大牛帮忙看看这个算法-经典问答-看雪-安全社区|安全招聘|kanxue.com

大牛帮忙看看这个算法

发表于: 2011-12-14 08:00 4192

大牛帮忙看看这个算法

siru

活跃值

2011-12-14 08:00

4192

00405920  /$  53          push ebx
00405921  |.  55          push ebp
00405922  |.  56          push esi
00405923  |.  8B7424 10    mov    esi, dword ptr [esp+10]
00405927  |.  85F6       test esi, esi
00405929  |.  57          push edi
0040592A  |.  0F84 B6030000 je    00405CE6
00405930  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405933  |.  85C0       test eax, eax
00405935  |.  0F84 AB030000 je    00405CE6
0040593B  |.  833E 00    cmp    dword ptr [esi], 0
0040593E  |.  0F84 A2030000 je    00405CE6
00405944  |.  8B5424 18    mov    edx, dword ptr [esp+18]
00405948  |.  33DB       xor    ebx, ebx
0040594A  |.  83FA 04    cmp    edx, 4
0040594D  |.  BF FBFFFFFF mov    edi, -5
00405952  |.  0F95C3       setne bl
00405955  |.  4B          dec    ebx
00405956  |.  BD 05000000 mov    ebp, 5
0040595B  |.  83E3 FB    and    ebx, FFFFFFFB
0040595E  |.  895C24 18    mov    dword ptr [esp+18], ebx
00405962  |>  8B46 1C    /mov    eax, dword ptr [esi+1C]
00405965  |.  8B08       |mov    ecx, dword ptr [eax]
00405967  |.  83F9 0D    |cmp    ecx, 0D                                  ;  Switch (cases 0..D)
0040596A  |.  0F87 76030000 |ja    00405CE6
00405970  |.  FF248D 105D40>|jmp    dword ptr [ecx*4+405D10]
00405977  |>  8B4E 04    |mov    ecx, dword ptr [esi+4]                   ;  Case 0 of switch 00405967
0040597A  |.  85C9       |test ecx, ecx
0040597C  |.  0F84 5B020000 |je    00405BDD
00405982  |.  49          |dec    ecx
00405983  |.  33D2       |xor    edx, edx
00405985  |.  894E 04    |mov    dword ptr [esi+4], ecx
00405988  |.  8B4E 08    |mov    ecx, dword ptr [esi+8]
0040598B  |.  41          |inc    ecx
0040598C  |.  8BFB       |mov    edi, ebx
0040598E  |.  894E 08    |mov    dword ptr [esi+8], ecx
00405991  |.  8B0E       |mov    ecx, dword ptr [esi]
00405993  |.  8A11       |mov    dl, byte ptr [ecx]
00405995  |.  8950 04    |mov    dword ptr [eax+4], edx
00405998  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
0040599B  |.  8B16       |mov    edx, dword ptr [esi]
0040599D  |.  8B48 04    |mov    ecx, dword ptr [eax+4]
004059A0  |.  83E1 0F    |and    ecx, 0F
004059A3  |.  42          |inc    edx
004059A4  |.  80F9 08    |cmp    cl, 8
004059A7  |.  8916       |mov    dword ptr [esi], edx
004059A9  |.  74 15       |je    short 004059C0
004059AB  |.  C700 0D000000 |mov    dword ptr [eax], 0D
004059B1  |.  8B56 1C    |mov    edx, dword ptr [esi+1C]
004059B4  |.  C746 18 D8C04>|mov    dword ptr [esi+18], 0043C0D8             ;  ASCII "unknown compression method"
004059BB  |.  896A 04    |mov    dword ptr [edx+4], ebp
004059BE  |.^ EB A2       |jmp    short 00405962
004059C0  |>  8B48 04    |mov    ecx, dword ptr [eax+4]
004059C3  |.  8B50 10    |mov    edx, dword ptr [eax+10]
004059C6  |.  C1E9 04    |shr    ecx, 4
004059C9  |.  83C1 08    |add    ecx, 8
004059CC  |.  3BCA       |cmp    ecx, edx
004059CE  |.  76 18       |jbe    short 004059E8
004059D0  |.  C700 0D000000 |mov    dword ptr [eax], 0D
004059D6  |.  8B56 1C    |mov    edx, dword ptr [esi+1C]
004059D9  |.  C746 18 F4C04>|mov    dword ptr [esi+18], 0043C0F4             ;  ASCII "invalid window size"
