有一个软件是ASProtect 2.1x SKE -> Alexey Solodovnikov [Overlay]我用Asprotect2.XX IAT fixer v2.2S脚本后,剪掉无效指针,修复,补区段,运行时会弹出一个错误信息窗口:
protectin error
! error:111
有时会是196代码
请问这是壳本身的吗?
谢谢
自校验代码是不是这里?
00E5F8D0 55 push ebp
00E5F8D1 8BEC mov ebp, esp
00E5F8D3 83C4 F8 add esp, -8
00E5F8D6 53 push ebx
00E5F8D7 56 push esi
00E5F8D8 57 push edi
00E5F8D9 8B5D 08 mov ebx, [ebp+8]
00E5F8DC EB 01 jmp short 00E5F8DF
00E5F8DE 9A 8B451883 E80>call far 08E8:8318458B
00E5F8E5 8B00 mov eax, [eax]
00E5F8E7 50 push eax
00E5F8E8 8A8B 96000000 mov cl, [ebx+96]
00E5F8EE 8B55 14 mov edx, [ebp+14]
00E5F8F1 8BC3 mov eax, ebx
00E5F8F3 E8 B4FFFFFF call 00E5F8AC
00E5F8F8 8B45 18 mov eax, [ebp+18]
00E5F8FB 50 push eax
00E5F8FC B1 04 mov cl, 4
00E5F8FE 8B55 14 mov edx, [ebp+14]
00E5F901 8BC3 mov eax, ebx
00E5F903 E8 A4FFFFFF call 00E5F8AC
00E5F908 EB 01 jmp short 00E5F90B
00E5F90A 698B 73308B7B 1>imul ecx, [ebx+7B8B3073], AA44A114
00E5F914 E7 00 out 0, eax
00E5F916 90 nop ;已经修改过
00E5F917 90 nop
00E5F918 90 nop
00E5F919 8B4424 58 mov eax, [esp+58]
00E5F91D 90 nop
00E5F91E 83E8 05 sub eax, 5
00E5F921 2B43 18 sub eax, [ebx+18]
00E5F924 2B43 68 sub eax, [ebx+68]
00E5F927 8945 FC mov [ebp-4], eax
00E5F92A 8D43 24 lea eax, [ebx+24]
00E5F92D 8945 F8 mov [ebp-8], eax
00E5F930 85FF test edi, edi
00E5F932 76 63 jbe short 00E5F997
00E5F934 EB 01 jmp short 00E5F937
00E5F936 C7 ??? ; 未知命令
00E5F937 8B45 F8 mov eax, [ebp-8]
00E5F93A 0FB600 movzx eax, byte ptr [eax]
00E5F93D 8B5483 40 mov edx, [ebx+eax*4+40]
00E5F941 8BC6 mov eax, esi
00E5F943 FFD2 call edx
00E5F945 3B45 FC cmp eax, [ebp-4]
00E5F948 75 45 jnz short 00E5F98F
00E5F94A EB 01 jmp short 00E5F94D
00E5F94C 9A 807B7400 742>call far 2274:00747B80
00E5F953 EB 01 jmp short 00E5F956
00E5F955 9A 8B451050 8B4>call far 458B:5010458B
00E5F95C 14 50 adc al, 50
00E5F95E E8 69FCFFFF call 00E5F5CC
00E5F963 50 push eax
00E5F964 8BCE mov ecx, esi
00E5F966 8B55 18 mov edx, [ebp+18]
00E5F969 8BC3 mov eax, ebx
00E5F96B E8 70F8FFFF call 00E5F1E0
00E5F970 EB 1D jmp short 00E5F98F
00E5F972 EB 01 jmp short 00E5F975
00E5F974 - E9 8B451050 jmp 50F63F04
00E5F979 8B45 14 mov eax, [ebp+14]
00E5F97C 50 push eax
00E5F97D E8 4AFCFFFF call 00E5F5CC
00E5F982 50 push eax
00E5F983 8BCE mov ecx, esi
00E5F985 8B55 18 mov edx, [ebp+18]
00E5F988 8BC3 mov eax, ebx
00E5F98A E8 D5F9FFFF call 00E5F364
00E5F98F 4F dec edi
00E5F990 0373 6C add esi, [ebx+6C]
00E5F993 85FF test edi, edi
00E5F995 ^ 77 A0 ja short 00E5F937
00E5F997 68 B4F9E500 push 00E5F9B4 ; ASCII "111",CR,LF弹出错误的信息
00E5F99C E8 9357FFFF call 00E55134
00E5F9A1 5F pop edi
00E5F9A2 5E pop esi
00E5F9A3 5B pop ebx
00E5F9A4 59 pop ecx
00E5F9A5 59 pop ecx
00E5F9A6 5D pop ebp
00E5F9A7 C2 1400 retn 14
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课