[求助]能帮我分析一下哪是OEP吗？谢谢-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] [求助]能帮我分析一下哪是OEP吗？谢谢 0.00雪花

发表于: 2009-11-10 14:39 1219

[旧帖] [求助]能帮我分析一下哪是OEP吗？谢谢 0.00雪花

rottom

2009-11-10 14:39

1219

005A4000 90                nop
005A4001 >  60                pushad
005A4002 E8 03000000       call dnfkfc1_.005A400A
005A4007  - E9 EB045D45       jmp 45B744F7
005A400C 55                push ebp
005A400D C3                retn
005A400E E8 01000000       call dnfkfc1_.005A4014
005A4013 EB 5D             jmp short dnfkfc1_.005A4072
005A4015 BB EDFFFFFF       mov ebx,-13
005A401A 03DD             add ebx,ebp
005A401C 81EB 00401A00    sub ebx,1A4000
005A4022 83BD 22040000 00 cmp dword ptr ss:[ebp+422],0
005A4029 899D 22040000    mov dword ptr ss:[ebp+422],ebx
005A402F 0F85 65030000    jnz dnfkfc1_.005A439A
005A4035 8D85 2E040000    lea eax,dword ptr ss:[ebp+42E]
005A403B 50                push eax
005A403C FF95 4D0F0000    call dword ptr ss:[ebp+F4D]
005A4042 8985 26040000    mov dword ptr ss:[ebp+426],eax
005A4048 8BF8             mov edi,eax
005A404A 8D5D 5E          lea ebx,dword ptr ss:[ebp+5E]
005A404D 53                push ebx
005A404E 50                push eax
005A404F FF95 490F0000    call dword ptr ss:[ebp+F49]
005A4055 8985 4D050000    mov dword ptr ss:[ebp+54D],eax
005A405B 8D5D 6B          lea ebx,dword ptr ss:[ebp+6B]
005A405E 53                push ebx
005A405F 57                push edi
005A4060 FF95 490F0000    call dword ptr ss:[ebp+F49]
005A4066 8985 51050000    mov dword ptr ss:[ebp+551],eax
005A406C 8D45 77          lea eax,dword ptr ss:[ebp+77]
005A406F FFE0             jmp eax
005A4071 56                push esi
005A4072 6972 74 75616C41 imul esi,dword ptr ds:[edx+74],416C6175
005A4079 6C                ins byte ptr es:[edi],dx
005A407A 6C                ins byte ptr es:[edi],dx
005A407B 6F                outs dx,dword ptr es:[edi]
005A407C 6300             arpl word ptr ds:[eax],ax
005A407E 56                push esi
005A407F 6972 74 75616C46 imul esi,dword ptr ds:[edx+74],466C6175
005A4086 72 65             jb short dnfkfc1_.005A40ED
005A4088 65:008B 9D310500 add byte ptr gs:[ebx+5319D],cl
005A408F 000B             add byte ptr ds:[ebx],cl
005A4091 DB                ???                                     ; 未知命令
005A4092 74 0A             je short dnfkfc1_.005A409E
005A4094 8B03             mov eax,dword ptr ds:[ebx]
005A4096 8785 35050000    xchg dword ptr ss:[ebp+535],eax
005A409C 8903             mov dword ptr ds:[ebx],eax
005A409E 8DB5 69050000    lea esi,dword ptr ss:[ebp+569]
005A40A4 833E 00          cmp dword ptr ds:[esi],0
005A40A7 0F84 21010000    je dnfkfc1_.005A41CE
005A40AD 6A 04             push 4
005A40AF 68 00100000       push 1000
005A40B4 68 00180000       push 1800
005A40B9 6A 00             push 0
005A40BB FF95 4D050000    call dword ptr ss:[ebp+54D]
005A40C1 8985 56010000    mov dword ptr ss:[ebp+156],eax
005A40C7 8B46 04          mov eax,dword ptr ds:[esi+4]
005A40CA 05 0E010000       add eax,10E
005A40CF 6A 04             push 4
005A40D1 68 00100000       push 1000
005A40D6 50                push eax
005A40D7 6A 00             push 0
005A40D9 FF95 4D050000    call dword ptr ss:[ebp+54D]
005A40DF 8985 52010000    mov dword ptr ss:[ebp+152],eax
005A40E5 56                push esi
005A40E6 8B1E             mov ebx,dword ptr ds:[esi]
005A40E8 039D 22040000    add ebx,dword ptr ss:[ebp+422]
005A40EE FFB5 56010000    push dword ptr ss:[ebp+156]
005A40F4 FF76 04          push dword ptr ds:[esi+4]
005A40F7 50                push eax
005A40F8 53                push ebx
005A40F9 E8 6E050000       call dnfkfc1_.005A466C
005A40FE B3 00             mov bl,0
005A4100 80FB 00          cmp bl,0
005A4103 75 5E             jnz short dnfkfc1_.005A4163
005A4105 FE85 EC000000    inc byte ptr ss:[ebp+EC]
005A410B 8B3E             mov edi,dword ptr ds:[esi]
005A410D 03BD 22040000    add edi,dword ptr ss:[ebp+422]
005A4113 FF37             push dword ptr ds:[edi]
005A4115 C607 C3          mov byte ptr ds:[edi],0C3
005A4118 FFD7             call edi
005A411A 8F07             pop dword ptr ds:[edi]
005A411C 50                push eax
005A411D 51                push ecx
005A411E 56                push esi
005A411F 53                push ebx
005A4120 8BC8             mov ecx,eax
005A4122 83E9 06          sub ecx,6
005A4125 8BB5 52010000    mov esi,dword ptr ss:[ebp+152]
005A412B 33DB             xor ebx,ebx
005A412D 0BC9             or ecx,ecx
005A412F 74 2E             je short dnfkfc1_.005A415F
005A4131 78 2C             js short dnfkfc1_.005A415F
005A4133 AC                lods byte ptr ds:[esi]
005A4134 3C E8             cmp al,0E8

