[求助]脱壳求助-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

最新回复 (8)
haodawei 雪币： 171 活跃值： (22) 能力值： ( LV2，RANK：10 ) 在线值：发帖 66 回帖 141 粉丝 0 关注私信	haodawei 2 楼载入后od段在下面的位置，请问是什么壳啊？会检测调试器 005F3CE0 > 55 push ebp 005F3CE1 8BEC mov ebp,esp 005F3CE3 81EC 0C010000 sub esp,0x10C 005F3CE9 53 push ebx 005F3CEA 56 push esi 005F3CEB 57 push edi 005F3CEC C785 04FFFFFF 0>mov dword ptr ss:[ebp-0xFC],0x0 005F3CF6 C745 FC 0000000>mov dword ptr ss:[ebp-0x4],0x0 005F3CFD C745 EC 0000000>mov dword ptr ss:[ebp-0x14],0x0 005F3D04 C745 F8 0000000>mov dword ptr ss:[ebp-0x8],0x0 005F3D0B C785 08FFFFFF 0>mov dword ptr ss:[ebp-0xF8],0x0 005F3D15 C745 E4 0400000>mov dword ptr ss:[ebp-0x1C],0x4 005F3D1C 833D 78185D00 0>cmp dword ptr ds:[0x5D1878],0x0 005F3D23 74 05 je Xg3rviewe.005F3D2A 005F3D25 E9 BE460000 jmp g3rviewe.005F83E8 005F3D2A A1 78185D00 mov eax,dword ptr ds:[0x5D1878] 005F3D2F 83C0 01 add eax,0x1 005F3D32 A3 78185D00 mov dword ptr ds:[0x5D1878],eax 005F3D37 8D2424 lea esp,dword ptr ss:[esp] 005F3D3A 87FF xchg edi,edi 005F3D3C EB 00 jmp Xg3rviewe.005F3D3E 005F3D3E F7D1 not ecx 005F3D40 F7D1 not ecx 005F3D42 7C 0B jl Xg3rviewe.005F3D4F 005F3D44 74 00 je Xg3rviewe.005F3D46 005F3D46 87F7 xchg edi,esi 005F3D48 87F7 xchg edi,esi 005F3D4A 74 00 je Xg3rviewe.005F3D4C 005F3D4C 7D 01 jge Xg3rviewe.005F3D4F 005F3D4E B8 83EC0868 mov eax,0x6808EC83 005F3D53 A2 8A5F0064 mov byte ptr ds:[0x64005F8A],al 005F3D58 FF35 00000000 push dword ptr ds:[0] 005F3D5E 64:8925 0000000>mov dword ptr fs:[0],esp 005F3D65 E8 00000000 call g3rviewe.005F3D6A 005F3D6A 83C4 04 add esp,0x4 005F3D6D C1CB 00 ror ebx,0x0 005F3D70 F7D8 neg eax 005F3D72 F7D8 neg eax 005F3D74 90 nop 005F3D75 71 11 jno Xg3rviewe.005F3D88 005F3D77 8D92 C1320000 lea edx,dword ptr ds:[edx+0x32C1] 005F3D7D 8D92 3FCDFFFF lea edx,dword ptr ds:[edx-0x32C1] 005F3D83 8D09 lea ecx,dword ptr ds:[ecx] 005F3D85 70 01 jo Xg3rviewe.005F3D88 005F3D87 BD E8165300 mov ebp,g3rviewe.005316E8 005F3D8C 008D 3FF7D6F7 add byte ptr ss:[ebp+0xF7D6F73F],cl 005F3D92 D6 salc 005F3D93 E8 00000000 call g3rviewe.005F3D98 005F3D98 8D6424 04 lea esp,dword ptr ss:[esp+0x4] 005F3D9C 7F 06 jg Xg3rviewe.005F3DA4 005F3D9E 74 00 je Xg3rviewe.005F3DA0 005F3DA0 7E 02 jle Xg3rviewe.005F3DA4 005F3DA2 BF A9C7058C mov edi,0x8C05C7A9 005F3DA7 1B5D 00 sbb ebx,dword ptr ss:[ebp] 005F3DAA 0100 add dword ptr ds:[eax],eax 005F3DAC 0000 add byte ptr ds:[eax],al 005F3DAE C1C6 1D rol esi,0x1D 005F3DB1 C1C6 03 rol esi,0x3 005F3DB4 7F 06 jg Xg3rviewe.005F3DBC 005F3DB6 77 00 ja Xg3rviewe.005F3DB8 005F3DB8 7E 02 jle Xg3rviewe.005F3DBC 005F3DBA BD 77B9F030 mov ebp,0x30F0B977 005F3DBF 5C pop esp 005F3DC0 0081 E900305C add byte ptr ds:[ecx+0x5C3000E9],al 005F3DC6 0089 0DC81B5D add byte ptr ds:[ecx+0x5D1BC80D],cl 005F3DCC 008D 2424C1C6 add byte ptr ss:[ebp+0xC6C12424],cl 005F3DD2 0041 49 add byte ptr ds:[ecx+0x49],al 005F3DD5 81C6 38070000 add esi,0x738 005F3DDB 81EE 38070000 sub esi,0x738 005F3DE1 7A 0D jpe Xg3rviewe.005F3DF0 005F3DE3 66:9C pushfw 005F3DE5 7D 00 jge Xg3rviewe.005F3DE7 005F3DE7 66:9D popfw 005F3DE9 8D1B lea ebx,dword ptr ds:[ebx] 005F3DEB 72 00 jb Xg3rviewe.005F3DED 005F3DED 7B 01 jpo Xg3rviewe.005F3DF0 005F3DEF BF 8B15C81B mov edi,0x1BC8158B 005F3DF4 5D pop ebp 005F3DF5 0081 E2070000 add byte ptr ds:[ecx+0x7E2],al 005F3DFB 8079 05 4A cmp byte ptr ds:[ecx+0x5],0x4A 005F3DFF 83CA F8 or edx,0xFFFFFFF8 005F3E02 42 inc edx 005F3E03 A1 C81B5D00 mov eax,dword ptr ds:[0x5D1BC8] 005F3E08 2BC2 sub eax,edx 005F3E0A A3 C81B5D00 mov dword ptr ds:[0x5D1BC8],eax 005F3E0F C1EB 00 shr ebx,0x0 005F3E12 C1E3 00 shl ebx,0x0 005F3E15 81FC 33300000 cmp esp,0x3033 005F3E1B 7A 17 jpe Xg3rviewe.005F3E34 005F3E1D 66:9C pushfw 005F3E1F C1C9 0B ror ecx,0xB 005F3E22 C1C1 0B rol ecx,0xB 005F3E25 3B5C24 10 cmp ebx,dword ptr ss:[esp+0x10] 005F3E29 66:9D popfw 005F3E2B 7D 00 jge Xg3rviewe.005F3E2D 005F3E2D 87F6 xchg esi,esi 005F3E2F 7C 00 jl Xg3rviewe.005F3E31 005F3E31 7B 01 jpo Xg3rviewe.005F3E34 005F3E33 BC E8E226FE mov esp,0xFE26E2E8 005F3E38 FF90 8BE4C1E4 call dword ptr ds:[eax+0xE4C1E48B] 005F3E3E 00C1 add cl,al 005F3E40 C3 retn 2014-4-19 21:44 0
