Modify shell header using equivalent replacement code method

From:Jgaoabc Space

Recently, I did some research on the Beidou 4.1 shell, and found that this shell has good compatibility, high compression, and easier shell modification. Therefore, I would like to recommend my shell modification method, after modification, rising 2009 and Kingsoft 2009 cannot be shelled. For Kabbah, you can use a digital signature. Because I do not want to make animations, I use text instructions. The following changes are for the EXE file, and the DLL is a little different.
Code and modification method before modification
004C51C4 pushfd
004C51C5 pushad
004C51C6 call 004C51CB
004C51CB pop ebp
004C51CC mov eax, 7 is changed to sub ebp, 7 (the ebp value is the memory value of the entry point)
004C51D1 sub ebp, eax NOP
004C51D3 lea esi, dword ptr ss: [ebp-48C] To mov ebx,-48C and add ebx, ebp, write down here the value of 48C is called A1.
004C51D9 mov al, byte ptr ds: [esi] change to mov al, 0 (the minimum two values of al are eax)
004C51DB cmp al, 0 NOP (EXE file in the ebp-48C value is 0, DLL is 1, so the following judgment statement NOP, If you modify the DLL file, here is a bit different .)
004C51DD je short 004C51F1 NOP (the following code is written to NOP, Or you can write some code here)
004C51DF mov esi, ebp NOP
004C51E1 lea esi, dword ptr ss: [ebp-464] NOP
004C51E7 mov al, byte ptr ds: [esi] NOP
004C51E9 cmp al, 1 NOP
004C51EB je 004C5433 NOP
004C51F1 mov byte ptr ds: [esi], 1 changed to mov byte ptr ds: [ebx], 1 (move up to NOP)
004C51F4 mov edx, ebp
004C51F6 sub edx, dword ptr ss: [ebp-4D0] changed to sub ebx, 44 and sub edx, dword ptr ss: [ebx]
004C51FC mov dword ptr ss: [ebp-4D0], edx modified to mov dword ptr ss: [ebx], edx (the value of edx is the base address)
004C5202 add dword ptr ss: [ebp-4A0], edx modify to add ebx, 30 and add dword ptr ss: [ebx], edx
004C5208 lea esi, dword ptr ss: [ebp-45C] changed to add ebx, 44 and lea esi, dword ptr ss: [ebx]
004C520E add dword ptr ds: [esi], edx
Modify the binary code of 004C5210 pushad to 50 51 52 53 54 55 56 57
004C5211 change push 40 to mov ebx, 40, and push ebx
004C5213 push 1000 and the following sentence are modified to mov ebx, 1000, push ebx, and push ebx together.
004C5218 push 1000
004c521 push 0 to sub ebx, 1000, and push ebx
004C521F call dword ptr ss: [ebp-428] change to mov ebx, ebp and add ebx,-428 and call dword ptr ss: [ebx], write down the 428 value here, it is called A2.
004C5225 test eax, eax NOP
004C5227 je 004C5597 NOP
004C522D mov dword ptr ss: [ebp-4A8], eax changed to sub ebx, 80 and mov dword ptr ss: [ebx], eax004C5233 call 004C5238 the following four sentences (including this sentence) change NOP to mov ebx, ebp, and add ebx, 3DC.
004C5238 pop ebx NOP
004C5239 mov ecx, 368 NOP
004C523E add ebx, ecx NOP
004C5240 push eax
004C5241 push ebx
The last line of code of 004C5242 call 004C54F8 004C54F8 is a JMP Statement, which is dropped by NOP. This sentence is changed to call 004C54F3.
004C5247 popad is modified here. If you are interested, continue.
004C5248 mov esi, dword ptr ds: [esi]
004C524A mov edi, ebp
See the figure below for the Beidou settings and modified code.

By comparing different files, I found that the memory offset difference is fixed, that is, A1 and A2 are different above, which provides convenience for batch modification. The binary code I provide is as follows:

9C 60 E8 00 00 00 00 5D 83 ED 07 BB 74 fb ff 03 DD C6 03 01 B0 00 8B D5 83 EB 44 36 2B 13 36 89 13 83 C3 30 36 01 13 83 C3 44 36 8D 33 01 16 50 51 52 53 54 55 57 BB 40 00 00 00 53 BB 00 10 00 53 53 81 EB 00 10 00 00 53 8B DD 81 C3 d8 fb ff 36 FF 13 81 EB 80 00 00 00 36 89 03 8B DD 81 C3 DC 03 00 00

Paste the preceding code from the beginning to c5240, and modify the A1 and A2 values of the two places noted down above as the actual values. Then modify the CALL statement 004C5242. OK.