-
-
再问ARM壳的问题.
-
发表于: 2006-9-14 22:38
-
用PEID0.94查壳显示为:Armadillo 3.00a - 3.61 -> Silicon Realms Toolworks 双进程.CopyMem-II
下断点:BP WaitForDebugEvent,F9运行,Shift+F9两次来到下面
7C85A268 > 8BFF mov edi, edi ; 复Ex91.008508C8
7C85A26A 55 push ebp
7C85A26B 8BEC mov ebp, esp
7C85A26D 83EC 68 sub esp, 68
7C85A270 56 push esi
7C85A271 FF75 0C push dword ptr [ebp+C]
7C85A274 8D45 F8 lea eax, [ebp-8]
7C85A277 50 push eax
7C85A278 E8 F381FAFF call 7C802470
7C85A27D 8BF0 mov esi, eax
7C85A27F 56 push esi
7C85A280 8D45 98 lea eax, [ebp-68]
7C85A283 50 push eax
7C85A284 E8 9A520200 call <jmp.&ntdll.DbgUiWaitStateChange>
7C85A289 3D 01010000 cmp eax, 101
7C85A28E ^ 74 EF je short 7C85A27F
7C85A290 3D C0000000 cmp eax, 0C0
7C85A295 ^ 74 E8 je short 7C85A27F
7C85A297 85C0 test eax, eax
7C85A299 7D 07 jge short 7C85A2A2
7C85A29B 3D 02000140 cmp eax, 40010002
7C85A2A0 75 26 jnz short 7C85A2C8
7C85A2A2 3D 02010000 cmp eax, 102
7C85A2A7 75 0E jnz short 7C85A2B7
7C85A2A9 6A 79 push 79
7C85A2AB E8 10F0FAFF call 7C8092C0
7C85A2B0 33C0 xor eax, eax
7C85A2B2 5E pop esi
7C85A2B3 C9 leave
7C85A2B4 C2 0800 retn 8
堆栈窗口:在12DA7C点在数据中跟随.
0012DA78 00825AF7 /CALL 到 WaitForDebugEvent
0012DA7C 0012EB54 |pDebugEvent = 0012EB54
0012DA80 000003E8 \Timeout = 1000. ms
接下来再下断点:bp WriteProcessMemory,F9
7C80220F > 8BFF mov edi, edi
7C802211 55 push ebp
7C802212 8BEC mov ebp, esp
7C802214 51 push ecx
7C802215 51 push ecx
7C802216 8B45 0C mov eax, [ebp+C]
7C802219 53 push ebx
7C80221A 8B5D 14 mov ebx, [ebp+14]
7C80221D 56 push esi
7C80221E 8B35 B812807C mov esi, [<&ntdll.NtProtectVirtualMe>; ntdll.ZwProtectVirtualMemory
0012D918 00829B0F /CALL 到 WriteProcessMemory
0012D91C 0000004C |hProcess = 0000004C
0012D920 005B8000 |Address = 5B8000
0012D924 003EBAD8 |Buffer = 003EBAD8
0012D928 00001000 |BytesToWrite = 1000 (4096.)
0012D92C 0012DA34 \pBytesWritten = 0012DA34
我想问的是:
用bp WriteProcessMemory我只断下来过一次.后来怎么都断不下来.请FLY帮帮我.
下断点:BP WaitForDebugEvent,F9运行,Shift+F9两次来到下面
7C85A268 > 8BFF mov edi, edi ; 复Ex91.008508C8
7C85A26A 55 push ebp
7C85A26B 8BEC mov ebp, esp
7C85A26D 83EC 68 sub esp, 68
7C85A270 56 push esi
7C85A271 FF75 0C push dword ptr [ebp+C]
7C85A274 8D45 F8 lea eax, [ebp-8]
7C85A277 50 push eax
7C85A278 E8 F381FAFF call 7C802470
7C85A27D 8BF0 mov esi, eax
7C85A27F 56 push esi
7C85A280 8D45 98 lea eax, [ebp-68]
7C85A283 50 push eax
7C85A284 E8 9A520200 call <jmp.&ntdll.DbgUiWaitStateChange>
7C85A289 3D 01010000 cmp eax, 101
7C85A28E ^ 74 EF je short 7C85A27F
7C85A290 3D C0000000 cmp eax, 0C0
7C85A295 ^ 74 E8 je short 7C85A27F
7C85A297 85C0 test eax, eax
7C85A299 7D 07 jge short 7C85A2A2
7C85A29B 3D 02000140 cmp eax, 40010002
7C85A2A0 75 26 jnz short 7C85A2C8
7C85A2A2 3D 02010000 cmp eax, 102
7C85A2A7 75 0E jnz short 7C85A2B7
7C85A2A9 6A 79 push 79
7C85A2AB E8 10F0FAFF call 7C8092C0
7C85A2B0 33C0 xor eax, eax
7C85A2B2 5E pop esi
7C85A2B3 C9 leave
7C85A2B4 C2 0800 retn 8
堆栈窗口:在12DA7C点在数据中跟随.
0012DA78 00825AF7 /CALL 到 WaitForDebugEvent
0012DA7C 0012EB54 |pDebugEvent = 0012EB54
0012DA80 000003E8 \Timeout = 1000. ms
接下来再下断点:bp WriteProcessMemory,F9
7C80220F > 8BFF mov edi, edi
7C802211 55 push ebp
7C802212 8BEC mov ebp, esp
7C802214 51 push ecx
7C802215 51 push ecx
7C802216 8B45 0C mov eax, [ebp+C]
7C802219 53 push ebx
7C80221A 8B5D 14 mov ebx, [ebp+14]
7C80221D 56 push esi
7C80221E 8B35 B812807C mov esi, [<&ntdll.NtProtectVirtualMe>; ntdll.ZwProtectVirtualMemory
0012D918 00829B0F /CALL 到 WriteProcessMemory
0012D91C 0000004C |hProcess = 0000004C
0012D920 005B8000 |Address = 5B8000
0012D924 003EBAD8 |Buffer = 003EBAD8
0012D928 00001000 |BytesToWrite = 1000 (4096.)
0012D92C 0012DA34 \pBytesWritten = 0012DA34
我想问的是:
用bp WriteProcessMemory我只断下来过一次.后来怎么都断不下来.请FLY帮帮我.
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
