0042D584 |. 6A 00 PUSH 0
0042D586 |. 68 9A99993E PUSH 3E99999A
0042D58B |. 8BCE MOV ECX,ESI
0042D58D |. E8 AEE6FFFF CALL GKK2.0042BC40
0042D592 |.^ E9 40FDFFFF JMP GKK2.0042D2D7
0042D597 |> 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]
0042D59B |. 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
0042D59F |. 8986 18020000 MOV DWORD PTR DS:[ESI+218],EAX
0042D5A5 |. 898E 1C020000 MOV DWORD PTR DS:[ESI+21C],ECX
0042D5AB |.^ E9 27FDFFFF JMP GKK2.0042D2D7
0042D5B0 |> 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+2C]
0042D5B4 |. 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+28]
0042D5B8 |. 898E 18020000 MOV DWORD PTR DS:[ESI+218],ECX
0042D5BE |. 8996 1C020000 MOV DWORD PTR DS:[ESI+21C],EDX
0042D5C4 |> 8A46 16 MOV AL,BYTE PTR DS:[ESI+16]
0042D5C7 |. 84C0 TEST AL,AL
0042D5C9 |. 0F84 C6000000 JE GKK2.0042D695
0042D5CF |. 8B46 74 MOV EAX,DWORD PTR DS:[ESI+74]
0042D5D2 |. 33FF XOR EDI,EDI
0042D5D4 |. 83F8 03 CMP EAX,3
0042D5D7 |. 75 05 JNZ SHORT GKK2.0042D5DE
0042D5D9 |. BF 01000000 MOV EDI,1
0042D5DE |> 83F8 09 CMP EAX,9
0042D5E1 |. 75 05 JNZ SHORT GKK2.0042D5E8
0042D5E3 |. BF 0A000000 MOV EDI,0A
0042D5E8 |> 395E 20 CMP DWORD PTR DS:[ESI+20],EBX
0042D5EB |. 75 09 JNZ SHORT GKK2.0042D5F6
0042D5ED |. 8B46 24 MOV EAX,DWORD PTR DS:[ESI+24]
0042D5F0 |. 3B4424 18 CMP EAX,DWORD PTR SS:[ESP+18]
0042D5F4 |. 74 65 JE SHORT GKK2.0042D65B
0042D5F6 |> 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18]
0042D5FA |. 895E 20 MOV DWORD PTR DS:[ESI+20],EBX
0042D5FD |. 8A5E 28 MOV BL,BYTE PTR DS:[ESI+28]
0042D600 |. 84DB TEST BL,BL
0042D602 |. 894E 24 MOV DWORD PTR DS:[ESI+24],ECX
0042D605 |. 74 17 JE SHORT GKK2.0042D61E
0042D607 |. 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24]
0042D60B |. 8BD1 MOV EDX,ECX
上面代码
0042D5FA |. 895E 20 MOV DWORD PTR DS:[ESI+20],EBX中,ESI是个地址指针,由于ESI是由前面多个代码确定,有没有方法能确定这个ESI是由哪条代码确定的.
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