004059E0  |.  896A 04    |mov    dword ptr [edx+4], ebp
004059E3  |.^ E9 7AFFFFFF |jmp    00405962
004059E8  |>  C700 01000000 |mov    dword ptr [eax], 1
004059EE  |>  8B46 04    |mov    eax, dword ptr [esi+4]                   ;  Case 1 of switch 00405967
004059F1  |.  85C0       |test eax, eax
004059F3  |.  0F84 E4010000 |je    00405BDD
004059F9  |.  48          |dec    eax
004059FA  |.  33C9       |xor    ecx, ecx
004059FC  |.  8946 04    |mov    dword ptr [esi+4], eax
004059FF  |.  8B46 08    |mov    eax, dword ptr [esi+8]
00405A02  |.  40          |inc    eax
00405A03  |.  8BFB       |mov    edi, ebx
00405A05  |.  8B5E 1C    |mov    ebx, dword ptr [esi+1C]
00405A08  |.  8946 08    |mov    dword ptr [esi+8], eax
00405A0B  |.  8B06       |mov    eax, dword ptr [esi]
00405A0D  |.  33D2       |xor    edx, edx
00405A0F  |.  BD 1F000000 |mov    ebp, 1F
00405A14  |.  8A08       |mov    cl, byte ptr [eax]
00405A16  |.  40          |inc    eax
00405A17  |.  8906       |mov    dword ptr [esi], eax
00405A19  |.  8B43 04    |mov    eax, dword ptr [ebx+4]
00405A1C  |.  C1E0 08    |shl    eax, 8
00405A1F  |.  03C1       |add    eax, ecx
00405A21  |.  F7F5       |div    ebp
00405A23  |.  BD 05000000 |mov    ebp, 5
00405A28  |.  85D2       |test edx, edx
00405A2A  |.  74 1C       |je    short 00405A48
00405A2C  |.  C703 0D000000 |mov    dword ptr [ebx], 0D
00405A32  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405A35  |.  8B5C24 18    |mov    ebx, dword ptr [esp+18]
00405A39  |.  C746 18 08C14>|mov    dword ptr [esi+18], 0043C108             ;  ASCII "incorrect header check"
00405A40  |.  8968 04    |mov    dword ptr [eax+4], ebp
00405A43  |.^ E9 1AFFFFFF |jmp    00405962
00405A48  |>  F6C1 20    |test cl, 20
00405A4B  |.  0F85 78010000 |jnz    00405BC9
00405A51  |.  C703 07000000 |mov    dword ptr [ebx], 7
00405A57  |.  8B5C24 18    |mov    ebx, dword ptr [esp+18]
00405A5B  |.^ E9 02FFFFFF |jmp    00405962
00405A60  |>  8B48 14    |mov    ecx, dword ptr [eax+14]                   ;  Case 7 of switch 00405967
00405A63  |.  57          |push edi
00405A64  |.  56          |push esi
00405A65  |.  51          |push ecx
00405A66  |.  E8 E5060000 |call 00406150
00405A6B  |.  8BF8       |mov    edi, eax
00405A6D  |.  83C4 0C    |add    esp, 0C
00405A70  |.  83FF FD    |cmp    edi, -3
00405A73  |.  75 18       |jnz    short 00405A8D
00405A75  |.  8B56 1C    |mov    edx, dword ptr [esi+1C]
00405A78  |.  C702 0D000000 |mov    dword ptr [edx], 0D
00405A7E  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405A81  |.  C740 04 00000>|mov    dword ptr [eax+4], 0
00405A88  |.^ E9 D5FEFFFF |jmp    00405962
00405A8D  |>  85FF       |test edi, edi
00405A8F  |.  75 02       |jnz    short 00405A93
00405A91  |.  8BFB       |mov    edi, ebx
00405A93  |>  83FF 01    |cmp    edi, 1
00405A96  |.  0F85 41010000 |jnz    00405BDD
00405A9C  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405A9F  |.  8BFB       |mov    edi, ebx
00405AA1  |.  8B50 14    |mov    edx, dword ptr [eax+14]
00405AA4  |.  8D48 04    |lea    ecx, dword ptr [eax+4]
00405AA7  |.  51          |push ecx
00405AA8  |.  56          |push esi
00405AA9  |.  52          |push edx
00405AAA  |.  E8 81050000 |call 00406030
