ImpREC手工指定IAT中的表项值

前言

在做Armadillo1.x的脱壳练习, 找OEP, 脱壳还是一样的.
但是在IAT修复时, 遇到了新知识点.
我找到了壳代码写IAT表项的代码, 由于很乱, 没有找到合适的点来修改(让壳代码写IAT表项时, 写真实的API地址), 但是我得到了壳代码自己用的一段导入dll名称和dll内的导入函数的文本列表. 经过跟ImpREC比较, 发现有好消息, 这个文本列表和ImpREC中dll名称, 导入函数名称, 次序一模一样.
这次, 我直接在ImpREC中指定确实的导入函数名称.就按照找到的导入Dll函数文本列表进行补充被壳加密的导入表项.

记录

在导入表项地址上下内存写入硬断点, 可以跟壳写IAT表项值的实现.
然后看到了(Dll名称 +DLL导入函数)文本描述的集合, 中间还夹杂这2进制数据(很像一个一个相同性质的结构体连在一起的数组).

修复PE头

到了OEP处, 在脱壳之前, 需要确认下PE头是否正确.
在Memory窗口处, 目标进程名称的节表上面就是PE头, 如果OD没认出来, 就是PE头不对.
另外开一个OD, 将带壳的原始程序载入, 将PE头在单独的数据窗口dump出来, 将PE头数据的4KB, 用拷贝中的全选, 再用2进制中的”2进制拷贝”
然后在待脱壳程序的Memory窗口, 将PE头数据单独dump在数据窗口, 也是全选, 然后2进制粘贴. 这时就可以在OEP处Dump了.

