网上下载的练手脱壳程序,是一个ZP1.49的程序,来到OEP,脱壳修复发现了怪事
004B15BF 55 push ebp -----OEP
004B15C0 8BEC mov ebp,esp
004B15C2 6A FF push -0x1
004B15C4 68 D0994B00 push 该程序求.004B99D0
004B15C9 68 46174B00 push 该程序求.004B1746
004B15CE 64:A1 00000000 mov eax,dword ptr fs:[0]
004B15D4 50 push eax
004B15D5 64:8925 0000000>mov dword ptr fs:[0],esp
004B15DC 83EC 68 sub esp,0x68
004B15DF 53 push ebx
004B15E0 56 push esi
004B15E1 57 push edi
004B15E2 8965 E8 mov dword ptr ss:[ebp-0x18],esp
004B15E5 33DB xor ebx,ebx
004B15E7 895D FC mov dword ptr ss:[ebp-0x4],ebx
004B15EA 6A 02 push 0x2
004B15EC FF15 BC534B00 call dword ptr ds:[0x4B53BC]
004B15F2 59 pop ecx
004B15F3 830D 38C34C04 F>or dword ptr ds:[0x44CC338],0xFFFFFFFF
004B15FA 830D 3CC34C04 F>or dword ptr ds:[0x44CC33C],0xFFFFFFFF
004B1601 FF15 C0534B00 call dword ptr ds:[0x4B53C0]
004B1607 8B0D 2CC34C04 mov ecx,dword ptr ds:[0x44CC32C]
004B160D 8908 mov dword ptr ds:[eax],ecx
004B160F FF15 C4534B00 call dword ptr ds:[0x4B53C4]
004B1615 8B0D 28C34C04 mov ecx,dword ptr ds:[0x44CC328]
004B161B 8908 mov dword ptr ds:[eax],ecx
004B161D A1 C8534B00 mov eax,dword ptr ds:[0x4B53C8]
004B1622 8B00 mov eax,dword ptr ds:[eax]
004B1624 A3 34C34C04 mov dword ptr ds:[0x44CC334],eax
004B1629 E8 17010000 call 该程序求.004B1745
因该是VC++的
然后脱壳修复找到OEP为415BF
填入ImportREC中居然出现这个
请大牛求解
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课