[收藏本方案]

AcProtect 1.41 外壳分析[26]

[入库：2005年8月19日] [更新：2007年3月24日]

本文简介：选择自 bmd2chen 的 blog
首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]

"2">ss:[ebp+40f52c] ; 当eax＝0时的处理 0058b083 b9 08000000 mov ecx,8 0058b088 f3:a5 rep movs dword ptr es:[edi],dword ptr ds:> 0058b08a 8db5 50f54000 lea esi,dword ptr ss:[ebp+40f550] 0058b090 b9 07000000 mov ecx,7 0058b095 f3:a5 rep movs dword ptr es:[edi],dword ptr ds:> 0058b097 4f dec edi 0058b098 803f 20 cmp byte ptr ds:[edi],20 0058b09b 75 06 jnz short 0058b0a3 0058b09d 90 nop 0058b09e 90 nop 0058b09f 90 nop 0058b0a0 90 nop 0058b0a1 ^ eb f4 jmp short 0058b097 0058b0a3 c647 01 00 mov byte ptr ds:[edi+1],0 0058b0a7 eb 4f jmp short <case else> 0058b0a9 90 nop 0058b0aa 90 nop 0058b0ab 90 nop 0058b0ac > 8a85 6df74000 mov al,byte ptr ss:[ebp+40f76d] ; 当eax==1时的处理 0058b0b2 aa stos byte ptr es:[edi] 0058b0b3 eb 43 jmp short <case else> 0058b0b5 90 nop 0058b0b6 90 nop 0058b0b7 90 nop 0058b0b8 > 50 push eax ; 当eax＝＝2时的处理 0058b0b9 8b4424 24 mov eax,dword ptr ss:[esp+24] 0058b0bd 8985 28f54000 mov dword ptr ss:[ebp+40f528],eax 0058b0c3 58 pop eax 0058b0c4 e8 02380000 call <reg_info> 0058b0c9 eb 2d jmp short <case else> 0058b0cb 90 nop 0058b0cc 90 nop 0058b0cd 90 nop 0058b0ce > e8 72000000 call 0058b145 ; 当 eax=3时的处理 0058b0d3 eb 23 jmp short <case else> 0058b0d5 90 nop 0058b0d6 90 nop 0058b0d7 90 nop 0058b0d8 > e8 9c020000 call <sub_restore_crypted_code> ; 当 eax==4时的处理 0058b0dd eb 19 jmp short <case else> 0058b0df 90 nop 0058b0e0 90 nop 0058b0e1 90 nop 0058b0e2 > e8 ca040000 call <sub_decrypt_code> ; 当 eax==5时的处理 0058b0e7 eb 0f jmp short <case else> 0058b0e9 90 nop 0058b0ea 90 nop 0058b0eb 90 nop 0058b0ec > 8b85 5d814100 mov eax,dword ptr ss:[ebp+41815d] ; 当eax==6时的处理 0058b0f2 ab stos dword ptr es:[edi] 0058b0f3 eb 03 jmp short <case else> 0058b0f5 90 nop 0058b0f6 90 nop 0058b0f7 90 nop 0058b0f8 > 90 nop ; case else 0058b0f9 90 nop 0058b0fa 90 nop ...... 0058b133 90 nop 0058b134 61 popad 0058b135 837c24 04 ff cmp dword ptr ss:[esp+4],-1 0058b13a 74 06 je short 0058b142 0058b13c 90

首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]
本文关键：AcProtect 1.41 外壳分析
　　相关方案
Google
 

本站最佳浏览方式为 分辨率 1024x768 IE 6.0（或更高版本的 IE浏览器）

go top