00405AAF  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405AB2  |.  83C4 0C    |add    esp, 0C
00405AB5  |.  8B48 0C    |mov    ecx, dword ptr [eax+C]
00405AB8  |.  85C9       |test ecx, ecx
00405ABA  |.  74 0B       |je    short 00405AC7
00405ABC  |.  C700 0C000000 |mov    dword ptr [eax], 0C
00405AC2  |.^ E9 9BFEFFFF |jmp    00405962
00405AC7  |>  C700 08000000 |mov    dword ptr [eax], 8
00405ACD  |>  8B46 04    |mov    eax, dword ptr [esi+4]                   ;  Case 8 of switch 00405967
00405AD0  |.  85C0       |test eax, eax
00405AD2  |.  0F84 05010000 |je    00405BDD
00405AD8  |.  48          |dec    eax
00405AD9  |.  8B56 1C    |mov    edx, dword ptr [esi+1C]
00405ADC  |.  8946 04    |mov    dword ptr [esi+4], eax
00405ADF  |.  8B46 08    |mov    eax, dword ptr [esi+8]
00405AE2  |.  40          |inc    eax
00405AE3  |.  33C9       |xor    ecx, ecx
00405AE5  |.  8946 08    |mov    dword ptr [esi+8], eax
00405AE8  |.  8B06       |mov    eax, dword ptr [esi]
00405AEA  |.  8BFB       |mov    edi, ebx
00405AEC  |.  8A08       |mov    cl, byte ptr [eax]
00405AEE  |.  C1E1 18    |shl    ecx, 18
00405AF1  |.  894A 08    |mov    dword ptr [edx+8], ecx
00405AF4  |.  8B06       |mov    eax, dword ptr [esi]
00405AF6  |.  40          |inc    eax
00405AF7  |.  8906       |mov    dword ptr [esi], eax
00405AF9  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405AFC  |.  C700 09000000 |mov    dword ptr [eax], 9
00405B02  |>  8B46 04    |mov    eax, dword ptr [esi+4]                   ;  Case 9 of switch 00405967
00405B05  |.  85C0       |test eax, eax
00405B07  |.  0F84 D0000000 |je    00405BDD
00405B0D  |.  8B56 08    |mov    edx, dword ptr [esi+8]
00405B10  |.  8B0E       |mov    ecx, dword ptr [esi]
00405B12  |.  48          |dec    eax
00405B13  |.  42          |inc    edx
00405B14  |.  8956 08    |mov    dword ptr [esi+8], edx
00405B17  |.  8946 04    |mov    dword ptr [esi+4], eax
00405B1A  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405B1D  |.  33D2       |xor    edx, edx
00405B1F  |.  8A11       |mov    dl, byte ptr [ecx]
00405B21  |.  8BFB       |mov    edi, ebx
00405B23  |.  8B48 08    |mov    ecx, dword ptr [eax+8]
00405B26  |.  C1E2 10    |shl    edx, 10
00405B29  |.  03CA       |add    ecx, edx
00405B2B  |.  8948 08    |mov    dword ptr [eax+8], ecx
00405B2E  |.  8B06       |mov    eax, dword ptr [esi]
00405B30  |.  40          |inc    eax
00405B31  |.  8906       |mov    dword ptr [esi], eax
00405B33  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405B36  |.  C700 0A000000 |mov    dword ptr [eax], 0A
00405B3C  |>  8B46 04    |mov    eax, dword ptr [esi+4]                   ;  Case A of switch 00405967
00405B3F  |.  85C0       |test eax, eax
00405B41  |.  0F84 96000000 |je    00405BDD
00405B47  |.  8B56 08    |mov    edx, dword ptr [esi+8]
00405B4A  |.  8B0E       |mov    ecx, dword ptr [esi]
00405B4C  |.  48          |dec    eax
00405B4D  |.  42          |inc    edx
00405B4E  |.  8956 08    |mov    dword ptr [esi+8], edx
00405B51  |.  8946 04    |mov    dword ptr [esi+4], eax
00405B54  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405B57  |.  33D2       |xor    edx, edx
00405B59  |.  8A11       |mov    dl, byte ptr [ecx]
00405B5B  |.  8BFB       |mov    edi, ebx
00405B5D  |.  8B48 08    |mov    ecx, dword ptr [eax+8]