收藏・0

免费・0

支持

最新回复 (10)
风随雨行雪币： 2523 活跃值： (520) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 604 粉丝 1 关注私信	风随雨行 1 2 楼继续往下，还没到呢自己用ESP定律就搞定了 2009-11-10 14:41 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 3 楼 005A4136 /74 0A je short dnfkfc1_.005A4142 005A4138 \|EB 00 jmp short dnfkfc1_.005A413A 005A413A \|3C E9 cmp al,0E9 005A413C \|74 04 je short dnfkfc1_.005A4142 005A413E \|43 inc ebx 005A413F \|49 dec ecx 005A4140 ^\|EB EB jmp short dnfkfc1_.005A412D 005A4142 \8B06 mov eax,dword ptr ds:[esi] 005A4144 EB 00 jmp short dnfkfc1_.005A4146 005A4146 803E C5 cmp byte ptr ds:[esi],0C5 005A4149 ^ 75 F3 jnz short dnfkfc1_.005A413E 005A414B 24 00 and al,0 005A414D C1C0 18 rol eax,18 005A4150 2BC3 sub eax,ebx 005A4152 8906 mov dword ptr ds:[esi],eax 005A4154 83C3 05 add ebx,5 005A4157 83C6 04 add esi,4 005A415A 83E9 05 sub ecx,5 005A415D ^ EB CE jmp short dnfkfc1_.005A412D 005A415F 5B pop ebx 005A4160 5E pop esi 005A4161 59 pop ecx 005A4162 58 pop eax 005A4163 EB 08 jmp short dnfkfc1_.005A416D 005A4165 0000 add byte ptr ds:[eax],al 005A4167 0000 add byte ptr ds:[eax],al 005A4169 0000 add byte ptr ds:[eax],al 005A416B 0000 add byte ptr ds:[eax],al 005A416D 8BC8 mov ecx,eax 005A416F 8B3E mov edi,dword ptr ds:[esi] 005A4171 03BD 22040000 add edi,dword ptr ss:[ebp+422] 005A4177 8BB5 52010000 mov esi,dword ptr ss:[ebp+152] 005A417D C1F9 02 sar ecx,2 005A4180 F3:A5 rep movs dword ptr es:[edi],dword ptr ds> 005A4182 8BC8 mov ecx,eax 005A4184 83E1 03 and ecx,3 005A4187 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[> 005A4189 5E pop esi 005A418A 68 00800000 push 8000 005A418F 6A 00 push 0 005A4191 FFB5 52010000 push dword ptr ss:[ebp+152] 005A4197 FF95 51050000 call dword ptr ss:[ebp+551] 005A419D 83C6 08 add esi,8 005A41A0 833E 00 cmp dword ptr ds:[esi],0 005A41A3 ^ 0F85 1EFFFFFF jnz dnfkfc1_.005A40C7 005A41A9 68 00800000 push 8000 005A41AE 6A 00 push 0 005A41B0 FFB5 56010000 push dword ptr ss:[ebp+156] 005A41B6 FF95 51050000 call dword ptr ss:[ebp+551] 005A41BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531] 005A41C2 0BDB or ebx,ebx 005A41C4 74 08 je short dnfkfc1_.005A41CE 005A41C6 8B03 mov eax,dword ptr ds:[ebx] 005A41C8 8785 35050000 xchg dword ptr ss:[ebp+535],eax 005A41CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A41D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D] 005A41DA 2BD0 sub edx,eax 005A41DC 74 79 je short dnfkfc1_.005A4257 005A41DE 8BC2 mov eax,edx 005A41E0 C1E8 10 shr eax,10 005A41E3 33DB xor ebx,ebx 005A41E5 8BB5 39050000 mov esi,dword ptr ss:[ebp+539] 005A41EB 03B5 22040000 add esi,dword ptr ss:[ebp+422] 005A41F1 833E 00 cmp dword ptr ds:[esi],0 005A41F4 74 61 je short dnfkfc1_.005A4257 005A41F6 8B4E 04 mov ecx,dword ptr ds:[esi+4] 005A41F9 83E9 08 sub ecx,8 005A41FC D1E9 shr ecx,1 005A41FE 8B3E mov edi,dword ptr ds:[esi] 005A4200 03BD 22040000 add edi,dword ptr ss:[ebp+422] 005A4206 83C6 08 add esi,8 005A4209 66:8B1E mov bx,word ptr ds:[esi] 005A420C C1EB 0C shr ebx,0C 005A420F 83FB 01 cmp ebx,1 005A4212 74 0C je short dnfkfc1_.005A4220 005A4214 83FB 02 cmp ebx,2 005A4217 74 16 je short dnfkfc1_.005A422F 005A4219 83FB 03 cmp ebx,3 005A421C 74 20 je short dnfkfc1_.005A423E 005A421E EB 2C jmp short dnfkfc1_.005A424C 005A4220 66:8B1E mov bx,word ptr ds:[esi] 005A4223 81E3 FF0F0000 and ebx,0FFF 005A4229 66:01041F add word ptr ds:[edi+ebx],ax 005A422D EB 1D jmp short dnfkfc1_.005A424C 005A422F 66:8B1E mov bx,word ptr ds:[esi] 005A4232 81E3 FF0F0000 and ebx,0FFF 005A4238 66:01141F add word ptr ds:[edi+ebx],dx 005A423C EB 0E jmp short dnfkfc1_.005A424C 005A423E 66:8B1E mov bx,word ptr ds:[esi] 005A4241 81E3 FF0F0000 and ebx,0FFF 005A4247 01141F add dword ptr ds:[edi+ebx],edx 005A424A EB 00 jmp short dnfkfc1_.005A424C 005A424C 66:830E FF or word ptr ds:[esi],0FFFF 005A4250 83C6 02 add esi,2 005A4253 ^ E2 B4 loopd short dnfkfc1_.005A4209 005A4255 ^ EB 9A jmp short dnfkfc1_.005A41F1 005A4257 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A425D 8BB5 41050000 mov esi,dword ptr ss:[ebp+541] 005A4263 0BF6 or esi,esi 005A4265 74 11 je short dnfkfc1_.005A4278 005A4267 03F2 add