ASProtect.SKE.2.11.Build.03.13-RES-crk对部分系统函数的处理（二）

上篇文章最后提到后面还有很多的内存分配，比如：
           00CD0000
           00CE0000
           00CF0000
           00D00000
           00D10000
           00D20000

这些地方，经过仔细的观察：
00D10000    A1 F435887C     mov     eax, [7C8835F4]
00D10005    C3              retn
7C812C8D >  A1 F435887C     mov     eax, [7C8835F4]
7C812C92    C3              retn
下面一段是系统函数kernel32.GetCommandLineA的代码，由此可知这些空间也是为对系统函数处理而分配的。
看看加壳后程序对GetCommandLineA的调用变成了：
004013C4    E8 3BEC9100     call    00D20004
00D20004    FF0424          inc     dword ptr [esp]                  ;
00D20007    36:EB 01         jmp     short 00D2000B
00D2000A    F2:             prefix repne:
00D2000B    68 0000D100     push    0D10000
00D20010    C3              retn
进去后可以看到00D20004行将返回地址加上了1，这个与修改后的代码长度有关，如：
加壳前：
  004013C4     FF15 5C504000  call    [<&KERNEL32.GetCommandLineA>]   
004013CA     A3 B88A4000   mov     [408AB8], eax
Call长度为6
加壳后：
004013C4    E8 3BEC9100     call    00D20004
004013C9    09A3 B88A4000   or      [ebx+408AB8], esp
004013CF    E8 9F060000     call    00401A73
Call长度为5
上面的代码可以看到，外壳为处理GetCommandLineA函数分配了两个空间：
00D10000  里面是系统代码
00D20000  里面处理长度问题，再跳到00D10000里。
这样看来对系统函数的处理远不止上篇文章提到的14处，外壳共处理了两次，是在两个不同的seh中处理的。
要得到所有第二批被处理过的函数，方法一样，对VirtualAlloc中断，找关键点如下：
00A8BAF1    03B3 E4000000   add     esi, [ebx+E4]
00A8BAF7    833C24 00       cmp     dword ptr [esp], 0  //还有要处理的吗？
00A8BAFB  ^ 0F87 55FEFFFF   ja      00A8B956
00A8BA8A    0383 E0000000   add     eax, [ebx+E0]
00A8BA90    EB 01           jmp     short 00A8BA93  //在该处设断，eax中可得到函数。
写个脚本将它们一网打尽：
var  VirtualAllocaddr
var  temp
        
checkver:     
  //check ollyscript's version
  cmp  $VERSION,"0.9"
  ja  start
  msg  "version bad!"
  ret
  
start:
        gpa  "VirtualAlloc","kernel32.dll"  
  mov  VirtualAllocaddr,$RESULT
                
        bp  VirtualAllocaddr    //在VirtualAlloc设断
       
continue:        
        run
        
        //is virtualalloc?
        cmp  eip,VirtualAllocaddr
        je  isVirtualAlloc
        
        //is 00A866AB?
        cmp  eip,00A866AB
        je  iskeycall1
        
        //is 00A8BA90?
        cmp  eip,00A8BA90
        je  iskeycall2
        
         //is 00A94774 write
        sto
        cmp  [00A94774],00A65EC0
        jne  fix
  jmp  continue  
isVirtualAlloc:
        rtr
   
        log  eax     
        //is 00A60000?  
        cmp  eax,00A60000
        je  bp1 
        //is 00C20000?
        cmp  eax,00C20000
        je  bp2
        jmp  continue
        
   bp1:
        bphws  00A866AB,"x"
        bphws  00A8BA90,"x"
        jmp  continue
        
   bp2:
        bpwm  00A94774,1
        jmp  continue
                
iskeycall1:
        log  [ebp-c]
        jmp  continue
        
iskeycall2:
        log  eax
        jmp  continue
                         
fix:
        mov  [00A94774],#C05EA6#
        bpmc
        jmp  continue
return:    
        bc  VirtualAllocaddr    
  ret
连同上篇的一起得到如下信息：
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C806A59 | ASCII "GetProcAddress"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 003C0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C8075CF | ASCII "LoadLibraryA"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 003D0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C8076FB | ASCII "MapViewOfFile"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 003E0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C805C30 | ASCII "FindResourceA"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 003F0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C807439 | ASCII "IsBadReadPtr"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00BB0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C8089C5 | ASCII "UnmapViewOfFile"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00BC0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C804F4D | ASCII "CloseHandle"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00BD0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C805141 | ASCII "CreateFileMappingA"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00BE0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C805135 | ASCII "CreateFileA"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00BF0000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C807494 | ASCII "IsDebuggerPresent"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00C00000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C806D02 | ASCII "GetSystemTime"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00C10000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C808AE2 | ASCII "VirtualAlloc"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00C20000
00A86EFA   当写入 [00A94774] 时设置内存断点
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C808B1C | ASCII "VirtualFree"
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00C30000
00A866AB   硬件断点 1 位于 00A866AB
           [ebp-c]: 7C806333 | ASCII "GetCurrentProcessId"

00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 77D24315 | user32.RegisterClassExA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00CD0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00CE0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 77D288E1 | user32.DialogBoxParamA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00CF0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D00000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C812C8D | kernel32.GetCommandLineA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D10000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D20000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C801EEE | kernel32.GetStartupInfoA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D30000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D40000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C80B529 | kernel32.GetModuleHandleA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D50000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D60000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C80E00D | kernel32.GetCurrentProcess
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D70000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D80000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C801E16 | kernel32.TerminateProcess
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00D90000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00DA0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C80B357 | kernel32.GetModuleFileNameA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00DB0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00DC0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C81DC3F | kernel32.FreeEnvironmentStringsA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00DD0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00DE0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C801EEE | kernel32.GetStartupInfoA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00DF0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E00000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C811069 | kernel32.GetFileType
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E10000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E20000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C812CA9 | kernel32.GetStdHandle
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E30000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E40000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C811069 | kernel32.GetFileType
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E50000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E60000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C80C6CF | kernel32.SetHandleCount
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E70000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E80000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C80B529 | kernel32.GetModuleHandleA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00E90000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00EA0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C81486A | kernel32.GetEnvironmentVariableA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00EB0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00EC0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C80B357 | kernel32.GetModuleFileNameA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00ED0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00EE0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C80B357 | kernel32.GetModuleFileNameA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00EF0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F00000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C812CA9 | kernel32.GetStdHandle
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F10000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F20000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C810F9F | kernel32.WriteFile
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F30000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F40000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C812BE6 | kernel32.GetCPInfo
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F50000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F60000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C81E82A | kernel32.GetOEMCP
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F70000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F80000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C809943 | kernel32.GetACP
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00F90000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00FA0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C812BE6 | kernel32.GetCPInfo
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00FB0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00FC0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C832E2B | kernel32.LCMapStringA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00FD0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00FE0000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C832E2B | kernel32.LCMapStringA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 00FF0000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 01000000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C838CB9 | kernel32.GetStringTypeA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 01010000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 01020000
00A8BA90   硬件断点 2 位于 00A8BA90
           eax: 7C838CB9 | kernel32.GetStringTypeA
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 01030000
7C809A81   断点位于 kernel32.VirtualAlloc
           eax: 01040000