脱壳高手帮忙看看这个软件是什么壳？？-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

最新回复 (11)
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 2 楼简单的UPX 004071B8 6A 60 push 60 004071BA 68 A8294200 push chess.004229A8 004071BF E8 EC0A0000 call chess.00407CB0 004071C4 BF 94000000 mov edi,94 004071C9 8BC7 mov eax,edi 004071CB E8 B0FBFFFF call chess.00406D80 004071D0 8965 E8 mov dword ptr ss:[ebp-18],esp 004071D3 8BF4 mov esi,esp 004071D5 893E mov dword ptr ds:[esi],edi 004071D7 56 push esi 004071D8 FF15 80024200 call dword ptr ds:[420280] ; kernel32.GetVersionExA 004071DE 8B4E 10 mov ecx,dword ptr ds:[esi+10] 2005-11-14 20:51 0
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 3 楼补充一句，脱完后还有自销毁程序等着您 2005-11-14 20:53 0
fly 雪币： 898 活跃值： (4039) 能力值： ( LV9，RANK：3410 ) 在线值：发帖 294 回帖 7686 粉丝 32 关注私信	fly 85 4 楼确切都说外面是一层其他东西，里面是UPX 0043A8A7 61 popad 0043A8A8 E9 0BC9FCFF jmp 004071B8 2005-11-14 20:57 0
hcfhcf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 22 粉丝 0 关注私信	hcfhcf 5 楼朋友，你用什么反汇编的啊，我用W32DASM怎么看不到和你贴出来的一样的代码啊？？ 2005-11-14 21:01 0
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 6 楼自杀地点： 00403053 8D4C24 08 lea ecx,dword ptr ss:[esp+8] 00403057 899C24 E0020000 mov dword ptr ss:[esp+2E0],ebx 0040305E E8 EE540100 call 1_.00418551 00403063 3D 00B60100 cmp eax,1B600 00403068 0F85 40010000 jnz 1_.004031AE //就是这个坏东东！ 0040306E 3BD3 cmp edx,ebx 00403070 0F85 38010000 jnz 1_.004031AE 00403076 8D9424 A8000000 lea edx,dword ptr ss:[esp+A8] 2005-11-14 21:05 0
hcfhcf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 22 粉丝 0 关注私信	hcfhcf 7 楼谢谢了各位朋友，慢慢研究呵呵 2005-11-14 21:19 0
无聊的菜鸟雪币： 622 活跃值： (294) 能力值： ( LV13，RANK：410 ) 在线值：发帖 59 回帖 561 粉丝 5 关注私信	无聊的菜鸟 9 8 楼不止，要自杀的地方还很多，改跳转的话还要改大概3个。后面爆注册的话，还会自杀。。。。。 2005-11-14 21:29 0
aki 雪币： 223 活跃值： (70) 能力值： ( LV6，RANK：90 ) 在线值：发帖 17 回帖 592 粉丝 0 关注私信	aki 2 9 楼作者注册用户名单 http://home.qyun.net/cranley/regcode.txt 2005-11-15 10:21 0
hcfhcf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 22 粉丝 0 关注私信	hcfhcf 10 楼壳已经脱了，但是运行的时候却出错，是正常的吗？ 2005-11-16 10:55 0
hcfhcf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 22 粉丝 0 关注私信	hcfhcf 11 楼哪位大哥能讲讲对付自杀程序的思路啊？谢谢，一点头绪都没有，郁闷 2005-11-17 17:17 0
hcfhcf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 22 粉丝 0 关注私信	hcfhcf 12 楼 0043A8D1 > $ 36: prefix ss: 0043A8D2 . 26:0FB7D9 movzx ebx,cx 0043A8D6 . 2E:47 inc edi 0043A8D8 . 1C 03 sbb al,3 0043A8DA . 0C 51 or al,51 0043A8DC . 48 dec eax 0043A8DD . 13F5 adc esi,ebp 0043A8DF . 0FBEEA movsx ebp,dl 0043A8E2 . 43 inc ebx 0043A8E3 . 2E:BE 756497F>mov esi,FE976475 0043A8E9 . 2E:87F1 xchg ecx,esi 0043A8EC . 1AE2 sbb ah,dl 0043A8EE . C1F3 A1 sal ebx,0A1 0043A8F1 . 88F0 mov al,dh 0043A8F3 . 11EE adc esi,ebp 0043A8F5 . 65:0FCB bswap ebx 0043A8F8 . 0FB7CF movzx ecx,di 0043A8FB . 47 inc edi 0043A8FC . 86E7 xchg bh,ah 0043A8FE . D1F3 sal ebx,1 0043A900 . C1E1 DC shl ecx,0DC 0043A903 . 0FA4F7 1D shld edi,esi,1D 0043A907 . 0FA4F7 ED shld edi,esi,0ED 0043A90B . 0FBBF7 btc edi,esi 0043A90E . 0FACFD 3B shrd ebp,edi,3B 0043A912 . C0CA C9 ror dl,0C9 0043A915 . 0FBAE0 E7 bt eax,0E7 0043A919 . 0FBEF4 movsx esi,ah 0043A91C . 88D4 mov ah,dl 0043A91E . 0FC1DA xadd edx,ebx 0043A921 . 0FABC1 bts ecx,eax 0043A924 . 0FA5F7 shld edi,esi,cl 0043A927 . 0FBDEF bsr ebp,edi 0043A92A . 43 inc ebx 0043A92B . 81E1 E4177E49 and ecx,497E17E4 0043A931 . 0FBEC6 movsx eax,dh 0043A934 . 0FCF bswap edi 0043A936 . 80DC 53 sbb ah,53 0043A939 . 0FC0D5 xadd ch,dl 0043A93C . 89F9 mov ecx,edi 0043A93E . F7D6 not esi 0043A940 . 0FC0E7 xadd bh,ah 0043A943 . C1F3 F9 sal ebx,0F9 0043A946 . 0FBEC6 movsx eax,dh 0043A949 . 8BF5 mov esi,ebp 0043A94B . 88D4 mov ah,dl 0043A94D . 35 D150D34A xor eax,4AD350D1 0043A952 . C0DC 23 rcr ah,23 0043A955 . 80CA 71 or dl,71 0043A958 . 0FA3D8 bt eax,ebx 0043A95B . 3E:4D dec ebp 0043A95D . 0FB7D9 movzx ebx,cx 0043A960 . 23CF and ecx,edi 0043A962 . 8BF5 mov esi,ebp 0043A964 . D2DC rcr ah,cl 0043A966 . 0FBAFB 21 btc ebx,21 0043A96A . 