菜鸟我,初学脱壳,遇到了麻烦,还请大家帮个忙,谢谢先,部分代码如下:
00430764 > BE A4014000 MOV ESI,1551-cra.004001A4 ; Fsg1.33的入口
00430769 AD LODS DWORD PTR DS:[ESI]
0043076A 93 XCHG EAX,EBX
0043076B AD LODS DWORD PTR DS:[ESI]
0043076C 97 XCHG EAX,EDI
0043076D AD LODS DWORD PTR DS:[ESI]
0043076E 56 PUSH ESI
0043076F 96 XCHG EAX,ESI
00430770 B2 80 MOV DL,80
00430772 A4 MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
00430773 B6 80 MOV DH,80
00430775 FF13 CALL DWORD PTR DS:[EBX]
00430777 ^ 73 F9 JNB SHORT 1551-cra.00430772 ; 这里往回跳
00430779 33C9 XOR ECX,ECX ; F4后,F8继续
0043077B FF13 CALL DWORD PTR DS:[EBX]
0043077D 73 16 JNB SHORT 1551-cra.00430795
0043077F 33C0 XOR EAX,EAX
00430781 FF13 CALL DWORD PTR DS:[EBX]
00430783 73 1F JNB SHORT 1551-cra.004307A4 ; 回车
00430785 B6 80 MOV DH,80
00430787 41 INC ECX
00430788 B0 10 MOV AL,10
0043078A FF13 CALL DWORD PTR DS:[EBX]
0043078C 12C0 ADC AL,AL
0043078E ^ 73 FA JNB SHORT 1551-cra.0043078A
00430790 /75 3C JNZ SHORT 1551-cra.004307CE
00430792 |AA STOS BYTE PTR ES:[EDI]
00430793 ^|EB E0 JMP SHORT 1551-cra.00430775
00430795 |FF53 08 CALL DWORD PTR DS:[EBX+8]
00430798 |02F6 ADD DH,DH
0043079A |83D9 01 SBB ECX,1
0043079D |75 0E JNZ SHORT 1551-cra.004307AD
0043079F |FF53 04 CALL DWORD PTR DS:[EBX+4]
004307A2 |EB 26 JMP SHORT 1551-cra.004307CA
004307A4 |AC LODS BYTE PTR DS:[ESI]
004307A5 |D1E8 SHR EAX,1
004307A7 |74 2F JE SHORT 1551-cra.004307D8
004307A9 |13C9 ADC ECX,ECX
004307AB |EB 1A JMP SHORT 1551-cra.004307C7 ; 跳
004307AD |91 XCHG EAX,ECX
004307AE |48 DEC EAX
004307AF |C1E0 08 SHL EAX,8
004307B2 |AC LODS BYTE PTR DS:[ESI]
004307B3 |FF53 04 CALL DWORD PTR DS:[EBX+4]
004307B6 |3D 007D0000 CMP EAX,7D00
004307BB |73 0A JNB SHORT 1551-cra.004307C7
004307BD |80FC 05 CMP AH,5
004307C0 |73 06 JNB SHORT 1551-cra.004307C8
004307C2 |83F8 7F CMP EAX,7F
004307C5 /77 02 JA SHORT 1551-cra.004307C9
004307C7 |41 INC ECX
004307C8 |41 INC ECX
004307C9 \95 XCHG EAX,EBP
004307CA 8BC5 MOV EAX,EBP
004307CC B6 00 MOV DH,0
004307CE 56 PUSH ESI
004307CF 8BF7 MOV ESI,EDI
004307D1 2BF0 SUB ESI,EAX
004307D3 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR >
004307D5 5E POP ESI
004307D6 ^ EB 9D JMP SHORT 1551-cra.00430775 ; 这里要往回跳
004307D8 8BD6 MOV EDX,ESI ; F4到这里,F8继续
004307DA 5E POP ESI
004307DB AD LODS DWORD PTR DS:[ESI]
004307DC 48 DEC EAX
004307DD 74 0A JE SHORT 1551-cra.004307E9
004307DF 79 02 JNS SHORT 1551-cra.004307E3 ; 跳
004307E1 AD LODS DWORD PTR DS:[ESI]
004307E2 50 PUSH EAX
004307E3 56 PUSH ESI
004307E4 8BF2 MOV ESI,EDX
004307E6 97 XCHG EAX,EDI
004307E7 ^ EB 87 JMP SHORT 1551-cra.00430770 ; 往回跳
004307E9 AD LODS DWORD PTR DS:[ESI] ; F4到这里,F8继续
004307EA 93 XCHG EAX,EBX
004307EB 5E POP ESI
004307EC 46 INC ESI
004307ED AD LODS DWORD PTR DS:[ESI]
004307EE 97 XCHG EAX,EDI
004307EF 56 PUSH ESI
004307F0 FF13 CALL DWORD PTR DS:[EBX]
004307F2 95 XCHG EAX,EBP
004307F3 AC LODS BYTE PTR DS:[ESI]
004307F4 84C0 TEST AL,AL
004307F6 ^ 75 FB JNZ SHORT 1551-cra.004307F3 ; 小心回跳
004307F8 FE0E DEC BYTE PTR DS:[ESI] ; F4到这里,F8继续
004307FA ^ 74 F0 JE SHORT 1551-cra.004307EC
004307FC 79 05 JNS SHORT 1551-cra.00430803 ; 跳
004307FE 46 INC ESI
004307FF AD LODS DWORD PTR DS:[ESI]
00430800 50 PUSH EAX
00430801 EB 09 JMP SHORT 1551-cra.0043080C
00430803 FE0E DEC BYTE PTR DS:[ESI]
00430805 - 0F84 5B1EFDFF JE 1551-cra.00402666 ; 我把这里认为是入口,不过不对,
0043080B 56 PUSH ESI
0043080C 55 PUSH EBP
0043080D FF53 04 CALL DWORD PTR DS:[EBX+4]
00430810 AB STOS DWORD PTR ES:[EDI]
00430811 ^ EB E0 JMP SHORT 1551-cra.004307F3 ; 小心回跳
00430813 33C9 XOR ECX,ECX ; F4到这里就会运行
00430815 41 INC ECX
00430816 FF13 CALL DWORD PTR DS:[EBX]
00430818 13C9 ADC ECX,ECX
0043081A FF13 CALL DWORD PTR DS:[EBX]
0043081C ^ 72 F8 JB SHORT 1551-cra.00430816
0043081E C3 RETN
0043081F 02D2 ADD DL,DL
00430821 75 05 JNZ SHORT 1551-cra.00430828
00430823 8A16 MOV DL,BYTE PTR DS:[ESI]
00430825 46 INC ESI
00430826 12D2 ADC DL,DL
00430828 C3 RETN
...................................
[培训]《安卓高级研修班(网课)》月薪三万计划，掌
握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
