脱PE-Armor V0.49 上 到达OEP
本帖最后由 hx131452 于 2010-11-29 00:40 编辑脱PE-Armor V0.49笔记
途中当然有很多异常
一些简单的异常就不说了
直接来特别精彩的地方吧
我可是不断的骚扰Ｈｍｉｌｙ
0037249E 8B4424 04 mov eax, dword ptr
003724A2 8B00 mov eax, dword ptr
003724A4 8B4C24 0C mov ecx, dword ptr
003724A8 FF81 B8000000 inc dword ptr
003724AE 3D 03000080 cmp eax, 80000003
003724B3 75 51 jnz short 00372506
003724B5 8B81 B4000000 mov eax, dword ptr
003724BB 8D80 A8010000 lea eax, dword ptr
003724C1 8941 04 mov dword ptr , eax
003724C4 8B81 B4000000 mov eax, dword ptr
003724CA 8D80 D2010000 lea eax, dword ptr
003724D0 8941 08 mov dword ptr , eax
003724D3 8B81 B4000000 mov eax, dword ptr
003724D9 8D80 FF010000 lea eax, dword ptr
003724DF 8941 0C mov dword ptr , eax
003724E2 8B81 B4000000 mov eax, dword ptr
003724E8 8D80 31020000 lea eax, dword ptr
003724EE 8941 10 mov dword ptr , eax
003724F1 33C0 xor eax, eax
003724F3 8161 14 F00FFFF>and dword ptr , FFFF0FF0
003724FA C741 18 5501000>mov dword ptr , 155
00372501 E9 A1000000 jmp 003725A7
00372506 3D 04000080 cmp eax, 80000004
0037250B 75 6C jnz short 00372579
0037250D E8 04000000 call 00372516
00372512 0000 add byte ptr , al
00372514 0000 add byte ptr , al
00372516 58 pop eax
00372517 FF00 inc dword ptr
00372519 8B00 mov eax, dword ptr
0037251B 83F8 01 cmp eax, 1
0037251E 75 08 jnz short 00372528
00372520 F791 B0000000 not dword ptr
00372526 EB 4D jmp short 00372575
00372528 83F8 02 cmp eax, 2
0037252B 75 11 jnz short 0037253E
0037252D 8B81 B0000000 mov eax, dword ptr
00372533 C1C0 13 rol eax, 13
00372536 8981 B0000000 mov dword ptr , eax
0037253C EB 37 jmp short 00372575
0037253E 83F8 03 cmp eax, 3
00372541 75 29 jnz short 0037256C
00372543 8181 B0000000 2>add dword ptr , 4B23526
0037254D 8B81 B0000000 mov eax, dword ptr
00372553 8B99 A4000000 mov ebx, dword ptr
00372559 66:93 xchg ax, bx
0037255B 66:03C3 add ax, bx
0037255E 8981 B0000000 mov dword ptr , eax
00372564 8999 A4000000 mov dword ptr , ebx
0037256A EB 09 jmp short 00372575
0037256C 8B81 A0000000 mov eax, dword ptr
00372572 8030 55 xor byte ptr , 55
00372575 33C0 xor eax, eax
00372577 EB 2E jmp short 003725A7
00372579 3D 940000C0 cmp eax, C0000094
0037257E 75 24 jnz short 003725A4
00372580 FF81 B8000000 inc dword ptr
00372586 33C0 xor eax, eax
00372588 2141 04 and dword ptr , eax
0037258B 2141 08 and dword ptr , eax
0037258E 2141 0C and dword ptr , eax
00372591 2141 10 and dword ptr , eax
00372594 8161 14 F00FFFF>and dword ptr , FFFF0FF0
0037259B 8161 18 00DC000>and dword ptr , 0DC00
003725A2 EB 03 jmp short 003725A7
003725A4 33C0 xor eax, eax
003725A6 40 inc eax
003725A7 C3 retn
003725A8 33C0 xor eax,eax
003725AA 64:FF35 0000000>push dword ptr fs:
003725B1 64:8925 0000000>mov dword ptr fs:,esp
003725B8 CC int3
003725B9 90 nop
003725BA 8BCD mov ecx,ebp
003725BC 2BCE sub ecx,esi
003725BE 33DB xor ebx,ebx
003725C0 33C0 xor eax,eax
003725C2 AC lods byte ptr ds:
003725C3 03D8 add ebx,eax
003725C5^ E2 FB loopd short 003725C2
003725C7 8BC3 mov eax,ebx
003725C9 F8 clc
003725CA 90 nop
003725CB 8DB5 D2010000 lea esi,dword ptr ss:
003725D1 B9 A1040000 mov ecx,0x4A1
003725D6 F7E1 mul ecx
003725D8 D3C8 ror eax,cl
003725DA 3006 xor byte ptr ds:,al
003725DC 46 inc esi
003725DD 40 inc eax
003725DE D40A aam
003725E0^ E2 F4 loopd short 003725D6
003725E2 B9 7D000000 mov ecx,0x7D
003725E7 8BF5 mov esi,ebp
003725E9 33C0 xor eax,eax
003725EB 3206 xor al,byte ptr ds:
003725ED C1C8 08 ror eax,0x8
003725F0 46 inc esi
003725F1^ E2 F8 loopd short 003725EB
003725F3 FC cld
003725F4 90 nop
003725F5 B9 74040000 mov ecx,0x474
003725FA 8DB5 FF010000 lea esi,dword ptr ss:
00372600 8D4481 43 lea eax,dword ptr ds:
00372604 3006 xor byte ptr ds:,al
00372606 D40A aam
00372608 46 inc esi
00372609^ E2 F5 loopd short 00372600
0037260B B9 78000000 mov ecx,0x78
00372610 C1E9 02 shr ecx,0x2
00372613 8DB5 87010000 lea esi,dword ptr ss:
00372619 33DB xor ebx,ebx
0037261B AD lods dword ptr ds:
0037261C 33D8 xor ebx,eax
0037261E^ E2 FB loopd short 0037261B
00372620 F9 stc
00372621 90 nop
00372622 B9 42040000 mov ecx,0x442
00372627 C1E9 02 shr ecx,0x2
0037262A 8DB5 31020000 lea esi,dword ptr ss:
00372630 33D2 xor edx,edx
00372632 F7E3 mul ebx
00372634 81C2 2635B204 add edx,0x4B23526
0037263A 3116 xor dword ptr ds:,edx
0037263C 8BC3 mov eax,ebx
0037263E 8BDA mov ebx,edx
00372640 83C6 04 add esi,0x4
00372643^ E2 EB loopd short 00372630
00372645 8DB5 36020000 lea esi,dword ptr ss:
0037264B B9 3D040000 mov ecx,0x43D
00372650 F616 not byte ptr ds:
00372652 90 nop
00372653 90 nop
00372654 46 inc esi
00372655^ E2 F9 loopd short 00372650
00372657 B8 00010000 mov eax,0x100
0037265C 33D2 xor edx,edx
0037265E 33DB xor ebx,ebx
00372660 F7F3 div ebx
00372662 90 nop
00372663 64:8F05 0000000>pop dword ptr fs:
0037266A 58 pop eax
首先我们在372580处下断点，f9后赶紧消除
接着再37266A处下个断点，f9后赶紧消除
好了
后面 就没有什么惊险了
就是IAT
SEH异常跳转吧? LZ,我X尼玛,,,你放个记事本的.exe来骗爹钱!!!擦你死妈的!!!
页:
[1]