这个样本还有点技术含量，驱动注入winlib.dll或者system.dll之后,会把这个dll删除掉让你找不到
喜欢玩的兄弟，帮忙逆向一下啊：）

花指令很好去,如下：

BYTE sig_1[] =
{
0x51,0xE8,
0x03,0x00,0x00,0x00,
0xC7,0x84,0x00,0x59,
0xE9,0x01,0x00,0x00,
0x00,0xE9,0x83,0xC1,
0x0A,0x51,0xC3,0xFF,
0x35,0xFF,0x25,0xE9,0x59
};

BYTE sig_2[] =
{
0xE8,0x08,
0x00,0x00,0x00,0x0F,
0x01,0xE9,0x08,0x00,
0x00,0x00,0xE8,0xE9,
0xF5,0xFF,0xFF,0xFF,
0x00,0x00,0x83,0xC4,0x04
};

BYTE sig_3[] =
{
0x50,0xE8,0x0A,
0x00,0x00,0x00,0xC7,0x83,
0x83,0xC0,0x1C,0xE9,0x11,
0x00,0x00,0x00,0x58,0xE9,
0x02,0x00,0x00,0x00,0xCD,
0x20,0x83,0xC0,0x02,0xE9,
0x01,0x00,0x00,0x00,0xE9,0x50,0xC3,0xE8,0x58
};

BYTE sig_4[] =
{
0xE9,0x01,0x00,
0x00,0x00,0x0F,0x50,0x31,
0xF0,0xE9,0x1A,0x00,0x00,
0x00,0x33,0xC8,0xE9,0x06,
0x00,0x00,0x00,0xE9,0x15,
0x00,0x00,0x00,0x0F,0x59,
0x0F,0x84,0x0D,0x00,0x00,
0x00,0x0F,0x85,0xED,0xFF,
0xFF,0xFF,0x58,0x51,0xE9,0xDF,0xFF,0xFF,0xFF
};

BYTE sig_5[] =
{
0x53,0xE8,0x08,
0x00,0x00,0x00,0x0F,0x01,
0x83,0xC3,0x0F,0x53,0xC3,
0xFF,0x5B,0x83,0xC3,0x02,0xFF,0xE3,0x0F,0x01,0x0C,0x5B
};

winlib.dll也很好拿到，只要用0xff异或驱动就好了：)
样本在附件里呢，呵呵

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

上传的附件：

• acpidisk.rar （224.16kb，7次下载）