dwlsxj 雪币： 230 活跃值： (12) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 35 粉丝 0 关注私信	dwlsxj 3 楼我怎么感觉没加壳的样子，558bec 2014-4-20 08:55 0
轮回期盼雪币： 5 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 8 粉丝 0 关注私信	轮回期盼 4 楼楼上有道理，这个入口怎么看着不像加了壳呢。。。。。 2014-4-20 09:52 0
shrxbs 雪币： 408 活跃值： (813) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 56 粉丝 4 关注私信	shrxbs 5 楼是hasp srm狗壳。 2014-4-20 10:35 0
haodawei 雪币： 171 活跃值： (22) 能力值： ( LV2，RANK：10 ) 在线值：发帖 66 回帖 141 粉丝 0 关注私信	haodawei 6 楼厉害啊，有个狗的啊，你怎么知道的啊？怎么脱啊？ 2014-4-20 15:05 0
haodawei 雪币： 171 活跃值： (22) 能力值： ( LV2，RANK：10 ) 在线值：发帖 66 回帖 141 粉丝 0 关注私信	haodawei 7 楼软件有个usb狗，插上就可以用，想破解一下但是无从下手，查壳查不到，但肯定是加了壳的，一开始运行不在代码段，而是在两个附加段里，运行过程程序代码改变了，然后能检测调试，老大告诉一下怎么破解啊，怎么脱壳！ 2014-4-20 15:11 0
haodawei 雪币： 171 活跃值： (22) 能力值： ( LV2，RANK：10 ) 在线值：发帖 66 回帖 141 粉丝 0 关注私信	haodawei 8 楼如下所示，调用MessageBoxA提示没有找到狗后调用ExitProcess退出，代码有大量的花指令，不知道怎么找到狗检测代码，如何去掉，请高手指教啊！提示的是 “E0003--未发现软件保护锁” 0074A41A B0 90 mov al,0x90 0074A41C FC cld 0074A41D 7C 03 jl Xg3rviewe.0074A422 0074A41F 7D 01 jge Xg3rviewe.0074A422 0074A421 DCF3 fdivr st(3),st 0074A423 AA stos byte ptr es:[edi] 0074A424 58 pop eax 0074A425 59 pop ecx 0074A426 5F pop edi 0074A427 7E 03 jle Xg3rviewe.0074A42C 0074A429 7F 01 jg Xg3rviewe.0074A42C 0074A42B ^ E3 8B jecxz Xg3rviewe.0074A3B8 0074A42D 45 inc ebp 0074A42E 1050 8B adc byte ptr ds:[eax-0x75],dl 0074A431 4D dec ebp 0074A432 0C 51 or al,0x51 0074A434 8B55 08 mov edx,dword ptr ss:[ebp+0x8] 0074A437 52 push edx 0074A438 FF15 7C127200 call dword ptr ds:[0x72127C] ; g3rviewe.00757FC9 0074A43E A3 78457300 mov dword ptr ds:[0x734578],eax 0074A443 A1 78457300 mov eax,dword ptr ds:[0x734578] 0074A448 E9 8D030000 jmp g3rviewe.0074A7DA 0074A44D E8 BD170000 call g3rviewe.0074BC0F 0074A452 33C0 xor eax,eax 0074A454 A0 FAF27100 mov al,byte ptr ds:[0x71F2FA] 0074A459 85C0 test eax,eax 0074A45B 75 0A jnz Xg3rviewe.0074A467 0074A45D E8 F32E0000 call g3rviewe.0074D355 0074A462 A3 EC427300 mov dword ptr ds:[0x7342EC],eax 0074A467 833D 50D07100 0>cmp dword ptr ds:[0x71D050],0x2 0074A46E 75 26 jnz Xg3rviewe.0074A496 0074A470 833D 44D07100 0>cmp dword ptr ds:[0x71D044],0x6 0074A477 75 1D jnz Xg3rviewe.0074A496 0074A479 833D D4D77100 0>cmp dword ptr ds:[0x71D7D4],0x0 0074A480 74 14 je Xg3rviewe.0074A496 0074A482 E8 58290000 call g3rviewe.0074CDDF 0074A487 A3 A4457300 mov dword ptr ds:[0x7345A4],eax 0074A48C E8 479EFFFF call g3rviewe.007442D8 0074A491 A3 A0457300 mov dword ptr ds:[0x7345A0],eax 0074A496 33C9 xor ecx,ecx 0074A498 8A0D 38FA7100 mov cl,byte ptr ds:[0x71FA38] 0074A49E 85C9 test ecx,ecx 0074A4A0 74 1B je Xg3rviewe.0074A4BD 0074A4A2 68 A1000000 push 0xA1 0074A4A7 68 38FA7100 push g3rviewe.0071FA38 0074A4AC 8D95 4CFFFFFF lea edx,dword ptr ss:[ebp-0xB4] 0074A4B2 52 push edx 0074A4B3 E8 A1D40000 call g3rviewe.00757959 0074A4B8 83C4 0C add esp,0xC 0074A4BB EB 19 jmp Xg3rviewe.0074A4D6 0074A4BD 68 A1000000 push 0xA1 0074A4C2 68 B0357100 push g3rviewe.007135B0 0074A4C7 8D85 4CFFFFFF lea eax,dword ptr ss:[ebp-0xB4] 0074A4CD 50 push eax 0074A4CE E8 86D40000 call g3rviewe.00757959 0074A4D3 83C4 0C add esp,0xC 0074A4D6 C745 F0 0000000>mov dword ptr ss:[ebp-0x10],0x0 0074A4DD EB 09 jmp Xg3rviewe.0074A4E8 0074A4DF 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10] 0074A4E2 83C1 01 add ecx,0x1 0074A4E5 894D F0 mov dword ptr ss:[ebp-0x10],ecx 0074A4E8 837D F0 0A cmp dword ptr ss:[ebp-0x10],0xA 0074A4EC 0F8D 86000000 jge g3rviewe.0074A578 0074A4F2 8B55 F0 mov edx,dword ptr ss:[ebp-0x10] 0074A4F5 C1E2 02 shl edx,0x2 0074A4F8 8B8495 4CFFFFFF mov eax,dword ptr ss:[ebp+edx4-0xB4] 0074A4FF 35 416C57AB xor eax,0xAB576C41 0074A504 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10] 0074A507 C1E1 02 shl ecx,0x2 0074A50A 89848D 4CFFFFFF mov dword ptr ss:[ebp+ecx4-0xB4],eax 0074A511 8B55 F0 mov edx,dword ptr ss:[ebp-0x10] 0074A514 C1E2 02 shl edx,0x2 0074A517 8B8495 50FFFFFF mov eax,dword ptr ss:[ebp+edx4-0xB0] 0074A51E 35 77CE5EAB xor eax,0xAB5ECE77 0074A523 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10] 0074A526 C1E1 02 shl ecx,0x2 0074A529 