『深圳腾讯2010安全技术竞赛』第二阶段第一题是一道虚拟机相关的题目。由于自己之前只接触过一些概念相关的知识，最多看过VMP虚拟化单句代码的效果，再复杂就搞不来了，所以想借此机会加深下对虚拟机的理解。在此把自己的分析过程整理出来，望高手指教。
废话结束，下面进入正题。
刚看了题目要求之后，并不知道程序中有虚拟机。挂上OD断到程序映射文件完毕，开始分析。
004010FE . 837D D0 00 cmp dword ptr [ebp-30], 0
00401102 . 0F84 B3000000 je 004011BB
00401108 . 8B4D E4 mov ecx, dword ptr [ebp-1C]
0040110B . 8139 54455354 cmp dword ptr [ecx], 54534554
00401111 . 0F85 A4000000 jnz 004011BB
00401F44 |. B8 10134000 mov eax, 00401310
00401F49 |. 870424 xchg dword ptr [esp], eax
00401F4C \. C3 retn
00401310 60 pushad
00401311 9C pushfd
00401312 8B5424 24 mov edx, dword ptr [esp+24]
00401316 8BC2 mov eax, edx
00401318 05 94000000 add eax, 94
0040131D 8038 01 cmp byte ptr [eax], 1
00401320 74 21 je short 00401343
00401322 8B5424 24 mov edx, dword ptr [esp+24]
00401326 8BC2 mov eax, edx
00401328 05 A4000000 add eax, 0A4
0040132D 50 push eax
0040132E 83E8 0C sub eax, 0C
00401331 8B00 mov eax, dword ptr [eax]
00401333 FFD0 call eax
00401335 8B5424 24 mov edx, dword ptr [esp+24]
00401339 8BC2 mov eax, edx
0040133B 05 94000000 add eax, 94
00401340 C600 01 mov byte ptr [eax], 1
00401343 8B5424 24 mov edx, dword ptr [esp+24]
00401347 8BC2 mov eax, edx
00401349 05 A4000000 add eax, 0A4
0040134E 50 push eax
0040134F 83E8 08 sub eax, 8
00401352 8B00 mov eax, dword ptr [eax]
00401354 FFD0 call eax
00401356 8BF4 mov esi, esp
00401358 B9 09000000 mov ecx, 9
0040135D 8B7C24 24 mov edi, dword ptr [esp+24]
00401361 F3:A5 rep movs dword ptr es:[edi], dword p>
00401363 9D popfd
00401364 61 popad
00401365 58 pop eax
00401366 8BC8 mov ecx, eax
00401368 05 C4000000 add eax, 0C4
0040136D 8B00 mov eax, dword ptr [eax]
0040136F 8BE0 mov esp, eax
00401371 51 push ecx
00401372 E8 E9FEFFFF call 00401260
004012E0 |> 8B46 68 /mov eax, dword ptr [esi+68]
004012E3 |. |0FB608 |movzx ecx, byte ptr [eax]
004012E6 |. |8B148D D0D840>|mov edx, dword ptr [ecx*4+40D8D0]
004012ED |. |56 |push esi
004012EE |. |FFD2 |call edx
004012F0 |. |8346 68 10 |add dword ptr [esi+68], 10
004012F4 |. |397E 68 |cmp dword ptr [esi+68], edi
004012F7 |.^\72 E7 \jb short 004012E0
0040D8D0 80 13 40 00 C0 13 40 00 D0 13 40 00 E0 13 40 00 €@.?@.?@.?@.
0040D8E0 30 14 40 00 80 14 40 00 D0 14 40 00 20 15 40 00 0@.€@.?@. @.
0040D8F0 80 15 40 00 E0 15 40 00 F0 15 40 00 00 16 40 00 €@.?@.?@..@.
0040D900 40 16 40 00 90 16 40 00 20 17 40 00 80 17 40 00 @@.?@. @.€@.
0040D910 F0 17 40 00 60 18 40 00 20 19 40 00 E0 19 40 00 ?@.`@. @.?@.
0040D920 40 1A 40 00 F0 1A 40 00 A0 1B 40 00 50 1C 40 00 @@.?@.?@.P@.
0040D930 F0 1C 40 00 A0 1D 40 00 50 1E 40 00 50 1E 40 00 ?@.?@.P@.P@.
0040D940 00 1F 40 00 00 1F 40 00 .@..@.
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