esi,edx 005A4269 AD lods dword ptr ds:[esi] 005A426A 0BC0 or eax,eax 005A426C 74 0A je short dnfkfc1_.005A4278 005A426E 03C2 add eax,edx 005A4270 8BF8 mov edi,eax 005A4272 66:AD lods word ptr ds:[esi] 005A4274 66:AB stos word ptr es:[edi] 005A4276 ^ EB F1 jmp short dnfkfc1_.005A4269 005A4278 BE CF4F1900 mov esi,194FCF 005A427D 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A4283 03F2 add esi,edx 005A4285 8B46 0C mov eax,dword ptr ds:[esi+C] 005A4288 85C0 test eax,eax 005A428A 0F84 0A010000 je dnfkfc1_.005A439A 005A4290 03C2 add eax,edx 005A4292 8BD8 mov ebx,eax 005A4294 50 push eax 005A4295 FF95 4D0F0000 call dword ptr ss:[ebp+F4D] 005A429B 85C0 test eax,eax 005A429D 75 07 jnz short dnfkfc1_.005A42A6 005A429F 53 push ebx 005A42A0 FF95 510F0000 call dword ptr ss:[ebp+F51] 005A42A6 8985 45050000 mov dword ptr ss:[ebp+545],eax 005A42AC C785 49050000 0000>mov dword ptr ss:[ebp+549],0 005A42B6 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A42BC 8B06 mov eax,dword ptr ds:[esi] 005A42BE 85C0 test eax,eax 005A42C0 75 03 jnz short dnfkfc1_.005A42C5 005A42C2 8B46 10 mov eax,dword ptr ds:[esi+10] 005A42C5 03C2 add eax,edx 005A42C7 0385 49050000 add eax,dword ptr ss:[ebp+549] 005A42CD 8B18 mov ebx,dword ptr ds:[eax] 005A42CF 8B7E 10 mov edi,dword ptr ds:[esi+10] 005A42D2 03FA add edi,edx 005A42D4 03BD 49050000 add edi,dword ptr ss:[ebp+549] 005A42DA 85DB test ebx,ebx 005A42DC 0F84 A2000000 je dnfkfc1_.005A4384 005A42E2 F7C3 00000080 test ebx,80000000 005A42E8 75 04 jnz short dnfkfc1_.005A42EE 005A42EA 03DA add ebx,edx 005A42EC 43 inc ebx 005A42ED 43 inc ebx 005A42EE 53 push ebx 005A42EF 81E3 FFFFFF7F and ebx,7FFFFFFF 005A42F5 53 push ebx 005A42F6 FFB5 45050000 push dword ptr ss:[ebp+545] 005A42FC FF95 490F0000 call dword ptr ss:[ebp+F49] 005A4302 85C0 test eax,eax 005A4304 5B pop ebx 005A4305 75 6F jnz short dnfkfc1_.005A4376 005A4307 F7C3 00000080 test ebx,80000000 005A430D 75 19 jnz short dnfkfc1_.005A4328 005A430F 57 push edi 005A4310 8B46 0C mov eax,dword ptr ds:[esi+C] 005A4313 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A4319 50 push eax 005A431A 53 push ebx 005A431B 8D85 75040000 lea eax,dword ptr ss:[ebp+475] 005A4321 50 push eax 005A4322 57 push edi 005A4323 E9 98000000 jmp dnfkfc1_.005A43C0 005A4328 81E3 FFFFFF7F and ebx,7FFFFFFF 005A432E 8B85 26040000 mov eax,dword ptr ss:[ebp+426] 005A4334 3985 45050000 cmp dword ptr ss:[ebp+545],eax 005A433A 75 24 jnz short dnfkfc1_.005A4360 005A433C 57 push edi 005A433D 8BD3 mov edx,ebx 005A433F 4A dec edx 005A4340 C1E2 02 shl edx,2 005A4343 8B9D 45050000 mov ebx,dword ptr ss:[ebp+545] 005A4349 8B7B 3C mov edi,dword ptr ds:[ebx+3C] 005A434C 8B7C3B 78 mov edi,dword ptr ds:[ebx+edi+78] 005A4350 035C3B 1C add ebx,dword ptr ds:[ebx+edi+1C] 005A4354 8B0413 mov eax,dword ptr ds:[ebx+edx] 005A4357 0385 45050000 add eax,dword ptr ss:[ebp+545] 005A435D 5F pop edi 005A435E EB 16 jmp short dnfkfc1_.005A4376 005A4360 57 push edi 005A4361 8B46 0C mov eax,dword ptr ds:[esi+C] 005A4364 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A436A 50 push eax 005A436B 53 push ebx 005A436C 8D85 C6040000 lea eax,dword ptr ss:[ebp+4C6] 005A4372 50 push eax 005A4373 57 push edi 005A4374 EB 4A jmp short dnfkfc1_.005A43C0 005A4376 8907 mov dword ptr ds:[edi],eax 005A4378 8385 49050000 04 add dword ptr ss:[ebp+549],4 005A437F ^ E9 32FFFFFF jmp dnfkfc1_.005A42B6 005A4384 8906 mov dword ptr ds:[esi],eax 005A4386 8946 0C mov dword ptr ds:[esi+C],eax 005A4389 8946 10 mov dword ptr ds:[esi+10],eax 005A438C 83C6 14 add esi,14 005A438F 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A4395 ^ E9 EBFEFFFF jmp dnfkfc1_.005A4285 005A439A B8 0B0C1900 mov eax,190C0B 005A439F 50 push eax 005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A43A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],eax 005A43AF 61 popad 005A43B0 75 08 jnz short dnfkfc1_.005A43BA 005A43B2 B8 01000000 mov eax,1 005A43B7 C2 0C00 retn 0C 005A43BA 68 00000000 push 0 005A43BF C3 retn 005A43C0 8B85 26040000 mov eax,dword ptr ss:[ebp+426] 005A43C6 8D8D 3B040000 lea ecx,dword ptr ss:[ebp+43B] 005A43CC 51 push ecx 005A43CD 