能力值:
( LV2,RANK:10 )
|
-
-
2 楼
peid查壳UPX-Scrambler RC1.x -> ┫nT?L
005D880F > $ 90 nop
005D8810 > 61 popad
005D8811 . BE 00D05400 mov esi, 江湖自补.0054D000 ; ASCII "卷稃"
005D8816 . 8DBE 0040EBFF lea edi, dword ptr ds:[esi+FFEB4000]
005D881C . 57 push edi ; ntdll.7C930738
005D881D . 83CD FF or ebp, FFFFFFFF
005D8820 . EB 10 jmp short 江湖自补.005D8832
005D8822 . EB 00 jmp short 江湖自补.005D8824
005D8824 >^ EB EA jmp short 江湖自补.005D8810
005D8826 .^ EB E8 jmp short 江湖自补.005D8810
005D8828 > 8A06 mov al, byte ptr ds:[esi]
005D882A . 46 inc esi
005D882B . 8807 mov byte ptr ds:[edi], al
005D882D . 47 inc edi ; ntdll.7C930738
005D882E > 01DB add ebx, ebx
005D8830 . 75 07 jnz short 江湖自补.005D8839
005D8832 > 8B1E mov ebx, dword ptr ds:[esi]
005D8834 . 83EE FC sub esi, -4
005D8837 . 11DB adc ebx, ebx
005D8839 >^ 72 ED jb short 江湖自补.005D8828
005D883B . B8 01000000 mov eax, 1
005D8840 > 01DB add ebx, ebx
005D8842 . 75 07 jnz short 江湖自补.005D884B
005D8844 . 8B1E mov ebx, dword ptr ds:[esi]
005D8846 . 83EE FC sub esi, -4
005D8849 . 11DB adc ebx, ebx
005D884B > 11C0 adc eax, eax
005D884D . 01DB add ebx, ebx
005D884F . 73 0B jnb short 江湖自补.005D885C
005D8851 . 75 19 jnz short 江湖自补.005D886C
005D8853 . 8B1E mov ebx, dword ptr ds:[esi]
005D8855 . 83EE FC sub esi, -4
005D8858 . 11DB adc ebx, ebx
005D885A . 72 10 jb short 江湖自补.005D886C
005D885C > 48 dec eax
005D885D . 01DB add ebx, ebx
005D885F . 75 07 jnz short 江湖自补.005D8868
005D8861 . 8B1E mov ebx, dword ptr ds:[esi]
005D8863 . 83EE FC sub esi, -4
005D8866 . 11DB adc ebx, ebx
005D8868 > 11C0 adc eax, eax
005D886A .^ EB D4 jmp short 江湖自补.005D8840
005D886C > 31C9 xor ecx, ecx
005D886E . 83E8 03 sub eax, 3
005D8871 . 72 11 jb short 江湖自补.005D8884
005D8873 . C1E0 08 shl eax, 8
005D8876 . 8A06 mov al, byte ptr ds:[esi]
005D8878 . 46 inc esi
005D8879 . 83F0 FF xor eax, FFFFFFFF
005D887C . 74 78 je short 江湖自补.005D88F6
005D887E . D1F8 sar eax, 1
005D8880 . 89C5 mov ebp, eax
005D8882 . EB 0B jmp short 江湖自补.005D888F
005D8884 > 01DB add ebx, ebx
005D8886 . 75 07 jnz short 江湖自补.005D888F
005D8888 . 8B1E mov ebx, dword ptr ds:[esi]
005D888A . 83EE FC sub esi, -4
005D888D . 11DB adc ebx, ebx
005D888F > 11C9 adc ecx, ecx
005D8891 . 01DB add ebx, ebx
005D8893 . 75 07 jnz short 江湖自补.005D889C
005D8895 . 8B1E mov ebx, dword ptr ds:[esi]
005D8897 . 83EE FC sub esi, -4
005D889A . 11DB adc ebx, ebx
005D889C > 11C9 adc ecx, ecx
005D889E . 75 20 jnz short 江湖自补.005D88C0
