EN | ZH The principle of the last exception method is that the program may trigger countless exceptions during self-extraction or self-decryption. If you can locate the last program exception, it may be close to the automatic shelling completion position. Now the last An exception method shelling can take advantage of Ollydbg's exception counter plugin, first record the number of exceptions, then reload, automatically stop at the last exception.
- Click on 'Options -> Debug Options -> Exceptions
, remove all the √ inside! PressCTRL+F2` to reload the program.
- The start program is a jump, here we press
SHIFT+F9, until the program runs, write down the number of times to start from
SHIFT+F9to the program
CTRL+F2reload the program, press
SHIFT+F9(the number of times this time is the program running times
- In the lower right corner of the OD we see a "
SE handle", then we press
CTRL+Gand enter the address before the `SE handle'!
- Press F2 to break the point! Then press
SHIFT+F9to the breakpoint, F8 single step tracking
The sample program can be downloaded here: 5_last_exception.zip
OD loader, uncheck all ignore exceptions in the menu
Options -> Debug Settings -> Exceptions tab and then reload the program.
Shift+F9, the number of times the record is pressed, the program runs normally. What we want to get is the number of times the second to last press is pressed. In this example
shift+F9once, to the position of
shift+F9twice, the program runs normally
Then we reload the program, just press 1 (
Shift+F9, go to the position of
0040CCD2, observe the stack window, there is a
SE handler: 0040CCD7
In the CPU window (assembly instruction), press
0040CCD7, then press F2 here. That is, set a breakpoint at
0040CCD7, then press
Shift+F9 to run. Trigger a breakpoint.
After triggering the breakpoint, step through the tracking. Down are some loops and jumps, we use F4 to skip the loop. Finally arrive at the following position
Obviously in the final
mov ebp, 0041010CC; jmp ebp is in the jump to OEP, we jump past as shown below:
Obviously, we were lucky enough to come to OEP.