50 push eax 005A43CE FF95 490F0000 call dword ptr ss:[ebp+F49] 005A43D4 8985 55050000 mov dword ptr ss:[ebp+555],eax 005A43DA 8D85 47040000 lea eax,dword ptr ss:[ebp+447] 005A43E0 50 push eax 005A43E1 FF95 510F0000 call dword ptr ss:[ebp+F51] 005A43E7 8985 2A040000 mov dword ptr ss:[ebp+42A],eax 005A43ED 8D8D 52040000 lea ecx,dword ptr ss:[ebp+452] 005A43F3 51 push ecx 005A43F4 50 push eax 005A43F5 FF95 490F0000 call dword ptr ss:[ebp+F49] 005A43FB 8985 59050000 mov dword ptr ss:[ebp+559],eax 005A4401 8B85 2A040000 mov eax,dword ptr ss:[ebp+42A] 005A4407 8D8D 5E040000 lea ecx,dword ptr ss:[ebp+45E] 005A440D 51 push ecx 005A440E 50 push eax 005A440F FF95 490F0000 call dword ptr ss:[ebp+F49] 005A4415 FFD0 call eax 005A4417 83C4 10 add esp,10 005A441A 5F pop edi 005A441B 6A 30 push 30 005A441D 8D9D 68040000 lea ebx,dword ptr ss:[ebp+468] 005A4423 53 push ebx 005A4424 57 push edi 005A4425 6A 00 push 0 005A4427 FF95 59050000 call dword ptr ss:[ebp+559] 005A442D 6A FF push -1 005A442F FF95 55050000 call dword ptr ss:[ebp+555] 005A4435 0000 add byte ptr ds:[eax],al 005A4437 0000 add byte ptr ds:[eax],al 005A4439 0000 add byte ptr ds:[eax],al 005A443B 0000 add byte ptr ds:[eax],al 005A443D 0000 add byte ptr ds:[eax],al 005A443F 0000 add byte ptr ds:[eax],al 005A4441 6B65 72 6E imul esp,dword ptr ss:[ebp+72],6E 005A4445 65:6C ins byte ptr es:[edi],dx 005A4447 3332 xor esi,dword ptr ds:[edx] 005A4449 2E: prefix cs: 005A444A 64:6C ins byte ptr es:[edi],dx 005A444C 6C ins byte ptr es:[edi],dx 005A444D 0045 78 add byte ptr ss:[ebp+78],al 005A4450 697450 72 6F636573 imul esi,dword ptr ds:[eax+edx2+72],736> 005A4458 73 00 jnb short dnfkfc1_.005A445A 005A445A 75 73 jnz short dnfkfc1_.005A44CF 005A445C 65:72 33 jb short dnfkfc1_.005A4492 005A445F 322E xor ch,byte ptr ds:[esi] 005A4461 64:6C ins byte ptr es:[edi],dx 005A4463 6C ins byte ptr es:[edi],dx 005A4464 004D 65 add byte ptr ss:[ebp+65],cl 005A4467 73 73 jnb short dnfkfc1_.005A44DC 005A4469 61 popad 005A446A 67:65:42 inc edx 005A446D 6F outs dx,dword ptr es:[edi] 005A446E 78 41 js short dnfkfc1_.005A44B1 005A4470 0077 73 add byte ptr ds:[edi+73],dh 005A4473 70 72 jo short dnfkfc1_.005A44E7 005A4475 696E 74 6641004C imul ebp,dword ptr ds:[esi+74],4C004166 005A447C 4F dec edi 005A447D 41 inc ecx 005A447E 44 inc esp 005A447F 45 inc ebp 005A4480 52 push edx 005A4481 2045 52 and byte ptr ss:[ebp+52],al 005A4484 52 push edx 005A4485 4F dec edi 005A4486 52 push edx 005A4487 005468 65 add byte ptr ds:[eax+ebp2+65],dl 005A448B 2070 72 and byte ptr ds:[eax+72],dh 005A448E 6F outs dx,dword ptr es:[edi] 005A448F 6365 64 arpl word ptr ss:[ebp+64],sp 005A4492 75 72 jnz short dnfkfc1_.005A4506 2009-11-10 14:43 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 4 楼 005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A43A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],eax 005A43AF 61 popad 005A43B0 75 08 jnz short dnfkfc1_.005A43BA 005A43B2 B8 01000000 mov eax,1 005A43B7 C2 0C00 retn 0C 005A43BA 68 0B0C5900 push dnfkfc1_.00590C0B 005A43BF C3 retn 这是不是出口 2009-11-10 15:05 0
达文西雪币： 1632 活跃值： (13) 能力值： ( LV2，RANK：10 ) 在线值：发帖 18 回帖 1328 粉丝 0 关注私信	达文西 5 楼靠，我真服了楼主，一段一段往下发代码，让别人告诉他哪是OEP，我的天啊 2009-11-10 15:06 0
达文西雪币： 1632 活跃值： (13) 能力值： ( LV2，RANK：10 ) 在线值：发帖 18 回帖 1328 粉丝 0 关注私信	达文西 6 楼 [QUOTE=rottom;710209]005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A...[/QUOTE] 对，005A43BF这里再F8就到OEP了。 2009-11-10 15:06 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 7 楼可是按你说的F8 DUMP后用PEID0.95查无法识别而且也打不开 2009-11-10 15:16 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 8 楼 EP段也由.aspack变成了vmp1 2009-11-10 15:19 0
yzsx 雪币： 173 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 97 粉丝 0 关注私信	yzsx 9 楼进来学习学习 2009-11-10 15:56 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 10 楼无人帮忙吗高手来个啊 2009-11-10 16:01 0
newine 雪币： 1849 活跃值： (57) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 121 粉丝 0 关注私信	newine 11 楼 [QUOTE=rottom;710209]005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A...[/QUOTE] 我有同感。。。。。。 2009-11-10 23:02 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

