-
-
[求助]请问这个Keygen用的是什么壳，怎么脱？
-
发表于: 2015-7-4 20:54
-
如题
程序是TuneUp Utilities 2012的序列号生成器
OD载入显示程序会跳出Code Section或自我修改
OEP是在这里吗？
怎么脱壳？求指导
0040121F /. 55 PUSH EBP
00401220 |. 89E5 MOV EBP,ESP
00401222 |. 6A FF PUSH -1
00401224 |. 68 1CE04400 PUSH keygen.0044E01C
00401229 |. 68 9A104000 PUSH keygen.0040109A
0040122E |. 50 PUSH EAX
0040122F |. 64:8925 000000>MOV DWORD PTR FS:[0],ESP
00401236 |. 83EC 10 SUB ESP,10
00401239 |. 53 PUSH EBX
0040123A |. 56 PUSH ESI
0040123B |. 57 PUSH EDI
0040123C |. 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
0040123F |. 50 PUSH EAX
00401240 |. D93C24 FSTCW WORD PTR SS:[ESP]
00401243 |. 66:810C24 0003 OR WORD PTR SS:[ESP],300
00401249 |. D92C24 FLDCW WORD PTR SS:[ESP]
0040124C |. 83C4 04 ADD ESP,4
0040124F |. 6A 00 PUSH 0
00401251 |. 6A 00 PUSH 0
00401253 |. 68 28E04400 PUSH keygen.0044E028
00401258 |. 68 24E04400 PUSH keygen.0044E024
0040125D |. 68 20E04400 PUSH keygen.0044E020
00401262 |. E8 E18F0100 CALL keygen.0041A248
00401267 |. FF35 28E04400 PUSH DWORD PTR DS:[44E028]
0040126D |. FF35 24E04400 PUSH DWORD PTR DS:[44E024]
00401273 |. FF35 20E04400 PUSH DWORD PTR DS:[44E020]
00401279 |. 8925 14E04400 MOV DWORD PTR DS:[44E014],ESP
0040127F |. E8 F8210100 CALL keygen.0041347C
00401284 |. 83C4 18 ADD ESP,18
00401287 |. 31C9 XOR ECX,ECX
00401289 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
0040128C |. 50 PUSH EAX
0040128D |. E8 E68F0100 CALL keygen.0041A278
00401292 |. C9 LEAVE
00401293 \. C3 RETN
程序是TuneUp Utilities 2012的序列号生成器
OD载入显示程序会跳出Code Section或自我修改
OEP是在这里吗？
怎么脱壳？求指导
0040121F /. 55 PUSH EBP
00401220 |. 89E5 MOV EBP,ESP
00401222 |. 6A FF PUSH -1
00401224 |. 68 1CE04400 PUSH keygen.0044E01C
00401229 |. 68 9A104000 PUSH keygen.0040109A
0040122E |. 50 PUSH EAX
0040122F |. 64:8925 000000>MOV DWORD PTR FS:[0],ESP
00401236 |. 83EC 10 SUB ESP,10
00401239 |. 53 PUSH EBX
0040123A |. 56 PUSH ESI
0040123B |. 57 PUSH EDI
0040123C |. 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
0040123F |. 50 PUSH EAX
00401240 |. D93C24 FSTCW WORD PTR SS:[ESP]
00401243 |. 66:810C24 0003 OR WORD PTR SS:[ESP],300
00401249 |. D92C24 FLDCW WORD PTR SS:[ESP]
0040124C |. 83C4 04 ADD ESP,4
0040124F |. 6A 00 PUSH 0
00401251 |. 6A 00 PUSH 0
00401253 |. 68 28E04400 PUSH keygen.0044E028
00401258 |. 68 24E04400 PUSH keygen.0044E024
0040125D |. 68 20E04400 PUSH keygen.0044E020
00401262 |. E8 E18F0100 CALL keygen.0041A248
00401267 |. FF35 28E04400 PUSH DWORD PTR DS:[44E028]
0040126D |. FF35 24E04400 PUSH DWORD PTR DS:[44E024]
00401273 |. FF35 20E04400 PUSH DWORD PTR DS:[44E020]
00401279 |. 8925 14E04400 MOV DWORD PTR DS:[44E014],ESP
0040127F |. E8 F8210100 CALL keygen.0041347C
00401284 |. 83C4 18 ADD ESP,18
00401287 |. 31C9 XOR ECX,ECX
00401289 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
0040128C |. 50 PUSH EAX
0040128D |. E8 E68F0100 CALL keygen.0041A278
00401292 |. C9 LEAVE
00401293 \. C3 RETN
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
