1、有个软件知道OEP是004B3BB8,但是到了OEP却是下面这样的,是什么原因?
004B3BB8 55 DB 55 ; CHAR 'U'
004B3BB9 8B DB 8B
004B3BBA EC DB EC
004B3BBB 83 DB 83
004B3BBC C4 DB C4
004B3BBD F0 DB F0
004B3BBE B8 DB B8
004B3BBF 18 DB 18
004B3BC0 1D DB 1D
004B3BC1 4B DB 4B ; CHAR 'K'
004B3BC2 00 DB 00
004B3BC3 E8 DB E8
004B3BC4 80 DB 80
004B3BC5 31 DB 31 ; CHAR '1'
004B3BC6 F5 DB F5
004B3BC7 FF DB FF
004B3BC8 6A DB 6A ; CHAR 'j'
004B3BC9 00 DB 00
004B3BCA 68 DB 68 ; CHAR 'h'
004B3BCB 6C DB 6C ; CHAR 'l'
004B3BCC 3C DB 3C ; CHAR '<'
2、PEID查壳是(什么都没找到 *)但是这个软件用脱壳机脱了后却如下:
004B3BB8 > $ 55 PUSH EBP ; (初始 cpu 选择)
004B3BB9 . 8BEC MOV EBP,ESP
004B3BBB . 83C4 F0 ADD ESP,-10
004B3BBE . B8 181D4B00 MOV EAX,Dbtjx2_e.004B1D18
004B3BC3 . E8 8031F5FF CALL Dbtjx2_e.00406D48
004B3BC8 . 6A 00 PUSH 0 ; /Title = NULL
004B3BCA . 68 6C3C4B00 PUSH Dbtjx2_e.004B3C6C ; |_jx2_plugin_
004B3BCF . E8 4039F5FF CALL <JMP.&USER32.FindWindowA> ; \FindWindowA
004B3BD4 . 85C0 TEST EAX,EAX
004B3BD6 . 74 14 JE SHORT Dbtjx2_e.004B3BEC
004B3BD8 . 6A 00 PUSH 0 ; /lParam = 0
004B3BDA . 6A 00 PUSH 0 ; |wParam = 0
004B3BDC . 68 5F200000 PUSH 205F ; |Message = MSG(205F)
004B3BE1 . 50 PUSH EAX ; |hWnd
004B3BE2 . E8 C53BF5FF CALL <JMP.&USER32.PostMessageA> ; \PostMessageA
004B3BE7 . E8 A80CF5FF CALL Dbtjx2_e.00404894
004B3BEC > E8 9BF5F4FF CALL Dbtjx2_e.0040318C
大虾说说是什么原因。还有这个软件脱壳后可运行但“登陆”键按了没反应了,是什么原因?
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!