38F0 cmp al,dh 0043A96C . C1D6 ED rcl esi,0ED 0043A96F . 0FBCFE bsf edi,esi 0043A972 . 0FBDEF bsr ebp,edi 0043A975 . 0FC1DA xadd edx,ebx 0043A978 . EB 01 jmp short chess.0043A97B 0043A97A . F4 hlt 0043A97B > 47 inc edi 0043A97C . 0FADFD shrd ebp,edi,cl 0043A97F . D1F3 sal ebx,1 0043A981 . 0FA5C1 shld ecx,eax,cl 0043A984 . C1D6 6D rcl esi,6D 0043A987 . 69FE 3D0C9FE6 imul edi,esi,E69F0C3D 0043A98D . FFC1 inc ecx 0043A98F . 85C3 test ebx,eax 0043A991 . 0FACFD 5B shrd ebp,edi,5B 0043A995 . 4A dec edx 0043A996 . 64:0FCF bswap edi 0043A999 . 65:0FA4D3 C1 shld ebx,edx,0C1 0043A99E . 26:69FE 8D1C6>imul edi,esi,766F1C8D 0043A9A5 . F7D1 not ecx 0043A9A7 . C7C6 2D3C0F96 mov esi,960F3C2D 0043A9AD . 0FC1C8 xadd eax,ecx 0043A9B0 . D1D6 rcl esi,1 0043A9B2 . 0FADFD shrd ebp,edi,cl 0043A9B5 . EB 01 jmp short chess.0043A9B8 0043A9B7 D9 db D9 0043A9B8 > 0FACD8 77 shrd eax,ebx,77 0043A9BC . 0FACCE 25 shrd esi,ecx,25 0043A9C0 . E8 00000000 call chess.0043A9C5 0043A9C5 /$ 59 pop ecx 0043A9C6 \|. 83C1 07 add ecx,7 0043A9C9 \|. 51 push ecx 0043A9CA \. C3 retn 0043A9CB > C3 retn 0043A9CC . BF 50A74300 mov edi,chess.0043A750 0043A9D1 . 57 push edi 0043A9D2 . B9 B0000000 mov ecx,0B0 0043A9D7 > 8137 06531C00 xor dword ptr ds:[edi],1C5306 0043A9DD . 51 push ecx 0043A9DE . 2BC9 sub ecx,ecx 0043A9E0 . B9 04000000 mov ecx,4 0043A9E5 > 83C7 01 add edi,1 0043A9E8 .^ E2 FB loopd short chess.0043A9E5 0043A9EA . 59 pop ecx 0043A9EB . 83E9 03 sub ecx,3 0043A9EE .^ E2 E7 loopd short chess.0043A9D7 0043A9F0 .^ EB D9 jmp short chess.0043A9CB 这里跳到下面，应该是UPX壳的起点吧？？ 0043A750 . 60 pushad 0043A751 . BE 00604200 mov esi,chess.00426000 0043A756 . 8DBE 00B0FDFF lea edi,dword ptr ds:[esi+FFFDB0> 0043A75C . 57 push edi 0043A75D . 83CD FF or ebp,FFFFFFFF 0043A760 . EB 10 jmp short chess.0043A772 0043A762 90 nop 0043A763 90 nop 0043A764 90 nop 0043A765 90 nop 0043A766 90 nop 0043A767 90 nop 0043A768 > 8A06 mov al,byte ptr ds:[esi] 0043A76A . 46 inc esi 0043A76B . 8807 mov byte ptr ds:[edi],al 0043A76D . 47 inc edi 0043A76E > 01DB add ebx,ebx 0043A770 . 75 07 jnz short chess.0043A779 0043A772 > 8B1E mov ebx,dword ptr ds:[esi] 0043A774 . 83EE FC sub esi,-4 0043A777 . 11DB adc ebx,ebx 0043A779 >^ 72 ED jb short chess.0043A768 0043A77B . B8 01000000 mov eax,1 0043A780 > 01DB add ebx,ebx 0043A782 . 75 07 jnz short chess.0043A78B 0043A784 . 8B1E mov ebx,dword ptr ds:[esi] 0043A786 . 83EE FC sub esi,-4 0043A789 . 11DB adc ebx,ebx 0043A78B > 11C0 adc eax,eax 0043A78D . 01DB add ebx,ebx 0043A78F .^ 73 EF jnb short chess.0043A780 0043A791 . 75 09 jnz short chess.0043A79C 0043A793 . 8B1E mov ebx,dword ptr ds:[esi] 0043A795 . 83EE FC sub esi,-4 0043A798 . 11DB adc ebx,ebx 0043A79A .^ 73 E4 jnb short chess.0043A780 0043A79C > 31C9 xor ecx,ecx 0043A79E . 83E8 03 sub eax,3 0043A7A1 . 72 0D jb short chess.0043A7B0 0043A7A3 . C1E0 08 shl eax,8 0043A7A6 . 8A06 mov al,byte ptr ds:[esi] 0043A7A8 . 46 inc esi 0043A7A9 . 83F0 FF xor eax,FFFFFFFF 0043A7AC . 74 74 je short chess.0043A822 0043A7AE . 89C5 mov ebp,eax 0043A7B0 > 01DB add ebx,ebx 0043A7B2 . 75 07 jnz short chess.0043A7BB 0043A7B4 . 8B1E mov ebx,dword ptr ds:[esi] 0043A7B6 . 83EE FC sub esi,-4 0043A7B9 . 11DB adc ebx,ebx 0043A7BB > 11C9 adc ecx,ecx 0043A7BD . 01DB add ebx,ebx 0043A7BF . 75 07 jnz short chess.0043A7C8 0043A7C1 . 8B1E mov ebx,dword ptr ds:[esi] 0043A7C3 . 83EE FC sub esi,-4 0043A7C6 . 11DB adc ebx,ebx 0043A7C8 > 11C9 adc ecx,ecx 0043A7CA . 75 20 jnz short chess.0043A7EC 0043A7CC . 41 inc ecx 0043A7CD > 01DB add ebx,ebx 0043A7CF . 75 07 jnz short chess.0043A7D8 0043A7D1 . 8B1E mov ebx,dword ptr ds:[esi] 0043A7D3 . 83EE FC sub esi,-4 0043A7D6 . 11DB adc ebx,ebx 0043A7D8 > 11C9 adc ecx,ecx 0043A7DA . 01DB add ebx,ebx 0043A7DC .^ 73 EF jnb short chess.0043A7CD 0043A7DE . 75 09 jnz short chess.0043A7E9 0043A7E0 . 8B1E mov ebx,dword ptr ds:[esi] 0043A7E2 . 83EE FC sub esi,-4 0043A7E5 . 11DB adc ebx,ebx 0043A7E7 .