-
-
[求助][MSLRH].V0.32a
-
发表于:
2006-2-13 16:52
3800
-
MSLRH].V0.32a 是利用什么方法ANTI-DUMP的
到OEP后
00406436 6A 00 PUSH 0
00406438 E8 CF110000 CALL [MSLRH].0040760C ; JMP 到 kernel32.GetModuleHandleA
0040643D A3 84E34000 MOV DWORD PTR DS:[40E384],EAX
00406442 E8 5B120000 CALL [MSLRH].004076A2 ; JMP 到 comctl32.InitCommonControls
00406447 6A 00 PUSH 0
00406449 68 64644000 PUSH [MSLRH].00406464
0040644E 6A 00 PUSH 0
00406450 6A 65 PUSH 65
00406452 FF35 84E34000 PUSH DWORD PTR DS:[40E384]
00406458 E8 FD110000 CALL [MSLRH].0040765A ; JMP 到 USER32.DialogBoxParamA
0040645D 6A 00 PUSH 0
0040645F E8 96110000 CALL [MSLRH].004075FA ; JMP 到 kernel32.ExitProcess
00406464 55 PUSH EBP
00406465 8BEC MOV EBP,ESP
00406467 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
0040646A 3D 10010000 CMP EAX,110
LOAD PE脱壳显示:“无法粘贴原始PE头”
用OD改变读写属性仍然不行
为什么
请指教
[课程]Android-CTF解题方法汇总!