Find the real entry (OEP)-generalized ESP Law

1. Preface

On the forum, I saw many friends who did not know what is the ESP law, what is the scope of application of ESP, what is the principle of ESP law, and how to use the ESP law? You can see that

Http://poptown.gamewan.com/dispbbs.asp? Boardid = 5 & id = 54 & page = 1

The survey results show that everyone is very interested in the ESP law, of course, because it is too easy to use. Now I will tell you what the ESP law is and how it works !!

BTW: After Reading 18 articles about manual shelling, reading this article may be more helpful to you!

Download from the address below:

Http://soft.winzheng.com/SoftView/SoftView_23125.htm

2. Prerequisites

Before we begin to discuss the ESP law, I will explain some simple assembly knowledge to you.
1. Call
This command is a basic assembly instruction for accessing subprograms. Maybe you said, I already know this! Don't worry, please continue watching.
What is the true meaning of call? We can understand this as follows: 1. The address of the next program is pushed to the stack; 2. The address of the subroutine from JMP to call. For example:

00401029. E8 da240a00 call 004a3508
0040102e. 5A pop edX
After 00401029 is executed, the program will press 0040102e into the stack, and then JMP to 004a3508 address!

2. Ret
The corresponding call is ret. We can understand RET as follows: 1. Stack the address pointed to in the current ESP; 2. Send JMP to this address.

This completes the process of calling a subroutine. The key here is: if we want to return the parent program, when we perform stack operations in the stack, we must ensure that before the RET command, ESP points to the address we press into the stack. This is also the famous "Stack balancing" principle!

3. Narrow ESP Law

The principle of ESP law is the "Stack balance" principle.

Let's take a look at the entrance to the program!

1. This is the value of each register when the entrance of the UPX shell is added!
Eax 00000000
ECX 0012ffb0
EdX 7ffe0304
EBX 7ffdf000
ESP 0012ffc4
EBP 0012fff0
ESI 77f51778 ntdll.77f51778
EDI 77f517e6 ntdll.77f517e6
EIP 0040ec90 note-UPX. <moduleentrypoint>
C 0 es 0023 32bit 0 (ffffffff)
P 1 CS 001b 32bit 0 (ffffffff)
A 0 SS 0023 32bit 0 (ffffffff)
Z 0 DS 0023 32bit 0 (ffffffff)
S 1 FS 0038 32bit 7ffde000 (FFF)
T 0 Gs 0000 null
D 0
O 0 lasterr error_mod_not_found (0000007e)

2. This is the value of the Register after the UPX shell JMP goes to OEP!
Eax 00000000
ECX 0012ffb0
EdX 7ffe0304
EBX 7ffdf000
ESP 0012ffc4
EBP 0012fff0
ESI 77f51778 ntdll.77f51778
EDI 77f517e6 ntdll.77f517e6
EIP 004010cc note-upx.004010CC.
C 0 es 0023 32bit 0 (ffffffff)
P 1 CS 001b 32bit 0 (ffffffff)
A 0 SS 0023 32bit 0 (ffffffff)
Z 1 Ds 0023 32bit 0 (ffffffff)
S 0 FS 0038 32bit 7ffde000 (FFF)
T 0 Gs 0000 null
D 0
O 0 lasterr error_mod_not_found (0000007e)

Haha ~ Is it the same except for the EIP!

Why?
Let's take a look at the first line of the UPX shell:

0040ec90 n> 60 pushad // ***** pay attention to this *****
0040ec91 be 15b04000 mov ESI, note-upx.0040B015

Pushad is to press all registers on the stack! At the end of the shell, let's take a look:

0040ee0f 61 popad // ***** Note *****
0040ee10-E9 b722ffff JMP note-upx.004010CC // JMP to OEP

Pop is to take all registers out of the stack!

When we pushad, esp pushed the Register into the stack of 0012ffc0--0012ffa4! As follows:

0012ffa4 77f517e6 returned to ntdll.77f517e6 from ntdll.77f78c4e // EDI
0012ffa8 77f51778 returned to ntdll.77f51778 from ntdll.77f517b5 // ESI
0012 ffac 0012fff0 // EBP
0012ffb0 0012ffc4 // ESP
0012ffb4 7ffdf000 // EBX
0012ffb8 7ffe0304 // edX
0012 ffbc 0012ffb0 // ECx
0012ffc0 00000000 // eax

In this case, we will tell you the hardware access breakpoint for the ESP 0012ffa4. That is to say, when the program needs to access these stacks, so as to restore the original register value and prepare to jump to the search OEP, OD helps us to interrupt.

So we stopped at ee10!

Summary: Let's assume the shell is a subroutine. After the shell unzips the code and decompress it, what he must do is follow the stack Balancing Principle and let ESP execute it to OEP, make ESP = 0012ffc4.

4. General ESP Law

After reading the tutorial, many people will ask: is the ESP law 0012ffa4? Is the ESP law applicable only to compression shells!

My answer is: no!

After reading the above, you will know that if you use 0012ffa8, you can also use the ESP law not only to compress the shell, but also to encrypt the shell !!!

