,dword ptr ss:[ebp+4032DA]
0040B08D C1E9 18 shr ecx,18
0040B090 D3C0 rol eax,cl
0040B092 AB stos dword ptr es:[edi]
0040B093 8B85 DA324000 mov eax,dword ptr ss:[ebp+4032DA]
0040B099 8ACB mov cl,bl
0040B09B D3C0 rol eax,cl
0040B09D 8985 DA324000 mov dword ptr ss:[ebp+4032DA],eax
0040B0A3 59 pop ecx
0040B0A4 ^ E2 D6 loopd short PCPEC.0040B07C
====>F4下去跳出LOOP
0040B0A6 BF 52334000 mov edi,PCPEC.00403352
0040B0AB 03FD add edi,ebp
0040B0AD 81C7 FC030000 add edi,3FC
0040B0B3 FD std
0040B0B4 BE 00000000 mov esi,0
0040B0B9 8BC6 mov eax,esi
0040B0BB B9 08000000 mov ecx,8
0040B0C0 A9 01000000 test eax,1
0040B0C5 75 10 jnz short PCPEC.0040B0D7
0040B0C7 90 nop
0040B0C8 90 nop
0040B0C9 90 nop
0040B0CA 90 nop
0040B0CB D1E8 shr eax,1
0040B0CD 35 2083B8ED xor eax,EDB88320
0040B0D2 EB 05 jmp short PCPEC.0040B0D9
0040B0D4 90 nop
0040B0D5 90 nop
0040B0D6 90 nop
0040B0D7 D1E8 shr eax,1
0040B0D9 ^ E2 E5 loopd short PCPEC.0040B0C0
====>F4下去跳出LOOP
0040B0DB AB stos dword ptr es:[edi]
0040B0DC 46 inc esi
0040B0DD 81FE 00010000 cmp esi,100
0040B0E3 ^ 75 D4 jnz short PCPEC.0040B0B9
====>F4下去跳出循环！
0040B0E5 FC cld
0040B0E6 66:C785 DA324000 FFF>mov word ptr ss:[ebp+4032DA],0FFFF
0040B0EF 66:C785 DC324000 FFF>mov word ptr ss:[ebp+4032DC],0FFFF
0040B0F8 8BB5 D2324000 mov esi,dword ptr ss:[ebp+4032D2]
0040B0FE 03B5 F2324000 add esi,dword ptr ss:[ebp+4032F2]
0040B104 33DB xor ebx,ebx
0040B106 33D2 xor edx,edx
0040B108 66:8B9D DA324000 mov bx,word ptr ss:[ebp+4032DA]
0040B10F 66:8B95 DC324000 mov dx,word ptr ss:[ebp+4032DC]
0040B116 AC lods byte ptr ds:[esi]
0040B117 32D8 xor bl,al
0040B119 32FF xor bh,bh
0040B11B 66:D1E3 shl bx,1
0040B11E 66:D1E3 shl bx,1
0040B121 81C3 52334000 add ebx,PCPEC.00403352
0040B127 03DD add ebx,ebp
0040B129 66:8B03 mov ax,word ptr ds:[ebx]
0040B12C 66:8B4B 02 mov cx,word ptr ds:[ebx+2]
0040B130 66:8B9D DA324000 mov bx,word ptr ss:[ebp+4032DA]
0040B137 66:8B95 DC324000 mov dx,word ptr ss:[ebp+4032DC]
0040B13E 51 push ecx
0040B13F B9 08000000 mov ecx,8
0040B144 66:D1EA shr dx,1
0040B147 66:D1DB rcr bx,1
0040B14A ^ E2 F8 loopd short PCPEC.0040B144
====>F4下去跳出LOOP
0040B14C 59 pop ecx
0040B14D 66:33C3 xor ax,bx
0040B150 66:33D1 xor dx,cx
0040B153 66:8985 DA324000 mov word ptr ss:[ebp+4032DA],ax
0040B15A 66:8995 DC324000 mov word ptr ss:[ebp+4032DC],dx
0040B161 FF8D D6324000 dec dword ptr ss:[ebp+4032D6]
0040B167 ^ 75 9B jnz short PCPEC.0040B104
====>F4下去跳出循环！
0040B169 8B85 DA324000 mov eax,dword ptr ss:[ebp+4032DA]