89848D 50FFFFFF mov dword ptr ss:[ebp+ecx4-0xB0],eax 0074A530 72 03 jb Xg3rviewe.0074A535 0074A532 73 01 jnb Xg3rviewe.0074A535 0074A534 398B 55F0C1E2 cmp dword ptr ds:[ebx+0xE2C1F055],ecx 0074A53A 028B 849554FF add cl,byte ptr ds:[ebx+0xFF549584] 0074A540 FFFF ??? ; 未知命令 0074A542 35 253A63AB xor eax,0xAB633A25 0074A547 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10] 0074A54A C1E1 02 shl ecx,0x2 0074A54D 89848D 54FFFFFF mov dword ptr ss:[ebp+ecx4-0xAC],eax 0074A554 8B55 F0 mov edx,dword ptr ss:[ebp-0x10] 0074A557 C1E2 02 shl edx,0x2 0074A55A 8B8495 58FFFFFF mov eax,dword ptr ss:[ebp+edx4-0xA8] 0074A561 35 322A57AB xor eax,0xAB572A32 0074A566 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10] 0074A569 C1E1 02 shl ecx,0x2 0074A56C 89848D 58FFFFFF mov dword ptr ss:[ebp+ecx*4-0xA8],eax 0074A573 ^ E9 67FFFFFF jmp g3rviewe.0074A4DF 0074A578 E8 9C0B0000 call g3rviewe.0074B119 0074A57D A3 F0427300 mov dword ptr ds:[0x7342F0],eax 0074A582 72 03 jb Xg3rviewe.0074A587 0074A584 73 01 jnb Xg3rviewe.0074A587 0074A586 1183 3D3C4573 adc dword ptr ds:[ebx+0x73453C3D],eax 0074A58C 0000 add byte ptr ds:[eax],al 0074A58E 75 0A jnz Xg3rviewe.0074A59A 0074A590 7C 03 jl Xg3rviewe.0074A595 0074A592 7D 01 jge Xg3rviewe.0074A595 0074A594 DCE8 fsub st,st 0074A596 C7 ??? ; 未知命令 0074A597 6300 arpl word ptr ds:[eax],ax 0074A599 0081 7C240472 add byte ptr ds:[ecx+0x7204247C],al 0074A59F 0373 01 add esi,dword ptr ds:[ebx+0x1] 0074A5A2 833D 242D7300 0>cmp dword ptr ds:[0x732D24],0x0 0074A5A9 0F85 DC000000 jnz g3rviewe.0074A68B 0074A5AF 75 03 jnz Xg3rviewe.0074A5B4 0074A5B1 74 01 je Xg3rviewe.0074A5B4 0074A5B3 ^ 73 8B jnb Xg3rviewe.0074A540 0074A5B5 15 E42C7300 adc eax,g3rviewe.00732CE4 0074A5BA 8915 902C7300 mov dword ptr ds:[0x732C90],edx 0074A5C0 817C24 08 75037>cmp dword ptr ss:[esp+0x8],0x1740375 0074A5C8 A1 E42C7300 mov eax,dword ptr ds:[0x732CE4] 0074A5CD 0305 58457300 add eax,dword ptr ds:[0x734558] 0074A5D3 A3 8C2C7300 mov dword ptr ds:[0x732C8C],eax 0074A5D8 817C24 08 75037>cmp dword ptr ss:[esp+0x8],0x1740375 0074A5E0 57 push edi 0074A5E1 51 push ecx 0074A5E2 50 push eax 0074A5E3 BF FEA87400 mov edi,g3rviewe.0074A8FE 0074A5E8 817C24 08 7C037>cmp dword ptr ss:[esp+0x8],0x17D037C 0074A5F0 803D 202D7300 0>cmp byte ptr ds:[0x732D20],0x0 0074A5F7 74 0A je Xg3rviewe.0074A603 0074A5F9 75 03 jnz Xg3rviewe.0074A5FE 0074A5FB 74 01 je Xg3rviewe.0074A5FE 0074A5FD ^ 71 BF jno Xg3rviewe.0074A5BE 0074A5FF F8 clc 0074A600 A9 74007503 test eax,0x3750074 0074A605 74 01 je Xg3rviewe.0074A608 0074A607 ^ 75 8B jnz Xg3rviewe.0074A594 0074A609 0D 8C2C7300 or eax,0x732C8C 0074A60E 7C 03 jl Xg3rviewe.0074A613 0074A610 7D 01 jge Xg3rviewe.0074A613 0074A612 D7 xlat byte ptr ds:[ebx+al] 0074A613 3BCF cmp ecx,edi 0074A615 76 11 jbe Xg3rviewe.0074A628 0074A617 76 03 jbe Xg3rviewe.0074A61C 0074A619 77 01 ja Xg3rviewe.0074A61C 0074A61B B7 2B mov bh,0x2B 0074A61D CF iretd 0074A61E B0 90 mov al,0x90 0074A620 FC cld 0074A621 72 03 jb Xg3rviewe.0074A626 0074A623 73 01 jnb Xg3rviewe.0074A626 0074A625 3C F3 cmp al,0xF3 0074A627 AA stos byte ptr es:[edi] 0074A628 75 03 jnz Xg3rviewe.0074A62D 0074A62A 74 01 je Xg3rviewe.0074A62D 0074A62C ^ 72 8B jb Xg3rviewe.0074A5B9 0074A62E 3D 902C7300 cmp eax,g3rviewe.00732C90 0074A633 76 03 jbe Xg3rviewe.0074A638 0074A635 77 01 ja Xg3rviewe.0074A638 0074A637 C1B9 BA877400 8>sar dword ptr ds:[ecx+0x7487BA],0x81 0074A63E 7C 24 jl Xg3rviewe.0074A664 0074A640 04 76 add al,0x76 0074A642 0377 01 add esi,dword ptr ds:[edi+0x1] 0074A645 3BCF cmp ecx,edi 0074A647 76 14 jbe Xg3rviewe.0074A65D 0074A649 817C24 04 72037>cmp dword ptr ss:[esp+0x4],0x1730372 0074A651 2BCF sub ecx,edi 0074A653 72 03 jb Xg3rviewe.0074A658 0074A655 73 01 jnb Xg3rviewe.0074A658 0074A657 0D B090FCF3 or eax,0xF3FC90B0 0074A65C AA stos byte ptr es:[edi] 0074A65D 7C 03 jl Xg3rviewe.0074A662 0074A65F 7D 01 jge Xg3rviewe.0074A662 0074A661 D1BF 8B887400 sar dword ptr ds:[edi+0x74888B],1 0074A667 817C24 04 72037>cmp dword ptr ss:[esp+0x4],0x1730372 0074A66F B9 4DA47400 mov ecx,g3rviewe.0074A44D 0074A674 817C24 08 7C037>cmp dword ptr