rottom

发帖

回帖

RANK

关注

私信

他的文章

[求助]能帮我分析一下哪是OEP吗？谢谢 1220

关于我们

联系我们

企业服务

看雪公众号

最新回复 (10)
风随雨行雪币： 2523 活跃值： (520) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 604 粉丝 1 关注私信	风随雨行 1 2 楼继续往下，还没到呢自己用ESP定律就搞定了 2009-11-10 14:41 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 3 楼 005A4136 /74 0A je short dnfkfc1_.005A4142 005A4138 \|EB 00 jmp short dnfkfc1_.005A413A 005A413A \|3C E9 cmp al,0E9 005A413C \|74 04 je short dnfkfc1_.005A4142 005A413E \|43 inc ebx 005A413F \|49 dec ecx 005A4140 ^\|EB EB jmp short dnfkfc1_.005A412D 005A4142 \8B06 mov eax,dword ptr ds:[esi] 005A4144 EB 00 jmp short dnfkfc1_.005A4146 005A4146 803E C5 cmp byte ptr ds:[esi],0C5 005A4149 ^ 75 F3 jnz short dnfkfc1_.005A413E 005A414B 24 00 and al,0 005A414D C1C0 18 rol eax,18 005A4150 2BC3 sub eax,ebx 005A4152 8906 mov dword ptr ds:[esi],eax 005A4154 83C3 05 add ebx,5 005A4157 83C6 04 add esi,4 005A415A 83E9 05 sub ecx,5 005A415D ^ EB CE jmp short dnfkfc1_.005A412D 005A415F 5B pop ebx 005A4160 5E pop esi 005A4161 59 pop ecx 005A4162 58 pop eax 005A4163 EB 08 jmp short dnfkfc1_.005A416D 005A4165 0000 add byte ptr ds:[eax],al 005A4167 0000 add byte ptr ds:[eax],al 005A4169 0000 add byte ptr ds:[eax],al 005A416B 0000 add byte ptr ds:[eax],al 005A416D 8BC8 mov ecx,eax 005A416F 8B3E mov edi,dword ptr ds:[esi] 005A4171 03BD 22040000 add edi,dword ptr ss:[ebp+422] 005A4177 8BB5 52010000 mov esi,dword ptr ss:[ebp+152] 005A417D C1F9 02 sar ecx,2 005A4180 F3:A5 rep movs dword ptr es:[edi],dword ptr ds> 005A4182 8BC8 mov ecx,eax 005A4184 83E1 03 and ecx,3 005A4187 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[> 005A4189 5E pop esi 005A418A 68 00800000 push 8000 005A418F 6A 00 push 0 005A4191 FFB5 52010000 push dword ptr ss:[ebp+152] 005A4197 FF95 51050000 call dword ptr ss:[ebp+551] 005A419D 83C6 08 add esi,8 005A41A0 833E 00 cmp dword ptr ds:[esi],0 005A41A3 ^ 0F85 1EFFFFFF jnz dnfkfc1_.005A40C7 005A41A9 68 00800000 push 8000 005A41AE 6A 00 push 0 005A41B0 FFB5 56010000 push dword ptr ss:[ebp+156] 005A41B6 FF95 51050000 call dword ptr ss:[ebp+551] 005A41BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531] 005A41C2 0BDB or ebx,ebx 005A41C4 74 08 je short dnfkfc1_.005A41CE 005A41C6 8B03 mov eax,dword ptr ds:[ebx] 005A41C8 8785 35050000 xchg dword ptr ss:[ebp+535],eax 005A41CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A41D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D] 005A41DA 2BD0 sub edx,eax 005A41DC 74 79 je short dnfkfc1_.005A4257 005A41DE 8BC2 mov eax,edx 005A41E0 C1E8 10 shr eax,10 005A41E3 33DB xor ebx,ebx 005A41E5 8BB5 39050000 mov esi,dword ptr ss:[ebp+539] 005A41EB 03B5 22040000 add esi,dword ptr ss:[ebp+422] 005A41F1 833E 00 cmp dword ptr ds:[esi],0 005A41F4 74 61 je short dnfkfc1_.005A4257 005A41F6 8B4E 04 mov ecx,dword ptr ds:[esi+4] 005A41F9 83E9 08 sub ecx,8 005A41FC D1E9 shr ecx,1 005A41FE 8B3E mov edi,dword ptr ds:[esi] 005A4200 03BD 22040000 add edi,dword ptr ss:[ebp+422] 005A4206 83C6 08 add esi,8 005A4209 66:8B1E mov bx,word ptr ds:[esi] 005A420C C1EB 0C shr ebx,0C 005A420F 83FB 01 cmp ebx,1 005A4212 74 0C je short dnfkfc1_.005A4220 005A4214 