^ 73 E4 jnb short chess.0043A7CD 0043A7E9 > 83C1 02 add ecx,2 0043A7EC > 81FD 00F3FFFF cmp ebp,-0D00 0043A7F2 . 83D1 01 adc ecx,1 0043A7F5 . 8D142F lea edx,dword ptr ds:[edi+ebp] 0043A7F8 . 83FD FC cmp ebp,-4 0043A7FB . 76 0F jbe short chess.0043A80C 0043A7FD > 8A02 mov al,byte ptr ds:[edx] 0043A7FF . 42 inc edx 0043A800 . 8807 mov byte ptr ds:[edi],al 0043A802 . 47 inc edi 0043A803 . 49 dec ecx 0043A804 .^ 75 F7 jnz short chess.0043A7FD 0043A806 .^ E9 63FFFFFF jmp chess.0043A76E 0043A80B 90 nop 0043A80C > 8B02 mov eax,dword ptr ds:[edx] 0043A80E . 83C2 04 add edx,4 0043A811 . 8907 mov dword ptr ds:[edi],eax 0043A813 . 83C7 04 add edi,4 0043A816 . 83E9 04 sub ecx,4 0043A819 .^ 77 F1 ja short chess.0043A80C 0043A81B . 01CF add edi,ecx 0043A81D .^ E9 4CFFFFFF jmp chess.0043A76E 0043A822 > 5E pop esi 0043A823 . 89F7 mov edi,esi 0043A825 . B9 BC0C0000 mov ecx,0CBC 0043A82A > 8A07 mov al,byte ptr ds:[edi] 0043A82C . 47 inc edi 0043A82D . 2C E8 sub al,0E8 0043A82F > 3C 01 cmp al,1 0043A831 .^ 77 F7 ja short chess.0043A82A 0043A833 . 803F 0A cmp byte ptr ds:[edi],0A 0043A836 .^ 75 F2 jnz short chess.0043A82A 0043A838 . 8B07 mov eax,dword ptr ds:[edi] 0043A83A . 8A5F 04 mov bl,byte ptr ds:[edi+4] 0043A83D . 66:C1E8 08 shr ax,8 0043A841 . C1C0 10 rol eax,10 0043A844 . 86C4 xchg ah,al 0043A846 . 29F8 sub eax,edi 0043A848 . 80EB E8 sub bl,0E8 0043A84B . 01F0 add eax,esi 0043A84D . 8907 mov dword ptr ds:[edi],eax 0043A84F . 83C7 05 add edi,5 0043A852 . 89D8 mov eax,ebx 0043A854 .^ E2 D9 loopd short chess.0043A82F 0043A856 . 8DBE 00700300 lea edi,dword ptr ds:[esi+37000] 0043A85C > 8B07 mov eax,dword ptr ds:[edi] 0043A85E . 09C0 or eax,eax 0043A860 . 74 45 je short chess.0043A8A7 0043A862 . 8B5F 04 mov ebx,dword ptr ds:[edi+4] 0043A865 . 8D8430 A00304>lea eax,dword ptr ds:[eax+esi+40> 0043A86C . 01F3 add ebx,esi 0043A86E . 50 push eax 0043A86F . 83C7 08 add edi,8 0043A872 . FF96 90040400 call dword ptr ds:[esi+40490] 0043A878 . 95 xchg eax,ebp 0043A879 > 8A07 mov al,byte ptr ds:[edi] 0043A87B . 47 inc edi 0043A87C . 08C0 or al,al 0043A87E .^ 74 DC je short chess.0043A85C 0043A880 . 89F9 mov ecx,edi 0043A882 . 79 07 jns short chess.0043A88B 0043A884 . 0FB707 movzx eax,word ptr ds:[edi] 0043A887 . 47 inc edi 0043A888 . 50 push eax 0043A889 . 47 inc edi 0043A88A B9 db B9 0043A88B . 57 push edi 0043A88C . 48 dec eax 0043A88D . F2:AE repne scas byte ptr es:[edi] 0043A88F . 55 push ebp 0043A890 . FF96 94040400 call dword ptr ds:[esi+40494] 0043A896 . 09C0 or eax,eax 0043A898 . 74 07 je short chess.0043A8A1 0043A89A . 8903 mov dword ptr ds:[ebx],eax 0043A89C . 83C3 04 add ebx,4 0043A89F .^ EB D8 jmp short chess.0043A879 0043A8A1 > FF96 98040400 call dword ptr ds:[esi+40498] 0043A8A7 > 61 popad　　　　　 0043A8A8 .- E9 0BC9FCFF jmp chess.004071B8发现这个，应该UPX壳已经结束，下面就是跳到程序的入口 00401000 81EC 68040000 sub esp,468 00401006 A1 B08A4200 mov eax,dword ptr ds:[428AB0] 0040100B 898424 64040000 mov dword ptr ss:[esp+464],eax 00401012 68 04010000 push 104 00401017 8D4424 58 lea eax,dword ptr ss:[esp+58] 0040101B 50 push eax 0040101C 6A 00 push 0 0040101E FF15 94024200 call dword ptr ds:[420294] ; kernel32.GetModuleFileNameA 00401024 85C0 test eax,eax 00401026 0F84 10010000 je chess.0040113C 0040102C 68 04010000 push 104 00401031 8D8C24 5C010000 lea ecx,dword ptr ss:[esp+15C] 00401038 51 push ecx 00401039 68 2C054200 push chess.0042052C ; ASCII "COMSPEC" 0040103E FF15 98024200 call dword ptr ds:[420298] ; kernel32.GetEnvironmentVariableA 00401044 85C0 test eax,eax 00401046 0F84 F0000000 je chess.0040113C 0040104C 68 04010000 push 104 00401051 8D5424 58 lea edx,dword ptr ss:[esp+58] 00401055 52 push edx 00401056 8BC2 mov eax,edx 00401058 50 push eax 00401059 FF15 9C024200 call dword ptr ds:[42029C] ; kernel32.GetShortPathNameA 0040105F 85C0 test eax,eax 00401061 0F84 D5000000 je chess.0040113C 00401067 57 push edi 00401068 33C0 xor eax,eax 0040106A B9 11000000 mov ecx,11 0040106F 8D7C24 14 lea edi,dword ptr ss:[esp+14] 00401073 F3:AB rep stos dword ptr es:[edi] 00401075 33C9 xor ecx,ecx 。。。。。。。。。 