ss:[esp+0x8],0x17D037C 0074A67C 2BCF sub ecx,edi 0074A67E B0 90 mov al,0x90 0074A680 FC cld 0074A681 F3:AA rep stos byte ptr es:[edi] 0074A683 75 03 jnz Xg3rviewe.0074A688 0074A685 74 01 je Xg3rviewe.0074A688 0074A687 7A 58 jpe Xg3rviewe.0074A6E1 0074A689 59 pop ecx 0074A68A 5F pop edi 0074A68B 833D EC427300 0>cmp dword ptr ds:[0x7342EC],0x0 0074A692 0F84 D6000000 je g3rviewe.0074A76E 0074A698 8B0D B4CF7100 mov ecx,dword ptr ds:[0x71CFB4] 0074A69E 81E1 00000080 and ecx,0x80000000 0074A6A4 85C9 test ecx,ecx 0074A6A6 75 74 jnz Xg3rviewe.0074A71C 0074A6A8 833D D4D77100 0>cmp dword ptr ds:[0x71D7D4],0x0 0074A6AF 74 6B je Xg3rviewe.0074A71C 0074A6B1 68 10202400 push 0x242010 0074A6B6 8D95 4CFFFFFF lea edx,dword ptr ss:[ebp-0xB4] 0074A6BC 52 push edx 0074A6BD 68 70477300 push g3rviewe.00734770 0074A6C2 6A 00 push 0x0 0074A6C4 FF15 EC427300 call dword ptr ds:[0x7342EC] ; USER32.MessageBoxA 0074A6CA 833D 50D07100 0>cmp dword ptr ds:[0x71D050],0x2 0074A6D1 75 47 jnz Xg3rviewe.0074A71A 0074A6D3 833D 44D07100 0>cmp dword ptr ds:[0x71D044],0x6 0074A6DA 75 3E jnz Xg3rviewe.0074A71A 0074A6DC 833D A0457300 F>cmp dword ptr ds:[0x7345A0],-0x1 0074A6E3 74 35 je Xg3rviewe.0074A71A 0074A6E5 6A 00 push 0x0 0074A6E7 8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8] 0074A6ED 50 push eax 0074A6EE 6A 00 push 0x0 0074A6F0 68 10200400 push 0x42010 0074A6F5 68 9D010000 push 0x19D 0074A6FA 68 70477300 push g3rviewe.00734770 0074A6FF 68 A1000000 push 0xA1 0074A704 8D8D 4CFFFFFF lea ecx,dword ptr ss:[ebp-0xB4] 0074A70A 51 push ecx 0074A70B 8B15 A0457300 mov edx,dword ptr ds:[0x7345A0] 0074A711 52 push edx 0074A712 6A 00 push 0x0 0074A714 FF15 A4457300 call dword ptr ds:[0x7345A4] 0074A71A EB 19 jmp Xg3rviewe.0074A735 0074A71C 68 10200400 push 0x42010 ; 错误 0074A721 8D85 4CFFFFFF lea eax,dword ptr ss:[ebp-0xB4] 0074A727 50 push eax 0074A728 68 70477300 push g3rviewe.00734770 0074A72D 6A 00 push 0x0 0074A72F FF15 EC427300 call dword ptr ds:[0x7342EC] ; USER32.MessageBoxA 0074A735 C705 A0447300 0>mov dword ptr ds:[0x7344A0],0x0 0074A73F EB 0F jmp Xg3rviewe.0074A750 0074A741 8B0D A0447300 mov ecx,dword ptr ds:[0x7344A0] 0074A747 83C1 01 add ecx,0x1 0074A74A 890D A0447300 mov dword ptr ds:[0x7344A0],ecx 0074A750 813D A0447300 A>cmp dword ptr ds:[0x7344A0],0xA1 0074A75A 73 10 jnb Xg3rviewe.0074A76C 0074A75C 8B15 A0447300 mov edx,dword ptr ds:[0x7344A0] 0074A762 C68415 4CFFFFFF>mov byte ptr ss:[ebp+edx-0xB4],0x0 0074A76A ^ EB D5 jmp Xg3rviewe.0074A741 0074A76C EB 26 jmp Xg3rviewe.0074A794 0074A76E 33C0 xor eax,eax 0074A770 A0 FAF27100 mov al,byte ptr ds:[0x71F2FA] 0074A775 83F8 01 cmp eax,0x1 0074A778 75 1A jnz Xg3rviewe.0074A794 0074A77A 68 70477300 push g3rviewe.00734770 0074A77F 8D8D 4CFFFFFF lea ecx,dword ptr ss:[ebp-0xB4] 0074A785 51 push ecx 0074A786 68 54227200 push g3rviewe.00722254 ; ASCII "%s: %s " 0074A78B FF15 C8F3AC00 call dword ptr ds:[0xACF3C8] ; msvcrt.printf 0074A791 83C4 0C add esp,0xC 0074A794 833D 0C2D7300 0>cmp dword ptr ds:[0x732D0C],0x0 0074A79B 75 3B jnz Xg3rviewe.0074A7D8 0074A79D 833D F0427300 0>cmp dword ptr ds:[0x7342F0],0x0 0074A7A4 74 0F je Xg3rviewe.0074A7B5 0074A7A6 8B15 9C447300 mov edx,dword ptr ds:[0x73449C] 0074A7AC 52 push edx 0074A7AD FF15 F0427300 call dword ptr ds:[0x7342F0] ; kernel32.ExitProcess 0074A7B3 EB 23 jmp Xg3rviewe.0074A7D8 0074A7B5 833D 50D07100 0>cmp dword ptr ds:[0x71D050],0x2 0074A7BC 75 13 jnz Xg3rviewe.0074A7D1 0074A7BE 833D 44D07100 0>cmp dword ptr ds:[0x71D044],0x6 0074A7C5 75 0A jnz Xg3rviewe.0074A7D1 0074A7C7 6A 63 push 0x63 0074A7C9 FF15 00F0AC00 call dword ptr ds:[0xACF000] ; kernel32.ExitProcess 0074A7CF EB 07 jmp Xg3rviewe.0074A7D8 0074A7D1 B8 63000000 mov eax,0x63 0074A7D6 EB 02 jmp Xg3rviewe.0074A7DA 0074A7D8 33C0 xor eax,eax 0074A7DA 5F pop edi 0074A7DB 5E pop esi 0074A7DC 5B pop ebx 0074A7DD 8BE5 mov esp,ebp 0074A7DF 5D pop ebp 0074A7E0 C2 0C00 retn 0xC 2014-4-20 21:27 0
KuNgBiM 雪币： 817 活跃值： (1927) 能力值： ( LV12，RANK：2670 ) 在线值：发帖 500 回帖 2517 粉丝 21 关注私信	KuNgBiM 66 9 楼这种狗无狗只有放弃 2014-4-21 11:19 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

