Simple Method for Extracting DLL files with ASPack2.12 shelling

Preface:
I read some articles from other people and summarized the following rules for ease of use. ***** 1A3 represents the last three digits of the virtual address. It is estimated that everyone and I should be the same.

The first thing to do is to use Lordpe to view the OEP and calculate the base address size after loading it with OD.

1. dump File

In the following position:

* *** 1A3 0F851EFFFFFF JNZ 00C700C7 <==== skip several times

* *** 1A9 6800800000 PUSH 00008000 <====== here, you can fully DUMP

2. Determine the address and size of the relocated table:

***** 1E5 8BB5 39050000 mov esi, dword ptr ss: [EBP + 539] <=== assign the start address of the table segment to ESI
* *** 1EB 03B5 22040000 add esi, dword ptr ss: [EBP + 422] <=== convert to VA
* *** 1F1 833E 00 cmp dword ptr ds: [ESI], 0 <== ESI is the VA address starting from Table segment relocation (1)

...........

* *** 25D 8BB5 41050000 mov esi, dword ptr ss: [EBP + 541] <= ESI is the RVA address after the table segment is relocated (2)

Relocation table RVA = [EBP + 539], SIZE = (2)-(1 ).

3. Confirm the start address of the input table:

* *** 278 BE 70C30000 mov esi, 0C370 <=== input table segment start address assigned to ESI

4. Confirm OEP

***** 3AF 61 popad
* ***** 3B0 75 08 jnz ***** 3BA
***** 3B2 B8 01000000 mov eax, 1
***** 3B7 C2 0C00 retn 0C
* ***** 3BA 68 D0E48B00 push ******* <==== real entry point

Then, use Lordpe to modify the OEP, relocate the table RVA and the size, and enter the table RVA.