在用od看Exepack加的一个简单的用汇编写的仅一个窗口的程序,直接用
bpx GetModuleHandleA,提示有int3在004012A5,离这不远,就看到啦下面
这些,请问各位大哥,我该怎么做?贴下有附件,包过加壳的和未加壳的.
004012B4 - FF25 5820400>jmp dword ptr ds:[402058] ; user32.CreateWindowExA
004012BA - FF25 5020400>jmp dword ptr ds:[402050] ; user32.DefWindowProcA
004012C0 - FF25 4C20400>jmp dword ptr ds:[40204C] ; user32.DestroyWindow
004012C6 - FF25 4820400>jmp dword ptr ds:[402048] ; user32.DispatchMessageA
004012CC - FF25 4420400>jmp dword ptr ds:[402044] ; user32.EnableMenuItem
004012D2 - FF25 4020400>jmp dword ptr ds:[402040] ; user32.GetMenu
004012D8 - FF25 3C20400>jmp dword ptr ds:[40203C] ; user32.GetMessageA
004012DE - FF25 3820400>jmp dword ptr ds:[402038] ; user32.LoadCursorA
004012E4 - FF25 2C20400>jmp dword ptr ds:[40202C] ; user32.LoadIconA
004012EA - FF25 2420400>jmp dword ptr ds:[402024] ; user32.PostQuitMessage
004012F0 - FF25 2820400>jmp dword ptr ds:[402028] ; user32.RegisterClassExA
004012F6 - FF25 5420400>jmp dword ptr ds:[402054] ; user32.ShowWindow
004012FC - FF25 3020400>jmp dword ptr ds:[402030] ; user32.TranslateMessage
00401302 - FF25 3420400>jmp dword ptr ds:[402034] ; user32.UpdateWindow
00401308 - FF25 1820400>jmp dword ptr ds:[402018] ; kernel32.CloseHandle
0040130E - FF25 1420400>jmp dword ptr ds:[402014] ; kernel32.CreateProcessA
00401314 - FF25 1020400>jmp dword ptr ds:[402010] ; kernel32.ExitProcess
0040131A - FF25 0C20400>jmp dword ptr ds:[40200C] ; kernel32.GetCommandLineA
00401320 - FF25 0820400>jmp dword ptr ds:[402008] ; kernel32.GetExitCodeProcess
00401326 - FF25 0420400>jmp dword ptr ds:[402004] ; kernel32.GetModuleHandleA
0040132C - FF25 0020400>jmp dword ptr ds:[402000] ; kernel32.GetStartupInfoA
00401332 - FF25 1C20400>jmp dword ptr ds:[40201C] ; kernel32.TerminateProcess
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