haodawei

雪币： 171

活跃值： (22)

能力值：

( LV2，RANK：10 )

在线值：

发帖

66

回帖

141

粉丝

0

关注

私信

haodawei: 2 楼

载入后od段在下面的位置，请问是什么壳啊？会检测调试器
005F3CE0 >  55             push ebp
005F3CE1 8BEC          mov ebp,esp
005F3CE3 81EC 0C010000 sub esp,0x10C
005F3CE9 53             push ebx
005F3CEA 56             push esi
005F3CEB 57             push edi
005F3CEC C785 04FFFFFF 0>mov dword ptr ss:[ebp-0xFC],0x0
005F3CF6 C745 FC 0000000>mov dword ptr ss:[ebp-0x4],0x0
005F3CFD C745 EC 0000000>mov dword ptr ss:[ebp-0x14],0x0
005F3D04 C745 F8 0000000>mov dword ptr ss:[ebp-0x8],0x0
005F3D0B C785 08FFFFFF 0>mov dword ptr ss:[ebp-0xF8],0x0
005F3D15 C745 E4 0400000>mov dword ptr ss:[ebp-0x1C],0x4
005F3D1C 833D 78185D00 0>cmp dword ptr ds:[0x5D1878],0x0
005F3D23 74 05          je Xg3rviewe.005F3D2A
005F3D25 E9 BE460000    jmp g3rviewe.005F83E8
005F3D2A A1 78185D00    mov eax,dword ptr ds:[0x5D1878]
005F3D2F 83C0 01       add eax,0x1
005F3D32 A3 78185D00    mov dword ptr ds:[0x5D1878],eax
005F3D37 8D2424       lea esp,dword ptr ss:[esp]
005F3D3A 87FF          xchg edi,edi
005F3D3C EB 00          jmp Xg3rviewe.005F3D3E
005F3D3E F7D1          not ecx
005F3D40 F7D1          not ecx
005F3D42 7C 0B          jl Xg3rviewe.005F3D4F
005F3D44 74 00          je Xg3rviewe.005F3D46
005F3D46 87F7          xchg edi,esi
005F3D48 87F7          xchg edi,esi
005F3D4A 74 00          je Xg3rviewe.005F3D4C
005F3D4C 7D 01          jge Xg3rviewe.005F3D4F
005F3D4E B8 83EC0868    mov eax,0x6808EC83
005F3D53 A2 8A5F0064    mov byte ptr ds:[0x64005F8A],al
005F3D58 FF35 00000000 push dword ptr ds:[0]
005F3D5E 64:8925 0000000>mov dword ptr fs:[0],esp
005F3D65 E8 00000000    call g3rviewe.005F3D6A
005F3D6A 83C4 04       add esp,0x4
005F3D6D C1CB 00       ror ebx,0x0
005F3D70 F7D8          neg eax
005F3D72 F7D8          neg eax
005F3D74 90             nop
005F3D75 71 11          jno Xg3rviewe.005F3D88
005F3D77 8D92 C1320000 lea edx,dword ptr ds:[edx+0x32C1]
005F3D7D 8D92 3FCDFFFF lea edx,dword ptr ds:[edx-0x32C1]
005F3D83 8D09          lea ecx,dword ptr ds:[ecx]
005F3D85 70 01          jo Xg3rviewe.005F3D88
005F3D87 BD E8165300    mov ebp,g3rviewe.005316E8
005F3D8C 008D 3FF7D6F7 add byte ptr ss:[ebp+0xF7D6F73F],cl
005F3D92 D6             salc
005F3D93 E8 00000000    call g3rviewe.005F3D98
005F3D98 8D6424 04    lea esp,dword ptr ss:[esp+0x4]
005F3D9C 7F 06          jg Xg3rviewe.005F3DA4
005F3D9E 74 00          je Xg3rviewe.005F3DA0
005F3DA0 7E 02          jle Xg3rviewe.005F3DA4
005F3DA2 BF A9C7058C    mov edi,0x8C05C7A9
005F3DA7 1B5D 00       sbb ebx,dword ptr ss:[ebp]
005F3DAA 0100          add dword ptr ds:[eax],eax
005F3DAC 0000          add byte ptr ds:[eax],al
005F3DAE C1C6 1D       rol esi,0x1D
005F3DB1 C1C6 03       rol esi,0x3
005F3DB4 7F 06          jg Xg3rviewe.005F3DBC
005F3DB6 77 00          ja Xg3rviewe.005F3DB8
005F3DB8 7E 02          jle Xg3rviewe.005F3DBC
005F3DBA BD 77B9F030    mov ebp,0x30F0B977
005F3DBF 5C             pop esp
005F3DC0 0081 E900305C add byte ptr ds:[ecx+0x5C3000E9],al
005F3DC6 0089 0DC81B5D add byte ptr ds:[ecx+0x5D1BC80D],cl
005F3DCC 008D 2424C1C6 add byte ptr ss:[ebp+0xC6C12424],cl
005F3DD2 0041 49       add byte ptr ds:[ecx+0x49],al
005F3DD5 81C6 38070000 add esi,0x738
005F3DDB 81EE 38070000 sub esi,0x738
005F3DE1 7A 0D          jpe Xg3rviewe.005F3DF0
005F3DE3 66:9C          pushfw
005F3DE5 7D 00          jge Xg3rviewe.005F3DE7
005F3DE7 66:9D          popfw
005F3DE9 8D1B          lea ebx,dword ptr ds:[ebx]
005F3DEB 72 00          jb Xg3rviewe.005F3DED
005F3DED 7B 01          jpo Xg3rviewe.005F3DF0
005F3DEF BF 8B15C81B    mov edi,0x1BC8158B
005F3DF4 5D             pop ebp
005F3DF5 0081 E2070000 add byte ptr ds:[ecx+0x7E2],al
005F3DFB 8079 05 4A    cmp byte ptr ds:[ecx+0x5],0x4A
005F3DFF 83CA F8       or edx,0xFFFFFFF8
005F3E02 42             inc edx
005F3E03 A1 C81B5D00    mov eax,dword ptr ds:[0x5D1BC8]
005F3E08 2BC2          sub eax,edx
005F3E0A A3 C81B5D00    mov dword ptr ds:[0x5D1BC8],eax
005F3E0F C1EB 00       shr ebx,0x0
005F3E12 C1E3 00       shl ebx,0x0
005F3E15 81FC 33300000 cmp esp,0x3033
005F3E1B 7A 17          jpe Xg3rviewe.005F3E34
005F3E1D 66:9C          pushfw
005F3E1F C1C9 0B       ror ecx,0xB
005F3E22 C1C1 0B       rol ecx,0xB
005F3E25 3B5C24 10    cmp ebx,dword ptr ss:[esp+0x10]
005F3E29 66:9D          popfw
005F3E2B 7D 00          jge Xg3rviewe.005F3E2D
005F3E2D 87F6          xchg esi,esi
005F3E2F 7C 00          jl Xg3rviewe.005F3E31
005F3E31 7B 01          jpo Xg3rviewe.005F3E34
005F3E33 BC E8E226FE    mov esp,0xFE26E2E8
005F3E38 FF90 8BE4C1E4 call dword ptr ds:[eax+0xE4C1E48B]
005F3E3E 00C1          add cl,al
005F3E40 C3             retn

