本帖最后由 hszt 于 2026-4-8 11:56 编辑
脱壳文件
先执行到OEP（基址+0x14E0），再运行脚本，好像x64dbg不能重复执行脚本，再次运行脚本最好重新打开x64dbg，脱壳后把基址改成固定的
脱壳脚本
[Asm] 纯文本查看 复制代码 var base
var iatStart
var iatEnd
var currentAddr
var encryptedPtr
var stubBase
var stubSig
var dwordVal
var decryptedFunc
var decryptFn
var savedCip
mov base, UnpackME:base
mov iatStart, base
add iatStart, 1F3DC
mov decryptFn, base
add decryptFn, 25D9F
mov iatEnd, iatStart
add iatEnd, 398
mov currentAddr, iatStart
log "Base : {x:base}"
log "IAT Start : {x:iatStart}"
log "IAT End : {x:iatEnd}"
log "Decrypt Fn : {x:decryptFn}"
LOOP:
cmp currentAddr, iatEnd
jae DONE
mov encryptedPtr, qword(currentAddr)
cmp encryptedPtr, 0
je SKIP
mov stubSig, dword(encryptedPtr)
cmp stubSig, 6A51006A
jne SKIP
mov stubBase, encryptedPtr
add stubBase, A
mov dwordVal, dword(stubBase)
cmp dwordVal, 0
je SKIP
log "Slot {x:currentAddr} Stub {x:encryptedPtr} Key {x:dwordVal}"
mov ccx, dwordVal
mov cax, dwordVal
mov savedCip, cip
mov cip, decryptFn
rtr
mov decryptedFunc, cax
mov cip, savedCip
cmp decryptedFunc, 0
je SKIP
log " => {x:decryptedFunc}"
mov [currentAddr], decryptedFunc
SKIP:
add currentAddr, 8
goto LOOP
DONE:
log "IAT repair finished."
msg "修复完成，请用 Scylla 转储并固定基址。"
ret | 
发表于 2026-4-7 17:03
|
发表于 2026-4-7 19:51