83FB 02 cmp ebx,2 005A4217 74 16 je short dnfkfc1_.005A422F 005A4219 83FB 03 cmp ebx,3 005A421C 74 20 je short dnfkfc1_.005A423E 005A421E EB 2C jmp short dnfkfc1_.005A424C 005A4220 66:8B1E mov bx,word ptr ds:[esi] 005A4223 81E3 FF0F0000 and ebx,0FFF 005A4229 66:01041F add word ptr ds:[edi+ebx],ax 005A422D EB 1D jmp short dnfkfc1_.005A424C 005A422F 66:8B1E mov bx,word ptr ds:[esi] 005A4232 81E3 FF0F0000 and ebx,0FFF 005A4238 66:01141F add word ptr ds:[edi+ebx],dx 005A423C EB 0E jmp short dnfkfc1_.005A424C 005A423E 66:8B1E mov bx,word ptr ds:[esi] 005A4241 81E3 FF0F0000 and ebx,0FFF 005A4247 01141F add dword ptr ds:[edi+ebx],edx 005A424A EB 00 jmp short dnfkfc1_.005A424C 005A424C 66:830E FF or word ptr ds:[esi],0FFFF 005A4250 83C6 02 add esi,2 005A4253 ^ E2 B4 loopd short dnfkfc1_.005A4209 005A4255 ^ EB 9A jmp short dnfkfc1_.005A41F1 005A4257 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A425D 8BB5 41050000 mov esi,dword ptr ss:[ebp+541] 005A4263 0BF6 or esi,esi 005A4265 74 11 je short dnfkfc1_.005A4278 005A4267 03F2 add esi,edx 005A4269 AD lods dword ptr ds:[esi] 005A426A 0BC0 or eax,eax 005A426C 74 0A je short dnfkfc1_.005A4278 005A426E 03C2 add eax,edx 005A4270 8BF8 mov edi,eax 005A4272 66:AD lods word ptr ds:[esi] 005A4274 66:AB stos word ptr es:[edi] 005A4276 ^ EB F1 jmp short dnfkfc1_.005A4269 005A4278 BE CF4F1900 mov esi,194FCF 005A427D 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A4283 03F2 add esi,edx 005A4285 8B46 0C mov eax,dword ptr ds:[esi+C] 005A4288 85C0 test eax,eax 005A428A 0F84 0A010000 je dnfkfc1_.005A439A 005A4290 03C2 add eax,edx 005A4292 8BD8 mov ebx,eax 005A4294 50 push eax 005A4295 FF95 4D0F0000 call dword ptr ss:[ebp+F4D] 005A429B 85C0 test eax,eax 005A429D 75 07 jnz short dnfkfc1_.005A42A6 005A429F 53 push ebx 005A42A0 FF95 510F0000 call dword ptr ss:[ebp+F51] 005A42A6 8985 45050000 mov dword ptr ss:[ebp+545],eax 005A42AC C785 49050000 0000>mov dword ptr ss:[ebp+549],0 005A42B6 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A42BC 8B06 mov eax,dword ptr ds:[esi] 005A42BE 85C0 test eax,eax 005A42C0 75 03 jnz short dnfkfc1_.005A42C5 005A42C2 8B46 10 mov eax,dword ptr ds:[esi+10] 005A42C5 03C2 add eax,edx 005A42C7 0385 49050000 add eax,dword ptr ss:[ebp+549] 005A42CD 8B18 mov ebx,dword ptr ds:[eax] 005A42CF 8B7E 10 mov edi,dword ptr ds:[esi+10] 005A42D2 03FA add edi,edx 005A42D4 03BD 49050000 add edi,dword ptr ss:[ebp+549] 005A42DA 85DB test ebx,ebx 005A42DC 0F84 A2000000 je dnfkfc1_.005A4384 005A42E2 F7C3 00000080 test ebx,80000000 005A42E8 75 04 jnz short dnfkfc1_.005A42EE 005A42EA 03DA add ebx,edx 005A42EC 43 inc ebx 005A42ED 43 inc ebx 005A42EE 53 push ebx 005A42EF 81E3 FFFFFF7F and ebx,7FFFFFFF 005A42F5 53 push ebx 005A42F6 FFB5 45050000 push dword ptr ss:[ebp+545] 005A42FC FF95 490F0000 call dword ptr ss:[ebp+F49] 005A4302 85C0 test eax,eax 005A4304 5B pop ebx 005A4305 75 6F jnz short dnfkfc1_.005A4376 005A4307 F7C3 00000080 test ebx,80000000 005A430D 75 19 jnz short dnfkfc1_.005A4328 005A430F 57 push edi 005A4310 8B46 0C mov eax,dword ptr ds:[esi+C] 005A4313 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A4319 50 