-
-
[求助]穿山甲Armadillo v1.71
-
发表于: 2007-2-8 20:21
-
斑竹：我用PEDI的外部扫描才看的到是Armadillo v1.71 [Overlay] *，用其他的扫描是Microsoft Visual C++ 6.0 [Overlay]，这是伪装了吗？Armadillo v1.71 [Overlay] *是穿山甲的哪种壳呢，我用OD载入后就不知道怎么下手了，我在论坛上找了很久也没有找到这个壳的介绍，请斑竹指点。此壳好下手吗？
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
00406B04 $- FF25 A0B54700 jmp dword ptr [<&user32.LoadStringA>] ; user32.LoadStringA
00406B0A 8BC0 mov eax, eax 00406B0C $- FF25 9CB54700 jmp dword ptr [<&user32.MapVirtualKeyA>] ; user32.MapVirtualKeyA 00406B12 8BC0 mov eax, eax 00406B14 $- FF25 98B54700 jmp dword ptr [<&user32.MapWindowPoints>] ; user32.MapWindowPoints 00406B1A 8BC0 mov eax, eax 00406B1C $- FF25 94B54700 jmp dword ptr [<&user32.MessageBoxA>] ; user32.MessageBoxA 00406B22 8BC0 mov eax, eax 00406B24 $- FF25 90B54700 jmp dword ptr [<&user32.OemToCharA>] ; user32.OemToCharA 00406B2A 8BC0 mov eax, eax 00406B2C $- FF25 8CB54700 jmp dword ptr [<&user32.OffsetRect>] ; user32.OffsetRect 00406B32 8BC0 mov eax, eax 00406B34 $- FF25 88B54700 jmp dword ptr [<&user32.PeekMessageA>] ; user32.PeekMessageA 00406B3A 8BC0 mov eax, eax 00406B3C $- FF25 84B54700 jmp dword ptr [<&user32.PostMessageA>] ; user32.PostMessageA 00406B42 8BC0 mov eax, eax 00406B44 $- FF25 80B54700 jmp dword ptr [<&user32.PostQuitMessage>] ; user32.PostQuitMessage 00406B4A 8BC0 mov eax, eax 00406B4C $- FF25 7CB54700 jmp dword ptr [<&user32.PtInRect>] ; user32.PtInRect 00406B52 8BC0 mov eax, eax 00406B54 $- FF25 78B54700 jmp dword ptr [<&user32.RedrawWindow>] ; user32.RedrawWindow 00406B5A 8BC0 mov eax, eax 00406B5C $- FF25 74B54700 jmp dword ptr [<&user32.RegisterClassA>] ; user32.RegisterClassA 00406B62 8BC0 mov eax, eax 00406B64 $- FF25 70B54700 jmp dword ptr [<&user32.RegisterClipboardForm>; user32.RegisterWindowMessageA 00406B6A 8BC0 mov eax, eax 00406B6C $- FF25 6CB54700 jmp dword ptr [<&user32.RegisterWindowMessage>; user32.RegisterWindowMessageA 00406B72 8BC0 mov eax, eax 00406B74 $- FF25 68B54700 jmp dword ptr [<&user32.ReleaseCapture>] ; user32.ReleaseCapture 00406B7A 8BC0 mov eax, eax 00406B7C $- FF25 64B54700 jmp dword ptr [<&user32.ReleaseDC>] ; user32.ReleaseDC 00406B82 8BC0 mov eax, eax 00406B84 $- FF25 60B54700 jmp dword ptr [<&user32.RemoveMenu>] ; user32.RemoveMenu 00406B8A 8BC0 mov eax, eax 00406B8C $- FF25 5CB54700 jmp dword ptr [<&user32.RemovePropA>] ; user32.RemovePropA 00406B92 8BC0 mov eax, eax 00406B94 $- FF25 58B54700 jmp dword ptr [<&user32.ScreenToClient>] ; user32.ScreenToClient 00406B9A 8BC0 mov eax, eax 00406B9C $- FF25 54B54700 jmp dword ptr [<&user32.ScrollWindow>] ; user32.ScrollWindow 00406BA2 8BC0 mov eax, eax 00406BA4 $- FF25 50B54700 jmp dword ptr [<&user32.SendMessageA>] ; user32.SendMessageA 00406BAA 8BC0 mov eax, eax 00406BAC $- FF25 4CB54700 jmp dword ptr [<&user32.SetActiveWindow>] ; user32.SetActiveWindow 00406BB2 8BC0 mov eax, eax 00406BB4 $- FF25 48B54700 jmp dword ptr [<&user32.SetCapture>] ; user32.SetCapture 00406BBA 8BC0 mov eax, eax 00406BBC $- FF25 44B54700 jmp dword ptr [<&user32.SetClassLongA>] ; user32.SetClassLongA 00406BC2 8BC0 mov eax, eax 00406BC4 $- FF25 40B54700 jmp dword ptr [<&user32.SetCursor>] ; user32.SetCursor 00406BCA 8BC0 mov eax, eax 00406BCC $- FF25 3CB54700 jmp dword ptr [<&user32.SetFocus>] ; user32.SetFocus 00406BD2 8BC0 mov eax, eax 00406BD4 $- FF25 38B54700 jmp dword ptr [<&user32.SetForegroundWindow>] ; user32.SetForegroundWindow 00406BDA 8BC0 