打开脱壳后文件,程序弹出错误提示,然后程序也不退出,一直弹出错误对话框
程序入口是这样的
007E4FDC > 55 push ebp
007E4FDD 8BEC mov ebp,esp
007E4FDF B9 05000000 mov ecx,0x5
007E4FE4 6A 00 push 0x0
007E4FE6 6A 00 push 0x0
007E4FE8 49 dec ecx
007E4FE9 ^ 75 F9 jnz short unpack.007E4FE4
007E4FEB 53 push ebx
007E4FEC 56 push esi
007E4FED 57 push edi
007E4FEE B8 10467D00 mov eax,unpack.007D4610
007E4FF3 E8 38ACC2FF call unpack.0040FC30
007E4FF8 8B1D 40437F00 mov ebx,dword ptr ds:[0x7F4340] ; unpack.007FA3EC
007E4FFE 33C0 xor eax,eax ; kernel32.BaseThreadInitThunk
007E5000 55 push ebp
007E5001 68 D9527E00 push unpack.007E52D9
007E5006 64:FF30 push dword ptr fs:[eax]
007E5009 64:8920 mov dword ptr fs:[eax],esp
007E500C A1 5C457F00 mov eax,dword ptr ds:[0x7F455C]
007E5011 66:C780 BE00000>mov word ptr ds:[eax+0xBE],0x2E
007E501A 6A 01 push 0x1
007E501C A1 34477F00 mov eax,dword ptr ds:[0x7F4734]
007E5021 B9 01000000 mov ecx,0x1
007E5026 8B15 F4194200 mov edx,dword ptr ds:[0x4219F4] ; unpack.004219F8
007E502C E8 277EC2FF call unpack.0040CE58
007E5031 83C4 04 add esp,0x4
007E5034 A1 34477F00 mov eax,dword ptr ds:[0x7F4734]
007E5039 8B00 mov eax,dword ptr ds:[eax]
007E503B BA F4527E00 mov edx,unpack.007E52F4
007E5040 E8 E35CC2FF call unpack.0040AD28
007E5045 6A 01 push 0x1
007E5047 A1 B43F7F00 mov eax,dword ptr ds:[0x7F3FB4]
007E504C B9 01000000 mov ecx,0x1
007E5051 8B15 241A4200 mov edx,dword ptr ds:[0x421A24] ; unpack.00421A28
007E5057 E8 FC7DC2FF call unpack.0040CE58
007E505C 83C4 04 add esp,0x4
007E505F A1 B43F7F00 mov eax,dword ptr ds:[0x7F3FB4]
用bp CreateFileA断点运行,程序直接跑起来了,断不下来
未脱壳文件:
http://pan.baidu.com/share/link?shareid=1132602126&uk=1780446887
脱壳后文件:
http://pan.baidu.com/share/link?shareid=1139392061&uk=1780446887
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)