能力值：
( LV2，RANK：10 )
|
-
-
2 楼
今天遇到同样的问题了
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
请大大分析一下!
|
能力值：
( LV3，RANK：30 )
|
-
-
4 楼
瞎跟了几下脱了。帮你修复了
1000FD17 >/$ 55 push ebp
1000FD18 |. 8BEC mov ebp, esp
1000FD1A |. 51 push ecx
1000FD1B |. 51 push ecx
1000FD1C |. 837D 0C 01 cmp dword ptr [ebp+C], 1
1000FD20 |. 56 push esi
1000FD21 |. 0F85 93000000 jnz 1000FDBA
1000FD27 |. 53 push ebx
1000FD28 |. 57 push edi
1000FD29 |. 33FF xor edi, edi
1000FD2B |. 897D 0C mov dword ptr [ebp+C], edi
1000FD2E |. E8 E50B0000 call <jmp.&mfc42.#1116>
1000FD33 |. E8 DA0B0000 call <jmp.&mfc42.#1176>
1000FD38 |. 57 push edi
1000FD39 |. 68 A4EC0110 push 1001ECA4
1000FD3E |. 57 push edi
1000FD3F |. 8BF0 mov esi, eax
1000FD41 |. FF75 08 push dword ptr [ebp+8]
1000FD44 |. 8B5E 08 mov ebx, dword ptr [esi+8]
1000FD47 |. E8 C00B0000 call <jmp.&mfc42.#1575>
1000FD4C |. 85C0 test eax, eax
1000FD4E |. 74 1E je short 1000FD6E
1000FD50 |. E8 B10B0000 call <jmp.&mfc42.#1168>
1000FD55 |. 8B78 04 mov edi, dword ptr [eax+4]
|
能力值：
( LV2，RANK：10 )
|
-
-
5 楼
感谢提供帮助,不过你修复的还是无法运行!还请在帮忙看一下!
|
能力值：
( LV3，RANK：30 )
|
-
-
6 楼
有一个指针被我cut 了，你自己修复吧。我没那么多时间，好吧，在不行你自己修复吧，很容易的！
|
能力值：
( LV3，RANK：20 )
|
-
-
7 楼
有意义么？？？？？？？？？？、
|
能力值：
( LV2，RANK：10 )
|
-
-
8 楼
感谢,还是无法运行,我自己来修复吧!谢谢了!
|
能力值：
( LV3，RANK：30 )
|
-
-
9 楼
已经帮你解决了。
1:脱壳后修复两个IAT 分别是CreateFileA CloseHandle，
2:修复被偷掉的代码
1000FFC5 57 push edi
1000FFC6 56 push esi
1000FFC7 53 push ebx
1000FFC8 E8 15FFFFFF call dumped_.1000FEE2
1000FEE2:
未脱壳前当前代码:
1000FEE2 - E9 5A10AFF0 jmp 00B00F41
1000FEE7 088A 19C3EFC2 or byte ptr ds:[edx+C2EFC319],cl
1000FEED 66:0FB6D2 movzx dx,dl
1000FEF1 C3 retn
1000FEF2 93 xchg eax,ebx
1000FEF3 8902 mov dword ptr ds:[edx],eax
1000FEF5 C3 retn
1000FEF6 34 66 xor al,66
1000FEF8 0FB678 06 movzx edi,byte ptr ds:[eax+6]
1000FEFC C3 retn
1000FEFD 67:5A pop edx
1000FEFF 8A0E mov cl,byte ptr ds:[esi]
1000FF01 C3 retn
1000FF02 B3 90 mov bl,90
1000FF04 B2 14 mov dl,14
1000FF06 C3 retn
1000FF07 98 cwde
1000FF08 8BE8 mov ebp,eax
1000FF0A C3 retn
1000FF0B 9B wait
1000FF0C B8 80D80110 mov eax,UPX(未脱.1001D880
1000FF11 C3 retn
1000FF12 57 push edi
1000FF13 B5 C1 mov ch,0C1
1000FF15 - E9 04C346C1 jmp D147C21E
1000FF1A - E9 1FC3FBFC jmp 0CFCC23E
1000FF1F 8B1C9D 58DA0110 mov ebx,dword ptr ds:[ebx*4+1001DA58]
1000FF26 C3 retn
1000FF27 693B D6C3C9C1 imul edi,dword ptr ds:[ebx],C1C9C3D6
1000FF2D E5 08 in eax,8
1000FF2F C3 retn
1000FF30 1A03 sbb al,byte ptr ds:[ebx]
1000FF32 C1E7 05 shl edi,5
1000FF35 C3 retn
1000FF36 BF 608B3DAC mov edi,AC3D8B60
1000FF3B EC in al,dx
1000FF3C 0110 add dword ptr ds:[eax],edx
