请问一下"OD调试自动关机"如何解决
本程序有两层壳第一层ASPack 2.12 -> Alexey Solodovnikov,第二层UPX-Scrambler RC1.x -> ┫nT?L [Overlay]
最后用PEID查为Borland C++ 1999,但用OD加载仍显示为加密文件,不理解!!调试会自动关闭电脑,还具有反跟踪的技术,如果有有OD ,PEID等破解工具运行亦会关闭电脑!!!请朋友们指点一下如何解决!!!
以下是我跟踪一段代码。希望大侠们指点一下！！
下载：http://www.3dcp.com/html/3Ddown.htm (3D组号大师专业版 3.62)
用OD载入(BjQx3D1重命名亦会被程序检测到)，下断bp ExitWindowsEx，运行拦断
77D59E6D > 8BFF mov edi, edi ; BjQx3D1-.00601ED0（光标停在此行）
77D59E6F 55 push ebp
77D59E70 8BEC mov ebp, esp
77D59E72 83EC 18 sub esp, 18
77D59E75 53 push ebx
77D59E76 8B5D 08 mov ebx, dword ptr [ebp+8]
77D59E79 56 push esi
77D59E7A 8BF3 mov esi, ebx
77D59E7C 81E6 0B580000 and esi, 580B
77D59E82 F7DE neg esi
77D59E84 1BF6 sbb esi, esi
77D59E86 F7DE neg esi
77D59E88 57 push edi
77D59E89 BF 00000200 mov edi, 20000
77D59E8E 74 4C je short 77D59EDC
堆栈：
0012FA68 004ED7D4 /CALL 到 ExitWindowsEx 来自 BjQx3D1.004ED7CF
0012FA6C 00000005 |Options = EWX_SHUTDOWN|EWX_FORCE
0012FA70 00000000 \Reserved = 0
0012FA74 00000001
0012FA78 00000013
0012FA7C 00000000
0012FA80 00000002
0012FA84 00000084
0012FA88 0111E038
0012FA8C /0012FEA0
0012FA90 |0041C67B 返回到 BjQx3D1.0041C67B 来自 BjQx3D1.004ED738
0012FA94 |00601ED0 BjQx3D1.00601ED0
0012FA98 |0111230C
0012FA9C |0111230C
0012FAA0 |00000080
0012FAA4 |00009344
0012FAA8 |0012FB64
0012FAAC |00588713 返回到 BjQx3D1.00588713 来自 <jmp.&GDI32.GetObjectA>
0012FAB0 |1C050A90
0012FAB4 |00000054
0012FAB8 |0012FB8C
0012FABC |0058871B BjQx3D1.0058871B
返回到 BjQx3D1.0041C67B的代码段
0041C5A3 E8 DC491D00 call 005F0F84
0041C5A8 FF8D 18FDFFFF dec dword ptr [ebp-2E8]
0041C5AE 8D45 A4 lea eax, dword ptr [ebp-5C]
0041C5B1 BA 02000000 mov edx, 2
0041C5B6 E8 C9491D00 call 005F0F84
0041C5BB 8B8D E4FCFFFF mov ecx, dword ptr [ebp-31C]
0041C5C1 85C9 test ecx, ecx
0041C5C3 75 45 jnz short 0041C60A
0041C5C5 66:C785 0CFDFFF>mov word ptr [ebp-2F4], 0D4
0041C5CE 8D45 9C lea eax, dword ptr [ebp-64]
0041C5D1 E8 E656FEFF call 00401CBC
0041C5D6 8BD0 mov edx, eax
0041C5D8 FF85 18FDFFFF inc dword ptr [ebp-2E8]
0041C5DE 8D45 F8 lea eax, dword ptr [ebp-8]
0041C5E1 E8 9E4C1D00 call 005F1284
0041C5E6 8D45 9C lea eax, dword ptr [ebp-64]
0041C5E9 8D55 FC lea edx, dword ptr [ebp-4]
0041C5EC E8 07501D00 call 005F15F8
0041C5F1 8985 E4FCFFFF mov dword ptr [ebp-31C], eax
0041C5F7 FF8D 18FDFFFF dec dword ptr [ebp-2E8]
0041C5FD 8D45 9C lea eax, dword ptr [ebp-64]
0041C600 BA 02000000 mov edx, 2
0041C605 E8 7A491D00 call 005F0F84
0041C60A FFB5 E0FCFFFF push dword ptr [ebp-320]
0041C610 E8 3B7B1C00 call 005E4150
0041C615 59 pop ecx
0041C616 8B8D E4FCFFFF mov ecx, dword ptr [ebp-31C]
0041C61C 85C9 test ecx, ecx
0041C61E 75 5B jnz short 0041C67B
0041C620 33C0 xor eax, eax
0041C622 8985 DCFCFFFF mov dword ptr [ebp-324], eax
0041C628 66:C785 0CFDFFF>mov word ptr [ebp-2F4], 0A4
0041C631 8B95 DCFCFFFF mov edx, dword ptr [ebp-324]
0041C637 81FA 00040000 cmp edx, 400
0041C63D 7D 37 jge short 0041C676 大于或等于跳到0041C676处，》》改JB
0041C63F 6A 18 push 18
0041C641 E8 2E7B1C00 call 005E4174
0041C646 59 pop ecx
0041C647 8985 D8FCFFFF mov dword ptr [ebp-328], eax
0041C64D 66:C785 0CFDFFF>mov word ptr [ebp-2F4], 0A4
0041C656 FFB5 D8FCFFFF push dword ptr [ebp-328]
0041C65C E8 DF7A1C00 call 005E4140
0041C661 59 pop ecx
0041C662 FF85 DCFCFFFF inc dword ptr [ebp-324]
0041C668 8B8D DCFCFFFF mov ecx, dword ptr [ebp-324]
0041C66E 81F9 00040000 cmp ecx, 400
0041C674 ^ 7C C9 jl short 0041C63F
0041C676 E8 BD100D00 call 004ED738
