[讨论]ASPR2.3的脱壳后再加壳-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

最新回复 (5)
fly 雪币： 898 活跃值： (4039) 能力值： ( LV9，RANK：3410 ) 在线值：发帖 294 回帖 7686 粉丝 32 关注私信	fly 85 2 楼一样的话应该是ASProtect没有加上，看提示 NsPack应该可以加上脱壳后用DT_FixRes等修复资源 2006-9-20 14:44 0
WANGZHE 雪币： 284 活跃值： (12) 能力值： ( LV2，RANK：10 ) 在线值：发帖 34 回帖 112 粉丝 1 关注私信	WANGZHE 3 楼资源已进行重建了，可还是不行，在加壳时提示软件已保护，是不是就是ASPR的标志没有清除，加壳软件认为已经加上壳了，FLY大侠，俺看过你以前说的，说是说是第一区段１０００那个事，可是俺不明白，能具体点吗，谢谢！ 2006-9-20 15:23 0
fly 雪币： 898 活跃值： (4039) 能力值： ( LV9，RANK：3410 ) 在线值：发帖 294 回帖 7686 粉丝 32 关注私信	fly 85 4 楼 ASProtect脱壳的软件如何重新加ASProtect壳 http://www.unpack.cn/viewthread.php?tid=4831 2006-9-20 15:47 0
WANGZHE 雪币： 284 活跃值： (12) 能力值： ( LV2，RANK：10 ) 在线值：发帖 34 回帖 112 粉丝 1 关注私信	WANGZHE 5 楼看了那个贴子了,可是这个不明白 ASProtect 壳标记第一个区段名应在位置之前2个字节能说得详细点吗?谢谢 2006-9-20 17:56 0
fly 雪币： 898 活跃值： (4039) 能力值： ( LV9，RANK：3410 ) 在线值：发帖 294 回帖 7686 粉丝 32 关注私信	fly 85 6 楼 Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ?........?.. 00000010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ?......@....... 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000030 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 ............?.. 00000040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ..?.???L?Th 00000050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno 00000060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS 00000070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$....... 00000080 50 45 00 00 4C 01 05 00 65 91 46 35 00 00 00 00 PE..L...e?5.... 00000090 00 00 00 00 E0 00 0E 01 0B 01 03 0A 00 40 00 00 ....?.......@.. 000000A0 00 74 00 00 00 00 00 00 CC 10 00 00 00 10 00 00 .t......?...... 000000B0 00 50 00 00 00 00 40 00 00 10 00 00 00 10 00 00 .P....@......... 000000C0 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................ 000000D0 00 D0 00 00 00 04 00 00 16 BE 01 00 02 00 00 00 .?......?..... 000000E0 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................ 000000F0 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................ 00000100 00 60 00 00 8C 00 00 00 00 70 00 00 B8 4F 00 00 .`..?...p..赶.. 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000120 00 C0 00 00 3C 09 00 00 00 00 00 00 00 00 00 00 .?.<........... 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000150 00 00 00 00 00 00 00 00 E0 62 00 00 40 02 00 00 ........噔..@... 00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000170 00 00 00 00 00 00 00 00 2E 74 65 78 74 00 12 00 .........text... 00000180 00 40 00 00 00 10 00 00 00 40 00 00 00 10 00 00 .@.......@...... 00000190 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..` 000001A0 2E 64 61 74 61 00 12 00 00 10 00 00 00 50 00 00 .data........P.. 000001B0 00 10 00 00 00 50 00 00 00 00 00 00 00 00 00 00 .....P.......... 000001C0 00 00 00 00 40 00 00 C0 2E 69 64 61 74 61 00 00 ....@..?idata.. 000001D0 00 10 00 00 00 60 00 00 00 10 00 00 00 60 00 00 .....`.......`.. 000001E0 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ............@..@ 000001F0 2E 72 73 72 63 00 12 00 00 50 00 00 00 70 00 00 .rsrc....P...p.. 00000200 00 50 00 00 00 70 00 00 00 00 00 00 00 00 00 00 .P...p.......... 00000210 00 00 00 00 40 00 00 40 2E 72 65 6C 6F 63 00 00 ....@..@.reloc.. 00000220 00 10 00 00 00 C0 00 00 00 10 00 00 00 C0 00 00 .....?......?. 00000230 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 ............@..B 以Win98记事本为例第一个区段名应在位置之前2个字节＝0X176 2006-9-20 18:51 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

fly

雪币： 898

活跃值： (4039)

能力值：

( LV9，RANK：3410 )

在线值：

发帖

294

回帖

7686

粉丝

32

关注

私信

fly 85: 2 楼

一样的话应该是ASProtect没有加上，看提示
NsPack应该可以加上

脱壳后用DT_FixRes等修复资源

2006-9-20 14:44

0

WANGZHE

雪币： 284

活跃值： (12)

能力值：

( LV2，RANK：10 )

