Basic knowledge of cainiao shelling (4) -- using ESP law to find OEP

The previous section describes the single-step tracing method. This section describes the use of stack balancing (ESP law) for shelling! I think everyone has heard of the ESP law! The ESP law applies the stack Balancing Principle!
During the execution of General shelling software, Initialization is required first to save the environment (to save the value of each register). Generally, PUSHAD (equivalent to eax, ecx, edx, ebx, esp, ebp, esi and edi are both stacked). When the shell of the shelling program is executed, the content of each register will be restored. POPAD (equivalent to eax, ecx, edx, ebx, esp, ebp, esi, and edi are all out of the stack), and the original program is executed by jumping to the OEP of the program through inter-zone transfer!
When shelling, we can break off the ESP Based on the stack balance to quickly reach the OEP!
We use OD to load the Delphi7.0 program with the UPX shell added in the last lesson. When pushad is used in a single step, the register values will be pushed into the stack!

004629D0> 60 PUSHAD // press all registers on the stack!
004629D1 BE 00F04300 mov esi, 0043F000
004629D6 8DBE 0020 fcff lea edi, dword ptr ds: [ESI + FFFC2000]

This is the value of each register in the register window:



This is the value of the stack window without a pushad statement:



This is the value of the stack window that has passed the pushad statement:


Obviously, after the pushad statement, the values of all registers are pushed to the stack, that is, the storage environment!
In this case, ESP points to 0012FF6C. We can access the breakpoint for the hardware under it. In the register window, right-click =, and follow the data window in the first four bytes of the data window, hardware access breakpoint = dword breakpoint!

Run the program according to F9. After the shell code processing is complete, call the popad command to restore the environment. when accessing these stacks, it will be captured and interrupted by the OD, the OEP of the program is no longer far away!

00462B75 61 POPAD
00462B76 8D4424 80 lea eax, dword ptr ss: [ESP-80]; disconnected here
00462B7A 6A 00 PUSH 0
00462B7C 39C4 cmp esp, EAX
00462B7E ^ 75 fa jnz short 00462B7A
00462B80 83EC 80 sub esp,-80
00462B83 ^ E9 109 ffeff jmp 0044CA98 // After analysis in the previous section, it is found that the transfer of this cross-region segment is redirected to OEP!

The ESP law does not have to be used when the ESP value is 0012FFA4. Reasonable Use will make shelling very easy! Let's talk about your experience! The ESP law is not only applicable to compression shells, but also to encryption shells (such as VMP !). Below I will refer to some of the words that Lenus of the snow forum has said in his broad ESP law (by the way, I put the stack Balancing Principle in the appendix ):
"First of all, it is also a fact that when the PE file starts running, that is, the first line of code that enters the shell. The register value is always the value above. If you don't believe it, try it yourself! When OEP is reached, most of the programs will start with a pressure stack! (Apart from the programs compiled by BC, BC usually uses the following statements to press the stack)
Now, based on the above ESP principle, we know that most shells run to OEP when ESP = 0012FFC4. That is to say, the first sentence of the program is to write 0012FFC0!
Finally, we get the general ESP law. If the hardware writes a breakpoint under 0012FFC0, we can stop at the second sentence of OEP! "
Attachment of the downloaded version:
Http://www.bkjia.com/uploadfile/2012/1205/20121205071227412.zip