mov eax, eax 00406BDC $- FF25 34B54700 jmp dword ptr [<&user32.SetMenu>] ; user32.SetMenu 00406BE2 8BC0 mov eax, eax 00406BE4 $- FF25 30B54700 jmp dword ptr [<&user32.SetMenuItemInfoA>] ; user32.SetMenuItemInfoA 00406BEA 8BC0 mov eax, eax 00406BEC $- FF25 2CB54700 jmp dword ptr [<&user32.SetParent>] ; user32.SetParent 00406BF2 8BC0 mov eax, eax 00406BF4 $- FF25 28B54700 jmp dword ptr [<&user32.SetPropA>] ; user32.SetPropA 00406BFA 8BC0 mov eax, eax 00406BFC $- FF25 24B54700 jmp dword ptr [<&user32.SetRect>] ; user32.SetRect 00406C02 8BC0 mov eax, eax 00406C04 .- FF25 20B54700 jmp dword ptr [<&user32.SetScrollInfo>] ; user32.SetScrollInfo 00406C0A 8BC0 mov eax, eax 00406C0C .- FF25 1CB54700 jmp dword ptr [<&user32.SetScrollPos>] ; user32.SetScrollPos 00406C12 8BC0 mov eax, eax 00406C14 .- FF25 18B54700 jmp dword ptr [<&user32.SetScrollRange>] ; user32.SetScrollRange 00406C1A 8BC0 mov eax, eax 00406C1C $- FF25 14B54700 jmp dword ptr [<&user32.SetTimer>] ; user32.SetTimer 00406C22 8BC0 mov eax, eax 00406C24 $- FF25 10B54700 jmp dword ptr [<&user32.SetWindowLongA>] ; user32.SetWindowLongA 00406C2A 8BC0 mov eax, eax 00406C2C $- FF25 0CB54700 jmp dword ptr [<&user32.SetWindowPlacement>] ; user32.SetWindowPlacement 00406C32 8BC0 mov eax, eax 00406C34 $- FF25 08B54700 jmp dword ptr [<&user32.SetWindowPos>] ; user32.SetWindowPos 00406C3A 8BC0 mov eax, eax 00406C3C $- FF25 04B54700 jmp dword ptr [<&user32.SetWindowTextA>] ; user32.SetWindowTextA 00406C42 8BC0 mov eax, eax 00406C44 $- FF25 00B54700 jmp dword ptr [<&user32.SetWindowsHookExA>] ; user32.SetWindowsHookExA 00406C4A 8BC0 mov eax, eax 00406C4C $- FF25 FCB44700 jmp dword ptr [<&user32.SetWindowRgn>] ; user32.SetWindowRgn 00406C52 8BC0 mov eax, eax 00406C54 $- FF25 F8B44700 jmp dword ptr [<&user32.ShowCursor>] ; user32.ShowCursor 00406C5A 8BC0 mov eax, eax 00406C5C $- FF25 F4B44700 jmp dword ptr [<&user32.ShowOwnedPopups>] ; user32.ShowOwnedPopups 00406C62 8BC0 mov eax, eax 00406C64 .- FF25 F0B44700 jmp dword ptr [<&user32.ShowScrollBar>] ; user32.ShowScrollBar 00406C6A 8BC0 mov eax, eax 00406C6C $- FF25 ECB44700 jmp dword ptr [<&user32.ShowWindow>] ; user32.ShowWindow 00406C72 8BC0 mov eax, eax 00406C74 $- FF25 E8B44700 jmp dword ptr [<&user32.SystemParametersInfoA>; user32.SystemParametersInfoA 00406C7A 8BC0 mov eax, eax 00406C7C $- FF25 E4B44700 jmp dword ptr [<&user32.TrackPopupMenu>] ; user32.TrackPopupMenu 00406C82 8BC0 mov eax, eax 00406C84 $- FF25 E0B44700 jmp dword ptr [<&user32.TranslateMDISysAccel>>; user32.TranslateMDISysAccel 00406C8A 8BC0 mov eax, eax 00406C8C $- FF25 DCB44700 jmp dword ptr [<&user32.TranslateMessage>] ; user32.TranslateMessage 00406C92 8BC0 mov eax, eax 00406C94 $- FF25 D8B44700 jmp dword ptr [<&user32.UnhookWindowsHookEx>] ; user32.UnhookWindowsHookEx 00406C9A 8BC0 mov eax, eax 00406C9C $- FF25 D4B44700 jmp dword ptr [<&user32.UnregisterClassA>] ; user32.UnregisterClassA 00406CA2 8BC0 mov eax, eax 00406CA4 $- FF25 D0B44700 jmp dword ptr [<&user32.UpdateWindow>] ; user32.UpdateWindow 00406CAA 8BC0 mov eax, eax 00406CAC $- FF25 CCB44700 jmp dword ptr [<&user32.WaitMessage>] ; user32.WaitMessage 00406CB2 8BC0 mov eax, eax 00406CB4 $- FF25 C8B44700 jmp dword ptr [<&user32.WinHelpA>] ; user32.WinHelpA 00406CBA 8BC0 mov eax, eax 00406CBC $- FF25 C4B44700 jmp dword ptr [<&user32.WindowFromPoint>] ; user32.WindowFromPoint 这些语句是干什么用的呀 ？？ 
|
|
|
|
|
|
|
