实战IDA PE+ DLL脱壳

IDA + Bochs 调试器插件进行PE+ 格式DLL脱壳

By :obaby

在IDA Pro6.1中我们扩展了Bochs调试器插件,现在已经可以进行64位代码段的调试。在IDA Pro 6.2版本中将有可能实现PE+ 可执行程序的动态调试。由于程序将会在Bochs系统中执行,因而在调试的过程中我们并不需要实际的64位操作系统,因而在实际的调试过程中可以从任何的32位或者64位的Linux,Mac OS 或者Windows操作系统中使用IDA Pro进行64位可执行文件的调试。

为了确认这一项新的功能,我们将进行PE+格式的一个木马程序进行脱壳并且进行一个大体的分析,这个文件是由MATCODE Software公司的mpress进行压缩的。我们将会对讲解DLL文件脱壳,修复输入表并且最终修复数据库来进行分析。

 

Unpacking the DLL

我们的目标文件是一个木马的DLL文件,该文件被杀软识别为“Win32/Giku”。我们从使用idaq64载入DLL文件开始进行分析,载入之后按Ctrl+S键打开区段窗口:

Continue Reading

PECompact 2.x -> Jeremy Collake [Overlay] 脱壳

在脱壳的时候虽然显示的有附加数据,但是我发现脱壳之后并不需要进行修复~

用OD载入之后会中断在下面的入口点处:

1
2
3
4
5
6
7
8
9
00401140 >  B8 D0A19900     mov eax,plistEdi.0099A1D0                ; 入口点
00401145    50              push eax
00401146    64:FF35 0000000>push dword ptr fs:[0]
0040114D    64:8925 0000000>mov dword ptr fs:[0],esp
00401154    33C0            xor eax,eax                              ; 单步执行到此处之后出现SE处理程序
00401156    8908            mov dword ptr ds:[eax],ecx
00401158    50              push eax
00401159    45              inc ebp
0040115A    43              inc ebx
Continue Reading

imp64

Here is one tool to fix imports on x64 target (and to dump them as well). This tool was done almost a year ago. GUI really sucks as I’m not very experienced with GUI programming. However import fixing code should do just fine as it uses 1API = 1IID technique which I described in one of my Blog entries. Good thing is that import scanning/fixing code can be extracted from source without a problem as those are held in separate files.

Hope that someone will find this tool useful, at least source code.
Download link1:http://exelab.ru/download.php?action=get&n=MTAzMA==

Download link2:http://deroko.phearless.org/imp64.rar

Continue Reading