push eax 005A431A 53 push ebx 005A431B 8D85 75040000 lea eax,dword ptr ss:[ebp+475] 005A4321 50 push eax 005A4322 57 push edi 005A4323 E9 98000000 jmp dnfkfc1_.005A43C0 005A4328 81E3 FFFFFF7F and ebx,7FFFFFFF 005A432E 8B85 26040000 mov eax,dword ptr ss:[ebp+426] 005A4334 3985 45050000 cmp dword ptr ss:[ebp+545],eax 005A433A 75 24 jnz short dnfkfc1_.005A4360 005A433C 57 push edi 005A433D 8BD3 mov edx,ebx 005A433F 4A dec edx 005A4340 C1E2 02 shl edx,2 005A4343 8B9D 45050000 mov ebx,dword ptr ss:[ebp+545] 005A4349 8B7B 3C mov edi,dword ptr ds:[ebx+3C] 005A434C 8B7C3B 78 mov edi,dword ptr ds:[ebx+edi+78] 005A4350 035C3B 1C add ebx,dword ptr ds:[ebx+edi+1C] 005A4354 8B0413 mov eax,dword ptr ds:[ebx+edx] 005A4357 0385 45050000 add eax,dword ptr ss:[ebp+545] 005A435D 5F pop edi 005A435E EB 16 jmp short dnfkfc1_.005A4376 005A4360 57 push edi 005A4361 8B46 0C mov eax,dword ptr ds:[esi+C] 005A4364 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A436A 50 push eax 005A436B 53 push ebx 005A436C 8D85 C6040000 lea eax,dword ptr ss:[ebp+4C6] 005A4372 50 push eax 005A4373 57 push edi 005A4374 EB 4A jmp short dnfkfc1_.005A43C0 005A4376 8907 mov dword ptr ds:[edi],eax 005A4378 8385 49050000 04 add dword ptr ss:[ebp+549],4 005A437F ^ E9 32FFFFFF jmp dnfkfc1_.005A42B6 005A4384 8906 mov dword ptr ds:[esi],eax 005A4386 8946 0C mov dword ptr ds:[esi+C],eax 005A4389 8946 10 mov dword ptr ds:[esi+10],eax 005A438C 83C6 14 add esi,14 005A438F 8B95 22040000 mov edx,dword ptr ss:[ebp+422] 005A4395 ^ E9 EBFEFFFF jmp dnfkfc1_.005A4285 005A439A B8 0B0C1900 mov eax,190C0B 005A439F 50 push eax 005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A43A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],eax 005A43AF 61 popad 005A43B0 75 08 jnz short dnfkfc1_.005A43BA 005A43B2 B8 01000000 mov eax,1 005A43B7 C2 0C00 retn 0C 005A43BA 68 00000000 push 0 005A43BF C3 retn 005A43C0 8B85 26040000 mov eax,dword ptr ss:[ebp+426] 005A43C6 8D8D 3B040000 lea ecx,dword ptr ss:[ebp+43B] 005A43CC 51 push ecx 005A43CD 50 push eax 005A43CE FF95 490F0000 call dword ptr ss:[ebp+F49] 005A43D4 8985 55050000 mov dword ptr ss:[ebp+555],eax 005A43DA 8D85 47040000 lea eax,dword ptr ss:[ebp+447] 005A43E0 50 push eax 005A43E1 FF95 510F0000 call dword ptr ss:[ebp+F51] 005A43E7 8985 2A040000 mov dword ptr ss:[ebp+42A],eax 005A43ED 8D8D 52040000 lea ecx,dword ptr ss:[ebp+452] 005A43F3 51 push ecx 005A43F4 50 push eax 005A43F5 FF95 490F0000 call dword ptr ss:[ebp+F49] 005A43FB 8985 59050000 mov dword ptr ss:[ebp+559],eax 005A4401 8B85 2A040000 mov eax,dword ptr ss:[ebp+42A] 005A4407 8D8D 5E040000 lea ecx,dword ptr ss:[ebp+45E] 005A440D 51 push ecx 005A440E 50 push eax 005A440F FF95 490F0000 call dword ptr ss:[ebp+F49] 005A4415 FFD0 call eax 005A4417 83C4 10 add esp,10 005A441A 5F pop edi 005A441B 6A 30 push 30 005A441D 8D9D 68040000 lea ebx,dword ptr ss:[ebp+468] 005A4423 53 push ebx 005A4424 57 push edi 005A4425 6A 00 push 0 005A4427 FF95 59050000 call dword ptr ss:[ebp+559] 005A442D 6A FF push -1 005A442F FF95 55050000 call dword ptr ss:[ebp+555] 005A4435 0000 add byte ptr ds:[eax],al 005A4437 0000 add byte ptr ds:[eax],al 