00405B60  |.  C1E2 08    |shl    edx, 8
00405B63  |.  03CA       |add    ecx, edx
00405B65  |.  8948 08    |mov    dword ptr [eax+8], ecx
00405B68  |.  8B06       |mov    eax, dword ptr [esi]
00405B6A  |.  40          |inc    eax
00405B6B  |.  8906       |mov    dword ptr [esi], eax
00405B6D  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405B70  |.  C700 0B000000 |mov    dword ptr [eax], 0B
00405B76  |>  8B46 04    |mov    eax, dword ptr [esi+4]                   ;  Case B of switch 00405967
00405B79  |.  85C0       |test eax, eax
00405B7B  |.  74 60       |je    short 00405BDD
00405B7D  |.  8B56 08    |mov    edx, dword ptr [esi+8]
00405B80  |.  8B0E       |mov    ecx, dword ptr [esi]
00405B82  |.  48          |dec    eax
00405B83  |.  42          |inc    edx
00405B84  |.  8946 04    |mov    dword ptr [esi+4], eax
00405B87  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405B8A  |.  8956 08    |mov    dword ptr [esi+8], edx
00405B8D  |.  33D2       |xor    edx, edx
00405B8F  |.  8A11       |mov    dl, byte ptr [ecx]
00405B91  |.  8B48 08    |mov    ecx, dword ptr [eax+8]
00405B94  |.  03CA       |add    ecx, edx
00405B96  |.  8BFB       |mov    edi, ebx
00405B98  |.  8948 08    |mov    dword ptr [eax+8], ecx
00405B9B  |.  8B06       |mov    eax, dword ptr [esi]
00405B9D  |.  40          |inc    eax
00405B9E  |.  8906       |mov    dword ptr [esi], eax
00405BA0  |.  8B46 1C    |mov    eax, dword ptr [esi+1C]
00405BA3  |.  8B48 04    |mov    ecx, dword ptr [eax+4]
00405BA6  |.  8B50 08    |mov    edx, dword ptr [eax+8]
00405BA9  |.  3BCA       |cmp    ecx, edx
00405BAB  |.  0F84 3F010000 |je    00405CF0
00405BB1  |.  C700 0D000000 |mov    dword ptr [eax], 0D
00405BB7  |.  8B56 1C    |mov    edx, dword ptr [esi+1C]
00405BBA  |.  C746 18 20C14>|mov    dword ptr [esi+18], 0043C120             ;  ASCII "incorrect data check"
00405BC1  |.  896A 04    |mov    dword ptr [edx+4], ebp
00405BC4  |.^ E9 99FDFFFF \jmp    00405962
00405BC9  |>  8B46 1C    mov    eax, dword ptr [esi+1C]
00405BCC  |.  8B5C24 18    mov    ebx, dword ptr [esp+18]
00405BD0  |.  C700 02000000 mov    dword ptr [eax], 2
00405BD6  |>  8B46 04    mov    eax, dword ptr [esi+4]                      ;  Case 2 of switch 00405967
00405BD9  |.  85C0       test eax, eax
00405BDB  |.  75 07       jnz    short 00405BE4
00405BDD  |>  8BC7       mov    eax, edi
00405BDF  |.  5F          pop    edi
00405BE0  |.  5E          pop    esi
00405BE1  |.  5D          pop    ebp
00405BE2  |.  5B          pop    ebx
00405BE3  |.  C3          retn
00405BE4  |>  8B56 08    mov    edx, dword ptr [esi+8]
00405BE7  |.  8B0E       mov    ecx, dword ptr [esi]
00405BE9  |.  48          dec    eax
00405BEA  |.  42          inc    edx
00405BEB  |.  8956 08    mov    dword ptr [esi+8], edx
00405BEE  |.  33D2       xor    edx, edx
00405BF0  |.  8946 04    mov    dword ptr [esi+4], eax
00405BF3  |.  8A11       mov    dl, byte ptr [ecx]
00405BF5  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405BF8  |.  8BFB       mov    edi, ebx
00405BFA  |.  C1E2 18    shl    edx, 18
00405BFD  |.  8950 08    mov    dword ptr [eax+8], edx
00405C00  |.  8B06       mov    eax, dword ptr [esi]
00405C02  |.  8B4E 1C    mov    ecx, dword ptr [esi+1C]