2014-4-19 21:44

0

dwlsxj

雪币： 230

活跃值： (12)

能力值：

( LV2，RANK：10 )

在线值：

发帖

0

回帖

35

粉丝

0

关注

私信

dwlsxj: 3 楼

我怎么感觉没加壳的样子，558bec

2014-4-20 08:55

0

轮回期盼

雪币： 5

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

0

回帖

8

粉丝

0

关注

私信

轮回期盼: 4 楼

楼上有道理，这个入口怎么看着不像加了壳呢。。。。。

2014-4-20 09:52

0

shrxbs

雪币： 408

活跃值： (813)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

56

粉丝

4

关注

私信

shrxbs: 5 楼

是hasp srm狗壳。

2014-4-20 10:35

0

haodawei

雪币： 171

活跃值： (22)

能力值：

( LV2，RANK：10 )

在线值：

发帖

66

回帖

141

粉丝

0

关注

私信

haodawei: 6 楼

厉害啊，有个狗的啊，你怎么知道的啊？怎么脱啊？

2014-4-20 15:05

0

haodawei

雪币： 171

活跃值： (22)

能力值：

( LV2，RANK：10 )

在线值：

发帖

66

回帖

141

粉丝

0

关注

私信

haodawei: 7 楼

软件有个usb狗，插上就可以用，想破解一下但是无从下手，查壳查不到，但肯定是加了壳的，一开始运行不在代码段，而是在两个附加段里，运行过程程序代码改变了，然后能检测调试，老大告诉一下怎么破解啊，怎么脱壳！

2014-4-20 15:11

0

haodawei

雪币： 171

活跃值： (22)

能力值：

( LV2，RANK：10 )

