下载地址：http://free5.ys168.com/?lzmo123
程序为：]32Lite 0.03a -> Oleg Prokhorov加壳
00401000 > 60 PUSHAD ; 加载到这里！说实话是第一次看到下面这样的代码！
00401001 06 PUSH ES
00401002 FC CLD
00401003 1E PUSH DS
00401004 07 POP ES ; 段寄存器更改
00401005 BE 00104000 MOV ESI,QEDITOR.<模块入口点>
0040100A 6A 04 PUSH 4
0040100C 68 00100000 PUSH 1000
00401011 68 A3820000 PUSH 82A3
00401016 6A 00 PUSH 0
00401018 FF96 80B50100 CALL DWORD PTR DS:[ESI+1B580]
0040101E 09C0 OR EAX,EAX
00401020 75 03 JNZ SHORT QEDITOR.00401025
00401022 07 POP ES ; 段寄存器更改
00401023 61 POPAD
00401024 C3 RETN
00401025 97 XCHG EAX,EDI
00401026 8D87 9F7F0000 LEA EAX,DWORD PTR DS:[EDI+7F9F]
0040102C 50 PUSH EAX
0040102D 56 PUSH ESI
0040102E 83C6 42 ADD ESI,42
00401031 57 PUSH EDI
00401032 B9 3E200000 MOV ECX,203E
00401037 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
00401039 5E POP ESI
0040103A 5F POP EDI
0040103B 89B6 EB800000 MOV DWORD PTR DS:[ESI+80EB],ESI
00401041 C3 RETN ; 一路F8到这里，跳！
00401042 C3 RETN
00347F9F 57 PUSH EDI ; QEDITOR.<模块入口点>
00347FA0 B2 80 MOV DL,80
00347FA2 31DB XOR EBX,EBX
00347FA4 A4 MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
00347FA5 B3 02 MOV BL,2
00347FA7 E8 64000000 CALL 00348010
00347FAC ^ 73 F6 JNB SHORT 00347FA4
00347FAE 31C9 XOR ECX,ECX
00347FB0 E8 5B000000 CALL 00348010
00347FB5 73 1C JNB SHORT 00347FD3
00347FB7 31C0 XOR EAX,EAX
00347FB9 E8 52000000 CALL 00348010
00347FBE 73 6C JNB SHORT 0034802C ; 一个大灰色跳！回车进去！
00347FC0 B3 02 MOV BL,2
00347FC2 41 INC ECX
0034802C AC LODS BYTE PTR DS:[ESI] ; 到这里！
0034802D D1E8 SHR EAX,1
0034802F 74 04 JE SHORT 00348035
00348031 11C9 ADC ECX,ECX
00348033 ^ EB CA JMP SHORT 00347FFF ; 有回跳！
00348035 5B POP EBX ; F4运行到这里！
00348036 53 PUSH EBX
00348037 8D73 63 LEA ESI,DWORD PTR DS:[EBX+63]
0034803A F7DB NEG EBX
0034803C B9 83120000 MOV ECX,1283
00348041 AC LODS BYTE PTR DS:[ESI]
00348042 D0E8 SHR AL,1
00348044 3C 74 CMP AL,74
00348046 ^ 75 F9 JNZ SHORT 00348041
00348048 803E 05 CMP BYTE PTR DS:[ESI],5
0034804B ^ 75 F4 JNZ SHORT 00348041
0034804D 8D141E LEA EDX,DWORD PTR DS:[ESI+EBX]
00348050 AD LODS DWORD PTR DS:[ESI]
00348051 66:C1E8 08 SHR AX,8
00348055 C1C8 10 ROR EAX,10
00348058 86E0 XCHG AL,AH
0034805A 29D0 SUB EAX,EDX
0034805C 8946 FC MOV DWORD PTR DS:[ESI-4],EAX
0034805F ^ E2 E0 LOOPD SHORT 00348041 ; 有回跳！
00348061 89F7 MOV EDI,ESI ; 这里F4
00348063 B9 6D190000 MOV ECX,196D
00348068 E9 16000000 JMP 00348083
0034806D 803F 05 CMP BYTE PTR DS:[EDI],5
00348083 B0 E8 MOV AL,0E8
00348085 F2:AE REPNE SCAS BYTE PTR ES:[EDI]
00348087 ^ 74 E4 JE SHORT 0034806D ; 有回跳！
00348089 5F POP EDI ; F4运行到这里！
0034808A 8BF7 MOV ESI,EDI
0034808C 8D9E 34730100 LEA EBX,DWORD PTR DS:[ESI+17334]
00348092 8DBE 9F750100 LEA EDI,DWORD PTR DS:[ESI+1759F]
00348098 47 INC EDI
00348099 8B07 MOV EAX,DWORD PTR DS:[EDI]
0034809B 83C7 04 ADD EDI,4
0034809E 01C3 ADD EBX,EAX