手工指定IAT表项-修复导入表

0168E05D  ?...m炓n筃詎_H詎?襫&呉n'I詎?..kernel32.dll.格x.&...
0168E09D  DeleteCriticalSection.LeaveCriticalSection.EnterCriticalSection.
0168E0DD  InitializeCriticalSection.VirtualFree.VirtualAlloc.LocalFree.Loc
0168E11D  alAlloc.GetTickCount.QueryPerformanceCounter.GetVersion.GetCurre
0168E15D  ntThreadId.InterlockedDecrement.InterlockedIncrement.VirtualQuer
0168E19D  y.WideCharToMultiByte.MultiByteToWideChar.lstrlenA.lstrcpynA.Loa
0168E1DD  dLibraryExA.GetThreadLocale.GetStartupInfoA.GetProcAddress.GetMo
0168E21D  duleHandleA.GetModuleFileNameA.GetLocaleInfoA.GetCommandLineA.Fr
0168E25D  eeLibrary.FindFirstFileA.FindClose.ExitProcess.ExitThread.Create
0168E29D  Thread.WriteFile.UnhandledExceptionFilter.RtlUnwind.RaiseExcepti
0168E2DD  on.GetStdHandle..user32.dll.T騲....GetKeyboardType.LoadStringA.
0168E31D  MessageBoxA.CharNextA..advapi32.dll.h騲....RegQueryValueExA.Reg
0168E35D  OpenKeyExA.RegCloseKey..oleaut32.dll.x騲....SysFreeString.SysRe
0168E39D  AllocStringLen.SysAllocStringLen..kernel32.dll.堯x....TlsSetVal
0168E3DD  ue.TlsGetValue.LocalAlloc.GetModuleHandleA..advapi32.dll.滘x.
..
0168E41D  .RegSetValueExA.RegQueryValueExA.RegQueryInfoKeyA.RegOpenKeyExA.
0168E45D  RegFlushKey.RegEnumValueA.RegEnumKeyExA.RegDeleteValueA.RegDelet
0168E49D  eKeyA.RegCreateKeyExA.RegCloseKey..kernel32.dll.舔x.X...lstrcpyA
0168E4DD  .lstrcmpA.WriteFile.WaitForSingleObject.VirtualQuery.VirtualAllo
0168E51D  c.TerminateThread.SuspendThread.SleepEx.Sleep.SizeofResource.Set
0168E55D  ThreadPriority.SetThreadLocale.SetFilePointer.SetEvent.SetErrorM
0168E59D  ode.SetEndOfFile.ResumeThread.ResetEvent.RemoveDirectoryA.ReadFi
0168E5DD  le.MultiByteToWideChar.MulDiv.LockResource.LoadResource.LoadLibr
0168E61D  aryA.LeaveCriticalSection.InitializeCriticalSection.GlobalUnlock
0168E65D  .GlobalReAlloc.GlobalHandle.GlobalLock.GlobalFree.GlobalFindAtom
0168E69D  A.GlobalDeleteAtom.GlobalAlloc.GlobalAddAtomA.GetVersionExA.GetV
0168E6DD  ersion.GetTimeZoneInformation.GetTickCount.GetThreadLocale.GetTe
0168E71D  mpPathA.GetSystemInfo.GetSystemDirectoryA.GetStringTypeExA.GetSt
0168E75D  dHandle.GetProcAddress.GetModuleHandleA.GetModuleFileNameA.GetLo
0168E79D  caleInfoA.GetLocalTime.GetLastError.GetFullPathNameA.GetFileSize
0168E7DD  .GetFileAttributesA.GetExitCodeThread.GetEnvironmentVariableA.Ge
0168E81D  tDriveTypeA.GetDiskFreeSpaceA.GetDateFormatA.GetCurrentThreadId.
0168E85D  GetCurrentProcessId.GetCPInfo.GetACP.FreeResource.InterlockedInc
0168E89D  rement.InterlockedExchange.InterlockedDecrement.FreeLibrary.Form
0168E8DD  atMessageA.FindResourceA.FindNextFileA.FindFirstFileA.FindClose.
0168E91D  FileTimeToLocalFileTime.FileTimeToDosDateTime.EnumCalendarInfoA.
0168E95D  EnterCriticalSection.DeviceIoControl.DeleteFileA.DeleteCriticalS
0168E99D  ection.CreateThread.CreateFileA.CreateEventA.CreateDirectoryA.Co
0168E9DD  mpareStringA.CloseHandle..version.dll.0魓....VerQueryValueA.Get
0168EA1D  FileVersionInfoSizeA.GetFileVersionInfoA..gdi32.dll.@魓.X...Upda
0168EA5D  teColors.UnrealizeObject.StretchBlt.SetWindowOrgEx.SetWinMetaFil
0168EA9D  eBits.SetViewportOrgEx.SetTextColor.SetStretchBltMode.SetROP2.Se
0168EADD  tPixel.SetEnhMetaFileBits.SetDIBits.SetDIBColorTable.SetBrushOrg
0168EB1D  Ex.SetBkMode.SetBkColor.SelectPalette.SelectObject.SelectClipRgn
0168EB5D  .SaveDC.RoundRect.RestoreDC.Rectangle.RectVisible.RealizePalette
0168EB9D  .PtInRegion.Polyline.Polygon.PolyPolyline.PlayEnhMetaFile.PatBlt
0168EBDD  .MoveToEx.MaskBlt.LineTo.IntersectClipRect.GetWindowOrgEx.GetWin
0168EC1D  MetaFileBits.GetTextMetricsA.GetTextExtentPointA.GetTextExtentPo
0168EC5D  int32A.GetTextColor.GetSystemPaletteEntries.GetStockObject.GetRg
0168EC9D  nBox.GetPixel.GetPaletteEntries.GetObjectType.GetObjectA.GetNear
0168ECDD  estColor.GetEnhMetaFilePaletteEntries.GetEnhMetaFileHeader.GetEn
0168ED1D  hMetaFileBits.GetDeviceCaps.GetDIBits.GetDIBColorTable.GetDCOrgE
0168ED5D  x.GetCurrentPositionEx.GetCurrentObject.GetClipRgn.GetClipBox.Ge
0168ED9D  tBrushOrgEx.GetBkMode.GetBitmapBits.ExtTextOutA.ExtSelectClipRgn
0168EDDD  .ExcludeClipRect.DeleteObject.DeleteEnhMetaFile.DeleteDC.CreateS
0168EE1D  olidBrush.CreateRectRgnIndirect.CreateRectRgn.CreatePolygonRgn.C
0168EE5D  reatePenIndirect.CreatePen.CreatePatternBrush.CreatePalette.Crea
0168EE9D  teHalftonePalette.CreateFontIndirectA.CreateDIBitmap.CreateDIBSe
0168EEDD  ction.CreateCompatibleDC.CreateCompatibleBitmap.CreateBrushIndir