005D88A0 . 41 inc ecx
005D88A1 > 01DB add ebx, ebx
005D88A3 . 75 07 jnz short 江湖自补.005D88AC
005D88A5 . 8B1E mov ebx, dword ptr ds:[esi]
005D88A7 . 83EE FC sub esi, -4
005D88AA . 11DB adc ebx, ebx
005D88AC > 11C9 adc ecx, ecx
005D88AE . 01DB add ebx, ebx
005D88B0 .^ 73 EF jnb short 江湖自补.005D88A1
005D88B2 . 75 09 jnz short 江湖自补.005D88BD
005D88B4 . 8B1E mov ebx, dword ptr ds:[esi]
005D88B6 . 83EE FC sub esi, -4
005D88B9 . 11DB adc ebx, ebx
005D88BB .^ 73 E4 jnb short 江湖自补.005D88A1
005D88BD > 83C1 02 add ecx, 2
005D88C0 > 81FD 00FBFFFF cmp ebp, -500
005D88C6 . 83D1 01 adc ecx, 1
005D88C9 . 8D142F lea edx, dword ptr ds:[edi+ebp]
005D88CC . 83FD FC cmp ebp, -4
005D88CF . 76 0F jbe short 江湖自补.005D88E0
005D88D1 > 8A02 mov al, byte ptr ds:[edx]
005D88D3 . 42 inc edx ; ntdll.KiFastSystemCallRet
005D88D4 . 8807 mov byte ptr ds:[edi], al
005D88D6 . 47 inc edi ; ntdll.7C930738
005D88D7 . 49 dec ecx
005D88D8 .^ 75 F7 jnz short 江湖自补.005D88D1
005D88DA .^ E9 4FFFFFFF jmp 江湖自补.005D882E
005D88DF 90 nop
005D88E0 > 8B02 mov eax, dword ptr ds:[edx]
005D88E2 . 83C2 04 add edx, 4
005D88E5 . 8907 mov dword ptr ds:[edi], eax
005D88E7 . 83C7 04 add edi, 4
005D88EA . 83E9 04 sub ecx, 4
005D88ED .^ 77 F1 ja short 江湖自补.005D88E0
005D88EF . 01CF add edi, ecx
005D88F1 .^ E9 38FFFFFF jmp 江湖自补.005D882E
005D88F6 > 5E pop esi ; kernel32.7C816D4F
005D88F7 . 89F7 mov edi, esi
005D88F9 . B9 787F0000 mov ecx, 7F78
005D88FE > 8A07 mov al, byte ptr ds:[edi]
005D8900 . 47 inc edi ; ntdll.7C930738
005D8901 . 2C E8 sub al, 0E8
005D8903 > 3C 01 cmp al, 1
005D8905 .^ 77 F7 ja short 江湖自补.005D88FE
005D8907 . 803F 39 cmp byte ptr ds:[edi], 39
005D890A .^ 75 F2 jnz short 江湖自补.005D88FE
005D890C . 8B07 mov eax, dword ptr ds:[edi]
005D890E . 8A5F 04 mov bl, byte ptr ds:[edi+4]
005D8911 . 66:C1E8 08 shr ax, 8
005D8915 . C1C0 10 rol eax, 10
005D8918 . 86C4 xchg ah, al
005D891A . 29F8 sub eax, edi ; ntdll.7C930738
005D891C . 80EB E8 sub bl, 0E8
005D891F . 01F0 add eax, esi
005D8921 . 8907 mov dword ptr ds:[edi], eax
005D8923 . 83C7 05 add edi, 5
005D8926 . 89D8 mov eax, ebx
005D8928 .^ E2 D9 loopd short 江湖自补.005D8903
005D892A . 8DBE 00501D00 lea edi, dword ptr ds:[esi+1D5000]
005D8930 > 8B07 mov eax, dword ptr ds:[edi]
005D8932 . 09C0 or eax, eax
005D8934 . 74 45 je short 江湖自补.005D897B
005D8936 . 8B5F 04 mov ebx, dword ptr ds:[edi+4] ; ntdll.7C96E05D
005D8939 . 8D8430 DCD91D>lea eax, dword ptr ds:[eax+esi+1DD9D>