0040B16F 8985 DE324000 mov dword ptr ss:[ebp+4032DE],eax
0040B175 33DB xor ebx,ebx
0040B177 53 push ebx
0040B178 C1E3 03 shl ebx,3
0040B17B 03DD add ebx,ebp
0040B17D 81C3 02334000 add ebx,PCPEC.00403302
0040B183 8B33 mov esi,dword ptr ds:[ebx]
0040B185 03B5 F2324000 add esi,dword ptr ss:[ebp+4032F2]
0040B18B 8BFE mov edi,esi
0040B18D 8B4B 04 mov ecx,dword ptr ds:[ebx+4]
0040B190 C1E9 02 shr ecx,2
0040B193 8B85 DE324000 mov eax,dword ptr ss:[ebp+4032DE]
0040B199 8985 DA324000 mov dword ptr ss:[ebp+4032DA],eax
0040B19F 51 push ecx
0040B1A0 AD lods dword ptr ds:[esi]
0040B1A1 8A5E FD mov bl,byte ptr ds:[esi-3]
0040B1A4 3385 DA324000 xor eax,dword ptr ss:[ebp+4032DA]
0040B1AA 8B8D DA324000 mov ecx,dword ptr ss:[ebp+4032DA]
0040B1B0 C1E9 18 shr ecx,18
0040B1B3 D3C0 rol eax,cl
0040B1B5 AB stos dword ptr es:[edi]
0040B1B6 8B85 DA324000 mov eax,dword ptr ss:[ebp+4032DA]
0040B1BC 8ACB mov cl,bl
0040B1BE D3C0 rol eax,cl
0040B1C0 8985 DA324000 mov dword ptr ss:[ebp+4032DA],eax
0040B1C6 59 pop ecx
0040B1C7 ^ E2 D6 loopd short PCPEC.0040B19F
====>F4下去跳出LOOP
0040B1C9 5B pop ebx
0040B1CA 43 inc ebx
0040B1CB 3B9D FE324000 cmp ebx,dword ptr ss:[ebp+4032FE]
0040B1D1 ^ 75 A4 jnz short PCPEC.0040B177
====>F4下去跳出循环！
0040B1D3 8B85 F2324000 mov eax,dword ptr ss:[ebp+4032F2]
0040B1D9 8B9D F6324000 mov ebx,dword ptr ss:[ebp+4032F6]
0040B1DF 2BC3 sub eax,ebx
0040B1E1 0F84 AC000000 je PCPEC.0040B293
0040B293 8B85 F2324000 mov eax,dword ptr ss:[ebp+4032F2]
0040B299 8B9D FA324000 mov ebx,dword ptr ss:[ebp+4032FA]
0040B29F 03C3 add eax,ebx
====>EAX=00400000 + 00002325=00402325 这就是OEP值
0040B2A1 5D pop ebp
0040B2A2 5F pop edi
0040B2A3 5E pop esi
0040B2A4 5A pop edx
0040B2A5 59 pop ecx
0040B2A6 5B pop ebx
0040B2A7 FFE0 jmp eax
====>飞向光明之巅！
————————————————————————
00402325 6A db 6A
====>在这儿用ProcessENG抓取这个进程
00402326 00 db 00
00402327 E8 db E8
———————————————————————
PCPEC 壳找OEP很容易，但是为了抓取这个进程可费了点劲。作者说的没错，PROCDUMP无法抓取进程，LordPE和PEditor也无法DUMP。
后来偶突然想起硬盘某个角落里还有ProcessENG 1.7 晓文的汉化版：“可以抓取内存中的映像文件，也可以重建输入表，是一款不错的脱壳辅助工具。” 呵呵，这个东东重建输入表的功能不太好用，但是却可以DUMP这个难缠的进程。
抓取进程后用LordPE把OEP改为00002325，重建PE后即可正常运行。 25.3K ->48K
—————————————————————————————————
, _/
/| _.-~/ _ , 青春都一饷
( /~ / ~-._ |
`\ _/ ~ ) 忍把浮名
_-~~~-.) )__/;;,. _ //'
/'_, --~ ~~~- ,;;___( (.-~~~-. 换了破解轻狂
`~ _( ,_..-- ( ,;'' / ~-- /._`
/~~//' /' `~ ) /--.._, )_ `~
" `~" " `" /~'` `\~~
" " "~' ""
Cracked By 巢水工作坊——fly [OCN][FCG]
2003-10-22 18:00