00405C05  |.  40          inc    eax
00405C06  |.  8906       mov    dword ptr [esi], eax
00405C08  |.  C701 03000000 mov    dword ptr [ecx], 3
00405C0E  |>  8B46 04    mov    eax, dword ptr [esi+4]                      ;  Case 3 of switch 00405967
00405C11  |.  85C0       test eax, eax
00405C13  |.  75 07       jnz    short 00405C1C
00405C15  |.  8BC7       mov    eax, edi
00405C17  |.  5F          pop    edi
00405C18  |.  5E          pop    esi
00405C19  |.  5D          pop    ebp
00405C1A  |.  5B          pop    ebx
00405C1B  |.  C3          retn
00405C1C  |>  8B16       mov    edx, dword ptr [esi]
00405C1E  |.  48          dec    eax
00405C1F  |.  8946 04    mov    dword ptr [esi+4], eax
00405C22  |.  8B46 08    mov    eax, dword ptr [esi+8]
00405C25  |.  40          inc    eax
00405C26  |.  33C9       xor    ecx, ecx
00405C28  |.  8946 08    mov    dword ptr [esi+8], eax
00405C2B  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405C2E  |.  8A0A       mov    cl, byte ptr [edx]
00405C30  |.  8BFB       mov    edi, ebx
00405C32  |.  8B50 08    mov    edx, dword ptr [eax+8]
00405C35  |.  C1E1 10    shl    ecx, 10
00405C38  |.  03D1       add    edx, ecx
00405C3A  |.  8950 08    mov    dword ptr [eax+8], edx
00405C3D  |.  8B06       mov    eax, dword ptr [esi]
00405C3F  |.  8B56 1C    mov    edx, dword ptr [esi+1C]
00405C42  |.  40          inc    eax
00405C43  |.  8906       mov    dword ptr [esi], eax
00405C45  |.  C702 04000000 mov    dword ptr [edx], 4
00405C4B  |>  8B46 04    mov    eax, dword ptr [esi+4]                      ;  Case 4 of switch 00405967
00405C4E  |.  85C0       test eax, eax
00405C50  |.  75 07       jnz    short 00405C59
00405C52  |.  8BC7       mov    eax, edi
00405C54  |.  5F          pop    edi
00405C55  |.  5E          pop    esi
00405C56  |.  5D          pop    ebp
00405C57  |.  5B          pop    ebx
00405C58  |.  C3          retn
00405C59  |>  8B0E       mov    ecx, dword ptr [esi]
00405C5B  |.  48          dec    eax
00405C5C  |.  8946 04    mov    dword ptr [esi+4], eax
00405C5F  |.  8B46 08    mov    eax, dword ptr [esi+8]
00405C62  |.  40          inc    eax
00405C63  |.  33D2       xor    edx, edx
00405C65  |.  8946 08    mov    dword ptr [esi+8], eax
00405C68  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405C6B  |.  8A11       mov    dl, byte ptr [ecx]
00405C6D  |.  8BFB       mov    edi, ebx
00405C6F  |.  8B48 08    mov    ecx, dword ptr [eax+8]
00405C72  |.  C1E2 08    shl    edx, 8
00405C75  |.  03CA       add    ecx, edx
00405C77  |.  8948 08    mov    dword ptr [eax+8], ecx
00405C7A  |.  8B06       mov    eax, dword ptr [esi]
00405C7C  |.  40          inc    eax
00405C7D  |.  8906       mov    dword ptr [esi], eax
00405C7F  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405C82  |.  8928       mov    dword ptr [eax], ebp
00405C84  |>  8B46 04    mov    eax, dword ptr [esi+4]                      ;  Case 5 of switch 00405967
00405C87  |.  85C0       test eax, eax
00405C89  |.  75 07       jnz    short 00405C92
00405C8B  |.  8BC7       mov    eax, edi
00405C8D  |.  5F          pop    edi
00405C8E  |.  5E          pop    esi
00405C8F  |.  5D          pop    ebp
00405C90  |.  5B          pop    ebx
00405C91  |.  C3          retn
