<span class="postbody">Dxpack V0.86 脱壳—— Dxpack 主程序 </span>
Dxpack V0.86 脱壳—— Dxpack 主程序
下载页面： http://www.skycn.com/soft/5647.html
软件大小： 82 KB
软件语言： 简体中文
软件类别： 国产软件 / 免费版 / 压缩解压
应用平台： Win9x/NT/2000/XP
加入
下载次数： 1235
推荐等级： ***
联 系 人： dxpack@163.net
【软件简介】：dxpack 是一Win32PE格式可执行文件压缩程序，程序界面有中英文两种。可以压缩资源，输入输出表。打开文件可以用三种方法，1:用界面上的打开按钮，2：直接拖放文件，3：右健菜单或命令行。主要目的是减少可执行文件的体积。兼可起到加密可执行文件的目的。程序压缩过后执行速度不会减慢，对于大的文件，甚至有所改善。由于时间有限，压缩算法采用Joergen Ibsen'"aPLib"库。没有自行研究压缩算法。Joergen Ibsen'"aPLib"库可以免费用于个人用户。本程序及可免费用于个人用户。
【作者声明】：初学Crack，只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教！
【调试环境】：Win98、Ollydbg1.09、PEiD、LordPE、ImportREC
—————————————————————————————————
【脱壳过程】：
用Ollydbg手动脱壳,老规矩：载入后弹出“是压缩代码——要继续进行分析吗？”，点“否”。
00431000 60 pushad
====>进入OD后断在这！
00431001 E8 00000000 call DXPACK.00431006
====>变形JMP！F7走进
00431006 5D pop ebp
00431007 8BFD mov edi,ebp
00431009 81ED 06104000 sub ebp,DXPACK.00401006
0043100F 2BBD 94124000 sub edi,dword ptr ss:[ebp+401294]
00431015 81EF 06000000 sub edi,6
0043101B 83BD 14134000 01 cmp dword ptr ss:[ebp+401314],1
00431022 0F84 2F010000 je DXPACK.00431157
00431028 C785 14134000 010000>mov dword ptr ss:[ebp+401314],1
00431032 89BD 1C134000 mov dword ptr ss:[ebp+40131C],edi
00431038 8D9D B2114000 lea ebx,dword ptr ss:[ebp+4011B2]
0043103E 8DB5 65114000 lea esi,dword ptr ss:[ebp+401165]
00431044 46 inc esi
00431045 803E 00 cmp byte ptr ds:[esi],0
00431048 74 24 je short DXPACK.0043106E
0043104A 56 push esi
0043104B FF95 34124000 call dword ptr ss:[ebp+401234]
00431051 46 inc esi
00431052 803E 00 cmp byte ptr ds:[esi],0
00431055 ^ 75 FA jnz short DXPACK.00431051
00431057 46 inc esi
00431058 803E 00 cmp byte ptr ds:[esi],0
0043105B ^ 74 E7 je short DXPACK.00431044
0043105D 50 push eax
0043105E 56 push esi
0043105F 50 push eax
00431060 FF95 38124000 call dword ptr ss:[ebp+401238]
00431066 8903 mov dword ptr ds:[ebx],eax
00431068 58 pop eax
00431069 83C3 04 add ebx,4
0043106C ^ EB E3 jmp short DXPACK.00431051
0043106E 8DB5 A4124000 lea esi,dword ptr ss:[ebp+4012A4]
00431074 8B46 04 mov eax,dword ptr ds:[esi+4]
00431077 6A 04 push 4
00431079 68 00300000 push 3000
0043107E 50 push eax
0043107F 6A 00 push 0
00431081 FF95 B2114000 call dword ptr ss:[ebp+4011B2]
00431087 8985 61124000 mov dword ptr ss:[ebp+401261],eax
0043108D 56 push esi
0043108E 8B1E mov ebx,dword ptr ds:[esi]
00431090 039D 1C134000 add ebx,dword ptr ss:[ebp+40131C]
00431096 50 push eax
00431097 53 push ebx
00431098 E8 13030000 call DXPACK.004313B0
0043109D 83C4 08 add esp,8
004310A0 8B4E 04 mov ecx,dword ptr ds:[esi+4]
004310A3 8B3E mov edi,dword ptr ds:[esi]
004310A5 03BD 1C134000 add edi,dword ptr ss:[ebp+40131C]
004310AB 8BB5 61124000 mov esi,dword ptr ss:[ebp+401261]
004310B1 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi]
004310B3 5E pop esi