0168EF1D  ect.CreateBitmap.CopyEnhMetaFileA.CombineRgn.BitBlt..user32.dll.
0168EF5D  x.?..CreateWindowExA.WindowFromPoint.WinHelpA.WaitMessage.VkK
0168EF9D  eyScanA.ValidateRect.UpdateWindow.UnregisterClassA.UnhookWindows
0168EFDD  HookEx.TranslateMessage.TranslateMDISysAccel.TrackPopupMenu.Syst
0168F01D  emParametersInfoA.ShowWindow.ShowScrollBar.ShowOwnedPopups.ShowC
0168F05D  ursor.ShowCaret.SetWindowsHookExA.SetWindowTextA.SetWindowPos.Se
0168F09D  tWindowPlacement.SetWindowLongA.SetTimer.SetScrollRange.SetScrol
0168F0DD  lPos.SetScrollInfo.SetRectEmpty.SetRect.SetPropA.SetParent.SetMe
0168F11D  nuItemInfoA.SetMenu.SetForegroundWindow.SetFocus.SetCursor.SetCl
0168F15D  ipboardData.SetClassLongA.SetCapture.SetActiveWindow.SendMessage
0168F19D  A.ScrollWindow.ScreenToClient.RemovePropA.RemoveMenu.ReleaseDC.R
0168F1DD  eleaseCapture.RegisterWindowMessageA.RegisterClipboardFormatA.Re
0168F21D  gisterClassA.RedrawWindow.PtInRect.PostQuitMessage.PostMessageA.
0168F25D  PeekMessageA.OpenClipboard.OffsetRect.OemToCharA.MsgWaitForMulti
0168F29D  pleObjects.MessageBoxA.MessageBeep.MapWindowPoints.MapVirtualKey
0168F2DD  A.LoadStringA.LoadKeyboardLayoutA.LoadIconA.LoadCursorA.LoadBitm
0168F31D  apA.KillTimer.IsZoomed.IsWindowVisible.IsWindowEnabled.IsWindow.
0168F35D  IsRectEmpty.IsIconic.IsDialogMessageA.IsChild.InvalidateRect.Int
0168F39D  ersectRect.InsertMenuItemA.InsertMenuA.InflateRect.HideCaret.Get
0168F3DD  WindowThreadProcessId.GetWindowTextA.GetWindowRect.GetWindowPlac
0168F41D  ement.GetWindowLongA.GetWindowDC.GetUpdateRect.GetTopWindow.GetS
0168F45D  ystemMetrics.GetSystemMenu.GetSysColorBrush.GetSysColor.GetSubMe
0168F49D  nu.GetScrollRange.GetScrollPos.GetScrollInfo.GetPropA.GetParent.
0168F4DD  GetWindow.GetMessagePos.GetMessageA.GetMenuStringA.GetMenuState.
0168F51D  GetMenuItemInfoA.GetMenuItemID.GetMenuItemCount.GetMenuDefaultIt
0168F55D  em.GetMenu.GetLastActivePopup.GetKeyboardState.GetKeyboardLayout
0168F59D  List.GetKeyboardLayout.GetKeyState.GetKeyNameTextA.GetIconInfo.G
0168F5DD  etForegroundWindow.GetFocus.GetDlgItem.GetDesktopWindow.GetDCEx.
0168F61D  GetDC.GetCursorPos.GetCursor.GetClipboardData.GetClientRect.GetC
0168F65D  lassNameA.GetClassLongA.GetClassInfoA.GetCaretPos.GetCapture.Get
0168F69D  AsyncKeyState.GetActiveWindow.FrameRect.FindWindowA.FillRect.Equ
0168F6DD  alRect.EnumWindows.EnumThreadWindows.EndPaint.EnableWindow.Enabl
0168F71D  eScrollBar.EnableMenuItem.EmptyClipboard.DrawTextExA.DrawTextA.D
0168F75D  rawMenuBar.DrawIconEx.DrawIcon.DrawFrameControl.DrawFocusRect.Dr
0168F79D  awEdge.DragDetect.DispatchMessageA.DestroyWindow.DestroyMenu.Des
0168F7DD  troyIcon.DestroyCursor.DeleteMenu.DefWindowProcA.DefMDIChildProc
0168F81D  A.DefFrameProcA.CreatePopupMenu.CreateMenu.CreateIcon.CopyImage.
0168F85D  CloseClipboard.ClientToScreen.ChildWindowFromPointEx.ChildWindow
0168F89D  FromPoint.CheckMenuItem.CallWindowProcA.CallNextHookEx.BeginPain
0168F8DD  t.CharNextA.CharLowerBuffA.CharLowerA.CharUpperBuffA.CharToOemA.
0168F91D  AdjustWindowRectEx.ActivateKeyboardLayout..ole32.dll.匄x....CoT
0168F95D  askMemFree.StringFromCLSID.CoCreateGuid..kernel32.dll.旞x....Sl
0168F99D  eep..oleaut32.dll.滧x.....SafeArrayPtrOfIndex.SafeArrayPutElemen
0168F9DD  t.SafeArrayGetElement.SafeArrayGetUBound.SafeArrayGetLBound.Safe
0168FA1D  ArrayCreate.VariantChangeType.VariantCopy.VariantClear.VariantIn
0168FA5D  it..ole32.dll.萨x....CoTaskMemAlloc.CoCreateInstance.CoUninitia
0168FA9D  lize.CoInitialize..oleaut32.dll.茗x....GetErrorInfo.SysFreeStri
0168FADD  ng..comctl32.dll.桫x....ImageList_SetIconSize.ImageList_GetIcon
0168FB1D  Size.ImageList_Write.ImageList_Read.ImageList_GetDragImage.Image
0168FB5D  List_DragShowNolock.ImageList_SetDragCursorImage.ImageList_DragM
0168FB9D  ove.ImageList_DragLeave.ImageList_DragEnter.ImageList_EndDrag.Im
0168FBDD  ageList_BeginDrag.ImageList_Remove.ImageList_DrawEx.ImageList_Re
0168FC1D  place.ImageList_Draw.ImageList_GetBkColor.ImageList_SetBkColor.I
0168FC5D  mageList_ReplaceIcon.ImageList_Add.ImageList_GetImageCount.Image
0168FC9D  List_Destroy.ImageList_Create.InitCommonControls..shell32.dll.L
0168FCDD  x....Shell_NotifyIconA.ShellExecuteA..shell32.dll.X鵻....SHGet
0168FD1D  SpecialFolderLocation.SHGetPathFromIDListA.SHBrowseForFolderA..c
0168FD5D  omdlg32.dll.h鵻....GetSaveFileNameA.GetOpenFileNameA..winmm.dll
0168FD9D  .t鵻....timeGetTime.PlaySoundA..armaccess.dll.€鵻....InstallKe
0168FDDD  y.VerifyKey..........................................

