|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
FSG2.0的壳
OD刚载入在此： 00400154 > 8725 EC444100 xchg dword ptr ds:[4144EC], esp 0040015A 61 popad 0040015B 94 xchg eax, esp 0040015C 55 push ebp 0040015D A4 movs byte ptr es:[edi], byte ptr ds:[> 0040015E B6 80 mov dh, 80 00400160 FF13 call dword ptr ds:[ebx] 00400162 ^ 73 F9 jnb short FSG_2_0.0040015D 00400164 33C9 xor ecx, ecx 00400166 FF13 call dword ptr ds:[ebx] 00400168 73 16 jnb short FSG_2_0.00400180 0040016A 33C0 xor eax, eax 0040016C FF13 call dword ptr ds:[ebx] 0040016E 73 1F jnb short FSG_2_0.0040018F 00400170 B6 80 mov dh, 80 00400172 41 inc ecx 00400173 B0 10 mov al, 10 00400175 FF13 call dword ptr ds:[ebx] 00400177 12C0 adc al, al 00400179 ^ 73 FA jnb short FSG_2_0.00400175 0040017B 75 3A jnz short FSG_2_0.004001B7 0040017D AA stos byte ptr es:[edi] 0040017E ^ EB E0 jmp short FSG_2_0.00400160 00400180 FF53 08 call dword ptr ds:[ebx+8] 00400183 02F6 add dh, dh 00400185 83D9 01 sbb ecx, 1 00400188 75 0E jnz short FSG_2_0.00400198 0040018A FF53 04 call dword ptr ds:[ebx+4] 0040018D EB 24 jmp short FSG_2_0.004001B3 0040018F AC lods byte ptr ds:[esi] 00400190 D1E8 shr eax, 1 00400192 74 2D je short FSG_2_0.004001C1 00400194 13C9 adc ecx, ecx 00400196 EB 18 jmp short FSG_2_0.004001B0 00400198 91 xchg eax, ecx 00400199 48 dec eax 0040019A C1E0 08 shl eax, 8 0040019D AC lods byte ptr ds:[esi] 0040019E FF53 04 call dword ptr ds:[ebx+4] 004001A1 3B43 F8 cmp eax, dword ptr ds:[ebx-8] 004001A4 73 0A jnb short FSG_2_0.004001B0 004001A6 80FC 05 cmp ah, 5 004001A9 73 06 jnb short FSG_2_0.004001B1 004001AB 83F8 7F cmp eax, 7F 004001AE 77 02 ja short FSG_2_0.004001B2 004001B0 41 inc ecx 004001B1 41 inc ecx 004001B2 95 xchg eax, ebp 004001B3 8BC5 mov eax, ebp 004001B5 B6 00 mov dh, 0 004001B7 56 push esi 004001B8 8BF7 mov esi, edi 004001BA 2BF0 sub esi, eax 004001BC F3:A4 rep movs byte ptr es:[edi], byte ptr> 004001BE 5E pop esi 004001BF ^ EB 9F jmp short FSG_2_0.00400160 004001C1 5E pop esi 004001C2 AD lods dword ptr ds:[esi] 004001C3 97 xchg eax, edi 004001C4 AD lods dword ptr ds:[esi] 004001C5 50 push eax 004001C6 FF53 10 call dword ptr ds:[ebx+10] 004001C9 95 xchg eax, ebp 004001CA 8B07 mov eax, dword ptr ds:[edi] 004001CC 40 inc eax 004001CD ^ 78 F3 js short FSG_2_0.004001C2 004001CF 75 03 jnz short FSG_2_0.004001D4 004001D1 FF63 0C jmp dword ptr ds:[ebx+C] //单步跟踪一次，你会发现这里是跳到OEP的 所以 嘻嘻  一载入直接在这里F2 然后F9 在一下F8就到了004001D4 50 push eax 004001D5 55 push ebp 004001D6 FF53 14 call dword ptr ds:[ebx+14] 004001D9 AB stos dword ptr es:[edi] 004001DA ^ EB EE jmp short FSG_2_0.004001CA //红色代码好像是IAT的 有耐心的可以慢慢跟踪，跟踪的时候留意寄存器的EAX 就可以知道了 004001DC 33C9 xor ecx, ecx 004001DE 41 inc ecx 004001DF FF13 call dword ptr ds:[ebx] 004001E1 13C9 adc ecx, ecx 004001E3 FF13 call dword ptr ds:[ebx] 004001E5 ^ 72 F8 jb short FSG_2_0.004001DF 004001E7 C3 retn 好了 废话也不多说 呵呵 就这样吧 晚安 各位 |
|
|
|
|
|
|
|
|
|
|
|
|
