软件地址在:http://www.csdelphi.com/downloads/M8000.zip
用PEiD v0.95 查壳:UPX 0.89.6 - 1.02 / 1.05 - 2.90 (Delphi) stub -> Markus & Laszlo
用Exeinfo PE 0.0.2.8 by A.S.L 578 查壳:UPX 0.89 - 3.xx -> Markus & Laszlo
用ESP 定律跑到这,脱壳后,不能运行,修复也不行,请有空的老师指导一下,(附件是用脱壳机脱的,也不能运行。)
005B8594 55 PUSH EBP
005B8595 8BEC MOV EBP,ESP
005B8597 83C4 F0 ADD ESP,-10
005B859A 53 PUSH EBX
005B859B B8 5C805B00 MOV EAX,MultVide.005B805C
005B85A0 E8 DFEAE4FF CALL MultVide.00407084
005B85A5 68 78865B00 PUSH MultVide.005B8678 ; ASCII "http://www.csdelphi.com"
005B85AA 6A FF PUSH -1
005B85AC 68 01001F00 PUSH 1F0001
005B85B1 E8 F6EEE4FF CALL MultVide.004074AC ; JMP 到 kernel32.OpenMutexA
005B85B6 8BD8 MOV EBX,EAX
005B85B8 85DB TEST EBX,EBX
005B85BA 0F87 B1000000 JA MultVide.005B8671
005B85C0 68 78865B00 PUSH MultVide.005B8678 ; ASCII "http://www.csdelphi.com"
005B85C5 6A 00 PUSH 0
005B85C7 6A 00 PUSH 0
005B85C9 E8 8EECE4FF CALL MultVide.0040725C
005B85CE 8BD8 MOV EBX,EAX
005B85D0 8B0D 70E25B00 MOV ECX,DWORD PTR DS:[5BE270] ; MultVide.005BFC3C
005B85D6 8B09 MOV ECX,DWORD PTR DS:[ECX]
005B85D8 B2 01 MOV DL,1
005B85DA A1 687D5B00 MOV EAX,DWORD PTR DS:[5B7D68]
005B85DF E8 3033EBFF CALL MultVide.0046B914
005B85E4 8B15 F4E05B00 MOV EDX,DWORD PTR DS:[5BE0F4] ; MultVide.005C1484
005B85EA 8902 MOV DWORD PTR DS:[EDX],EAX
005B85EC A1 F4E05B00 MOV EAX,DWORD PTR DS:[5BE0F4]
005B85F1 8B00 MOV EAX,DWORD PTR DS:[EAX]
005B85F3 E8 5C75EBFF CALL MultVide.0046FB54
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!