004071B8 6A 60 push 60　　　前面61　POPAD之后跳到这里，在这里DUMP之后，用ImportREC修复之后，程序运行出错？？？　　　　　　 004071BA 68 A8294200 push chess.004229A8 004071BF E8 EC0A0000 call chess.00407CB0 004071C4 BF 94000000 mov edi,94 004071C9 8BC7 mov eax,edi 004071CB E8 B0FBFFFF call chess.00406D80 004071D0 8965 E8 mov dword ptr ss:[ebp-18],esp 004071D3 8BF4 mov esi,esp 004071D5 893E mov dword ptr ds:[esi],edi 004071D7 56 push esi 004071D8 FF15 80024200 call dword ptr ds:[420280] ; kernel32.GetVersionExA 004071DE 8B4E 10 mov ecx,dword ptr ds:[esi+10] 004071E1 890D 08BA4200 mov dword ptr ds:[42BA08],ecx 004071E7 8B46 04 mov eax,dword ptr ds:[esi+4] 004071EA A3 14BA4200 mov dword ptr ds:[42BA14],eax 004071EF 8B56 08 mov edx,dword ptr ds:[esi+8] 004071F2 8915 18BA4200 mov dword ptr ds:[42BA18],edx 004071F8 8B76 0C mov esi,dword ptr ds:[esi+C] 004071FB 81E6 FF7F0000 and esi,7FFF 00407201 8935 0CBA4200 mov dword ptr ds:[42BA0C],esi 00407207 83F9 02 cmp ecx,2 0040720A 74 0C je short chess.00407218 0040720C 81CE 00800000 or esi,8000 00407212 8935 0CBA4200 mov dword ptr ds:[42BA0C],esi 00407218 C1E0 08 shl eax,8 0040721B 03C2 add eax,edx 0040721D A3 10BA4200 mov dword ptr ds:[42BA10],eax 00407222 33F6 xor esi,esi 00407224 56 push esi 00407225 8B3D 40024200 mov edi,dword ptr ds:[420240] ; kernel32.GetModuleHandleA 0040722B FFD7 call edi 0040722D 66:8138 4D5A cmp word ptr ds:[eax],5A4D 00407232 75 1F jnz short chess.00407253 00407234 8B48 3C mov ecx,dword ptr ds:[eax+3C] 00407237 03C8 add ecx,eax 00407239 8139 50450000 cmp dword ptr ds:[ecx],4550 0040723F 75 12 jnz short chess.00407253 00407241 0FB741 18 movzx eax,word ptr ds:[ecx+18] 00407245 3D 0B010000 cmp eax,10B 0040724A 74 1F je short chess.0040726B 0040724C 3D 0B020000 cmp eax,20B 00407251 74 05 je short chess.00407258 00407253 8975 E4 mov dword ptr ss:[ebp-1C],esi 00407256 EB 27 jmp short chess.0040727F 00407258 83B9 84000000 0>cmp dword ptr ds:[ecx+84],0E 0040725F ^ 76 F2 jbe short chess.00407253 00407261 33C0 xor eax,eax 00407263 39B1 F8000000 cmp dword ptr ds:[ecx+F8],esi 00407269 EB 0E jmp short chess.00407279 0040726B 8379 74 0E cmp dword ptr ds:[ecx+74],0E 0040726F ^ 76 E2 jbe short chess.00407253 00407271 33C0 xor eax,eax 00407273 39B1 E8000000 cmp dword ptr ds:[ecx+E8],esi 00407279 0F95C0 setne al 0040727C 8945 E4 mov dword ptr ss:[ebp-1C],eax 0040727F 6A 01 push 1 00407281 E8 87450000 call chess.0040B80D 00407286 59 pop ecx 00407287 85C0 test eax,eax 00407289 75 08 jnz short chess.00407293 0040728B 6A 1C push 1C 0040728D E8 02FFFFFF call chess.00407194 00407292 59 pop ecx 00407293 E8 E0340000 call chess.0040A778 00407298 85C0 test eax,eax 0040729A 75 08 jnz short chess.004072A4 0040729C 6A 10 push 10 0040729E E8 F1FEFFFF call chess.00407194 004072A3 59 pop ecx 004072A4 E8 63660000 call chess.0040D90C 004072A9 8975 FC mov dword ptr ss:[ebp-4],esi 004072AC E8 5D640000 call chess.0040D70E 004072B1 85C0 test eax,eax 004072B3 7D 08 jge short chess.004072BD 004072B5 6A 1B push 1B 004072B7 E8 B3FEFFFF call chess.0040716F 004072BC 59 pop ecx 004072BD FF15 B4004200 call dword ptr ds:[4200B4] ; kernel32.GetCommandLineA 004072C3 A3 D0D24200 mov dword ptr ds:[42D2D0],eax 004072C8 E8 1F630000 call chess.0040D5EC 004072CD A3 F4B94200 mov dword ptr ds:[42B9F4],eax 004072D2 E8 73620000 call chess.0040D54A 004072D7 85C0 test eax,eax 004072D9 7D 08 jge short chess.004072E3 004072DB 6A 08 push 8 004072DD E8 8DFEFFFF call chess.0040716F 004072E2 59 pop ecx 004072E3 E8 2F600000 call chess.0040D317 004072E8 85C0 test eax,eax 004072EA 7D 08 jge short chess.004072F4 004072EC 6A 09 push 9 004072EE E8 7CFEFFFF call chess.0040716F 004072F3 59 pop ecx 004072F4 6A 01 push 1 004072F6 E8 1E0C0000 call chess.00407F19 脱掉之后，运行不起来，把入口地址由71B8改成1000，结果程序自动消失请fly帮忙,这个入口地址应该是71B8还是1000？？？ 2005-11-17 21:41 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

