一个菜鸟看ZPROTECT普通函数加密

已经有脚本出来了 汗
大家好,我是lunglungyu
用DEMO版加的 强度比较低 只是说说自己的思路________________________________
搞了下ZPROTECT脱壳 找回 己加密输入表 （低强度）
其他去掉 方便我菜鸟搞
只GETMODULEHANDLEA 加密 
文章写的不好 别见怪
0040DACB yh_pac>^\E9 4BFBFFFF          jmp 0040D61B                               ; yh_packe.0040D61B
0040DAD0        ^ 0F85 76FBFFFF        jnz 0040D64C                               ; yh_packe.0040D64C
0040DAD6          E9 BA010000          jmp 0040DC95                               ; yh_packe.0040DC95
0040DADB          8BF7                 mov esi,edi                                ; ntdll.7C930738
0040DADD        ^ E9 A7FDFFFF          jmp 0040D889                               ; yh_packe.0040D889
0040DAE2          C9                   leave
0040DAE3          06                   push es
0040DAE4        ^ 0F84 A2FEFFFF        je 0040D98C                                ; yh_packe.0040D98C
0040DAEA          E9 D7000000          jmp 0040DBC6                               ; yh_packe.0040DBC6
0040DAEF          C2 0400              retn 4
0040DAF2        ^ E9 0FFDFFFF          jmp 0040D806                               ; yh_packe.0040D806
0040DAF7          894424 10            mov dword ptr ss:[esp+10],eax
0040DAFB        ^ E9 20FDFFFF          jmp 0040D820                               ; yh_packe.0040D820
0040DB00          4E                   dec esi
开始的EP是如上这样的
F8 下
0040D61B          E8 01000000          call 0040D621                              ; yh_packe.0040D621
看见上面的CALL，跟（F7）
F8 4下
看见PUSHAD
用ESP定律
hr esp
F9 运行
断下后去掉硬件断点
F8到RETN
便是OEP
这个是其他文件载的 @@
------------------------------------
sto
sti
sto
sto
sto
sto
sto
BPHWS esp,"r"
run
bc esp
sto
sto
msg "reach oep"
ret
-----------------------------
就是这角本 到oep 
偶写的不好 也加不上IAT修复
00402317          6A 00                push 0
00402319          E8 F2000000          call 00402410                              ; yh_packe.00402410
0040231E          A3 24404000          mov dword ptr ds:[404024],eax
00402323          6A 00                push 0
00402325          68 75224000          push 402275
0040232A          6A 00                push 0
0040232C          68 E8030000          push 3E8
00402331          FF35 24404000        push dword ptr ds:[404024]
00402337          E8 26000000          call 00402362                              ; jmp 到 USER32.DialogBoxParamA
0040233C          50                   push eax
0040233D          E8 B6000000          call 004023F8                              ; jmp 到 kernel32.ExitProcess
00402342          C3                   retn
00402343          CC                   int3
00402344        - FF25 EC304000        jmp dword ptr ds:[4030EC]                  ; USER32.wsprintfA
0040234A        - FF25 E8304000        jmp dword ptr ds:[4030E8]                  ; USER32.AppendMenuA
00402350        - FF25 E4304000        jmp dword ptr ds:[4030E4]                  ; USER32.CallWindowProcA
00402356        - FF25 E0304000        jmp dword ptr ds:[4030E0]                  ; USER32.CloseClipboard
0040235C        - FF25 DC304000        jmp dword ptr ds:[4030DC]                  ; USER32.CreatePopupMenu