004310B4 8B85 61124000 mov eax,dword ptr ss:[ebp+401261]
004310BA 68 00800000 push 8000
004310BF 6A 00 push 0
004310C1 50 push eax
004310C2 FF95 B6114000 call dword ptr ss:[ebp+4011B6]
004310C8 83C6 08 add esi,8
004310CB 833E 00 cmp dword ptr ds:[esi],0
004310CE ^ 75 A4 jnz short DXPACK.00431074
004310D0 E8 4F020000 call DXPACK.00431324
004310D5 8BB5 98124000 mov esi,dword ptr ss:[ebp+401298]
004310DB 8BBD 1C134000 mov edi,dword ptr ss:[ebp+40131C]
004310E1 8B443E 0C mov eax,dword ptr ds:[esi+edi+C]
004310E5 0BC0 or eax,eax
004310E7 74 6E je short DXPACK.00431157
004310E9 03C7 add eax,edi
004310EB 50 push eax
004310EC FF95 34124000 call dword ptr ss:[ebp+401234]
004310F2 0BC0 or eax,eax
004310F4 74 43 je short DXPACK.00431139
004310F6 8B1C3E mov ebx,dword ptr ds:[esi+edi]
004310F9 8B4C3E 10 mov ecx,dword ptr ds:[esi+edi+10]
004310FD 83C6 14 add esi,14
00431100 0BDB or ebx,ebx
00431102 75 02 jnz short DXPACK.00431106
00431104 8BD9 mov ebx,ecx
00431106 8B143B mov edx,dword ptr ds:[ebx+edi]
00431109 83C3 04 add ebx,4
0043110C 0BD2 or edx,edx
0043110E ^ 74 D1 je short DXPACK.004310E1
00431110 F7C2 00000080 test edx,80000000
00431116 74 05 je short DXPACK.0043111D
00431118 0FB7D2 movzx edx,dx
0043111B EB 04 jmp short DXPACK.00431121
0043111D 8D543A 02 lea edx,dword ptr ds:[edx+edi+2]
00431121 50 push eax
00431122 51 push ecx
00431123 52 push edx
00431124 50 push eax
00431125 FF95 38124000 call dword ptr ss:[ebp+401238]
0043112B 59 pop ecx
0043112C 0BC0 or eax,eax
0043112E 74 09 je short DXPACK.00431139
00431130 890439 mov dword ptr ds:[ecx+edi],eax
00431133 58 pop eax
00431134 83C1 04 add ecx,4
00431137 ^ EB CD jmp short DXPACK.00431106
00431139 8D8D 65124000 lea ecx,dword ptr ss:[ebp+401265]
0043113F 8D85 84124000 lea eax,dword ptr ss:[ebp+401284]
00431145 6A 00 push 0
00431147 50 push eax
00431148 51 push ecx
00431149 6A 00 push 0
0043114B FF95 BE114000 call dword ptr ss:[ebp+4011BE]
00431151 FFA5 BA114000 jmp dword ptr ss:[ebp+4011BA]
00431157 8B85 9C124000 mov eax,dword ptr ss:[ebp+40129C]
====>F4直接到这！ 不用跟踪啦
0043115D 03C7 add eax,edi
====>EAX=00006B10 + 00400000=00406B10 这就是OEP值
0043115F 894424 1C mov dword ptr ss:[esp+1C],eax
00431163 61 popad
00431164 FFE0 jmp eax
———————————————————————
00406B10 55 push ebp
====>在这儿用LordPE完全DUMP这个进程
00406B11 8BEC mov ebp,esp
00406B13 6A FF push -1
00406B15 68 E8F04100 push DXPACK.0041F0E8
00406B1A 68 E0B04000 push DXPACK.0040B0E0
———————————————————————
重新运行，运行ImportREC，选择这个进程。把OEP改为00006B10，点IT AutoSearch，
点“Get Import”，FixDump，正常运行！ 8.85K ->208K
—————————————————————————————————
, _/
/| _.-~/ _ , 青春都一饷
( /~ / ~-._ |
`\ _/ ~ ) 忍把浮名
_-~~~-.) )__/;;,. _ //'
/'_, --~ ~~~- ,;;___( (.-~~~-. 换了破解轻狂
`~ _( ,_..-- ( ,;'' / ~-- /._`
/~~//' /' `~ ) /--.._, )_ `~
" `~" " `" /~'` `\~~
" " "~' ""
Cracked By 巢水工作坊——fly [OCN][FCG]
2003-10-05 20:46
