Armadillo 3.78 -> Silicon Realms Toolworks脱壳后跟踪的困惑
近来遇到一软件，用Armadillo 3.78 -> Silicon Realms Toolworks加壳，看了看为标准壳，根据前人的经验脱了壳，没有遇到什么问题，脱壳修复后用PEID查为Armadillo1.××，用FI查则显示为VC5.0了，应该是脱壳修复正确了吧。
用OD跟踪时，到了一处004405E6 52 PUSH EDX ，看下面代码，大家给分析一下。
00440578 8D8424 8C030000 LEA EAX,DWORD PTR SS:[ESP+38C]
0044057F 52 PUSH EDX
00440580 8D8C24 94030000 LEA ECX,DWORD PTR SS:[ESP+394]
00440587 50 PUSH EAX
00440588 8D9424 68030000 LEA EDX,DWORD PTR SS:[ESP+368]
0044058F 51 PUSH ECX
00440590 8D8424 24040000 LEA EAX,DWORD PTR SS:[ESP+424]
00440597 52 PUSH EDX
00440598 8D8C24 68030000 LEA ECX,DWORD PTR SS:[ESP+368]
0044059F 50 PUSH EAX
004405A0 8D9424 64030000 LEA EDX,DWORD PTR SS:[ESP+364]
004405A7 51 PUSH ECX
004405A8 8D8424 74030000 LEA EAX,DWORD PTR SS:[ESP+374]
004405AF 52 PUSH EDX
004405B0 8D8C24 70030000 LEA ECX,DWORD PTR SS:[ESP+370]
004405B7 50 PUSH EAX
004405B8 8D9424 24040000 LEA EDX,DWORD PTR SS:[ESP+424]
004405BF 51 PUSH ECX
004405C0 8D8424 20040000 LEA EAX,DWORD PTR SS:[ESP+420]
004405C7 52 PUSH EDX
004405C8 8D8C24 74030000 LEA ECX,DWORD PTR SS:[ESP+374]
004405CF 50 PUSH EAX
004405D0 8D9424 40040000 LEA EDX,DWORD PTR SS:[ESP+440]
004405D7 51 PUSH ECX
004405D8 8B8C24 70040000 MOV ECX,DWORD PTR SS:[ESP+470]
004405DF 8D8424 3C040000 LEA EAX,DWORD PTR SS:[ESP+43C]
004405E6 52 PUSH EDX 以此为分界线，上面显示的是这样。
004405E7 50 PUSH EAX
004405E8 51 PUSH ECX
004405E9 E8 32A3FFFF CALL dumped_.0043A920
004405EE DB8424 8C030000 FILD DWORD PTR SS:[ESP+38C]
004405F5 81C4 6C030000 ADD ESP,36C
004405FB DD9424 24010000 FST QWORD PTR SS:[ESP+124]
00440602 D9C0 FLD ST
00440604 D9FE FSIN
00440606 DD9C24 F0000000 FSTP QWORD PTR SS:[ESP+F0]
0044060D 8BAC24 E8000000 MOV EBP,DWORD PTR SS:[ESP+E8]
00440614 8B5C24 30 MOV EBX,DWORD PTR SS:[ESP+30]
00440618 B8 56555555 MOV EAX,55555556
0044061D 8BCB MOV ECX,EBX
0044061F 0FAF4C24 24 IMUL ECX,DWORD PTR SS:[ESP+24]
00440624 F7ED IMUL EBP
00440626 8BC2 MOV EAX,EDX
00440628 898C24 94010000 MOV DWORD PTR SS:[ESP+194],ECX
0044062F C1E8 1F SHR EAX,1F
00440632 03D0 ADD EDX,EAX
00440634 2BCA SUB ECX,EDX
004405C9 8C2474 MOV WORD PTR SS:[ESP+ESI*2],FS
004405CC 0300 ADD EAX,DWORD PTR DS:[EAX]
004405CE 0050 8D ADD BYTE PTR DS:[EAX-73],DL
004405D1 94 XCHG EAX,ESP
004405D2 24 40 AND AL,40
004405D4 04 00 ADD AL,0
004405D6 0051 8B ADD BYTE PTR DS:[ECX-75],DL
004405D9 8C2470 MOV WORD PTR DS:[EAX+ESI*2],FS
004405DC 04 00 ADD AL,0
004405DE 008D 84243C04 ADD BYTE PTR SS:[EBP+43C2484],CL
004405E4 0000 ADD BYTE PTR DS:[EAX],AL 转动几下鼠标后就成了上面这样，
004405E6 52 PUSH EDX
004405E7 50 PUSH EAX
004405E8 51 PUSH ECX
004405E9 E8 32A3FFFF CALL dumped_.0043A920
004405EE DB8424 8C030000 FILD DWORD PTR SS:[ESP+38C]
004405F5 81C4 6C030000 ADD ESP,36C
004405FB DD9424 24010000 FST QWORD PTR SS:[ESP+124]
00440602 D9C0 FLD ST
00440604 D9FE FSIN
00440606 DD9C24 F0000000 FSTP QWORD PTR SS:[ESP+F0]
0044060D 8BAC24 E8000000 MOV EBP,DWORD PTR SS:[ESP+E8]
00440614 8B5C24 30 MOV EBX,DWORD PTR SS:[ESP+30]
00440618 B8 56555555 MOV EAX,55555556
0044061D 8BCB MOV ECX,EBX
0044061F 0FAF4C24 24 IMUL ECX,DWORD PTR SS:[ESP+24]
00440624 F7ED IMUL EBP
00440626 8BC2 MOV EAX,EDX
00440628 898C24 94010000 MOV DWORD PTR SS:[ESP+194],ECX
0044062F C1E8 1F SHR EAX,1F
00440632 03D0 ADD EDX,EAX
00440634 2BCA SUB ECX,EDX
00440636 894C24 34 MOV DWORD PTR SS:[ESP+34],ECX
0044063A DB4424 34 FILD DWORD PTR SS:[ESP+34]
0044063E DC8424 F0000000 FADD QWORD PTR SS:[ESP+F0]
00440645 DB4424 1C FILD DWORD PTR SS:[ESP+1C]
00440649 D9FF FCOS
0044064B DEE9 FSUBP ST(1),ST
0044064D DC8424 50050000 FADD QWORD PTR SS:[ESP+550]
00440654 E8 178C0000 CALL <JMP.&msvcrt._ftol>
00440659 DB8424 E4000000 FILD DWORD PTR SS:[ESP+E4]
00440660 DB4424 2C FILD DWORD PTR SS:[ESP+2C]
00440664 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