00402362        - FF25 D8304000        jmp dword ptr ds:[4030D8]                  ; USER32.DialogBoxParamA
00402368        - FF25 D4304000        jmp dword ptr ds:[4030D4]                  ; USER32.EnableWindow
0040236E        - FF25 D0304000        jmp dword ptr ds:[4030D0]                  ; USER32.EndDialog
00402374        - FF25 CC304000        jmp dword ptr ds:[4030CC]                  ; USER32.EnumChildWindows
0040237A        - FF25 C8304000        jmp dword ptr ds:[4030C8]                  ; USER32.GetAsyncKeyState
00402380        - FF25 C4304000        jmp dword ptr ds:[4030C4]                  ; USER32.GetClassNameA
00402386        - FF25 C0304000        jmp dword ptr ds:[4030C0]                  ; USER32.GetClipboardData
0040238C        - FF25 BC304000        jmp dword ptr ds:[4030BC]                  ; USER32.GetDlgItem
00402392        - FF25 B8304000        jmp dword ptr ds:[4030B8]                  ; USER32.GetWindowLongA
00402398        - FF25 B4304000        jmp dword ptr ds:[4030B4]                  ; USER32.GetWindowRect
0040239E        - FF25 B0304000        jmp dword ptr ds:[4030B0]                  ; USER32.GetWindowTextA
004023A4        - FF25 AC304000        jmp dword ptr ds:[4030AC]                  ; USER32.IsClipboardFormatAvailable
004023AA        - FF25 A8304000        jmp dword ptr ds:[4030A8]                  ; USER32.LoadIconA
004023B0        - FF25 A4304000        jmp dword ptr ds:[4030A4]                  ; USER32.MessageBoxA
004023B6        - FF25 A0304000        jmp dword ptr ds:[4030A0]                  ; USER32.MoveWindow
004023BC        - FF25 9C304000        jmp dword ptr ds:[40309C]                  ; USER32.OpenClipboard
004023C2        - FF25 98304000        jmp dword ptr ds:[403098]                  ; USER32.ScreenToClient
004023C8        - FF25 94304000        jmp dword ptr ds:[403094]                  ; USER32.SendDlgItemMessageA
004023CE        - FF25 90304000        jmp dword ptr ds:[403090]                  ; USER32.SendMessageA
004023D4        - FF25 8C304000        jmp dword ptr ds:[40308C]                  ; USER32.SetWindowLongA
004023DA        - FF25 88304000        jmp dword ptr ds:[403088]                  ; USER32.SetWindowTextA
004023E0        - FF25 84304000        jmp dword ptr ds:[403084]                  ; USER32.TrackPopupMenu
004023E6        - FF25 6C304000        jmp dword ptr ds:[40306C]                  ; kernel32.CloseHandle
004023EC        - FF25 70304000        jmp dword ptr ds:[403070]                  ; kernel32.CreateFileA
004023F2        - FF25 28304000        jmp dword ptr ds:[403028]                  ; kernel32.DeviceIoControl
004023F8        - FF25 2C304000        jmp dword ptr ds:[40302C]                  ; kernel32.ExitProcess
004023FE        - FF25 74304000        jmp dword ptr ds:[403074]                  ; kernel32.FormatMessageA
00402404        - FF25 68304000        jmp dword ptr ds:[403068]                  ; kernel32.GetCurrentDirectoryA
0040240A        - FF25 64304000        jmp dword ptr ds:[403064]                  ; ntdll.RtlGetLastWin32Error
00402410        - FF25 60304000        jmp dword ptr ds:[403060]