005D8940 . 01F3 add ebx, esi
005D8942 . 50 push eax
005D8943 . 83C7 08 add edi, 8
005D8946 . FF96 CCDA1D00 call near dword ptr ds:[esi+1DDACC]
005D894C . 95 xchg eax, ebp
005D894D > 8A07 mov al, byte ptr ds:[edi]
005D894F . 47 inc edi ; ntdll.7C930738
005D8950 . 08C0 or al, al
005D8952 .^ 74 DC je short 江湖自补.005D8930
005D8954 . 89F9 mov ecx, edi ; ntdll.7C930738
005D8956 . 79 07 jns short 江湖自补.005D895F
005D8958 . 0FB707 movzx eax, word ptr ds:[edi]
005D895B . 47 inc edi ; ntdll.7C930738
005D895C . 50 push eax
005D895D . 47 inc edi ; ntdll.7C930738
005D895E B9 db B9
005D895F . 57 push edi ; ntdll.7C930738
005D8960 . 48 dec eax
005D8961 . F2:AE repne scasb
005D8963 . 55 push ebp
005D8964 . FF96 D0DA1D00 call near dword ptr ds:[esi+1DDAD0]
005D896A . 09C0 or eax, eax
005D896C . 74 07 je short 江湖自补.005D8975
005D896E . 8903 mov dword ptr ds:[ebx], eax
005D8970 . 83C3 04 add ebx, 4
005D8973 .^ EB D8 jmp short 江湖自补.005D894D
005D8975 > FF96 D4DA1D00 call near dword ptr ds:[esi+1DDAD4]
005D897B > 60 pushad //--upx特征--//
005D897C .- E9 278CE2FF jmp 江湖自补.004015A8 //--这里本该OEP--//
跳过来却变这样:
004015A8 /EB 10 jmp short 江湖自补.004015BA
004015AA |66:623A bound di, dword ptr ds:[edx]
004015AD |43 inc ebx ; 江湖自补.0052A4D4
004015AE |2B2B sub ebp, dword ptr ds:[ebx]
004015B0 |48 dec eax
004015B1 |4F dec edi ; 江湖自补.005D79F8
004015B2 |4F dec edi ; 江湖自补.005D79F8
004015B3 |4B dec ebx ; 江湖自补.0052A4D4
004015B4 |90 nop
004015B5 -|E9 98C05100 jmp 0091D652
004015BA \A1 8BC05100 mov eax, dword ptr ds:[51C08B]
004015BF C1E0 02 shl eax, 2
004015C2 A3 8FC05100 mov dword ptr ds:[51C08F], eax
004015C7 52 push edx ; ntdll.7C99C0D8
004015C8 6A 00 push 0
004015CA E8 17981100 call 江湖自补.0051ADE6 ; jmp 到 kernel32.GetModuleHandleA
004015CF 8BD0 mov edx, eax
004015D1 E8 A2B80F00 call 江湖自补.004FCE78
004015D6 5A pop edx ; 江湖自补.005D79F8
004015D7 E8 00B80F00 call 江湖自补.004FCDDC
004015DC E8 D7B80F00 call 江湖自补.004FCEB8
004015E1 6A 00 push 0
004015E3 E8 DCCC0F00 call 江湖自补.004FE2C4
004015E8 59 pop ecx ; 江湖自补.005D79F8
004015E9 68 34C05100 push 江湖自补.0051C034
004015EE 6A 00 push 0
004015F0 E8 F1971100 call 江湖自补.0051ADE6 ; jmp 到 kernel32.GetModuleHandleA
004015F5 A3 93C05100 mov dword ptr ds:[51C093], eax
004015FA 6A 00 push 0
004015FC E9 8F1D1000 jmp 江湖自补.00503390
00401601 E9 0ACD0F00 jmp 江湖自补.004FE310
00401606 33C0 xor eax, eax
00401608 A0 7DC05100 mov al, byte ptr ds:[51C07D]
0040160D C3 retn
|