能力值:
( LV9,RANK:3410 )
|
-
-
2 楼
stripper_v207f脱壳
VBExplorer反编译
***********Reference To:[propget]App.EXEName
|
:00416C90 0D58001A00 VCallHresult ;Call ptr_004073DC
:00416C95 3EE0FE FLdZeroAd ;Push DWORD [LOCAL_0120]; [LOCAL_0120]=0
:00416C98 46D0FE CVarStr ;
:00416C9B FBEFC0FE ConcatVar ;
******Possible String Ref To->".exe"
|
:00416C9F 3AB0FE2600 LitVarStr ;PushVarString ptr_004075E4
:00416CA4 FBEFA0FE ConcatVar ;
:00416CA8 60 CStrVarTmp ;
:00416CA9 3178FF FStStr ;SysFreeString [LOCAL_0088]; [LOCAL_0088]=Pop
:00416CAC 2F68FF FFree1Str ;SysFreeString [LOCAL_0098]; [LOCAL_0098]=0
:00416CAF 29060074FF6CFFE4 FFreeAd ;
:00416CB8 36120058FF38FF18 FFreeVar ;Free 0012/2 variants
:00416CCD 0013 LargeBos ;IDE beginning of line with 13 byte codes
:00416CCF 6C78FF ILdRf ;Push DWORD [LOCAL_0088]
**********Reference To->msvbvm50.rtcFileLen
//rtcFileLen 文件大小
:00416CD2 5E07000400 ImpAdCallI2 ;Call ptr_00401012; check stack 0004; Push EAX
:00416CD7 F5D8850100 LitI4 ;Push 000185D8
:00416CDC DB GtI4 ;Push (Pop1 > Pop2)
:00416CDD 1CDF00 BranchF ;If Pop=0 then ESI=00416CE7
//改为绝对跳转 Branch 1C->1E
:00416CE0 0004 LargeBos ;IDE beginning of line with 04 byte codes
:00416CE2 FCC800 End
//Over ;
:00416CE5 031300140B InvalidExcode ;
:00416CEA 270000 LitVar ;PushVar LOCAL_0000
:00416CED 0023 LargeBos ;IDE beginning of line with 23 byte codes
:00416CEF 70FF08 FStI2 ;Pop WORD [STACK_08FF]
:00416CF2 0800FD FLdPr ;[SR]=[LOCAL_0300]
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
说实在,小弟对于VB程序的反编译的经验值为零,先跟 FLY 兄弟说声谢谢,实作过程中如有疑问提出也请继续给予指导建议才好!祝 顺心
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
最初由 peaceworld 发布 说实在,小弟对于VB程序的反编译的经验值为零,先跟 FLY 兄弟说声谢谢,实作过程中如有疑问提出也请继续给予指导建议才好!祝 顺心
就是下断msvbvm50.rtcFileLen
这个函数咯
然后往下找跳转~改成JMP OK?
|
|
|