<Crack> Hand off UPX

2016-4-19 (YPP)

< This article is an introduction to shelling tutorial >

UPX Introduction

Http://baike.baidu.com/link?url=h_P3r-L0icvZoSNO-HUwY4RE3ptQ9r6d8H1ZFsgGlCOqyv6Q68N95BHIvNY2nCs0IUdYt0xy6LYQ_pDF-Gg6Na

①UPX Shell Compression

② Looking for Oep

③dump Memory Image

④ Rebuilding the IAT

⑤ normal operation

First, the Win98 Notepad program NOTEPAD.exe with the UPX compression processing

P E The detection information is as follows:

Upx version : 3.91

before compression: (10CC is the real entry point for the program,Original Entry points abbreviated OEP)

Change in file size before and after compression ( file name changed to Notepad_upx.exe after compression )

GUI version of UPX The compression method is as follows:

-------------------------------------------------------------------------------------------------------------

Get the Compressed Notepad program: Notepad_upx.exe

Let's start with "hands off."

ollydbg Gta5-In Notepad_upx.exe , parked in 0040e8c0 Pushad

0040e8c0 not the real entry point of the program, looking for real OEP The key is to find "jump" , A single step down, if you encounter a wide range of jumps, you are likely to encounter OEP ,

simplified instance, jump OEP the instruction is at "End" (Page Down)

004010CC is the entry point for files that are not compressed, F4 at this point, F7 step in and come OEP .

has successfully sought OEP , the next step to rebuild Dump Image

The premise of crawling is that the memory image has been restored

Arrive OEP , you can crawl

Open Lord Pe-options

Default check: Full dump:paste headers from disk <pe The header information is obtained directly from the disk file >

selected Notepad_upx.exe the process, right-click execution : Dump full Command

the memory fetch file is Dumped.exe It can't be run at this time! The next step is to " recreate the IAT"

is still in OEP Place, open Importrec Select the process.

Fill in OEP of the RVA : 10CC , automatic detection IAT the offset and size

Click "Get Input Table" to display all DLL Effective!

Click the Fix Dump "Fix dump file

Select Dumped.exe , the repair is automatically renamed after completion Dumped_.exe

Now that the shelling is complete, rebuild IAT after that, it can run normally!

END.

<Crack> Hand off UPX