1000FF3E C3 retn
1000FF3F 4C dec esp
1000FF40 0C 0B or al,0B
1000FF42 D9C3 fld st(3)
1000FF44 49 dec ecx
1000FF45 8B1D B0EC0110 mov ebx,dword ptr ds:[1001ECB0]
1000FF4B C3 retn
1000FF4C F3: prefix rep:
1000FF4D 8BDE mov ebx,esi
1000FF4F C3 retn
1000FF50 50 push eax
3:替换代码的如下
1000FEE2 8B4424 08 mov eax,dword ptr ss:[esp+8]
1000FEE6 85C0 test eax,eax
1000FEE8 75 0E jnz short dumped_3.1000FEF8
1000FEEA 3905 C4FD0110 cmp dword ptr ds:[1001FDC4],eax
1000FEF0 7E 2E jle short dumped_3.1000FF20
1000FEF2 FF0D C4FD0110 dec dword ptr ds:[1001FDC4]
1000FEF8 8B0D 68110110 mov ecx,dword ptr ds:[10011168] ; msvcrt._adjust_fdiv
1000FEFE 83F8 01 cmp eax,1
1000FF01 8B09 mov ecx,dword ptr ds:[ecx]
1000FF03 890D F0FD0110 mov dword ptr ds:[1001FDF0],ecx
1000FF09 75 3F jnz short dumped_3.1000FF4A
1000FF0B 68 80000000 push 80
1000FF10 FF15 90110110 call dword ptr ds:[10011190] ; msvcrt.malloc
1000FF16 85C0 test eax,eax
1000FF18 59 pop ecx
1000FF19 A3 F8FD0110 mov dword ptr ds:[1001FDF8],eax
1000FF1E 75 04 jnz short dumped_3.1000FF24
1000FF20 33C0 xor eax,eax
1000FF22 EB 66 jmp short dumped_3.1000FF8A
1000FF24 8320 00 and dword ptr ds:[eax],0
1000FF27 A1 F8FD0110 mov eax,dword ptr ds:[1001FDF8]
1000FF2C 68 0C200110 push dumped_3.1001200C
1000FF31 68 00200110 push dumped_3.10012000
1000FF36 A3 F4FD0110 mov dword ptr ds:[1001FDF4],eax
1000FF3B E8 36010000 call <jmp.&msvcrt.#316>
1000FF40 FF05 C4FD0110 inc dword ptr ds:[1001FDC4]
1000FF46 59 pop ecx
1000FF47 59 pop ecx
1000FF48 EB 3D jmp short dumped_3.1000FF87
1000FF4A 85C0 test eax,eax
1000FF4C 75 39 jnz short dumped_3.1000FF87
1000FF4E A1 F8FD0110 mov eax,dword ptr ds:[1001FDF8]
1000FF53 85C0 test eax,eax
1000FF55 74 30 je short dumped_3.1000FF87
1000FF57 8B0D F4FD0110 mov ecx,dword ptr ds:[1001FDF4]
1000FF5D 56 push esi
1000FF5E 8D71 FC lea esi,dword ptr ds:[ecx-4]
1000FF61 3BF0 cmp esi,eax
1000FF63 72 12 jb short dumped_3.1000FF77
1000FF65 8B0E mov ecx,dword ptr ds:[esi]
1000FF67 85C9 test ecx,ecx
1000FF69 74 07 je short dumped_3.1000FF72
1000FF6B FFD1 call ecx
1000FF6D A1 F8FD0110 mov eax,dword ptr ds:[1001FDF8]
1000FF72 83EE 04 sub esi,4
1000FF75 ^ EB EA jmp short dumped_3.1000FF61
1000FF77 50 push eax
1000FF78 FF15 9C110110 call dword ptr ds:[1001119C] ; msvcrt.free
1000FF7E 8325 F8FD0110 00 and dword ptr ds:[1001FDF8],0
1000FF85 59 pop ecx
1000FF86 5E pop esi
1000FF87 6A 01 push 1
1000FF89 58 pop eax
1000FF8A C2 0C00 retn 0C
|
能力值：
( LV2，RANK：10 )
|
-
-
10 楼
大虾 路过看看！
|
能力值：
( LV2，RANK：10 )
|
-
-
11 楼
这段代码怎么这么熟悉？
|
能力值：
( LV2，RANK：10 )
|
-
-
12 楼
咕~~(╯﹏╰)b ...
|
