00408549 \. C3 RETN
0040854A 90 NOP
0040854B 90 NOP
0040854C 90 NOP
0040854D 90 NOP
0040854E 90 NOP
0040854F 90 NOP
00408550 90 NOP
00408551 . E8 C21A0000 CALL pycq.0040A018
Address Thread Command ; Registers and comments
00E6D01B Main PUSH FD40BD35
00E6D020 Main PUSH EAX
00E6D021 Main MOV EAX,ABAB2DA1 ; EAX=ABAB2DA1
00E6D026 Main ADD DWORD PTR SS:[ESP+4],EAX
00E6D02A Main POP EAX ; EAX=00E6C6D0
00E6D02B Main JMP 00E6D1C7
00E6D1C7 Main PUSH EAX
00E6D1C8 Main PUSH 0
00E6D1CD Main PUSH EAX
00E6D1CE Main MOV EAX,ABAB2DA1 ; EAX=ABAB2DA1
00E6D1D3 Main ADD DWORD PTR SS:[ESP+4],EAX
00E6D1D7 Main POP EAX ; EAX=00E6C6D0
00E6D1D8 Main POP EAX ; EAX=ABAB2DA1
00E6D1D9 Main JMP 00E6D6EE
00E6D6EE Main ADD DWORD PTR SS:[ESP+4],EAX
00E6D6F2 Main JMP 00E6D913
00E6D913 Main POP EAX ; EAX=00E6C6D0
00E6D914 Main PUSH EAX
00E6D915 Main PUSH 5454D25F
00E6D91A Main PUSH EAX
00E6D91B Main MOV EAX,ABAB2DA1 ; EAX=ABAB2DA1
00E6D920 Main JMP 00E6CBF4
00E6CBF4 Main ADD DWORD PTR SS:[ESP+4],EAX
00E6CBF8 Main POP EAX ; EAX=00E6C6D0
00E6CBF9 Main PUSH EAX
00E6CBFA Main JMP 00E6DF60
00E6DF60 Main PUSH 0
00E6DF65 Main PUSH EAX
00E6DF66 Main MOV EAX,ABAB2DA1 ; EAX=ABAB2DA1
00E6DF6B Main NOP
00E6DF6C Main ADD DWORD PTR SS:[ESP+4],EAX
00E6DF70 Main POP EAX ; EAX=00E6C6D0
00E6DF71 Main POP EAX ; EAX=ABAB2DA1
00E6DF72 Main XCHG EBX,EBX
00E6DF74 Main JMP 00E6D2AC
00E6D2AC Main ADD DWORD PTR SS:[ESP+4],EAX
00E6D2B0 Main MOV ECX,ECX
00E6D2B2 Main POP EAX ; EAX=00E6C6D0
00E6D2B3 Main POP EAX ; EAX=ABAB2DA1
00E6D2B4 Main ADD DWORD PTR SS:[ESP+4],EAX
00E6D2B8 Main MOV ESP,ESP
00E6D2BA Main JMP 00E6CA38
00E6CA38 Main POP EAX ; EAX=00E6C6D0
00E6CA39 Main PUSH 549557B0
00E6CA3E Main PUSH EAX
00E6CA3F Main MOV EAX,ABAB2DA1 ; EAX=ABAB2DA1
00E6CA44 Main JMP 00E6D450
00E6D450 Main ADD DWORD PTR SS:[ESP+4],EAX
00E6D454 Main POP EAX ; EAX=00E6C6D0
00E6D455 Main ADD ESP,4
00E6D458 Main JMP DWORD PTR SS:[ESP-4]
00408551 Main CALL pycq.0040A018
Run trace stopped
EAX 00E6C6D0 ASCII "h:"
ECX 00010101
EDX FFFFFFFF
EBX 7FFDF000
ESP 0012FFBC
EBP 0012FFF0
ESI 00000000
EDI 0012D180
EIP 00408551 pycq.00408551
0012FFBC 00424618 pycq.00424618
0012FFC0 00000060
0012FFC4 77E71AF6 RETURN to KERNEL32.77E71AF6
0012FFC8 0012D180
0012FFCC 00000000
0012FFD0 7FFDF000
0012FFD4 00564DC8
0012FFD8 0012FFC8
0012FFDC 00564DC8
0012FFE0 FFFFFFFF End of SEH chain
0012FFE4 77E6E597 SE handler
0012FFE8 77E71B00 KERNEL32.77E71B00
0012FFEC 00000000
0012FFF0 00000000
0012FFF4 00000000
0012FFF8 0045B000 OFFSET pycq.<ModuleEntryPoint>
0012FFFC 00000000
这个oep处的代码怎么恢复呢,知道的就帮下我啦。。。谢谢~~
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课