只要OEP填对了, ImpREC中找的IAT范围是对的, 可能范围小, 需要调整确认下.
得到导入函数后, 在无效项上双击, 在编辑框中填入在文本列表中找到的对应函数(对应关系一模一样^_^), 可以直接粘贴函数名点击确定IAT项修改完成.

这次遇到的无效IAT项有30个左右, 搞了一个小时填完, 又点击ImpREC的无效表项按钮, 又出现几项, 发现是自己手工填写时搞错了. 修正后, 点击IAT无效表项时, 已经都是正确的了.

壳代码将IAT末尾间隔0那个位置, 也写成了地址, 这些地址可以cut掉.

最后还用到了armaccess.dll中的2个函数(Key操作), 本地没有这个armaccess.dll, 将这个DLL的IATcut掉.

然后进行IAT修复(如果不采用原始文件的PE头, ImpREC显示错误, 空间不够之类, 如果ImpREC报错, 那说明PE头错了).

修复PE运行错误-原因是IAT表项缺失

在IAT修复完, 用OD载入, 因为去掉了armaccess.dll的IAT, 导致用到armaccess.dll中API时报错.

解决方法是不断的F8, 报错后, 进入那个函数下F2断点(去掉旧断点,只有这一个断点).
10个回合不到, 就可以定位使用armaccess.dll中API的代码(使用的API在IAT中的位置,正好是自己cut掉的位置, 本机上没有, cut掉不得已).

分析反汇编, 去掉使用armaccess.dll中API的代码, 保持堆栈平衡.

打文件补丁, 练习完成.

等程序运行起来, 可以知道, 使用armaccess.dllAPI的地方是注册码判断中的一个环节, 直接时该函数返回1就行.

cm跑起来, 已经是注册版.