这个是什么壳

陈可恩

yoda's Protector v1.02 (.dll,.ocx) -> Ashkbiz Danehkar (h) *  我完全看不懂啊

huzpsb

yp就是yp...
1.02的OEP脚本

[Lua] 纯文本查看 复制代码

/*
1h54 AM Sunday 23 January 2005
yoda's Protector 1.02 OEP Finder
Author : dqtln
Email : [email]dqtlncrk@gmail.com[/email]
OS : WinXP Pro SP1 , OllyDbg 1.10 , OllyScript 0.92
Website : [url]www.phudu.com[/url]
For opinions & bugreport send me a email
Thank you very much
*/

msgyn "Please check Options/Debugging options/Exceptions/INT3 breaks"
cmp $RESULT,0
je dqtln
var x
var y
gmi eip,CODEBASE
mov x,$RESULT
gmi eip,CODESIZE
mov y,$RESULT
dbh
run
bprm x,y
esto
dbs
bpmc
msg "Please press No if have a question"
an eip
cmt eip,"This is the OEP - Found by dqtln"
msg "Dump and fix IAT now - Good day"
ret

dqtln:
msg "Script Abort"
ret

JuncoJet

huzpsb 发表于 2020-3-16 21:04
yp就是yp...
1.02的OEP脚本
[mw_shl_code=lua,true]/*

yoda 不一定是壳，mingw编译的dll都会显示yoda

陈可恩

huzpsb 发表于 2020-3-16 21:04
yp就是yp...
1.02的OEP脚本
[mw_shl_code=lua,true]/*

哈哈哈

huzpsb

JuncoJet 发表于 2020-3-16 21:09
yoda 不一定是壳，mingw编译的dll都会显示yoda

QwQ
划掉这一行(用exeinfope回*啊)

陈可恩

huzpsb 发表于 2020-3-16 21:11
QwQ
划掉这一行(用exeinfope回*啊)

25B99F593196DBBF64D4F074772917CC5D953D1012BBE72F178D6F40CD300B4A

陈可恩

huzpsb 发表于 2020-3-16 21:11
QwQ
划掉这一行(用exeinfope回*啊)

52C03AB095B7685D564A3FE63E7561D3CB5A238F2F60FA76

byh3025

peid查不出来的都会显示这个