EXECryptor2.3.9 main program shelling

I. Target: EXECryptor2.3.9 main program

Ii. cracking tools: OllyDbg v1.10, ImportREC 1.6 Final, LordPE

Iii. Cracked by DarkBull # 126.com

4. Cracking Process:

1. Search for OEP

First, set the OD to stop at the system breakpoint, hide the OD, ignore all exceptions, and run the following script:

Data:
Var hInstance
Var codeseg
Var vmseg
Var ep
Var oep
Var temp
Code:
Gpa "VirtualFree", "kernel32.dll"
Bphws $ RESULT, "x"
Run
Bphwc $ RESULT
Rtu
Gmi eip, MODULEBASE
Mov hInstance, $ RESULT
Mov temp, $ RESULT
Add temp, 3c
Mov temp, [temp]
Add temp, hInstance
Add temp, 28
Mov temp, [temp]
Add temp, hInstance
Bc temp
Mov ep, temp
Gmemi eip, MEMORYBASE
Mov codeseg, $ RESULT
Find $ RESULT, # 2ECC9D #
Mov [$ RESULT], #2ECC90 #
Gpa "EnumWindows", "user32.dll"
Mov [$ RESULT], #8BC09C85C09D0578563412C20800 #
Gpa "CreateThread", "kernel32.dll"
Find $ RESULT, # FF7518 #
Mov [$ RESULT], #6A0490 #
Gpa "ZwCreateThread", "ntdll. dll"
Bp $ RESULT
Loop1:
Run
Cmp eip, $ RESULT
Jne loop1
Bc $ RESULT
Bp ep
Loop2:
Run
Cmp eip, ep
Jne loop2
Bc ep
Mov temp, codeseg
Sub temp, 1
Gmemi temp, MEMORYBASE
Mov vmseg, $ RESULT
Gmemi temp, MEMORYSIZE
Bprm vmseg, $ RESULT
Run
Bpmc
Mov oep, eax
Sti
Bprm oep, 1
Loop3:
Run
Cmp eip, oep
Jne loop3
Bpmc
Ret

2. Fixed IAT

Through observation, we can determine that the starting address of IAT is: 004DD168, And the ending address is: 004DD988. The IAT repair script is as follows:
Data:
Var base
Var size
Var iats
Var iate
Var fun
Var cnt
Code:
Gmi eip, MODULEBASE
Mov base, $ RESULT
Gmi eip, MODULESIZE
Mov size, $ RESULT
Add size, base
Mov iats, 4DD168
Mov iate, 4DD988
Exec
Push 004d70f0
Push 004d70a0
Push 004d7050
Push 004d7000
Ende
Loop1:
Mov fun, [iats]
Cmp fun, base
Jb next
Cmp fun, size
Ja next
Mov eip, fun
Mov esp, 0012ffb4
Bphws iats, "w"
Run
Gn [iats]
Cmp $ RESULT, 0
Je pause1
Bphwc iats
Inc cnt
Jmp next
Pause1:
Pause; manual repair
Bphwc iats
Next:
Add iats, 4
Cmp iats, iate
Ja end
Jmp loop1
End:
Eval "Already Found {cnt} Function! "
Msg $ RESULT
Ret

3. cross-platform
Clear initialized data. The restoration method is basically the same as EXECr2.2.6, and more than 40 are fixed.
The above scripts and shelling programs are tested and passed in WINXP and WIN2003.