telock0.98b1脱壳分析

一、单步跟踪（不详细，需要补充）

IDA第一次解密：

*****
EAX初始为：00007EFC   
ECX=1951  解码长度   
一、Eax =len +EAX *4 + 103
AL 为KEY
二、ax = AAM 9  
****************
auto start_addr = 0x004c5041
auto ecx = 0x1951
auto eax = 0x7EFC
eax = ecx + eax*4 + 0x67#include <idc.idc>static main() {auto start_addr = 0x004c5041;auto ecx = 0x1951; auto eax = 0x00001951;        auto al,ah,key,data;    while(ecx > 0){eax = ecx + eax *4 + 0x67;key = eax & 0xFF;Message("KEY_%d = 0x%02X   and eax = 0x%002x\n", i, key,eax);data = Byte(start_addr) ^ key;patch_byte(start_addr,data);ah = (key /9)  << 8;al = (key %9) & 0xFF;eax = eax & 0xFFFF0000 | ah | al;start_addr++;ecx --;}
}

IDA第二次解密：

004C6AB5:解密start_addr = 004c69b8
loc_4C6ADA: start_addr+4
#include <idc.idc>static main() {auto start_addr = 0x004c69b8;auto ebx = 0xD; auto edx = 0x1F5DA32D;                auto data = 0;while(ebx > 0){edx = (edx * 0x5F) & 0xFFFFFFFF;data = Dword(start_addr) ^ edx;patch_dword(start_addr,data);edx = (edx << 5) | (edx >> 27);edx = (edx + 0x17 + 0x63409211) & 0xFFFFFFFF;                                        start_addr = start_addr + 4;ebx --;}
}

后续补充。。