能力值：
( LV2，RANK：10 )
|
-
-
2 楼
知道的说下啊。。。。。。。。。。。。。。。。想不明白难受啊。
|
能力值：
![]()
(RANK：570 )
|
-
-
3 楼
那就是你所谓的关键点没找对
壳是可以伪装的
|
能力值：
( LV2，RANK：10 )
|
-
-
4 楼
00400154 8725 30F94500 xchg dword ptr [45F930], esp
0040015A 61 popad
0040015B 94 xchg eax, esp //在这里看堆栈
0040015C 55 push ebp
0040015D A4 movs byte ptr es:[edi], byte ptr [esi>
0040015E B6 80 mov dh, 80
00400160 FF13 call dword ptr [ebx]
00400162 ^ 73 F9 jnb short 0040015D
00400164 33C9 xor ecx, ecx
00400166 FF13 call dword ptr [ebx]
00400168 73 16 jnb short 00400180
0040016A 33C0 xor eax, eax
0040016C FF13 call dword ptr [ebx]
0040016E 73 1F jnb short 0040018F
00400170 B6 80 mov dh, 80
00400172 41 inc ecx
00400173 B0 10 mov al, 10
00400175 FF13 call dword ptr [ebx]
00400177 12C0 adc al, al
00400179 ^ 73 FA jnb short 00400175
0040017B 75 3A jnz short 004001B7
0040017D AA stos byte ptr es:[edi]
0040017E ^ EB E0 jmp short 00400160
00400180 FF53 08 call dword ptr [ebx+8]
00400183 02F6 add dh, dh
00400185 83D9 01 sbb ecx, 1
00400188 75 0E jnz short 00400198
0040018A FF53 04 call dword ptr [ebx+4]
0040018D EB 24 jmp short 004001B3
0040018F AC lods byte ptr [esi]
00400190 D1E8 shr eax, 1
00400192 74 2D je short 004001C1
00400194 13C9 adc ecx, ecx
00400196 EB 18 jmp short 004001B0
00400198 91 xchg eax, ecx
00400199 48 dec eax
0040019A C1E0 08 shl eax, 8
0040019D AC lods byte ptr [esi]
0040019E FF53 04 call dword ptr [ebx+4]
004001A1 3B43 F8 cmp eax, dword ptr [ebx-8]
004001A4 73 0A jnb short 004001B0
004001A6 80FC 05 cmp ah, 5
004001A9 73 06 jnb short 004001B1
004001AB 83F8 7F cmp eax, 7F
004001AE 77 02 ja short 004001B2
004001B0 41 inc ecx
004001B1 41 inc ecx
004001B2 95 xchg eax, ebp
004001B3 8BC5 mov eax, ebp
004001B5 B6 00 mov dh, 0
004001B7 56 push esi
004001B8 8BF7 mov esi, edi
004001BA 2BF0 sub esi, eax
004001BC F3:A4 rep movs byte ptr es:[edi], byte ptr>
004001BE 5E pop esi
004001BF ^ EB 9F jmp short 00400160
004001C1 5E pop esi
004001C2 AD lods dword ptr [esi]
004001C3 97 xchg eax, edi
004001C4 AD lods dword ptr [esi]
004001C5 50 push eax
004001C6 FF53 10 call dword ptr [ebx+10]
004001C9 95 xchg eax, ebp
004001CA 8B07 mov eax, dword ptr [edi]
004001CC 40 inc eax
004001CD ^ 78 F3 js short 004001C2
004001CF 75 03 jnz short 004001D4
004001D1 FF63 0C jmp dword ptr [ebx+C]
堆栈的情况；
0045F934 004001E8 ASCII 02,"襲"
0045F938 004001DC 病毒.004001DC
0045F93C 004001DE 病毒.004001DE
0045F940 00401D70 病毒.00401D70
0045F944 7C915F9C offset kernel32.LoadLibraryA
0045F948 7C915FEC offset kernel32.GetProcAddress
4001d1应该是关键跳转。oep应该是00401D70但是怎么也运行不到着个入口。
|
能力值：
( LV2，RANK：10 )
|
-
-
5 楼
................................
|
