OD Experiment (15)-The reverse of a program

Program:

Open Program

A NAG window appears

This is the main interface

Click Exit

The program appears in the NAG window and then exits

Take a look at Peid.

It's a program written in VC + + 6.0.

Reverse:

Loading the program with OD

Run the program.

Pause when NAG window appears

Press Alt+k to display the call stack

This is the MFC dialog box, double-click where it is located

Next breakpoint, run the program again.

OD stops at the breakpoint.

Press F8 to go down one step

The NAG window appears

It took a few seconds to go down a step.

Press F9 to run

The program stops at this breakpoint again.

Press the F8, please.

The main window appears.

Click Exit

OD took a step down

Press F9 to run

OD's stopping at the breakpoint.

Press the F8, please.

The program closed NAG window appears

Indicates that this breakpoint is a place where three windows appear.

This call statement has a JE jump instruction, and if you do jump, you will skip this

If this je jump instruction executes a jump for the first time, the second does not perform a jump, the third execution jumps, will only show the main interface does not show NAG window

Can be used to determine the condition, set a variable i, if I equals 2, then do not jump, I equals 1 or 3, then execute jump

Press Alt+m to display the Memory window to view the program's PE header structure

Double-click into data segment

Find a place with no data.

Let's test if this place will be affected when the program is running.

Hardware access, breakpoints, right-click Byte, follow this one byte

Run the program again, the program does not stop at the breakpoint at the time of operation, indicating that the program does not affect the byte area during the process

Next, look for a blank place in the code block area.

Next use a plugin for OD Nonawrite to modify

Write the assembly code on the Nonawrite

0X437D6E is the address to be modified

The following is the statement to be modified

Click "Assemble" after you finish writing

Then change the JE Jump command to jmp.

Save the file, run the program

There is no NAG window, only the main window

OD Experiment (15)-The reverse of a program