003480A0 83F8 FF CMP EAX,-1
003480A3 74 2B JE SHORT 003480D0 ; 又是一个灰色跳！注意一下后面在说！ 后面发现该在这里回车进去！
003480A5 57 PUSH EDI
003480A6 FF96 78B50100 CALL DWORD PTR DS:[ESI+1B578]
003480AC 09C0 OR EAX,EAX
003480AE 74 1D JE SHORT 003480CD
003480B0 95 XCHG EAX,EBP
003480B1 89F9 MOV ECX,EDI
003480B3 31C0 XOR EAX,EAX
003480B5 F2:AE REPNE SCAS BYTE PTR ES:[EDI]
003480B7 803F 00 CMP BYTE PTR DS:[EDI],0
003480BA ^ 74 DC JE SHORT 00348098
003480BC 57 PUSH EDI
003480BD 55 PUSH EBP
003480BE FF96 7CB50100 CALL DWORD PTR DS:[ESI+1B57C]
003480C4 8903 MOV DWORD PTR DS:[EBX],EAX
003480C6 83C3 04 ADD EBX,4
003480C9 09C0 OR EAX,EAX
003480CB ^ 75 E4 JNZ SHORT 003480B1
003480CD 07 POP ES ; 段寄存器更改
003480CE 61 POPAD ; 一个出口标志！但是跟踪几次发现是 死循环！放弃他！
003480CF C3 RETN
003480D0 89F7 MOV EDI,ESI
003480D2 81C7 34AC0100 ADD EDI,1AC34
003480D0 89F7 MOV EDI,ESI ; 到这里！F2下断，F9运行，F2在取消断点，F8向下走！
003480D2 81C7 34AC0100 ADD EDI,1AC34
003480D8 B9 F3000000 MOV ECX,0F3
003480DD 31C0 XOR EAX,EAX
003480DF F3:AB REP STOS DWORD PTR ES:[EDI]
003480E1 97 XCHG EAX,EDI
003480E2 07 POP ES ; 段寄存器更改
003480E3 68 00800000 PUSH 8000
003480E8 6A 00 PUSH 0
003480EA 68 00003400 PUSH 340000
003480EF 05 3C050000 ADD EAX,53C
003480F4 50 PUSH EAX
003480F5 C3 RETN ; 一个转跳！
0041C53C FF96 84B50100 CALL DWORD PTR DS:[ESI+1B584] ; KERNEL32.VirtualFree
0041C542 61 POPAD ; 这里才是真正的OEP入口！跳过去！
0041C543 - E9 0848FFFF JMP QEDITOR.00410D50 ; 开跳了！
0041C548 0010 ADD BYTE PTR DS:[EAX],DL
0041C54A 0000 ADD BYTE PTR DS:[EAX],AL
00410D50 55 PUSH EBP ; OEP真正的领空！
00410D51 8BEC MOV EBP,ESP
00410D53 53 PUSH EBX
00410D54 56 PUSH ESI
00410D55 57 PUSH EDI
00410D56 BB 00604100 MOV EBX,QEDITOR.00416000
00410D5B 66:2E:F705 D213>TEST WORD PTR CS:[4113D2],4
00410D65 0F85 DB000000 JNZ QEDITOR.00410E46
00410D6B 6A 00 PUSH 0
00410D6D FF15 54844100 CALL DWORD PTR DS:[418454] ; OLE32.CoInitialize
00410D73 E8 92020000 CALL QEDITOR.0041100A
00410D78 C783 08010000 0>MOV DWORD PTR DS:[EBX+108],1
00410D82 8D83 90020000 LEA EAX,DWORD PTR DS:[EBX+290]
00410D88 50 PUSH EAX
00410D89 FF15 DC834100 CALL DWORD PTR DS:[4183DC] ; KERNEL32.GetVersionExA
00410D8F 83EC 44 SUB ESP,44
00410D92 C70424 44000000 MOV DWORD PTR SS:[ESP],44
00410D99 C74424 2C 00000>MOV DWORD PTR SS:[ESP+2C],0
00410DA1 54 PUSH ESP
00410DA2 FF15 D4834100 CALL DWORD PTR DS:[4183D4] ; KERNEL32.GetStartupInfoA
00410DA8 B8 0A000000 MOV EAX,0A
00410DAD F74424 2C 01000>TEST DWORD PTR SS:[ESP+2C],1
00410DB5 74 05 JE SHORT QEDITOR.00410DBC
00410DB7 0FB74424 30 MOVZX EAX,WORD PTR SS:[ESP+30]
00410DBC 83C4 44 ADD ESP,44
00410DBF 8983 FE000000 MOV DWORD PTR DS:[EBX+FE],EAX
00410DC5 FF15 B0834100 CALL DWORD PTR DS:[4183B0] ; KERNEL32.GetCommandLineA
脱完壳不能正常运行，用LordPE 转存后在用ImportREC_fix_hh修复下。在用LordPE重建PE，OK 可以运行了
脱完后程序为：PowerBasic 7.02编写！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
