为什么我脱upx的壳时老是死循环啊??
10030BA5 /0F85 8601000>jnz stream.10030D31
10030BAB |60 pushad 入
10030BAC |BE 00E00110 mov esi,stream.1001E000
10030BB1 |8DBE 0030FEF>lea edi,dword ptr ds:[esi+FFFE3000]
10030BB7 |57 push edi
10030BB8 |83CD FF or ebp,FFFFFFFF
10030BBB |EB 0D jmp short stream.10030BCA
10030BBD |90 nop
10030BBE |90 nop
10030BBF |90 nop
10030BC0 |8A06 mov al,byte ptr ds:[esi]
10030BC2 |46 inc esi
10030BC3 |8807 mov byte ptr ds:[edi],al
10030BC5 |47 inc edi
10030BC6 |01DB add ebx,ebx
10030BC8 |75 07 jnz short stream.10030BD1
10030BCA |8B1E mov ebx,dword ptr ds:[esi]
10030BCC |83EE FC sub esi,-4
10030BCF |11DB adc ebx,ebx
10030BD1 ^|72 ED jb short stream.10030BC0
10030BD3 |B8 01000000 mov eax,1
10030BD8 |01DB add ebx,ebx
10030BDA |75 07 jnz short stream.10030BE3
10030BDC |8B1E mov ebx,dword ptr ds:[esi]
10030BDE |83EE FC sub esi,-4
10030BE1 |11DB adc ebx,ebx
10030BE3 |11C0 adc eax,eax
10030BE5 |01DB add ebx,ebx
10030BE7 ^|73 EF jnb short stream.10030BD8
10030BE9 |75 09 jnz short stream.10030BF4
10030BEB |8B1E mov ebx,dword ptr ds:[esi]
10030BED |83EE FC sub esi,-4
10030BF0 |11DB adc ebx,ebx
10030BF2 ^|73 E4 jnb short stream.10030BD8
10030BF4 |31C9 xor ecx,ecx
10030BF6 |83E8 03 sub eax,3
10030BF9 |72 0D jb short stream.10030C08
10030BFB |C1E0 08 shl eax,8
10030BFE |8A06 mov al,byte ptr ds:[esi]
10030C00 |46 inc esi
10030C01 |83F0 FF xor eax,FFFFFFFF
10030C04 |74 74 je short stream.10030C7A
10030C06 |89C5 mov ebp,eax
10030C08 |01DB add ebx,ebx
10030C0A |75 07 jnz short stream.10030C13
10030C0C |8B1E mov ebx,dword ptr ds:[esi]
10030C0E |83EE FC sub esi,-4
10030C11 |11DB adc ebx,ebx
10030C13 |11C9 adc ecx,ecx
10030C15 |01DB add ebx,ebx
10030C17 |75 07 jnz short stream.10030C20
10030C19 |8B1E mov ebx,dword ptr ds:[esi]
10030C1B |83EE FC sub esi,-4
10030C1E |11DB adc ebx,ebx
10030C20 |11C9 adc ecx,ecx
10030C22 |75 20 jnz short stream.10030C44
10030C24 |41 inc ecx
10030C25 |01DB add ebx,ebx
10030C27 |75 07 jnz short stream.10030C30
10030C29 |8B1E mov ebx,dword ptr ds:[esi]
10030C2B |83EE FC sub esi,-4
10030C2E |11DB adc ebx,ebx
10030C30 |11C9 adc ecx,ecx
10030C32 |01DB add ebx,ebx
10030C34 ^|73 EF jnb short stream.10030C25
10030C36 |75 09 jnz short stream.10030C41
10030C38 |8B1E mov ebx,dword ptr ds:[esi]
10030C3A |83EE FC sub esi,-4
10030C3D |11DB adc ebx,ebx
10030C3F ^|73 E4 jnb short stream.10030C25
10030C41 |83C1 02 add ecx,2
10030C44 |81FD 00F3FFF>cmp ebp,-0D00
10030C4A |83D1 01 adc ecx,1
10030C4D |8D142F lea edx,dword ptr ds:[edi+ebp]
10030C50 |83FD FC cmp ebp,-4
10030C53 |76 0F jbe short stream.10030C64
10030C55 |8A02 mov al,byte ptr ds:[edx]
10030C57 |42 inc edx
10030C58 |8807 mov byte ptr ds:[edi],al
10030C5A |47 inc edi
10030C5B |49 dec ecx
10030C5C ^|75 F7 jnz short stream.10030C55
10030C5E ^|E9 63FFFFFF jmp stream.10030BC6
10030C63 |90 nop
10030C64 |8B02 mov eax,dword ptr ds:[edx]
10030C66 |83C2 04 add edx,4
10030C69 |8907 mov dword ptr ds:[edi],eax
10030C6B |83C7 04 add edi,4
10030C6E |83E9 04 sub ecx,4
10030C71 ^|77 F1 ja short stream.10030C64
10030C73 |01CF add edi,ecx
10030C75 ^|E9 4CFFFFFF jmp stream.10030BC6
10030C7A |5E pop esi
10030C7B |89F7 mov edi,esi
10030C7D |B9 FE0A0000 mov ecx,0AFE
10030C82 |8A07 mov al,byte ptr ds:[edi]
10030C84 |47 inc edi
10030C85 |2C E8 sub al,0E8
10030C87 |3C 01 cmp al,1
10030C89 ^|77 F7 ja short stream.10030C82
10030C8B |803F 0E cmp byte ptr ds:[edi],0E
10030C8E ^|75 F2 jnz short stream.10030C82
10030C90 |8B07 mov eax,dword ptr ds:[edi]
10030C92 |8A5F 04 mov bl,byte ptr ds:[edi+4]
10030C95 |66:C1E8 08 shr ax,8
10030C99 |C1C0 10 rol eax,10
10030C9C |86C4 xchg ah,al
10030C9E |29F8 sub eax,edi
10030CA0 |80EB E8 sub bl,0E8
10030CA3 |01F0 add eax,esi
10030CA5 |8907 mov dword ptr ds:[edi],eax
10030CA7 |83C7 05 add edi,5
10030CAA |89D8 mov eax,ebx
10030CAC ^|E2 D9 loopd short stream.10030C87这里就循环啊!
走不出了!!请高手指点
附件:stream.rar
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!