[收藏本方案]

AcProtect 1.41 外壳分析[68]

[入库：2005年8月19日] [更新：2007年3月24日]

本文简介：选择自 bmd2chen 的 blog
首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]

>sub_getebp >
0058d4d4 . e8 f30b0000 call <eax=0 do something> 0058d4d9 . 0bc0 or eax,eax 0058d4db . 75 3e jnz short 0058d51b 0058d4dd . 90 nop 0058d4de . 90 nop 0058d4df . 90 nop 0058d4e0 . 90 nop 0058d4e1 . c685 24234100>mov byte ptr ss:[ebp+412324],0c3 ; 改入口为ret 0058d4e8 . 8d9d f8244100 lea ebx,dword ptr ss:[ebp+4124f8] 0058d4ee . e8 40f7ffff call <sub_checkapi_cc> ; 检测unhandledexceptionfilter入口有没有处cc断点 0058d4f3 . eb 26 jmp short 0058d51b 0058d4f5 90 nop 0058d4f6 90 nop 0058d4f7 90 nop 0058d4f8 . 8b85 5ffd4000 mov eax,dword ptr ss:[ebp+40fd5f] 0058d4fe . 8038 cc cmp byte ptr ds:[eax],0cc 0058d501 . 75 17 jnz short 0058d51a 0058d503 > 90 nop 0058d504 . 90 nop 0058d505 . 90 nop 0058d506 . 90 nop 0058d507 . b8 90010000 mov eax,190 0058d50c . e8 bde3ffff call <get_rnd_value> 0058d511 . 8dbd 812e4000 lea edi,dword ptr ss:[ebp+402e81] 0058d517 . 03f8 add edi,eax 0058d519 . ab stos dword ptr es:[edi] 0058d51a > c3 retn 0058d51b > 60 pushad ; crypt code 0058d51c . e8 00000000 call 0058d521 0058d521 /$ 5e pop esi 0058d522 |. 83ee 06 sub esi,6 0058d525 |. b9 4c000000 mov ecx,4c 0058d52a |. 29ce sub esi,ecx 0058d52c |> ba 02ca9ea2 mov edx,a29eca02 0058d531 |. c1e9 02 shr ecx,2 0058d534 |. 83e9 02 sub ecx,2 0058d537 |> 83f9 00 /cmp ecx,0 0058d53a |. 7c 1a |jl short 0058d556 0058d53c |. 8b048e |mov eax,dword ptr ds:[esi+ecx*4] 0058d53f |. 8b5c8e 04 |mov ebx,dword ptr ds:[esi+ecx*4+4] 0058d543 |. 33c3 |xor eax,ebx 0058d545 |. c1c8 1a |ror eax,1a 0058d548 |. 03c2 |add eax,edx 0058d54a |. 81ea f6727bc1 |sub edx,c17b72f6 0058d550 |. 89048e |mov dword ptr ds:[esi+ecx*4],eax 0058d553 |. 49 |dec ecx 0058d554 |.^ eb e1 \jmp short 0058d537 0058d556 |> 61 popad 0058d557 |. 61 popad 0058d558 \. c3 retn sub_checkapi_cc: 0058cc33 > $ 33c0 xor eax,eax 0058cc35 . 8dbd f6fd4000 lea edi,dword ptr ss:[ebp+40fdf6] ; 取该api 0058cc3b . 57 push edi 0058cc3c . 64:ff30 push dword ptr fs:[eax] 0058cc3f . 64:8920 mov dword ptr fs:[eax],esp 0058cc42 . ffd3 call ebx 0058cc44 . 2bc0 sub eax,eax 0058cc46 . 64:8f00 pop dword ptr

首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69]
本文关键：AcProtect 1.41 外壳分析
　　相关方案
Google
 

本站最佳浏览方式为 分辨率 1024x768 IE 6.0（或更高版本的 IE浏览器）

go top