0041C67B 33C0 xor eax, eax （应该是往上找关键跳转）
0041C63D jge 大于或等于跳》》改JB，但没效仍然会退出
来自 BjQx3D1.004ED738的代码段CALL ExitWindowsEx
004ED6C1 90 nop
004ED6C2 90 nop
004ED6C3 90 nop
004ED6C4 55 push ebp
004ED6C5 8BEC mov ebp, esp
004ED6C7 81C4 6CFFFFFF add esp, -94
004ED6CD C785 6CFFFFFF 9>mov dword ptr [ebp-94], 94
004ED6D7 8D85 6CFFFFFF lea eax, dword ptr [ebp-94]
004ED6DD 50 push eax
004ED6DE E8 EB431000 call <jmp.&KERNEL32.GetVersionExA>
004ED6E3 85C0 test eax, eax
004ED6E5 74 4A je short 004ED731
004ED6E7 8B95 7CFFFFFF mov edx, dword ptr [ebp-84]
004ED6ED 83FA 01 cmp edx, 1
004ED6F0 75 12 jnz short 004ED704
004ED6F2 68 F0336400 push 006433F0 ; ASCII "WIN9X"
004ED6F7 FF75 08 push dword ptr [ebp+8]
004ED6FA E8 61780F00 call 005E4F60
004ED6FF 83C4 08 add esp, 8
004ED702 EB 2D jmp short 004ED731
004ED704 8B8D 7CFFFFFF mov ecx, dword ptr [ebp-84]
004ED70A 83F9 02 cmp ecx, 2
004ED70D 75 12 jnz short 004ED721
004ED70F 68 F6336400 push 006433F6 ; ASCII "WINNT"
004ED714 FF75 08 push dword ptr [ebp+8]
004ED717 E8 44780F00 call 005E4F60
004ED71C 83C4 08 add esp, 8
004ED71F EB 10 jmp short 004ED731
004ED721 68 FC336400 push 006433FC ; ASCII "OTHER"
004ED726 FF75 08 push dword ptr [ebp+8]
004ED729 E8 32780F00 call 005E4F60
004ED72E 83C4 08 add esp, 8
004ED731 8BE5 mov esp, ebp
004ED733 5D pop ebp
004ED734 C3 retn
004ED735 90 nop
004ED736 90 nop
004ED737 90 nop
004ED738 55 push ebp
004ED739 8BEC mov ebp, esp
004ED73B 83C4 E8 add esp, -18
004ED73E 6A 06 push 6
004ED740 E8 CF6B0F00 call 005E4314
004ED745 59 pop ecx
004ED746 8945 FC mov dword ptr [ebp-4], eax
004ED749 FF75 FC push dword ptr [ebp-4]
004ED74C E8 73FFFFFF call 004ED6C4
004ED751 59 pop ecx
004ED752 68 02346400 push 00643402 ; ASCII "WIN9X"
004ED757 FF75 FC push dword ptr [ebp-4]
004ED75A E8 B5770F00 call 005E4F14
004ED75F 83C4 08 add esp, 8
004ED762 85C0 test eax, eax
004ED764 75 0B jnz short 004ED771
004ED766 68 08346400 push 00643408 ; ASCII "EXPLORER.EXE"
004ED76B E8 58FCFFFF call 004ED3C8
004ED770 59 pop ecx
004ED771 FF75 FC push dword ptr [ebp-4]
004ED774 E8 C7690F00 call 005E4140
004ED779 59 pop ecx
004ED77A 68 C8000000 push 0C8
004ED77F E8 70441000 call <jmp.&KERNEL32.Sleep>
004ED784 8D45 F8 lea eax, dword ptr [ebp-8]
004ED787 50 push eax
004ED788 6A 28 push 28
004ED78A E8 79421000 call <jmp.&KERNEL32.GetCurrentProcess>
004ED78F 50 push eax
004ED790 E8 8D411000 call <jmp.&ADVAPI32.OpenProcessToken>
004ED795 85C0 test eax, eax
004ED797 74 3B je short 004ED7D4
004ED799 8D55 EC lea edx, dword ptr [ebp-14]
004ED79C 52 push edx
004ED79D 68 15346400 push 00643415 ; ASCII "SeShutdownPrivilege"
004ED7A2 6A 00 push 0
004ED7A4 E8 73411000 call <jmp.&ADVAPI32.LookupPrivilegeValueA>
004ED7A9 C745 E8 0100000>mov dword ptr [ebp-18], 1
004ED7B0 C745 F4 0200000>mov dword ptr [ebp-C], 2
004ED7B7 6A 00 push 0
004ED7B9 6A 00 push 0
004ED7BB 6A 00 push 0
004ED7BD 8D4D E8 lea ecx, dword ptr [ebp-18]
004ED7C0 51 push ecx
004ED7C1 6A 00 push 0
004ED7C3 FF75 F8 push dword ptr [ebp-8]
004ED7C6 E8 45411000 call <jmp.&ADVAPI32.AdjustTokenPrivileges>
004ED7CB 6A 00 push 0
004ED7CD 6A 05 push 5
004ED7CF E8 FE481000 call <jmp.&USER32.ExitWindowsEx> 这个是退出WINDOWS的东西
004ED7D4 68 F4010000 push 1F4
004ED7D9 E8 16441000 call <jmp.&KERNEL32.Sleep>
004ED7DE E8 05FEFFFF call 004ED5E8
004ED7E3 8BE5 mov esp, ebp
004ED7E5 5D pop ebp
004ED7E6 C3 retn
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
