能力值：
( LV4，RANK：50 )
|
-
-
2 楼
00412CA0 55 push ebp
00412CA1 89E5 mov ebp,esp
00412CA3 51 push ecx
00412CA4 B9 08000000 mov ecx,0x8
00412CA9 6A 00 push 0x0
00412CAB 49 dec ecx
00412CAC ^ 75 FB jnz short ImportAd.00412CA9
00412CAE 8B4C24 20 mov ecx,dword ptr ss:[esp+0x20] ; kernel32.7C839AB0
00412CB2 8944E4 1C mov dword ptr ss:[esp+0x1C],eax
00412CB6 895CE4 18 mov dword ptr ss:[esp+0x18],ebx
00412CBA 894CE4 14 mov dword ptr ss:[esp+0x14],ecx
00412CBE 8954E4 10 mov dword ptr ss:[esp+0x10],edx ; ntdll.KiFastSystemCallRet
00412CC2 8964E4 0C mov dword ptr ss:[esp+0xC],esp
00412CC6 896CE4 08 mov dword ptr ss:[esp+0x8],ebp
00412CCA 8974E4 04 mov dword ptr ss:[esp+0x4],esi
00412CCE 893CE4 mov dword ptr ss:[esp],edi
00412CD1 90 nop
00412CD2 90 nop
00412CD3 90 nop
00412CD4 E8 00000000 call ImportAd.00412CD9
00412CD9 58 pop eax ; kernel32.7C81776F
00412CDA 25 00F0FFFF and eax,-0x1000
00412CDF 66:8138 4D5A cmp word ptr ds:[eax],0x5A4D
00412CE4 74 07 je short ImportAd.00412CED
00412CE6 2D 00100000 sub eax,0x1000
00412CEB ^ EB F2 jmp short ImportAd.00412CDF
00412CED 50 push eax
00412CEE 8BD8 mov ebx,eax
00412CF0 83C3 3C add ebx,0x3C
00412CF3 8B1B mov ebx,dword ptr ds:[ebx]
00412CF5 03D8 add ebx,eax
00412CF7 53 push ebx
00412CF8 83C3 14 add ebx,0x14
00412CFB 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet
00412CFD 66:8B13 mov dx,word ptr ds:[ebx]
00412D00 52 push edx ; ntdll.KiFastSystemCallRet
00412D01 8B5424 04 mov edx,dword ptr ss:[esp+0x4]
00412D05 83C2 18 add edx,0x18
00412D08 031424 add edx,dword ptr ss:[esp] ; kernel32.7C81776F
00412D0B 52 push edx ; ntdll.KiFastSystemCallRet
00412D0C 83C2 0C add edx,0xC
00412D0F 8B1A mov ebx,dword ptr ds:[edx]
00412D11 035C24 0C add ebx,dword ptr ss:[esp+0xC]
00412D15 53 push ebx
00412D16 8B5424 04 mov edx,dword ptr ss:[esp+0x4]
00412D1A 83C2 10 add edx,0x10
00412D1D 8B1A mov ebx,dword ptr ds:[edx]
00412D1F 53 push ebx
00412D20 8B5424 08 mov edx,dword ptr ss:[esp+0x8]
00412D24 83C2 28 add edx,0x28
00412D27 83C2 0C add edx,0xC
00412D2A 8B1A mov ebx,dword ptr ds:[edx]
00412D2C 035C24 14 add ebx,dword ptr ss:[esp+0x14]
00412D30 53 push ebx
00412D31 83C2 04 add edx,0x4
00412D34 8B1A mov ebx,dword ptr ds:[edx]
00412D36 53 push ebx
00412D37 90 nop
00412D38 90 nop
00412D39 59 pop ecx ; kernel32.7C81776F
00412D3A 81E9 00020000 sub ecx,0x200
00412D40 5B pop ebx ; kernel32.7C81776F
00412D41 8033 34 xor byte ptr ds:[ebx],0x34
00412D44 43 inc ebx
00412D45 49 dec ecx
00412D46 ^ 75 F9 jnz short ImportAd.00412D41
00412D48 90 nop
00412D49 59 pop ecx ; kernel32.7C81776F
00412D4A 81E9 00060000 sub ecx,0x600
00412D50 5B pop ebx ; kernel32.7C81776F
00412D51 8033 45 xor byte ptr ds:[ebx],0x45
00412D54 43 inc ebx
00412D55 49 dec ecx
00412D56 ^ 75 F9 jnz short ImportAd.00412D51
00412D58 58 pop eax ; kernel32.7C81776F
00412D59 58 pop eax ; kernel32.7C81776F
00412D5A 58 pop eax ; kernel32.7C81776F
00412D5B 58 pop eax ; kernel32.7C81776F
00412D5C 8B44E4 1C mov eax,dword ptr ss:[esp+0x1C]
00412D60 8B5CE4 18 mov ebx,dword ptr ss:[esp+0x18]
00412D64 8B4CE4 14 mov ecx,dword ptr ss:[esp+0x14]
00412D68 8B54E4 10 mov edx,dword ptr ss:[esp+0x10]
00412D6C 8B64E4 0C mov esp,dword ptr ss:[esp+0xC]
00412D70 8B6CE4 08 mov ebp,dword ptr ss:[esp+0x8]
00412D74 8B74E4 04 mov esi,dword ptr ss:[esp+0x4]
00412D78 8B3CE4 mov edi,dword ptr ss:[esp] ; kernel32.7C81776F
00412D7B B9 00020000 mov ecx,0x200
00412D80 C1E1 06 shl ecx,0x6
00412D83 C1E9 0C shr ecx,0xC
00412D86 83EC FC sub esp,-0x4
00412D89 49 dec ecx
00412D8A ^ 75 FA jnz short ImportAd.00412D86
00412D8C 8B6C24 04 mov ebp,dword ptr ss:[esp+0x4]
00412D90 B9 00020000 mov ecx,0x200
00412D95 C1E1 06 shl ecx,0x6
00412D98 C1E9 0C shr ecx,0xC
00412D9B 44 inc esp
00412D9C 49 dec ecx
00412D9D ^ 75 FC jnz short ImportAd.00412D9B
00412D9F 8B4C24 F8 mov ecx,dword ptr ss:[esp-0x8]
看不懂呀
|
能力值：
![]()
(RANK：20 )
|
-
-
3 楼
中间那一段是获取PE结构的信息，然后找到代码段和数据段其实位置和他们的物理大小，对其进行异或加密，然后调到原入口点，很简单啊！
|
