[收藏本方案]

AcProtect 1.41 外壳分析[50]

[入库：2005年8月19日] [更新：2007年3月24日]

本文简介：选择自 bmd2chen 的 blog
首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]

a id="2">ds:[edi+4],6c6c6c64 0058ef4e c647 07 00 mov byte ptr ds:[edi+7],0 0058ef52 8db5 98f34000 lea esi,dword ptr ss:[ebp+40f398] 0058ef58 6a 00 push 0 ; /htemplatefile = null 0058ef5a 6a 20 push 20 ; |attributes = archive 0058ef5c 6a 02 push 2 ; |mode = create_always 0058ef5e 6a 00 push 0 ; |psecurity = null 0058ef60 6a 03 push 3 ; |sharemode = file_share_read|file_share_write 0058ef62 68 000000c0 push c0000000 ; |access = generic_read|generic_write 0058ef67 56 push esi ; |filename = "c:\docume~1\admini~1\locals~1\temp\cid.dll" 0058ef68 ff95 2bfd4000 call dword ptr ss:[ebp+40fd2b] ; \createfilea 0058ef6e 50 push eax ; /push hfile 0058ef6f 6a 00 push 0 ; |/poverlapped = null 0058ef71 8db5 b3f44000 lea esi,dword ptr ss:[ebp+40f4b3] ; || 0058ef77 56 push esi ; ||pbyteswritten = maincon.0058a4b3 0058ef78 ffb5 59814100 push dword ptr ss:[ebp+418159] ; ||nbytestowrite = 0 0058ef7e 8b9d 4f814100 mov ebx,dword ptr ss:[ebp+41814f] ; || 0058ef84 039d 46f84000 add ebx,dword ptr ss:[ebp+40f846] ; || 0058ef8a 2b9d 53814100 sub ebx,dword ptr ss:[ebp+418153] ; || 0058ef90 2b9d 59814100 sub ebx,dword ptr ss:[ebp+418159] ; || 0058ef96 53 push ebx ; ||buffer = maincon.00400000 0058ef97 50 push eax ; ||hfile = 00000054 (window) 0058ef98 ff95 53fd4000 call dword ptr ss:[ebp+40fd53] ; |\writefile 0058ef9e ff95 27fd4000 call dword ptr ss:[ebp+40fd27] ; \closehandle 0058efa4 8db5 98f34000 lea esi,dword ptr ss:[ebp+40f398] 0058efaa 56 push esi ; /librarya name 0058efab ff95 24854100 call dword ptr ss:[ebp+418524] ; \loadlibrarya 0058efb1 8985 3ef84000 mov dword ptr ss:[ebp+40f83e],eax ; hmodule 0058efb7 8db5 5d814100 lea esi,dword ptr ss:[ebp+41815d] 0058efbd 56 push esi ; /procnameorordinal = "randimize" 0058efbe ffb5 3ef84000 push dword ptr ss:[ebp+40f83e] ; |hmodule = null 0058efc4 ff95 1c854100 call dword ptr ss:[ebp+41851c] ; \getprocaddress 0058efca ffb5 67814100 push dword ptr ss:[ebp+418167] 0058efd0 ffd0 call

首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]
本文关键：AcProtect 1.41 外壳分析
　　相关方案
Google
 

本站最佳浏览方式为 分辨率 1024x768 IE 6.0（或更高版本的 IE浏览器）

go top