VMP壳 脱壳后 自动生成文件
修复OEP
输入表 UIF 去弄
Importrec 去修复 要看准
右键-》高级-》选择区段 -》FULL DUMP -》修改这个生成的文件就行了
查看按钮事件 按钮事件入口被VMP掉了
进去看到 jmp xxxxx 就是VMP入口
右键 ZEUS 分析
看LOG窗口
寻找 Cpuid antidumo 的重要handler VM_Cpuid
复制一行···········································
跳过去下断
F9 F8```````````````````````````````````````
看到Cpuid 记录下脱壳机器的cpuid信息，也就是寄存器eax,ebx,ecx,edx的值
记录 下 cpuid 下面几行 和 寄存器值
重来 ！！！！！！！！！！！！！！！！！！！！！！！！！
HOOK 它到 OEP附近
将刚才的值赋值到······寄存器 跳回原来的地址
多点几次会崩溃···································
VMP的随机检验······························
同样的方法 跑到按钮事件入口
断下 分析···································
找到 VM_Rdtsc 随机检测············
断下·········
记录检测的 eax edx 和 跳过去的 几行代码（rdtsc）
将 rdtsc 下面的call 下 跳入 空白指令处
PATCH eax,edx ·
·····································
之后就正常运行了···················································
优化VMP CFF软件区优化
修改区段为 va 为1000 RA为 1000
对齐 重建····························
指令过程···········································································································································
脱壳后：
00403285 E8 511B0000 call UnPackMe.00404DDB
0040328A ^ E9 19FFFFFF jmp UnPackMe.004031A8
0040328F 8BFF mov edi,edi ; this is OEP or Near OEP!
00403291 55 push ebp
00403292 8BEC mov ebp,esp
00403294 83EC 10 sub esp,10
00403297 A1 84904000 mov eax,dword ptr ds:[409084]
生成的文件：
0058D530 > E8 CBFBFFFF call De_UnPac.0058D100
0058D535 B8 8F324000 mov eax,De_UnPac.0040328F
0058D53A FFD0 call eax //跳转到源文件脱壳后到达的地址
0058D53C C3 retn
0058D53D CC int3
0058D53E CC int3
0058D53F CC int3
0058D540 0000 add byte ptr ds:[eax],al
0058D542 0000 add byte ptr ds:[eax],al
0058D544 0000 add byte ptr ds:[eax],al
修改为：
0058D530 > E8 CBFBFFFF call De_UnPac.0058D100
0058D535 B8 40D55800 mov eax,De_UnPac.0058D540 //修改为到下面执行
0058D53A FFD0 call eax
0058D53C C3 retn
0058D53D CC int3
0058D53E CC int3
0058D53F CC int3
0058D540 68 5DCE4A00 push De_UnPac.004ACE5D //这个是源文件脱壳后的一个压入堆栈的值
0058D545 - E9 455DE7FF jmp De_UnPac.0040328F //跳
0058D54A 0000 add byte ptr ds:[eax],al
0058D54C 0000 add byte ptr ds:[eax],al
Log data, item 212
Address=0040B01C
Message=2B: 522840C6 ---> 0040B01C[VM_Cpuid
0040B5BB 0FA2 cpuid
0040B5BD 68 0D7D05AF push AF057D0D
0040B5C2 60 pushad
0040B5C3 83ED 0C sub ebp,0C
0040B5C6 66:0FBAE4 01 bt sp,1
0040B5CB 837D 0C 01 cmp dword ptr ss:[ebp+C],1
HOOK 掉EAX,ECX,EDX,EBX
EAX 000206A7
ECX 02982203
EDX 0FEBFBFF
EBX 00010800 UNICODE " FilesMicrosoft Visual StudioVC98lib"
ESP 0012FA34
EBP 0012FB04
rdtsc:
0040C415 9C pushfd
0040C416 83ED 08 sub ebp,8
0040C419 885C24 04 mov byte ptr ss:[esp+4],bl
0040C41D 52 push edx
0040C41E 882C24 mov byte ptr ss:[esp],ch
0040C421 FF7424 04 push dword ptr ss:[esp+4]
HOOK掉 EAX,EDX
EAX D37FA7AB
ECX 0040BF5F offset <3.VM_Rdtsc>
EDX 00002180
EBX BA9EA8A0