This note is for the early ximo of the shelling Basic video tutorial, organized notes. the tools used in this note:
http://download.csdn.net/detail/obuyiseng/9466056
Telock
Action 1. Last Exception Method 1, Option---DEBUG Settings---exception------Cancel all exceptions.
in the Od plugin--strongod--options--skip Some exceptions option is canceled, restart OD and try again.
2. Then reload the program into
3, according to SHIFT+F9, found 17 times SHIFT+F9 will let the program run up, 4, because 17 run fly, we reload the program, press 16 times shift+f9, and then find the SE handle in the Stack window
5. Then we ctrl +g go to 0042D7FD and press F2 to set breakpoints
6, Shift+f9 Run, to the breakpoint, and then press F2 again to cancel the breakpoint, and then single-step tracking can be reached Oep.
7, then shelling can
8, finally set the OD configuration back to the original appearance.
2. Analog Tracking
You need to configure the OD as the last exception
1.We load the program, press 16 times SHIFT+F9, and then look up the SE handle in the Stack window
2. Then we ctrl +g go to 0042D7FD and press F2 to set breakpoints
3, Shift+f9 Run, go to the breakpoint, and then press F2 to cancel the breakpoint, open the Memory window, and find the location containing "SFX ...", enter TC eip<0042c000 at the command and then go back, wait for the trace to finish, (time is a bit long, Please wait patiently) found to jump directly to the OEP, and then shelled.
4, finally set the OD configuration back to the original appearance.
3. Two memory image 1, come to the memory window, in the ". rsrc" section under the breakpoint, press SHIFT+F9 run
2, again to the Memory window, containing the ". Text" section under the breakpoint, press SHIFT+F9 to run, found that came directly to the OEP
Simple Shelling Tutorial notes (9)---hand telock0.98b1 shell