First, tell you an experience that is also true-when the PE file starts running, that is, the first line of code that enters the shell. The register value is always the value above. If you don't believe it, try it yourself! When OEP is reached, most of the programs will start with a pressure stack! (Apart from the programs compiled by BC, BC usually uses the following statements to press the stack)

Now, based on the above ESP principle, we know that most shells run to OEP when ESP = 0012ffc4. That is to say, the first sentence of the program is to write 0012ffc0!

Finally, we get the general ESP law. If the hardware writes a breakpoint under 0012ffc0, we can stop at the second sentence of OEP !!

Let's take an example. Let's go to the first article on shelling!

After loading OD, come here:

0040d042 n> B8 00d04000 mov eax, notepad.0040d000 // stop here
0040d047 68 4c584000 push notepad.0040584c
0040d04c 64: ff35 00000000 push dword ptr fs: [0] // The First hardware interruption, F9
0040d053 64: 8925 00000000 mov dword ptr fs: [0], ESP
0040d05a 66: 9C pushfw
0040d05c 60 pushad
0040d05d 50 push eax

Directly write a breakpoint to the hardware under 0012ffc0, and F9 runs. (Pay attention to hardware interruption)

The first hardware interruption at 0040d04c, F9 continues!

0040d135 A4 movs byte ptr es: [EDI], byte ptr ds: [esi] // access exception, whether SHIFT + F9 continues
0040d136 33c9 XOR ECx, ECx
0040d138 83fb 00 cmp ebx, 0
0040d13b ^ 7E A4 jle short notepad.0040d0e1

The second hardware interruption.

004058b5 64 dB 64 // disconnected here
004058b6 89 dB 89
004058b7 1D dB 1d
004058b8 00 dB 00
004058b9 00 dB 00

Not here. F9 continues!

004010cc/. 55 push EBP
004010cd |. 8bec mov EBP, esp // disconnected here, haha, now! (If you find a flower command, use Ctrl + A to analyze it)
004010cf |. 83ec 44 sub ESP, 44
004010d2 |. 56 push ESI

Come on! This is not an addiction. Here is an example.

Shell removal advanced Article 2

If the above method cannot be broken, the program runs directly! Nothing. We are using another method!

Stop here after loading, and use the plug-in to hide od!

0040dbd6 n> ^ \ E9 25e4ffff JMP note_tel.0040c000 // stop here
0040 dbdb 0000 add byte ptr ds: [eax], Al
0040 DBDD 0038 add byte ptr ds: [eax], BH
0040 dbdf A4 movs byte ptr es: [EDI], byte ptr ds: [esi]
0040dbe0 54 push ESP

Run F9 and skip the exception with Shift + F9:

0040d817 ^ \ 73 dc jnb short note_tel.0040d7f5 // here
0040d819 CD20 64678f06 vxdcall 68f6764
0040d81f 0000 add byte ptr ds: [eax], Al
0040d821 58 pop eax

Write a breakpoint to the hardware under 0012ffc0! (Type HW 12ffc0 in the command line) Shift + F9 skip the exception and you will be taken to the second line of OEP: (use Ctrl + A to analyze it)

004010cc/. 55 push EBP
004010cd |. 8bec mov EBP, esp // disconnected here
004010cf |. 83ec 44 sub ESP, 44
004010d2 |. 56 push ESI
004010d3 |. ff15 e4634000 call dword ptr ds: [4063e4]
004010d9 |. 8bf0 mov ESI, eax
004010db |. 8a00 mov Al, byte ptr ds: [eax]
004010dd |. 3C 22 CMP Al, 22

In this way, we can easily solve the problem of finding OEP with two encrypted shells!

5. Summary

Now we can easily answer some questions.

1. What is the principle of ESP law?

Stack Balancing Principle.

2. What is the scope of application of ESP law?

Almost all compression shells, partially encrypted shells. As long as it is the shell of ESP = 0012ffc4 after JMP to OEP, we can use it theoretically. However, when a breakpoint is placed to avoid verification and when the OD is disconnected, this requires further summarization and accumulation. You are welcome to share your experience with us.

3. Can I only break the access breakpoint of 12ffa4?

Of course not. It is only an embodiment of the ESP law. We use the principle of the ESP law, not its specific value. It cannot be said that 12ffa4, or 12ffc0 is the ESP law, they are just an application of the ESP law!

4. What should we do with stolen code?

Haha, this is the best way to find stolen code! When we disconnected, it happened to be in the place where the shell was processing stolen code, and we went to OEP in f8!

6. Later

The principles of the above methods are summarized by myself and my own experience. If there is anything wrong, there is nothing to explain clearly. Also, haihan! However, if you think I am very good, you don't have to, because the ESP law is also taught by others, not my first one! I'm just a newbie who flies a little earlier than you. ^-^

After reading the above text, I hope it will help you find OEP, but don't forget one sentence: cainiao thinks it is difficult to find OEP, and experts think it is the most difficult to fix it! Now, I should write down the IAT repair principle in the next article! Let's work together!