00402416        - FF25 5C304000        jmp dword ptr ds:[40305C]                  ; kernel32.GetProcAddress
0040241C        - FF25 58304000        jmp dword ptr ds:[403058]                  ; kernel32.GetProcessHeap
00402422        - FF25 54304000        jmp dword ptr ds:[403054]                  ; kernel32.GetVersion
00402428        - FF25 50304000        jmp dword ptr ds:[403050]                  ; kernel32.GlobalLock
0040242E        - FF25 4C304000        jmp dword ptr ds:[40304C]                  ; kernel32.GlobalUnlock
00402434        - FF25 48304000        jmp dword ptr ds:[403048]                  ; ntdll.RtlAllocateHeap
0040243A        - FF25 44304000        jmp dword ptr ds:[403044]                  ; ntdll.RtlFreeHeap
00402440        - FF25 40304000        jmp dword ptr ds:[403040]                  ; ntdll.RtlZeroMemory
00402446        - FF25 3C304000        jmp dword ptr ds:[40303C]                  ; kernel32.SetCurrentDirectoryA
0040244C        - FF25 38304000        jmp dword ptr ds:[403038]                  ; kernel32.lstrcmpiA
00402452        - FF25 34304000        jmp dword ptr ds:[403034]                  ; kernel32.lstrcpyA
00402458        - FF25 30304000        jmp dword ptr ds:[403030]                  ; kernel32.lstrlenA
0040245E        - FF25 14304000        jmp dword ptr ds:[403014]                  ; ADVAPI32.CloseServiceHandle
00402464        - FF25 04304000        jmp dword ptr ds:[403004]                  ; ADVAPI32.ControlService
0040246A        - FF25 08304000        jmp dword ptr ds:[403008]                  ; ADVAPI32.CreateServiceA
00402470        - FF25 0C304000        jmp dword ptr ds:[40300C]                  ; ADVAPI32.DeleteService
00402476        - FF25 18304000        jmp dword ptr ds:[403018]                  ; ADVAPI32.OpenSCManagerA
0040247C        - FF25 00304000        jmp dword ptr ds:[403000]                  ; ADVAPI32.OpenServiceA
00402482        - FF25 10304000        jmp dword ptr ds:[403010]                  ; ADVAPI32.StartServiceA
00402488        - FF25 20304000        jmp dword ptr ds:[403020]                  ; comdlg32.GetOpenFileNameA
0040248E        - FF25 7C304000        jmp dword ptr ds:[40307C]                  ; SHELL32.DragQueryFileA
00402494          0000                 add byte ptr ds:[eax],al
00402496          0000                 add byte ptr ds:[eax],al
好 。看见了
这里注意下
我给加密的部分
00402410        - FF25 60304000        jmp dword ptr ds:[403060]
因为上面有调用
要PROGRAM运行一定要修复好 所以用GETMODULEHANDLEA这个 . 而不是那些运行到特定时候才调用的
跟进
call 00402410 
就是给加密的GETMODULEHANDLEA
00EC0000          50                   push eax
00EC0001          60                   pushad
00EC0002          68 92D455AA          push AA55D492
00EC0007          E8 9404ECFF          call 00D804A0
00EC000C          61                   popad
00EC000D          C3                   retn
call 00D804A0 这句是重点 我们进去
里面一堆JMP 混淆

先探口风
00D9E8AB          8B0CB1               mov ecx,dword ptr ds:[ecx+esi*4]           ; kernel32.GetModuleHandleA
这句 由OD的分析看见了是 getmodulehandleA 
ds:[00DA42AC]=7C80B6A1 (kernel32.GetModuleHandleA)
ecx=00DA4250
其实这里可以直接把它的位址放到ptr ds:[403060]
便弄成修复 。。但是这是最简单的
我们看看他是如何搞出这地址的
mov ecx,dword ptr ds:[ecx+esi*4]