00405C92  |>  8B56 08    mov    edx, dword ptr [esi+8]
00405C95  |.  8B0E       mov    ecx, dword ptr [esi]
00405C97  |.  48          dec    eax
00405C98  |.  42          inc    edx
00405C99  |.  8946 04    mov    dword ptr [esi+4], eax
00405C9C  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405C9F  |.  8956 08    mov    dword ptr [esi+8], edx
00405CA2  |.  33D2       xor    edx, edx
00405CA4  |.  8A11       mov    dl, byte ptr [ecx]
00405CA6  |.  8B48 08    mov    ecx, dword ptr [eax+8]
00405CA9  |.  03CA       add    ecx, edx
00405CAB  |.  5F          pop    edi
00405CAC  |.  8948 08    mov    dword ptr [eax+8], ecx
00405CAF  |.  8B06       mov    eax, dword ptr [esi]
00405CB1  |.  40          inc    eax
00405CB2  |.  8906       mov    dword ptr [esi], eax
00405CB4  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405CB7  |.  8B48 08    mov    ecx, dword ptr [eax+8]
00405CBA  |.  894E 30    mov    dword ptr [esi+30], ecx
00405CBD  |.  5E          pop    esi
00405CBE  |.  C700 06000000 mov    dword ptr [eax], 6
00405CC4  |.  5D          pop    ebp
00405CC5  |.  B8 02000000 mov    eax, 2
00405CCA  |.  5B          pop    ebx
00405CCB  |.  C3          retn
00405CCC  |>  8B56 1C    mov    edx, dword ptr [esi+1C]                   ;  Case 6 of switch 00405967
00405CCF  |.  C702 0D000000 mov    dword ptr [edx], 0D
00405CD5  |.  8B46 1C    mov    eax, dword ptr [esi+1C]
00405CD8  |.  C746 18 38C14>mov    dword ptr [esi+18], 0043C138                ;  ASCII "need dictionary"
00405CDF  |.  C740 04 00000>mov    dword ptr [eax+4], 0
00405CE6  |>  5F          pop    edi                                        ;  Default case of switch 00405967
00405CE7  |.  5E          pop    esi
00405CE8  |.  5D          pop    ebp
00405CE9  |.  B8 FEFFFFFF mov    eax, -2
00405CEE  |.  5B          pop    ebx
00405CEF  |.  C3          retn
00405CF0  |>  8B4E 1C    mov    ecx, dword ptr [esi+1C]
00405CF3  |.  C701 0C000000 mov    dword ptr [ecx], 0C
00405CF9  |>  5F          pop    edi                                        ;  Case C of switch 00405967
00405CFA  |.  5E          pop    esi
00405CFB  |.  5D          pop    ebp
00405CFC  |.  B8 01000000 mov    eax, 1
00405D01  |.  5B          pop    ebx
00405D02  |.  C3          retn
00405D03  |>  5F          pop    edi                                        ;  Case D of switch 00405967
00405D04  |.  5E          pop    esi
00405D05  |.  5D          pop    ebp
00405D06  |.  B8 FDFFFFFF mov    eax, -3
00405D0B  |.  5B          pop    ebx
00405D0C  \.  C3          retn
00405D0D    8D49 00    lea    ecx, dword ptr [ecx]
00405D10 .  77594000    dd    Patch.00405977                            ;  分支表被用于 00405970
00405D14 .  EE594000    dd    Patch.004059EE
00405D18 .  D65B4000    dd    Patch.00405BD6
00405D1C .  0E5C4000    dd    Patch.00405C0E
00405D20 .  4B5C4000    dd    Patch.00405C4B
00405D24 .  845C4000    dd    Patch.00405C84
00405D28 .  CC5C4000    dd    Patch.00405CCC
00405D2C .  605A4000    dd    Patch.00405A60
00405D30 .  CD5A4000    dd    Patch.00405ACD
00405D34 .  025B4000    dd    Patch.00405B02
00405D38 .  3C5B4000    dd    Patch.00405B3C
00405D3C .  765B4000    dd    Patch.00405B76
00405D40 .  F95C4000    dd    Patch.00405CF9
00405D44 .  035D4000    dd    Patch.00405D03