在线值：

发帖

34

回帖

112

粉丝

1

关注

私信

WANGZHE: 3 楼

资源已进行重建了，可还是不行，在加壳时提示软件已保护，是不是就是ASPR的标志没有清除，加壳软件认为已经加上壳了，FLY大侠，俺看过你以前说的，说是说是第一区段１０００那个事，可是俺不明白，能具体点吗，谢谢！

2006-9-20 15:23

0

fly

雪币： 898

活跃值： (4039)

能力值：

( LV9，RANK：3410 )

在线值：

发帖

294

回帖

7686

粉丝

32

关注

私信

fly 85: 4 楼

ASProtect脱壳的软件如何重新加ASProtect壳
http://www.unpack.cn/viewthread.php?tid=4831

2006-9-20 15:47

0

WANGZHE

雪币： 284

活跃值： (12)

能力值：

( LV2，RANK：10 )

在线值：

发帖

34

回帖

112

粉丝

1

关注

私信

WANGZHE: 5 楼

看了那个贴子了,可是这个不明白
ASProtect 壳标记

第一个区段名应在位置之前2个字节
能说得详细点吗?谢谢

2006-9-20 17:56

0

fly

雪币： 898

活跃值： (4039)

能力值：

( LV9，RANK：3410 )

在线值：

发帖

294

回帖

7686

粉丝

32

关注

私信

fly 85: 6 楼

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   4D 5A 90 00 03 00 00 00  04 00 00 00 FF FF 00 00   MZ?........?..
00000010   B8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   ?......@.......
00000020   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000030   00 00 00 00 00 00 00 00  00 00 00 00 80 00 00 00   ............?..
00000040   0E 1F BA 0E 00 B4 09 CD  21 B8 01 4C CD 21 54 68   ..?.???L?Th
00000050   69 73 20 70 72 6F 67 72  61 6D 20 63 61 6E 6E 6F   is program canno
00000060   74 20 62 65 20 72 75 6E  20 69 6E 20 44 4F 53 20   t be run in DOS 
00000070   6D 6F 64 65 2E 0D 0D 0A  24 00 00 00 00 00 00 00   mode....$.......
00000080   50 45 00 00 4C 01 05 00  65 91 46 35 00 00 00 00   PE..L...e?5....
00000090   00 00 00 00 E0 00 0E 01  0B 01 03 0A 00 40 00 00   ....?.......@..
000000A0   00 74 00 00 00 00 00 00  CC 10 00 00 00 10 00 00   .t......?......
000000B0   00 50 00 00 00 00 40 00  00 10 00 00 00 10 00 00   .P....@.........
000000C0   04 00 00 00 00 00 00 00  04 00 00 00 00 00 00 00   ................
000000D0   00 D0 00 00 00 04 00 00  16 BE 01 00 02 00 00 00   .?......?.....
000000E0   00 00 10 00 00 10 00 00  00 00 10 00 00 10 00 00   ................
000000F0   00 00 00 00 10 00 00 00  00 00 00 00 00 00 00 00   ................
00000100   00 60 00 00 8C 00 00 00  00 70 00 00 B8 4F 00 00   .`..?...p..赶..
00000110   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000120   00 C0 00 00 3C 09 00 00  00 00 00 00 00 00 00 00   .?.<...........
00000130   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000140   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000150   00 00 00 00 00 00 00 00  E0 62 00 00 40 02 00 00   ........噔..@...
00000160   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000170   00 00 00 00 00 00 00 00  2E 74 65 78 74 00 12 00   .........text...
00000180   00 40 00 00 00 10 00 00  00 40 00 00 00 10 00 00   .@.......@......
00000190   00 00 00 00 00 00 00 00  00 00 00 00 20 00 00 60   ............ ..`
000001A0   2E 64 61 74 61 00 12 00  00 10 00 00 00 50 00 00   .data........P..
000001B0   00 10 00 00 00 50 00 00  00 00 00 00 00 00 00 00   .....P..........
000001C0   00 00 00 00 40 00 00 C0  2E 69 64 61 74 61 00 00   ....@..?idata..
000001D0   00 10 00 00 00 60 00 00  00 10 00 00 00 60 00 00   .....`.......`..
000001E0   00 00 00 00 00 00 00 00  00 00 00 00 40 00 00 40   ............@..@
000001F0   2E 72 73 72 63 00 12 00  00 50 00 00 00 70 00 00   .rsrc....P...p..
00000200   00 50 00 00 00 70 00 00  00 00 00 00 00 00 00 00   .P...p..........
00000210   00 00 00 00 40 00 00 40  2E 72 65 6C 6F 63 00 00   ....@..@.reloc..
00000220   00 10 00 00 00 C0 00 00  00 10 00 00 00 C0 00 00   .....?......?.
00000230   00 00 00 00 00 00 00 00  00 00 00 00 40 00 00 42   ............@..B

以Win98记事本为例
第一个区段名应在位置之前2个字节＝0X176

2006-9-20 18:51

0