005A4439 0000 add byte ptr ds:[eax],al 005A443B 0000 add byte ptr ds:[eax],al 005A443D 0000 add byte ptr ds:[eax],al 005A443F 0000 add byte ptr ds:[eax],al 005A4441 6B65 72 6E imul esp,dword ptr ss:[ebp+72],6E 005A4445 65:6C ins byte ptr es:[edi],dx 005A4447 3332 xor esi,dword ptr ds:[edx] 005A4449 2E: prefix cs: 005A444A 64:6C ins byte ptr es:[edi],dx 005A444C 6C ins byte ptr es:[edi],dx 005A444D 0045 78 add byte ptr ss:[ebp+78],al 005A4450 697450 72 6F636573 imul esi,dword ptr ds:[eax+edx2+72],736> 005A4458 73 00 jnb short dnfkfc1_.005A445A 005A445A 75 73 jnz short dnfkfc1_.005A44CF 005A445C 65:72 33 jb short dnfkfc1_.005A4492 005A445F 322E xor ch,byte ptr ds:[esi] 005A4461 64:6C ins byte ptr es:[edi],dx 005A4463 6C ins byte ptr es:[edi],dx 005A4464 004D 65 add byte ptr ss:[ebp+65],cl 005A4467 73 73 jnb short dnfkfc1_.005A44DC 005A4469 61 popad 005A446A 67:65:42 inc edx 005A446D 6F outs dx,dword ptr es:[edi] 005A446E 78 41 js short dnfkfc1_.005A44B1 005A4470 0077 73 add byte ptr ds:[edi+73],dh 005A4473 70 72 jo short dnfkfc1_.005A44E7 005A4475 696E 74 6641004C imul ebp,dword ptr ds:[esi+74],4C004166 005A447C 4F dec edi 005A447D 41 inc ecx 005A447E 44 inc esp 005A447F 45 inc ebp 005A4480 52 push edx 005A4481 2045 52 and byte ptr ss:[ebp+52],al 005A4484 52 push edx 005A4485 4F dec edi 005A4486 52 push edx 005A4487 005468 65 add byte ptr ds:[eax+ebp2+65],dl 005A448B 2070 72 and byte ptr ds:[eax+72],dh 005A448E 6F outs dx,dword ptr es:[edi] 005A448F 6365 64 arpl word ptr ss:[ebp+64],sp 005A4492 75 72 jnz short dnfkfc1_.005A4506 2009-11-10 14:43 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 4 楼 005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A43A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],eax 005A43AF 61 popad 005A43B0 75 08 jnz short dnfkfc1_.005A43BA 005A43B2 B8 01000000 mov eax,1 005A43B7 C2 0C00 retn 0C 005A43BA 68 0B0C5900 push dnfkfc1_.00590C0B 005A43BF C3 retn 这是不是出口 2009-11-10 15:05 0
达文西雪币： 1632 活跃值： (13) 能力值： ( LV2，RANK：10 ) 在线值：发帖 18 回帖 1328 粉丝 0 关注私信	达文西 5 楼靠，我真服了楼主，一段一段往下发代码，让别人告诉他哪是OEP，我的天啊 2009-11-10 15:06 0
达文西雪币： 1632 活跃值： (13) 能力值： ( LV2，RANK：10 ) 在线值：发帖 18 回帖 1328 粉丝 0 关注私信	达文西 6 楼 [QUOTE=rottom;710209]005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A...[/QUOTE] 对，005A43BF这里再F8就到OEP了。 2009-11-10 15:06 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 7 楼可是按你说的F8 DUMP后用PEID0.95查无法识别而且也打不开 2009-11-10 15:16 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 8 楼 EP段也由.aspack变成了vmp1 2009-11-10 15:19 0
yzsx 雪币： 173 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 97 粉丝 0 关注私信	yzsx 9 楼进来学习学习 2009-11-10 15:56 0
rottom 雪币： 34 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 6 粉丝 0 关注私信	rottom 10 楼无人帮忙吗高手来个啊 2009-11-10 16:01 0
newine 雪币： 1849 活跃值： (57) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 121 粉丝 0 关注私信	newine 11 楼 [QUOTE=rottom;710209]005A43A0 0385 22040000 add eax,dword ptr ss:[ebp+422] 005A43A6 59 pop ecx 005A43A7 0BC9 or ecx,ecx 005A...[/QUOTE] 我有同感。。。。。。 2009-11-10 23:02 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

[旧帖] [求助]能帮我分析一下 哪是OEP吗？谢谢 0.00雪花

[旧帖] [求助]能帮我分析一下哪是OEP吗？谢谢 0.00雪花