[已结束][PEDIY.华章 Crackme 竞赛 2009] [第十回] –ninejs
0047A034 > 60 pushad
0047A035 9C pushfd
0047A036 E8 8E000000 call 0047A0C9
0047A03B C3 retn
0047A35E 83EC 04 sub esp, 4
0047A361 C70424 40000000 mov dword ptr [esp], 40
0047A368 83EC 04 sub esp, 4
0047A36B C70424 00100000 mov dword ptr [esp], 1000
0047A372 52 push edx
0047A373 83EC 04 sub esp, 4
0047A376 C70424 00000000 mov dword ptr [esp], 0
0047A37D FFD0 call eax ;VitualAlloc
0047A37F 0BC0 or eax, eax
0047A381 75 01 jnz short 0047A384
0047A383 C3 retn
0047A40F 42 inc edx
0047A410 83C2 20 add edx, 20
0047A413 42 inc edx
0047A414 42 inc edx
0047A415 83EA 07 sub edx, 7
0047A418 83C2 01 add edx, 1
0047A41B FFD2 call edx ;跟进
00371173 8D6424 04 lea esp, dword ptr [esp+4]
00371177 83F8 01 cmp eax, 1
;关键比较
0037117A E9 D2000000 jmp 00371251
00371251 ^\0F85 A5F5FFFF jnz 003707FC ;这里改成jmp
00371257 ^ E9 0CF1FFFF jmp 00370368
0037125C 0BC0 or eax, eax
0037125E ^ E9 48FCFFFF jmp 00370EAB
003713E5 ^\0F85 FDF9FFFF jnz 00370DE8
003713EB E8 25FCFFFF call 00371015
; 填充IAT结束 下断
003713F0 8D6424 04 lea esp, dword ptr [esp+4]
003713F4 0345 E4 add eax, dword ptr [ebp-1C]
00371430 58 pop eax ;OEP
00370879 9D popfd
0037161B 61 popad
00371008 - FFE0 jmp eax ; jmp OEP