pendan2001

雪币： 61

活跃值： (160)

能力值：

( LV9，RANK：170 )

在线值：

发帖

25

回帖

1180

粉丝

0

关注

私信

pendan2001 4: 2 楼

简单的UPX

004071B8 6A 60          push 60

004071BA 68 A8294200    push chess.004229A8

004071BF E8 EC0A0000    call chess.00407CB0

004071C4 BF 94000000    mov edi,94

004071C9 8BC7          mov eax,edi

004071CB E8 B0FBFFFF    call chess.00406D80

004071D0 8965 E8       mov dword ptr ss:[ebp-18],esp

004071D3 8BF4          mov esi,esp

004071D5 893E          mov dword ptr ds:[esi],edi

004071D7 56             push esi

004071D8 FF15 80024200 call dword ptr ds:[420280]                   ; kernel32.GetVersionExA

004071DE 8B4E 10       mov ecx,dword ptr ds:[esi+10]

2005-11-14 20:51

0

pendan2001

雪币： 61

活跃值： (160)

能力值：

( LV9，RANK：170 )

在线值：

发帖

25

回帖

1180

粉丝

0

关注

私信

pendan2001 4: 3 楼

补充一句，脱完后还有自销毁程序等着您

2005-11-14 20:53

0

fly

雪币： 898

活跃值： (4039)

能力值：

( LV9，RANK：3410 )

在线值：

发帖

294

回帖

7686

粉丝

32

关注

私信

fly 85: 4 楼

确切都说外面是一层其他东西，里面是UPX
0043A8A7 61 popad
0043A8A8 E9 0BC9FCFF jmp 004071B8

2005-11-14 20:57

0

hcfhcf

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

22

粉丝

0

关注

私信

hcfhcf: 5 楼

朋友，你用什么反汇编的啊，我用W32DASM怎么看不到和你贴出来的一样的代码啊？？

2005-11-14 21:01

0

pendan2001

雪币： 61

活跃值： (160)

能力值：

( LV9，RANK：170 )

在线值：

发帖

25

回帖

1180

粉丝

0

关注

私信

pendan2001 4: 6 楼

自杀地点：

00403053 8D4C24 08    lea ecx,dword ptr ss:[esp+8]

00403057 899C24 E0020000 mov dword ptr ss:[esp+2E0],ebx

0040305E E8 EE540100    call 1_.00418551

00403063 3D 00B60100    cmp eax,1B600

00403068 0F85 40010000 jnz 1_.004031AE //就是这个坏东东！

0040306E 3BD3          cmp edx,ebx

00403070 0F85 38010000 jnz 1_.004031AE

00403076 8D9424 A8000000 lea edx,dword ptr ss:[esp+A8]

2005-11-14 21:05

0

hcfhcf

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

22

粉丝

0

关注

私信

hcfhcf: 7 楼

谢谢了各位朋友，慢慢研究呵呵

2005-11-14 21:19

0

无聊的菜鸟

雪币： 622

活跃值： (294)

能力值：

( LV13，RANK：410 )

在线值：

发帖

59

回帖

561

粉丝

5

关注

私信

无聊的菜鸟 9: 8 楼

不止，要自杀的地方还很多，改跳转的话还要改大概3个。
后面爆注册的话，还会自杀。。。。。

2005-11-14 21:29

0

aki

雪币： 223

活跃值： (70)

能力值：

( LV6，RANK：90 )