换言之 我们要知道D9E8AB时（在我的电脑上）的ECX 和ESI 哪里来的
Ctrl + F2 重载 在重复STEPS  到00EC0007          E8 9404ECFF          call 00D804A0这CALL
留意堆的变化

我略了当中那些混淆的JMP
因此代码不是跟次序的
程序行的先後
mov eax,dword ptr ss:[esp+4] 当时的ESP 12FF90
Eax 变成AA55D492
push esi 
FFFFFFFF
push eax
刚才的AA55D492 了
后来有一个CALL
call dword ptr ds:[D8C514]
我们先跳过
但注意堆化
前
EAX AA55D492
ECX 0012FFB0
EDX 7C92EB94 ntdll.KiFastSystemCallRet
EBX 7FFD5000
ESP 0012FF88
EBP 0012FFF0
ESI FFFFFFFF
EDI 7C930738 ntdll.7C930738
EIP 00D9B19F
后
EAX 00000017
ECX 0012FFB0
EDX 7C92EB94 ntdll.KiFastSystemCallRet
EBX 7FFD5000
ESP 0012FF8C
EBP 0012FFF0
ESI FFFFFFFF
EDI 7C930738 ntdll.7C930738
EIP 00D9B1A5
EIP ESP变化是正常的
经历这CALL
eax 变了
看回头  是中间
mov eax,dword ptr ss:[esp+24]
sub eax,17B415D1
xor eax,24DB7550
xchg edx,esi
lea eax,dword ptr ds:[eax+F792273]
等等
作的
这里我们不理
我们看见
00D94C12          8B0D 28CCD800        mov ecx,dword ptr ds:[D8CC28]
是ECX　！！！！
ecx 变了00DA4250
test ecx,ecx 
mov esi,eax 原来这里ESI跟EAX有关
EAX 经过运算的值搬到了ESI
mov eax,dword ptr ds:[D8CC2C]
sub eax,ecx
sar eax,2
cmp esi,eax
最后 我们又到了mov ecx,dword ptr ds:[ecx+esi*4] 
ds:[00DA42AC]=7C80B6A1 (kernel32.GetModuleHandleA)
因为偶ASSEMBLY 不好
所以 中间不能说个明白
就是zprotect 加壳是 把API 的位址拆解  然后用算法合回
当中主要用到EAX 运算 
然后最后再把不同的需要值放到ECX 和ESI 算回API 位址
在来
mov dword ptr ss:[esp+2C],ecx  这里是吧GETMODULEHANDLEA这个的地址 记录
POP　ＥＳＩ　恢复ＦＦＦＦＦＦＦＦ原的值
return出ＣＡＬＬ　
在return
就到了GETMODULEHANDLE的地址。
API行後回到程序代段 大概就是这样
就是由EP附近的
mov dword ptr ds:[404024],eax行下去
每都是这样.
这就是zprotect 导入函数加密 中 普通加密的部分

下面我们在来写清楚一下
其实
当我们到达OEP时
00402317          6A 00                push 0
00402319          E8 F2000000          call 00402410                    
          ; yh_packe.00402410
这个就是跳往加密API 的
即00402410        - FF25 60304000        jmp dword ptr ds:[403060]
因为我只加密这个 所以 很容易改回
跟进去
00EC0000          50                   push eax
00EC0001          60                   pushad
00EC0002          68 92D455AA          push AA55D492
00EC0007          E8 9404ECFF          call 00D804A0
00EC000C          61                   popad
00EC000D          C3                   retn
00EC000E          0000                 add byte ptr ds:[eax],al
可以知道call 00D804A0后API会给弹进堆
/在FPU中
F4到00EC000C          61                   popad 
其实已经可以看见给加密的函数
EAX 00000037
ECX 7C80B6A1 kernel32.GetModuleHandleA 就是这里 
EDX 7C92EB94 ntdll.KiFastSystemCallRet
EBX 7FFD9000
ESP 0012FF98
EBP 0012FFF0
ESI FFFFFFFF
EDI 7C930738 ntdll.7C930738
EIP 00EC000C
或是。在
0012FF98   7C930738  8..|  ntdll.7C930738
0012FF9C   FFFFFFFF  ....
0012FFA0   0012FFF0  ....
0012FFA4   0012FFB8  ....
0012FFA8   7FFD9000  ....
0012FFAC   7C92EB94  ...|  ntdll.KiFastSystemCallRet
0012FFB0   0012FFB0  ....
0012FFB4   00000000  ....
0012FFB8   7C80B6A1  ...|  kernel32.GetModuleHandleA
0012FFBC   0040231E  .#@.  返回到 yh_packe.0040231E 来自 
yh_packe.00402410
0012FFC0   00000000  ....
0012FFC4   7C816FD7  .o.|  返回到 kernel32.7C816FD7
0012FFC8   7C930738  8..|  ntdll.7C930738
0012FFCC   FFFFFFFF  ....
0012FFD0   7FFD9000  ....
0012FFD4   80873B38  8;..
0012FFD8   0012FFC8  ....
0012FFDC   82793528  (5y.
0012FFE0   FFFFFFFF  ....  SEH 链尾部
0012FFE4   7C839AA8  ...|  SE 处理器
也可以看见
但我不会写角本 恢复IAT..汗
我们再F8一下
就会由OD的分析看见 RETN 会到GETMODULEHANDLEA 了
行後 就会返回程序的原本流程