在线值：

发帖

66

回帖

141

粉丝

0

关注

私信

haodawei: 8 楼

如下所示，调用MessageBoxA提示没有找到狗后调用ExitProcess退出，代码有大量的花指令，不知道怎么找到狗检测代码，如何去掉，请高手指教啊！
提示的是 “E0003--未发现软件保护锁”
0074A41A B0 90          mov al,0x90
0074A41C FC             cld
0074A41D 7C 03          jl Xg3rviewe.0074A422
0074A41F 7D 01          jge Xg3rviewe.0074A422
0074A421 DCF3          fdivr st(3),st
0074A423 AA             stos byte ptr es:[edi]
0074A424 58             pop eax
0074A425 59             pop ecx
0074A426 5F             pop edi
0074A427 7E 03          jle Xg3rviewe.0074A42C
0074A429 7F 01          jg Xg3rviewe.0074A42C
0074A42B  ^ E3 8B          jecxz Xg3rviewe.0074A3B8
0074A42D 45             inc ebp
0074A42E 1050 8B       adc byte ptr ds:[eax-0x75],dl
0074A431 4D             dec ebp
0074A432 0C 51          or al,0x51
0074A434 8B55 08       mov edx,dword ptr ss:[ebp+0x8]
0074A437 52             push edx
0074A438 FF15 7C127200 call dword ptr ds:[0x72127C]          ; g3rviewe.00757FC9
0074A43E A3 78457300    mov dword ptr ds:[0x734578],eax
0074A443 A1 78457300    mov eax,dword ptr ds:[0x734578]
0074A448 E9 8D030000    jmp g3rviewe.0074A7DA
0074A44D E8 BD170000    call g3rviewe.0074BC0F
0074A452 33C0          xor eax,eax
0074A454 A0 FAF27100    mov al,byte ptr ds:[0x71F2FA]
0074A459 85C0          test eax,eax
0074A45B 75 0A          jnz Xg3rviewe.0074A467
0074A45D E8 F32E0000    call g3rviewe.0074D355
0074A462 A3 EC427300    mov dword ptr ds:[0x7342EC],eax
0074A467 833D 50D07100 0>cmp dword ptr ds:[0x71D050],0x2
0074A46E 75 26          jnz Xg3rviewe.0074A496
0074A470 833D 44D07100 0>cmp dword ptr ds:[0x71D044],0x6
0074A477 75 1D          jnz Xg3rviewe.0074A496
0074A479 833D D4D77100 0>cmp dword ptr ds:[0x71D7D4],0x0
0074A480 74 14          je Xg3rviewe.0074A496
0074A482 E8 58290000    call g3rviewe.0074CDDF
0074A487 A3 A4457300    mov dword ptr ds:[0x7345A4],eax
0074A48C E8 479EFFFF    call g3rviewe.007442D8
0074A491 A3 A0457300    mov dword ptr ds:[0x7345A0],eax
0074A496 33C9          xor ecx,ecx
0074A498 8A0D 38FA7100 mov cl,byte ptr ds:[0x71FA38]
0074A49E 85C9          test ecx,ecx
0074A4A0 74 1B          je Xg3rviewe.0074A4BD
0074A4A2 68 A1000000    push 0xA1
0074A4A7 68 38FA7100    push g3rviewe.0071FA38
0074A4AC 8D95 4CFFFFFF lea edx,dword ptr ss:[ebp-0xB4]
0074A4B2 52             push edx
0074A4B3 E8 A1D40000    call g3rviewe.00757959
0074A4B8 83C4 0C       add esp,0xC
0074A4BB EB 19          jmp Xg3rviewe.0074A4D6
0074A4BD 68 A1000000    push 0xA1
0074A4C2 68 B0357100    push g3rviewe.007135B0
0074A4C7 8D85 4CFFFFFF lea eax,dword ptr ss:[ebp-0xB4]
0074A4CD 50             push eax
0074A4CE E8 86D40000    call g3rviewe.00757959
0074A4D3 83C4 0C       add esp,0xC
0074A4D6 C745 F0 0000000>mov dword ptr ss:[ebp-0x10],0x0
0074A4DD EB 09          jmp Xg3rviewe.0074A4E8
0074A4DF 8B4D F0       mov ecx,dword ptr ss:[ebp-0x10]
0074A4E2 83C1 01       add ecx,0x1
0074A4E5 894D F0       mov dword ptr ss:[ebp-0x10],ecx
0074A4E8 837D F0 0A    cmp dword ptr ss:[ebp-0x10],0xA
0074A4EC 0F8D 86000000 jge g3rviewe.0074A578
0074A4F2 8B55 F0       mov edx,dword ptr ss:[ebp-0x10]
0074A4F5 C1E2 02       shl edx,0x2
0074A4F8 8B8495 4CFFFFFF mov eax,dword ptr ss:[ebp+edx*4-0xB4]
0074A4FF 35 416C57AB    xor eax,0xAB576C41
0074A504 8B4D F0       mov ecx,dword ptr ss:[ebp-0x10]
0074A507 C1E1 02       shl ecx,0x2
0074A50A 89848D 4CFFFFFF mov dword ptr ss:[ebp+ecx*4-0xB4],eax
0074A511 8B55 F0       mov edx,dword ptr ss:[ebp-0x10]
0074A514 C1E2 02       shl edx,0x2
0074A517 8B8495 50FFFFFF mov eax,dword ptr ss:[ebp+edx*4-0xB0]
0074A51E 35 77CE5EAB    xor eax,0xAB5ECE77
0074A523 8B4D F0       mov ecx,dword ptr ss:[ebp-0x10]
0074A526 C1E1 02       shl ecx,0x2
0074A529 89848D 50FFFFFF mov dword ptr ss:[ebp+ecx*4-0xB0],eax
0074A530 72 03          jb Xg3rviewe.0074A535
0074A532 73 01          jnb Xg3rviewe.0074A535
0074A534 398B 55F0C1E2 cmp dword ptr ds:[ebx+0xE2C1F055],ecx
0074A53A 028B 849554FF add cl,byte ptr ds:[ebx+0xFF549584]
0074A540 FFFF          ???                                     ; 未知命令
0074A542 35 253A63AB    xor eax,0xAB633A25
0074A547 8B4D F0       mov ecx,dword ptr ss:[ebp-0x10]
0074A54A C1E1 02       shl ecx,0x2
0074A54D 89848D 54FFFFFF mov dword ptr ss:[ebp+ecx*4-0xAC],eax
0074A554 8B55 F0       mov edx,dword ptr ss:[ebp-0x10]
0074A557 C1E2 02       shl edx,0x2
0074A55A 8B8495 58FFFFFF mov eax,dword ptr ss:[ebp+edx*4-0xA8]
0074A561 35 322A57AB    xor eax,0xAB572A32
0074A566 8B4D F0       mov ecx,dword ptr ss:[ebp-0x10]
0074A569 C1E1 02       shl ecx,0x2
0074A56C 89848D 58FFFFFF mov dword ptr ss:[ebp+ecx*4-0xA8],eax
0074A573  ^ E9 67FFFFFF    jmp g3rviewe.0074A4DF
0074A578 E8 9C0B0000    call g3rviewe.0074B119
0074A57D A3 F0427300    mov dword ptr ds:[0x7342F0],eax
0074A582 72 03          jb Xg3rviewe.0074A587
0074A584 73 01          jnb Xg3rviewe.0074A587
0074A586 1183 3D3C4573 adc dword ptr ds:[ebx+0x73453C3D],eax
0074A58C 0000          add byte ptr ds:[eax],al
0074A58E 75 0A          jnz Xg3rviewe.0074A59A
0074A590 7C 03          jl Xg3rviewe.0074A595
0074A592 7D 01          jge Xg3rviewe.0074A595
0074A594 DCE8          fsub st,st
0074A596 C7             ???                                     ; 未知命令
0074A597 6300          arpl word ptr ds:[eax],ax
0074A599 0081 7C240472 add byte ptr ds:[ecx+0x7204247C],al
0074A59F 0373 01       add esi,dword ptr ds:[ebx+0x1]
0074A5A2 833D 242D7300 0>cmp dword ptr ds:[0x732D24],0x0
0074A5A9 0F85 DC000000 jnz g3rviewe.0074A68B
0074A5AF 75 03          jnz Xg3rviewe.0074A5B4
0074A5B1 74 01          je Xg3rviewe.0074A5B4
0074A5B3  ^ 73 8B          jnb Xg3rviewe.0074A540
0074A5B5 15 E42C7300    adc eax,g3rviewe.00732CE4
0074A5BA 8915 902C7300 mov dword ptr ds:[0x732C90],edx
0074A5C0 817C24 08 75037>cmp dword ptr ss:[esp+0x8],0x1740375
0074A5C8 A1 E42C7300    mov eax,dword ptr ds:[0x732CE4]
0074A5CD 0305 58457300 add eax,dword ptr ds:[0x734558]
0074A5D3 A3 8C2C7300    mov dword ptr ds:[0x732C8C],eax
0074A5D8 817C24 08 75037>cmp dword ptr ss:[esp+0x8],0x1740375
0074A5E0 57             push edi
0074A5E1 51             push ecx
0074A5E2 50             push eax
0074A5E3 BF FEA87400    mov edi,g3rviewe.0074A8FE
0074A5E8 817C24 08 7C037>cmp dword ptr ss:[esp+0x8],0x17D037C
0074A5F0 803D 202D7300 0>cmp byte ptr ds:[0x732D20],0x0
0074A5F7 74 0A          je Xg3rviewe.0074A603
0074A5F9 75 03          jnz Xg3rviewe.0074A5FE
0074A5FB 74 01          je Xg3rviewe.0074A5FE
0074A5FD  ^ 71 BF          jno Xg3rviewe.0074A5BE
0074A5FF F8             clc
