[收藏本方案]

AcProtect 1.41 外壳分析[64]

[入库：2005年8月19日] [更新：2007年3月24日]

本文简介：选择自 bmd2chen 的 blog
首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]

2">eax+2] 0058dbc3 0ac0 or al,al 0058dbc5 75 1b jnz short <found debug> 0058dbc7 90 nop 0058dbc8 90 nop 0058dbc9 90 nop 0058dbca 90 nop 0058dbcb eb 28 jmp short <safe way> 0058dbcd 90 nop 0058dbce 90 nop 0058dbcf 90 nop 0058dbd0 > 64:67:a1 2000 mov eax,dword ptr fs:[20] 0058dbd5 0bc0 or eax,eax 0058dbd7 75 09 jnz short <found debug> 0058dbd9 90 nop 0058dbda 90 nop 0058dbdb 90 nop 0058dbdc 90 nop 0058dbdd eb 16 jmp short <safe way> 0058dbdf 90 nop 0058dbe0 90 nop 0058dbe1 90 nop 0058dbe2 > 8bbd 4b814100 mov edi,dword ptr ss:[ebp+41814b] ; 如果发现调试器就阴人了:-( 0058dbe8 03bd 46f84000 add edi,dword ptr ss:[ebp+40f846] 0058dbee b9 0a000000 mov ecx,0a 0058dbf3 f3:ab rep stos dword ptr es:[edi] 0058dbf5 > 60 pushad ; crypt code 0058dbf6 e8 00000000 call 0058dbfb 0058dbfb 5e pop esi 0058dbfc 83ee 06 sub esi,6 0058dbff b9 5e000000 mov ecx,5e 0058dc04 29ce sub esi,ecx 0058dc06 ba 49f84a73 mov edx,734af849 0058dc0b c1e9 02 shr ecx,2 0058dc0e 83e9 02 sub ecx,2 0058dc11 83f9 00 cmp ecx,0 0058dc14 7c 1a jl short 0058dc30 0058dc16 8b048e mov eax,dword ptr ds:[esi+ecx*4] 0058dc19 8b5c8e 04 mov ebx,dword ptr ds:[esi+ecx*4+4] 0058dc1d 33c3 xor eax,ebx 0058dc1f c1c8 16 ror eax,16 0058dc22 03c2 add eax,edx 0058dc24 81f2 172969ff xor edx,ff692917 0058dc2a 89048e mov dword ptr ds:[esi+ecx*4],eax 0058dc2d 49 dec ecx 0058dc2e ^ eb e1 jmp short 0058dc11 0058dc30 61 popad 0058dc31 61 popad 0058dc32 c3 retn sub_chekring0's debug: 0058cc50 > 60 pushad ; 检测ring0级调试器 0058cc51 d3da rcr edx,cl 0058cc53 45 inc ebp 0058cc54 e8 01000000 call 0058cc5a 0058cc59 - e9 83c4040f jmp 0f5d90e1 0058cc5e 8802 mov byte ptr ds:[edx],al 0058cc60 0000 add byte ptr ds:[eax],al ...... 0058cdfb . e8 00f3ffff call <sub_getebp >
0058ce00 . e8 c7120000 call <eax=0 do something> 0058ce05 . 0bc0 or eax,eax 0058ce07 . 0f85 6f010000 jnz <not found way> 0058ce0d . c685 501c4100>mov byte ptr ss:[ebp+411c50],0c3 ; check sice 0058ce14 . 8d

首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]
本文关键：AcProtect 1.41 外壳分析
　　相关方案
Google
 

本站最佳浏览方式为 分辨率 1024x768 IE 6.0（或更高版本的 IE浏览器）

go top