peid
检测为
ASProtect 2.0x Registered -> Alexey Solodovnikov
0101E5AB 59 pop ecx
0101E5AC 64:FF31 push dword ptr fs:[ecx]
0101E5AF EB 01 jmp short 0101E5B2
0101E5B1 F0:64:8921 lock mov dword ptr fs:[ecx],e>; 锁定前缀是不允许的
0101E5B5 C601 CE mov byte ptr ds:[ecx],0CE // 最后到这里
0101E5B8 ^ 72 9B jb short 0101E555
shift+f7
继续会到
7C92EB8B n> 8BD4 mov edx,esp
7C92EB8D 0F34 sysenter
7C92EB8F 90 nop
7C92EB90 90 nop
7C92EB91 90 nop
7C92EB92 90 nop
7C92EB93 90 nop
7C92EB94 n> C3 retn
7C92EB8D 0F34 sysenter
在这里以后 再按 f7 程序就出来了
如果直接 tc 会报错
OS: Windows XP Professional, SP2
CPU: GenuineIntel, Intel Pentium 4, MMX @ 2400 MHz
Application data:
VmVyc2lvbjogDQpJbWFnZUJhc2U6IDAwNDAwMDAwDQpFaXA6IDEwMUY
2RTQNCkVheDogMA0KRWN4OiAwDQpFZHg6IDANCkVieDogMTAxRjY1OA
0KRXNpOiBGRDAwMDANCkVkaTogMTAwMDAwMA0KRWJwOiAxMkZGOTgNC
kVzcDogMTJGRjc4DQpFcnJvckNvZGU6IA0KODMsQzQsNCxGMyxFQiwy
LENELDIwLDJCLEQyLDVBLDY4LDQ0LEI5LDAsMSw2OCxENCxGRiwxLDE
sNjgsQTQsQ0YsMSwxLDY4LDM0LEUwLDEsMSw2OCw3MCxDQiwxLDEsNj
gsMzQsQkIsMSwxLDY4LEI4LEU3LDEsMSxDMywzMyxDMCw1QSw1OSwwD
QpDb2RlID0gWzBdDQotIDANCi0gMA0KLSAwDQotIFtdDQpFOlxEb3du
bG9hZHNcQklaXLeisrxcs6TJs8Dow/e18b/M0tXK9bmry75cT2xseWR
iZ19maXhcTWF0ZXJpYWxcc3lzdGVtZXhwZXJ0LmV4ZQ0KQzpcV0lORE
9XU1xzeXN0ZW0zMlxudGRsbC5kbGwNCkM6XFdJTkRPV1Ncc3lzdGVtM
zJca2VybmVsMzIuZGxsDQpDOlxXSU5ET1dTXHN5c3RlbTMyXHVzZXIz
Mi5kbGwNCkM6XFdJTkRPV1Ncc3lzdGVtMzJcR0RJMzIuZGxsDQpDOlx
XSU5ET1dTXHN5c3RlbTMyXGFkdmFwaTMyLmRsbA0KQzpcV0lORE9XU1
xzeXN0ZW0zMlxSUENSVDQuZGxsDQpDOlxXSU5ET1dTXHN5c3RlbTMyX
G9sZWF1dDMyLmRsbA0KQzpcV0lORE9XU1xzeXN0ZW0zMlxtc3ZjcnQu
ZGxsDQpDOlxXSU5ET1dTXHN5c3RlbTMyXG9sZTMyLmRsbA0KQzpcV0l
ORE9XU1xzeXN0ZW0zMlx2ZXJzaW9uLmRsbA0KQzpcV0lORE9XU1xzeX
N0ZW0zMlxjb21jdGwzMi5kbGwNCkM6XFdJTkRPV1Ncc3lzdGVtMzJcc
2hlbGwzMi5kbGwNCkM6XFdJTkRPV1Ncc3lzdGVtMzJcU0hMV0FQSS5k
bGwNCkM6XFdJTkRPV1Ncc3lzdGVtMzJcSU1NMzIuRExMDQpDOlxXSU5
ET1dTXHN5c3RlbTMyXExQSy5ETEwNCkM6XFdJTkRPV1Ncc3lzdGVtMz
JcVVNQMTAuZGxsDQpDOlxXSU5ET1dTXFdpblN4U1x4ODZfTWljcm9zb
2Z0LldpbmRvd3MuQ29tbW9uLUNvbnRyb2xzXzY1OTViNjQxNDRjY2Yx
ZGZfNi4wLjI2MDAuMjE4MF94LXd3X2E4NGYxZmY5XGNvbWN0bDMyLmR
sbA0KQzpcV0lORE9XU1xzeXN0ZW0zMlx3c29jazMyLmRsbA0KQzpcV0
lORE9XU1xzeXN0ZW0zMlxXUzJfMzIuZGxsDQpDOlxXSU5ET1dTXHN5c
3RlbTMyXFdTMkhFTFAuZGxsDQpDOlxXSU5ET1dTXHN5c3RlbTMyXHV4
dGhlbWUuZGxsDQpDOlxXSU5ET1dTXHN5c3RlbTMyXE1TQ1RGLmRsbA0
KQzpcUFJPR1JBfjFcMzcyMVxoZWxwZXIuZGxsDQpDOlxXSU5ET1dTXH
N5c3RlbTMyXFdJTklORVQuZGxsDQpDOlxXSU5ET1dTXHN5c3RlbTMyX
ENSWVBUMzIuZGxsDQpDOlxXSU5ET1dTXHN5c3RlbTMyXE1TQVNOMS5k
bGwNCkM6XFdJTkRPV1Ncc3lzdGVtMzJcbXNjdGZpbWUuaW1l
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