在线值：

发帖

17

回帖

592

粉丝

0

关注

私信

aki 2: 9 楼

作者注册用户名单
http://home.qyun.net/cranley/regcode.txt

2005-11-15 10:21

0

hcfhcf

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

22

粉丝

0

关注

私信

hcfhcf: 10 楼

壳已经脱了，但是运行的时候却出错，是正常的吗？

2005-11-16 10:55

0

hcfhcf

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

22

粉丝

0

关注

私信

hcfhcf: 11 楼

哪位大哥能讲讲对付自杀程序的思路啊？谢谢，一点头绪都没有，郁闷

2005-11-17 17:17

0

hcfhcf

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

22

粉丝

0

关注

私信

hcfhcf: 12 楼

0043A8D1 > $  36:          prefix ss:
0043A8D2 .  26:0FB7D9    movzx ebx,cx
0043A8D6 .  2E:47       inc edi
0043A8D8 .  1C 03       sbb al,3
0043A8DA .  0C 51       or al,51
0043A8DC .  48          dec eax
0043A8DD .  13F5       adc esi,ebp
0043A8DF .  0FBEEA       movsx ebp,dl
0043A8E2 .  43          inc ebx
0043A8E3 .  2E:BE 756497F>mov esi,FE976475
0043A8E9 .  2E:87F1    xchg ecx,esi
0043A8EC .  1AE2       sbb ah,dl
0043A8EE .  C1F3 A1    sal ebx,0A1
0043A8F1 .  88F0       mov al,dh
0043A8F3 .  11EE       adc esi,ebp
0043A8F5 .  65:0FCB    bswap ebx
0043A8F8 .  0FB7CF       movzx ecx,di
0043A8FB .  47          inc edi
0043A8FC .  86E7       xchg bh,ah
0043A8FE .  D1F3       sal ebx,1
0043A900 .  C1E1 DC    shl ecx,0DC
0043A903 .  0FA4F7 1D    shld edi,esi,1D
0043A907 .  0FA4F7 ED    shld edi,esi,0ED
0043A90B .  0FBBF7       btc edi,esi
0043A90E .  0FACFD 3B    shrd ebp,edi,3B
0043A912 .  C0CA C9    ror dl,0C9
0043A915 .  0FBAE0 E7    bt eax,0E7
0043A919 .  0FBEF4       movsx esi,ah
0043A91C .  88D4       mov ah,dl
0043A91E .  0FC1DA       xadd edx,ebx
0043A921 .  0FABC1       bts ecx,eax
0043A924 .  0FA5F7       shld edi,esi,cl
0043A927 .  0FBDEF       bsr ebp,edi
0043A92A .  43          inc ebx
0043A92B .  81E1 E4177E49 and ecx,497E17E4
0043A931 .  0FBEC6       movsx eax,dh
0043A934 .  0FCF       bswap edi
0043A936 .  80DC 53    sbb ah,53
0043A939 .  0FC0D5       xadd ch,dl
0043A93C .  89F9       mov ecx,edi
0043A93E .  F7D6       not esi
0043A940 .  0FC0E7       xadd bh,ah
0043A943 .  C1F3 F9    sal ebx,0F9
0043A946 .  0FBEC6       movsx eax,dh
0043A949 .  8BF5       mov esi,ebp
0043A94B .  88D4       mov ah,dl
0043A94D .  35 D150D34A xor eax,4AD350D1
0043A952 .  C0DC 23    rcr ah,23
0043A955 .  80CA 71    or dl,71
0043A958 .  0FA3D8       bt eax,ebx
0043A95B .  3E:4D       dec ebp
0043A95D .  0FB7D9       movzx ebx,cx
0043A960 .  23CF       and ecx,edi
0043A962 .  8BF5       mov esi,ebp
0043A964 .  D2DC       rcr ah,cl
0043A966 .  0FBAFB 21    btc ebx,21
0043A96A .  38F0       cmp al,dh
0043A96C .  C1D6 ED    rcl esi,0ED
0043A96F .  0FBCFE       bsf edi,esi
0043A972 .  0FBDEF       bsr ebp,edi
0043A975 .  0FC1DA       xadd edx,ebx
0043A978 .  EB 01       jmp short chess.0043A97B
0043A97A .  F4          hlt
0043A97B >  47          inc edi
0043A97C .  0FADFD       shrd ebp,edi,cl
0043A97F .  D1F3       sal ebx,1
0043A981 .  0FA5C1       shld ecx,eax,cl
0043A984 .  C1D6 6D    rcl esi,6D
0043A987 .  69FE 3D0C9FE6 imul edi,esi,E69F0C3D
0043A98D .  FFC1       inc ecx
0043A98F .  85C3       test ebx,eax
0043A991 .  0FACFD 5B    shrd ebp,edi,5B
0043A995 .  4A          dec edx
0043A996 .  64:0FCF    bswap edi
0043A999 .  65:0FA4D3 C1  shld ebx,edx,0C1
0043A99E .  26:69FE 8D1C6>imul edi,esi,766F1C8D
0043A9A5 .  F7D1       not ecx
0043A9A7 .  C7C6 2D3C0F96 mov esi,960F3C2D
0043A9AD .  0FC1C8       xadd eax,ecx
0043A9B0 .  D1D6       rcl esi,1
0043A9B2 .  0FADFD       shrd ebp,edi,cl
0043A9B5 .  EB 01       jmp short chess.0043A9B8
0043A9B7    D9          db D9
0043A9B8 >  0FACD8 77    shrd eax,ebx,77
0043A9BC .  0FACCE 25    shrd esi,ecx,25
0043A9C0 .  E8 00000000 call chess.0043A9C5
0043A9C5  /$  59          pop ecx
0043A9C6  |.  83C1 07    add ecx,7
0043A9C9  |.  51          push ecx
0043A9CA  \.  C3          retn
0043A9CB >  C3          retn
0043A9CC .  BF 50A74300 mov edi,chess.0043A750
0043A9D1 .  57          push edi
0043A9D2 .  B9 B0000000 mov ecx,0B0
0043A9D7 >  8137 06531C00 xor dword ptr ds:[edi],1C5306
0043A9DD .  51          push ecx
0043A9DE .  2BC9       sub ecx,ecx
0043A9E0 .  B9 04000000 mov ecx,4
0043A9E5 >  83C7 01    add edi,1
0043A9E8 .^ E2 FB       loopd short chess.0043A9E5
0043A9EA .  59          pop ecx
0043A9EB .  83E9 03    sub ecx,3
0043A9EE .^ E2 E7       loopd short chess.0043A9D7
0043A9F0 .^ EB D9       jmp short chess.0043A9CB 这里跳到下面，应该是UPX壳的起点吧？？