0074A600 A9 74007503    test eax,0x3750074
0074A605 74 01          je Xg3rviewe.0074A608
0074A607  ^ 75 8B          jnz Xg3rviewe.0074A594
0074A609 0D 8C2C7300    or eax,0x732C8C
0074A60E 7C 03          jl Xg3rviewe.0074A613
0074A610 7D 01          jge Xg3rviewe.0074A613
0074A612 D7             xlat byte ptr ds:[ebx+al]
0074A613 3BCF          cmp ecx,edi
0074A615 76 11          jbe Xg3rviewe.0074A628
0074A617 76 03          jbe Xg3rviewe.0074A61C
0074A619 77 01          ja Xg3rviewe.0074A61C
0074A61B B7 2B          mov bh,0x2B
0074A61D CF             iretd
0074A61E B0 90          mov al,0x90
0074A620 FC             cld
0074A621 72 03          jb Xg3rviewe.0074A626
0074A623 73 01          jnb Xg3rviewe.0074A626
0074A625 3C F3          cmp al,0xF3
0074A627 AA             stos byte ptr es:[edi]
0074A628 75 03          jnz Xg3rviewe.0074A62D
0074A62A 74 01          je Xg3rviewe.0074A62D
0074A62C  ^ 72 8B          jb Xg3rviewe.0074A5B9
0074A62E 3D 902C7300    cmp eax,g3rviewe.00732C90
0074A633 76 03          jbe Xg3rviewe.0074A638
0074A635 77 01          ja Xg3rviewe.0074A638
0074A637 C1B9 BA877400 8>sar dword ptr ds:[ecx+0x7487BA],0x81
0074A63E 7C 24          jl Xg3rviewe.0074A664
0074A640 04 76          add al,0x76
0074A642 0377 01       add esi,dword ptr ds:[edi+0x1]
0074A645 3BCF          cmp ecx,edi
0074A647 76 14          jbe Xg3rviewe.0074A65D
0074A649 817C24 04 72037>cmp dword ptr ss:[esp+0x4],0x1730372
0074A651 2BCF          sub ecx,edi
0074A653 72 03          jb Xg3rviewe.0074A658
0074A655 73 01          jnb Xg3rviewe.0074A658
0074A657 0D B090FCF3    or eax,0xF3FC90B0
0074A65C AA             stos byte ptr es:[edi]
0074A65D 7C 03          jl Xg3rviewe.0074A662
0074A65F 7D 01          jge Xg3rviewe.0074A662
0074A661 D1BF 8B887400 sar dword ptr ds:[edi+0x74888B],1
0074A667 817C24 04 72037>cmp dword ptr ss:[esp+0x4],0x1730372
0074A66F B9 4DA47400    mov ecx,g3rviewe.0074A44D
0074A674 817C24 08 7C037>cmp dword ptr ss:[esp+0x8],0x17D037C
0074A67C 2BCF          sub ecx,edi
0074A67E B0 90          mov al,0x90
0074A680 FC             cld
0074A681 F3:AA          rep stos byte ptr es:[edi]
0074A683 75 03          jnz Xg3rviewe.0074A688
0074A685 74 01          je Xg3rviewe.0074A688
0074A687 7A 58          jpe Xg3rviewe.0074A6E1
0074A689 59             pop ecx
0074A68A 5F             pop edi
0074A68B 833D EC427300 0>cmp dword ptr ds:[0x7342EC],0x0
0074A692 0F84 D6000000 je g3rviewe.0074A76E
0074A698 8B0D B4CF7100 mov ecx,dword ptr ds:[0x71CFB4]
0074A69E 81E1 00000080 and ecx,0x80000000
0074A6A4 85C9          test ecx,ecx
0074A6A6 75 74          jnz Xg3rviewe.0074A71C
0074A6A8 833D D4D77100 0>cmp dword ptr ds:[0x71D7D4],0x0
0074A6AF 74 6B          je Xg3rviewe.0074A71C
0074A6B1 68 10202400    push 0x242010
0074A6B6 8D95 4CFFFFFF lea edx,dword ptr ss:[ebp-0xB4]
0074A6BC 52             push edx
0074A6BD 68 70477300    push g3rviewe.00734770
0074A6C2 6A 00          push 0x0
0074A6C4 FF15 EC427300 call dword ptr ds:[0x7342EC]          ; USER32.MessageBoxA
0074A6CA 833D 50D07100 0>cmp dword ptr ds:[0x71D050],0x2
0074A6D1 75 47          jnz Xg3rviewe.0074A71A
0074A6D3 833D 44D07100 0>cmp dword ptr ds:[0x71D044],0x6
0074A6DA 75 3E          jnz Xg3rviewe.0074A71A
0074A6DC 833D A0457300 F>cmp dword ptr ds:[0x7345A0],-0x1
0074A6E3 74 35          je Xg3rviewe.0074A71A
0074A6E5 6A 00          push 0x0
0074A6E7 8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
0074A6ED 50             push eax
0074A6EE 6A 00          push 0x0
0074A6F0 68 10200400    push 0x42010
0074A6F5 68 9D010000    push 0x19D
0074A6FA 68 70477300    push g3rviewe.00734770
0074A6FF 68 A1000000    push 0xA1
0074A704 8D8D 4CFFFFFF lea ecx,dword ptr ss:[ebp-0xB4]
0074A70A 51             push ecx
0074A70B 8B15 A0457300 mov edx,dword ptr ds:[0x7345A0]
0074A711 52             push edx
0074A712 6A 00          push 0x0
0074A714 FF15 A4457300 call dword ptr ds:[0x7345A4]
0074A71A EB 19          jmp Xg3rviewe.0074A735
0074A71C 68 10200400    push 0x42010                            ; 错误
0074A721 8D85 4CFFFFFF lea eax,dword ptr ss:[ebp-0xB4]
0074A727 50             push eax
0074A728 68 70477300    push g3rviewe.00734770
0074A72D 6A 00          push 0x0
0074A72F FF15 EC427300 call dword ptr ds:[0x7342EC]          ; USER32.MessageBoxA
0074A735 C705 A0447300 0>mov dword ptr ds:[0x7344A0],0x0
0074A73F EB 0F          jmp Xg3rviewe.0074A750
0074A741 8B0D A0447300 mov ecx,dword ptr ds:[0x7344A0]
0074A747 83C1 01       add ecx,0x1
0074A74A 890D A0447300 mov dword ptr ds:[0x7344A0],ecx
0074A750 813D A0447300 A>cmp dword ptr ds:[0x7344A0],0xA1
0074A75A 73 10          jnb Xg3rviewe.0074A76C
0074A75C 8B15 A0447300 mov edx,dword ptr ds:[0x7344A0]
0074A762 C68415 4CFFFFFF>mov byte ptr ss:[ebp+edx-0xB4],0x0
0074A76A  ^ EB D5          jmp Xg3rviewe.0074A741
0074A76C EB 26          jmp Xg3rviewe.0074A794
0074A76E 33C0          xor eax,eax
0074A770 A0 FAF27100    mov al,byte ptr ds:[0x71F2FA]
0074A775 83F8 01       cmp eax,0x1
0074A778 75 1A          jnz Xg3rviewe.0074A794
0074A77A 68 70477300    push g3rviewe.00734770
0074A77F 8D8D 4CFFFFFF lea ecx,dword ptr ss:[ebp-0xB4]
0074A785 51             push ecx
0074A786 68 54227200    push g3rviewe.00722254                ; ASCII "%s: %s
"
0074A78B FF15 C8F3AC00 call dword ptr ds:[0xACF3C8]          ; msvcrt.printf
0074A791 83C4 0C       add esp,0xC
0074A794 833D 0C2D7300 0>cmp dword ptr ds:[0x732D0C],0x0
0074A79B 75 3B          jnz Xg3rviewe.0074A7D8
0074A79D 833D F0427300 0>cmp dword ptr ds:[0x7342F0],0x0
0074A7A4 74 0F          je Xg3rviewe.0074A7B5
0074A7A6 8B15 9C447300 mov edx,dword ptr ds:[0x73449C]
0074A7AC 52             push edx
0074A7AD FF15 F0427300 call dword ptr ds:[0x7342F0]          ; kernel32.ExitProcess
0074A7B3 EB 23          jmp Xg3rviewe.0074A7D8
0074A7B5 833D 50D07100 0>cmp dword ptr ds:[0x71D050],0x2
0074A7BC 75 13          jnz Xg3rviewe.0074A7D1
0074A7BE 833D 44D07100 0>cmp dword ptr ds:[0x71D044],0x6
0074A7C5 75 0A          jnz Xg3rviewe.0074A7D1
0074A7C7 6A 63          push 0x63
0074A7C9 FF15 00F0AC00 call dword ptr ds:[0xACF000]          ; kernel32.ExitProcess
0074A7CF EB 07          jmp Xg3rviewe.0074A7D8
0074A7D1 B8 63000000    mov eax,0x63
0074A7D6 EB 02          jmp Xg3rviewe.0074A7DA
0074A7D8 33C0          xor eax,eax
0074A7DA 5F             pop edi
0074A7DB 5E             pop esi
0074A7DC 5B             pop ebx
0074A7DD 8BE5          mov esp,ebp
0074A7DF 5D             pop ebp
0074A7E0 C2 0C00       retn 0xC

2014-4-20 21:27

0