有人说是 zlib 解压  可我用 zlib压缩的文件无法实现解压

[课程]FART 脱壳王！加量不加价！FART作者讲授！

收藏・1

免费・0

支持

分享

最新回复 (9)
yangjh 雪币： 335 活跃值： (91) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 55 粉丝 0 关注私信	yangjh 2 楼我是來看樓主這個核潛艇的..... 2011-12-14 08:50 0
justlovemm 雪币： 208 活跃值： (40) 能力值： ( LV3，RANK：20 ) 在线值：发帖 33 回帖 605 粉丝 0 关注私信	justlovemm 3 楼我是来看楼上头像的美腿的， 2011-12-14 12:47 0
网络游侠雪币： 0 活跃值： (954) 能力值： ( LV3，RANK：30 ) 在线值：发帖 19 回帖 971 粉丝 14 关注私信	网络游侠 4 楼扣代码吧！ 2011-12-14 14:23 0
baohongyu 雪币： 306 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 29 回帖 211 粉丝 0 关注私信	baohongyu 5 楼 ida + f5 会对你有点帮助。 2011-12-14 17:01 0
siru 雪币： 194 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 4 粉丝 0 关注私信	siru 6 楼多谢我试一下 2011-12-14 18:50 0
sessiondiy 雪币： 2067 活跃值： (82) 能力值： ( LV9，RANK：180 ) 在线值：发帖 37 回帖 3244 粉丝 6 关注私信	sessiondiy 4 7 楼试试使用易语言的压缩库 2011-12-14 19:14 0
疯子雪币： 2242 活跃值： (488) 能力值： ( LV9，RANK：200 ) 在线值：发帖 9 回帖 461 粉丝 8 关注私信	疯子 4 8 楼应该是zlib，试试1.1.4和1.2.x版本 2011-12-14 19:36 0
siru 雪币： 194 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 4 粉丝 0 关注私信	siru 9 楼应该是 zlib 1.1.3 好像直接用 zilb compress 的文件不可以用这个解压用ida 查看好像有个inflate 1.1.3 copyright 1995-1998 mark adler 但网上又查不到 zlib inflate 和 deflate 的具体用法 2011-12-14 22:15 0
siru 雪币： 194 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 4 粉丝 0 关注私信	siru 10 楼确认是 zlib 1.1.3 原来用 zilb compress 压缩的文件不能解压是因为带有 zlib头和zlib尾改了之后压缩16K以下的文件可以正常解压可16K以是的文件就不行了。。。 2011-12-16 02:27 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

返回

siru

发帖

回帖

RANK

他的文章

大牛帮忙看看这个算法 4193

看雪公众号

专注于PC、移动、智能设备安全研究及逆向工程的开发者社区

//