0043A750 .  60          pushad
0043A751 .  BE 00604200 mov esi,chess.00426000
0043A756 .  8DBE 00B0FDFF lea edi,dword ptr ds:[esi+FFFDB0>
0043A75C .  57          push edi
0043A75D .  83CD FF    or ebp,FFFFFFFF
0043A760 .  EB 10       jmp short chess.0043A772
0043A762    90          nop
0043A763    90          nop
0043A764    90          nop
0043A765    90          nop
0043A766    90          nop
0043A767    90          nop
0043A768 >  8A06       mov al,byte ptr ds:[esi]
0043A76A .  46          inc esi
0043A76B .  8807       mov byte ptr ds:[edi],al
0043A76D .  47          inc edi
0043A76E >  01DB       add ebx,ebx
0043A770 .  75 07       jnz short chess.0043A779
0043A772 >  8B1E       mov ebx,dword ptr ds:[esi]
0043A774 .  83EE FC    sub esi,-4
0043A777 .  11DB       adc ebx,ebx
0043A779 >^ 72 ED       jb short chess.0043A768
0043A77B .  B8 01000000 mov eax,1
0043A780 >  01DB       add ebx,ebx
0043A782 .  75 07       jnz short chess.0043A78B
0043A784 .  8B1E       mov ebx,dword ptr ds:[esi]
0043A786 .  83EE FC    sub esi,-4
0043A789 .  11DB       adc ebx,ebx
0043A78B >  11C0       adc eax,eax
0043A78D .  01DB       add ebx,ebx
0043A78F .^ 73 EF       jnb short chess.0043A780
0043A791 .  75 09       jnz short chess.0043A79C
0043A793 .  8B1E       mov ebx,dword ptr ds:[esi]
0043A795 .  83EE FC    sub esi,-4
0043A798 .  11DB       adc ebx,ebx
0043A79A .^ 73 E4       jnb short chess.0043A780
0043A79C >  31C9       xor ecx,ecx
0043A79E .  83E8 03    sub eax,3
0043A7A1 .  72 0D       jb short chess.0043A7B0
0043A7A3 .  C1E0 08    shl eax,8
0043A7A6 .  8A06       mov al,byte ptr ds:[esi]
0043A7A8 .  46          inc esi
0043A7A9 .  83F0 FF    xor eax,FFFFFFFF
0043A7AC .  74 74       je short chess.0043A822
0043A7AE .  89C5       mov ebp,eax
0043A7B0 >  01DB       add ebx,ebx
0043A7B2 .  75 07       jnz short chess.0043A7BB
0043A7B4 .  8B1E       mov ebx,dword ptr ds:[esi]
0043A7B6 .  83EE FC    sub esi,-4
0043A7B9 .  11DB       adc ebx,ebx
0043A7BB >  11C9       adc ecx,ecx
0043A7BD .  01DB       add ebx,ebx
0043A7BF .  75 07       jnz short chess.0043A7C8
0043A7C1 .  8B1E       mov ebx,dword ptr ds:[esi]
0043A7C3 .  83EE FC    sub esi,-4
0043A7C6 .  11DB       adc ebx,ebx
0043A7C8 >  11C9       adc ecx,ecx
0043A7CA .  75 20       jnz short chess.0043A7EC
0043A7CC .  41          inc ecx
0043A7CD >  01DB       add ebx,ebx
0043A7CF .  75 07       jnz short chess.0043A7D8
0043A7D1 .  8B1E       mov ebx,dword ptr ds:[esi]
0043A7D3 .  83EE FC    sub esi,-4
0043A7D6 .  11DB       adc ebx,ebx
0043A7D8 >  11C9       adc ecx,ecx
0043A7DA .  01DB       add ebx,ebx
0043A7DC .^ 73 EF       jnb short chess.0043A7CD
0043A7DE .  75 09       jnz short chess.0043A7E9
0043A7E0 .  8B1E       mov ebx,dword ptr ds:[esi]
0043A7E2 .  83EE FC    sub esi,-4
0043A7E5 .  11DB       adc ebx,ebx
0043A7E7 .^ 73 E4       jnb short chess.0043A7CD
0043A7E9 >  83C1 02    add ecx,2
0043A7EC >  81FD 00F3FFFF cmp ebp,-0D00
0043A7F2 .  83D1 01    adc ecx,1
0043A7F5 .  8D142F       lea edx,dword ptr ds:[edi+ebp]
0043A7F8 .  83FD FC    cmp ebp,-4
0043A7FB .  76 0F       jbe short chess.0043A80C
0043A7FD >  8A02       mov al,byte ptr ds:[edx]
0043A7FF .  42          inc edx
0043A800 .  8807       mov byte ptr ds:[edi],al
0043A802 .  47          inc edi
0043A803 .  49          dec ecx
0043A804 .^ 75 F7       jnz short chess.0043A7FD
0043A806 .^ E9 63FFFFFF jmp chess.0043A76E
0043A80B    90          nop
0043A80C >  8B02       mov eax,dword ptr ds:[edx]
0043A80E .  83C2 04    add edx,4
0043A811 .  8907       mov dword ptr ds:[edi],eax
0043A813 .  83C7 04    add edi,4
0043A816 .  83E9 04    sub ecx,4
0043A819 .^ 77 F1       ja short chess.0043A80C
0043A81B .  01CF       add edi,ecx
0043A81D .^ E9 4CFFFFFF jmp chess.0043A76E
0043A822 >  5E          pop esi
0043A823 .  89F7       mov edi,esi
0043A825 .  B9 BC0C0000 mov ecx,0CBC
0043A82A >  8A07       mov al,byte ptr ds:[edi]
0043A82C .  47          inc edi
0043A82D .  2C E8       sub al,0E8
0043A82F >  3C 01       cmp al,1
0043A831 .^ 77 F7       ja short chess.0043A82A
0043A833 .  803F 0A    cmp byte ptr ds:[edi],0A
0043A836 .^ 75 F2       jnz short chess.0043A82A
0043A838 .  8B07       mov eax,dword ptr ds:[edi]
0043A83A .  8A5F 04    mov bl,byte ptr ds:[edi+4]
0043A83D .  66:C1E8 08 shr ax,8
0043A841 .  C1C0 10    rol eax,10
0043A844 .  86C4       xchg ah,al
0043A846 .  29F8       sub eax,edi
0043A848 .  80EB E8    sub bl,0E8
0043A84B .  01F0       add eax,esi
0043A84D .  8907       mov dword ptr ds:[edi],eax
0043A84F .  83C7 05    add edi,5
0043A852 .  89D8       mov eax,ebx
0043A854 .^ E2 D9       loopd short chess.0043A82F
0043A856 .  8DBE 00700300 lea edi,dword ptr ds:[esi+37000]
0043A85C >  8B07       mov eax,dword ptr ds:[edi]
0043A85E .  09C0       or eax,eax
0043A860 .  74 45       je short chess.0043A8A7
0043A862 .  8B5F 04    mov ebx,dword ptr ds:[edi+4]
0043A865 .  8D8430 A00304>lea eax,dword ptr ds:[eax+esi+40>
0043A86C .  01F3       add ebx,esi
0043A86E .  50          push eax
0043A86F .  83C7 08    add edi,8
0043A872 .  FF96 90040400 call dword ptr ds:[esi+40490]
0043A878 .  95          xchg eax,ebp
0043A879 >  8A07       mov al,byte ptr ds:[edi]
0043A87B .  47          inc edi
0043A87C .  08C0       or al,al
0043A87E .^ 74 DC       je short chess.0043A85C
0043A880 .  89F9       mov ecx,edi
0043A882 .  79 07       jns short chess.0043A88B
0043A884 .  0FB707       movzx eax,word ptr ds:[edi]
0043A887 .  47          inc edi
0043A888 .  50          push eax
0043A889 .  47          inc edi
0043A88A    B9          db B9
0043A88B .  57          push edi
0043A88C .  48          dec eax
0043A88D .  F2:AE       repne scas byte ptr es:[edi]
0043A88F .  55          push ebp
0043A890 .  FF96 94040400 call dword ptr ds:[esi+40494]
0043A896 .  09C0       or eax,eax
0043A898 .  74 07       je short chess.0043A8A1
0043A89A .  8903       mov dword ptr ds:[ebx],eax
0043A89C .  83C3 04    add ebx,4
0043A89F .^ EB D8       jmp short chess.0043A879
0043A8A1 >  FF96 98040400 call dword ptr ds:[esi+40498]
0043A8A7 >  61          popad　　　　　
0043A8A8 .- E9 0BC9FCFF jmp chess.004071B8发现这个，应该UPX壳已经结束，下面就是跳到程序的入口

