|
讨论 关于一个DLL脱壳的不解之处
这是俺的分析 00400000 00001000 LOADDLL PE 文件头 Imag R RWE 00410000 00001000 LOADDLL CODE 代码 Imag R E RWE 00420000 00003000 LOADDLL DATA 数据 Imag RW RWE 00430000 00001000 LOADDLL .idata 输入表 Imag RW RWE 00440000 00001000 LOADDLL .edata 输出表 Imag R RWE 00450000 00001000 LOADDLL .rsrc 资源 Imag RW RWE 00460000 000DA000 Map R E R E 00760000 00008000 Priv RW RW 00770000 00001000 Priv RW RW 00780000 00001000 Priv RW RW 00790000 00003000 Priv RW RW 007A0000 00010000 Priv RW RW 00C00000 00054000 Priv RWE RWE 00C60000 00004000 Priv RW RW 00C70000 00002000 Map R R \Device\HarddiskVolume1\WINNT\System32\ctype.nls 10000000 00001000 aal PE 文件头 Imag R RWE 10001000 00012000 aal 代码 Imag R RWE 10013000 00005000 aal 数据 Imag R RWE 10018000 00005000 aal Imag R RWE 1001D000 00002000 aal .rsrc 资源 Imag R RWE 1001F000 00003000 aal Imag R RWE 10022000 00001000 aal 输出表 Imag R RWE 10023000 00052000 aal .data SFX,输入表, OEP: 00C40F28 55 push ebp ; aal.100233FF 00C40F29 8BEC mov ebp,esp 00C40F2B 83C4 B4 add esp,-4C 00C40F2E B8 080CC400 mov eax,0C40C08 IAT: 00C4C118 77E710D1 KERNEL32.GetCurrentThreadId 00C4C11C 77F87BF9 ntdll.RtlDeleteCriticalSection 00C4C120 77F89134 ntdll.RtlLeaveCriticalSection 00C4C124 77F89103 ntdll.RtlEnterCriticalSection 00C4C128 77E7BE13 KERNEL32.InitializeCriticalSection 00C4C12C 77E7E2DC KERNEL32.VirtualFree 00C4C130 77E7175C KERNEL32.VirtualAlloc 00C4C134 77E7C1C6 KERNEL32.LocalFree 00C4C138 77E7C13B KERNEL32.LocalAlloc 镜像基址:00400000 大小:00060000 ->> 选择的模块: e:\aal.dll 镜像基址:10000000 大小:00076000 不知咋的。跟本就是不这样的哦。 重定位不是在这里么? 00C523FB 8B03 mov eax,dword ptr ds:[ebx] 00C523FD 8785 592A4400 xchg dword ptr ss:[ebp+442A59],eax 00C52403 8B95 D8304400 mov edx,dword ptr ss:[ebp+4430D8] 00C52409 8B85 512A4400 mov eax,dword ptr ss:[ebp+442A51] 00C5240F 2BD0 sub edx,eax 00C52411 74 75 je short 00C52488 00C52413 8BC2 mov eax,edx 00C52415 C1E8 10 shr eax,10 00C52418 33DB xor ebx,ebx 00C5241A 8BB5 5D2A4400 mov esi,dword ptr ss:[ebp+442A5D] 00C52420 03B5 D8304400 add esi,dword ptr ss:[ebp+4430D8] 00C52426 833E 00 cmp dword ptr ds:[esi],0 00C52429 74 5D je short 00C52488 00C5242B 8B4E 04 mov ecx,dword ptr ds:[esi+4] 00C5242E 83E9 08 sub ecx,8 00C52431 D1E9 shr ecx,1 00C52433 8B3E mov edi,dword ptr ds:[esi] 00C52435 03BD D8304400 add edi,dword ptr ss:[ebp+4430D8] 00C5243B 83C6 08 add esi,8 00C5243E 66:8B1E mov bx,word ptr ds:[esi] 00C52441 C1EB 0C shr ebx,0C 00C52444 83FB 01 cmp ebx,1 00C52447 74 0C je short 00C52455 00C52449 83FB 02 cmp ebx,2 00C5244C 74 16 je short 00C52464 00C5244E 83FB 03 cmp ebx,3 00C52451 74 20 je short 00C52473 00C52453 EB 2C jmp short 00C52481 00C52455 66:8B1E mov bx,word ptr ds:[esi] 00C52458 81E3 FF0F0000 and ebx,0FFF 00C5245E 66:01041F add word ptr ds:[edi+ebx],ax 00C52462 EB 1D jmp short 00C52481 00C52464 66:8B1E mov bx,word ptr ds:[esi] 00C52467 81E3 FF0F0000 and ebx,0FFF 00C5246D 66:01141F add word ptr ds:[edi+ebx],dx 00C52471 EB 0E jmp short 00C52481 00C52473 66:8B1E mov bx,word ptr ds:[esi] 00C52476 81E3 FF0F0000 and ebx,0FFF 00C5247C 01141F add dword ptr ds:[edi+ebx],edx 00C5247F EB 00 jmp short 00C52481 00C52481 83C6 02 add esi,2 00C52484 ^ E2 B8 loopd short 00C5243E 00C52486 ^ EB 9E jmp short 00C52426 00C52488 8BB5 612A4400 mov esi,dword ptr ss:[ebp+442A61] 300K无法上传附件。郁闷 |
|
[原创]既然这么多人想脱themida..那我就说两句吧..
破解外挂。让我进步 让我有那种干劲 让我有那种``````````````` |
|
|
|
|
|
Themida SMC+注入 破解实例。
牛B思路.爽.又学到一招 |
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值