The Bat! 1.39 shelling notes

1. shelling of the main program

014F: 00990B35 8B10 mov edx, [EAX]
014F: 00990B37 8bda-8 mov eax, [EBP + 08]
014F: 00990B3A 035018 add edx, [EAX + 18]
014F: 00990B3D 8bda-8 mov eax, [EBP + 08]
014F: 00990B40 8B401C mov eax, [EAX + 1C]
014F: 00990B43 E880F9FFFF CALL 009904C8 <-here! Enter F8

014F: 009904C8 89C4 mov esp, EAX
014F: 009904CA 89D0 mov eax, EDX
014F: 009904CC 8b1d34213900 mov ebx, [00995634]
014F: 009904D2 89041C MOV [EBX + ESP], EAX
014F: 009904D5 61 POPAD
014F: 009904D6 50 push eax <-Write down the EAX value (61C528)
014F: 009904D7 C3 RET <-use Procdump to Shell

2. Obtain the complete. idata section.

The program obtained after shelling is still unable to run after you change the EIP. You have to use Icedump to do more work.

014F: 009909FF 8bda-8 mov eax, [EBP + 08]
014F: 00990A02 8D4824 lea ecx, [EAX + 24]
014F: 00990A05 8bda-8 mov eax, [EBP + 08]
014F: 00990A08 8B500C mov edx, [EAX + 0C]
014F: 00990A0B 8bda-8 mov eax, [EBP + 08]
014F: 00990A0E 8B4008 mov eax, [EAX + 08]
014F: 00990A11 E8FAF6FFFF CALL 00990110
014F: 00990A16 33C0 xor eax, EAX <-here!
014F: 00990A18 5A POP EDX
014F: 00990A19 59 POP ECX
014F: 00990A1A 59 POP ECX
014F: 00990A1B 648910 mov fs: [EAX], EDX
014F: 00990A1E EB13 JMP 00990A33

In line 00990A16, Pagein D 62e000 3000 c: hebat. bin

3. Run the Hex editing program and replace the. idata section in the main program after shelling with the complete. idata. Job done.