00401000 81EC 68040000 sub esp,468
00401006 A1 B08A4200    mov eax,dword ptr ds:[428AB0]
0040100B 898424 64040000 mov dword ptr ss:[esp+464],eax
00401012 68 04010000    push 104
00401017 8D4424 58    lea eax,dword ptr ss:[esp+58]
0040101B 50             push eax
0040101C 6A 00          push 0
0040101E FF15 94024200 call dword ptr ds:[420294]    ; kernel32.GetModuleFileNameA
00401024 85C0          test eax,eax
00401026 0F84 10010000 je chess.0040113C
0040102C 68 04010000    push 104
00401031 8D8C24 5C010000 lea ecx,dword ptr ss:[esp+15C]
00401038 51             push ecx
00401039 68 2C054200    push chess.0042052C             ; ASCII "COMSPEC"
0040103E FF15 98024200 call dword ptr ds:[420298]    ; kernel32.GetEnvironmentVariableA
00401044 85C0          test eax,eax
00401046 0F84 F0000000 je chess.0040113C
0040104C 68 04010000    push 104
00401051 8D5424 58    lea edx,dword ptr ss:[esp+58]
00401055 52             push edx
00401056 8BC2          mov eax,edx
00401058 50             push eax
00401059 FF15 9C024200 call dword ptr ds:[42029C]    ; kernel32.GetShortPathNameA
0040105F 85C0          test eax,eax
00401061 0F84 D5000000 je chess.0040113C
00401067 57             push edi
00401068 33C0          xor eax,eax
0040106A B9 11000000    mov ecx,11
0040106F 8D7C24 14    lea edi,dword ptr ss:[esp+14]
00401073 F3:AB          rep stos dword ptr es:[edi]
00401075 33C9          xor ecx,ecx
。。。
。。。
。。。
004071B8 6A 60          push 60　　　前面61　POPAD之后跳到这里，在这里DUMP之后，用ImportREC修复之后，程序运行出错？？？　　　　　　
004071BA 68 A8294200    push chess.004229A8
004071BF E8 EC0A0000    call chess.00407CB0
004071C4 BF 94000000    mov edi,94
004071C9 8BC7          mov eax,edi
004071CB E8 B0FBFFFF    call chess.00406D80
004071D0 8965 E8       mov dword ptr ss:[ebp-18],esp
004071D3 8BF4          mov esi,esp
004071D5 893E          mov dword ptr ds:[esi],edi
004071D7 56             push esi
004071D8 FF15 80024200 call dword ptr ds:[420280]    ; kernel32.GetVersionExA
004071DE 8B4E 10       mov ecx,dword ptr ds:[esi+10]
004071E1 890D 08BA4200 mov dword ptr ds:[42BA08],ecx
004071E7 8B46 04       mov eax,dword ptr ds:[esi+4]
004071EA A3 14BA4200    mov dword ptr ds:[42BA14],eax
004071EF 8B56 08       mov edx,dword ptr ds:[esi+8]
004071F2 8915 18BA4200 mov dword ptr ds:[42BA18],edx
004071F8 8B76 0C       mov esi,dword ptr ds:[esi+C]
004071FB 81E6 FF7F0000 and esi,7FFF
00407201 8935 0CBA4200 mov dword ptr ds:[42BA0C],esi
00407207 83F9 02       cmp ecx,2
0040720A 74 0C          je short chess.00407218
0040720C 81CE 00800000 or esi,8000
00407212 8935 0CBA4200 mov dword ptr ds:[42BA0C],esi
00407218 C1E0 08       shl eax,8
0040721B 03C2          add eax,edx
0040721D A3 10BA4200    mov dword ptr ds:[42BA10],eax
00407222 33F6          xor esi,esi
00407224 56             push esi
00407225 8B3D 40024200 mov edi,dword ptr ds:[420240] ; kernel32.GetModuleHandleA
0040722B FFD7          call edi
0040722D 66:8138 4D5A cmp word ptr ds:[eax],5A4D
00407232 75 1F          jnz short chess.00407253
00407234 8B48 3C       mov ecx,dword ptr ds:[eax+3C]
00407237 03C8          add ecx,eax
00407239 8139 50450000 cmp dword ptr ds:[ecx],4550
0040723F 75 12          jnz short chess.00407253
00407241 0FB741 18    movzx eax,word ptr ds:[ecx+18]
00407245 3D 0B010000    cmp eax,10B
0040724A 74 1F          je short chess.0040726B
0040724C 3D 0B020000    cmp eax,20B
00407251 74 05          je short chess.00407258
00407253 8975 E4       mov dword ptr ss:[ebp-1C],esi
00407256 EB 27          jmp short chess.0040727F
00407258 83B9 84000000 0>cmp dword ptr ds:[ecx+84],0E
0040725F  ^ 76 F2          jbe short chess.00407253
00407261 33C0          xor eax,eax
00407263 39B1 F8000000 cmp dword ptr ds:[ecx+F8],esi
00407269 EB 0E          jmp short chess.00407279
0040726B 8379 74 0E    cmp dword ptr ds:[ecx+74],0E
0040726F  ^ 76 E2          jbe short chess.00407253
00407271 33C0          xor eax,eax
00407273 39B1 E8000000 cmp dword ptr ds:[ecx+E8],esi
00407279 0F95C0       setne al
0040727C 8945 E4       mov dword ptr ss:[ebp-1C],eax
0040727F 6A 01          push 1
00407281 E8 87450000    call chess.0040B80D
00407286 59             pop ecx
00407287 85C0          test eax,eax
00407289 75 08          jnz short chess.00407293
0040728B 6A 1C          push 1C
0040728D E8 02FFFFFF    call chess.00407194
00407292 59             pop ecx
00407293 E8 E0340000    call chess.0040A778
00407298 85C0          test eax,eax
0040729A 75 08          jnz short chess.004072A4
0040729C 6A 10          push 10
0040729E E8 F1FEFFFF    call chess.00407194
004072A3 59             pop ecx
004072A4 E8 63660000    call chess.0040D90C
004072A9 8975 FC       mov dword ptr ss:[ebp-4],esi
004072AC E8 5D640000    call chess.0040D70E
004072B1 85C0          test eax,eax
004072B3 7D 08          jge short chess.004072BD
004072B5 6A 1B          push 1B
004072B7 E8 B3FEFFFF    call chess.0040716F
004072BC 59             pop ecx
004072BD FF15 B4004200 call dword ptr ds:[4200B4]    ; kernel32.GetCommandLineA
004072C3 A3 D0D24200    mov dword ptr ds:[42D2D0],eax
004072C8 E8 1F630000    call chess.0040D5EC
004072CD A3 F4B94200    mov dword ptr ds:[42B9F4],eax
004072D2 E8 73620000    call chess.0040D54A
004072D7 85C0          test eax,eax
004072D9 7D 08          jge short chess.004072E3
004072DB 6A 08          push 8
004072DD E8 8DFEFFFF    call chess.0040716F
004072E2 59             pop ecx
004072E3 E8 2F600000    call chess.0040D317
004072E8 85C0          test eax,eax
004072EA 7D 08          jge short chess.004072F4
004072EC 6A 09          push 9
004072EE E8 7CFEFFFF    call chess.0040716F
004072F3 59             pop ecx
004072F4 6A 01          push 1
004072F6 E8 1E0C0000    call chess.00407F19

脱掉之后，运行不起来，把入口地址由71B8改成1000，结果程序自动消失
请fly帮忙,这个入口地址应该是71B8还是1000？？？

2005-11-17 21:41

0