能力值：
![]()
(RANK：10 )
|
-
-
2 楼
官方还是eXPressor v. 1.5.0.1呀
|
能力值：
( LV4，RANK：50 )
|
-
-
3 楼
愚人节后遗症
|
能力值：
( LV12，RANK：2670 )
|
-
-
4 楼
如果这么说的话，你何不下载回来看看究竟再发表高见！
|
能力值：
( LV2，RANK：10 )
|
-
-
5 楼
下载了，谢谢
|
能力值：
( LV4，RANK：50 )
|
-
-
6 楼
我没下吗?这一点你不能肯定吧.但有一点是肯定的,你的高见肯定是看过以后发表的.
1.5.0.1有个BUG,保存的epf文件是空的,需要用SDK里的,而这个也是.
1.5.0.1的OEP是:
0045417D 55 push ebp
0045417E 8BEC mov ebp, esp
00454180 6A FF push -1
00454182 68 48694800 push 00486948
00454187 68 D0954500 push 004595D0
0045418C 64:A1 00000000 mov eax, dword ptr fs:[0]
00454192 50 push eax
00454193 64:8925 0000000>mov dword ptr fs:[0], esp
0045419A 83EC 58 sub esp, 58
0045419D 53 push ebx
0045419E 56 push esi
0045419F 57 push edi
004541A0 8965 E8 mov dword ptr [ebp-18], esp
004541A3 FF15 40024800 call dword ptr [480240] ; kernel32.GetVersion
........
这个是:
0045417D 68 FF27B622 push 22B627FF
00454182 - E9 2D0D0B00 jmp 00504EB4
00454187 58 pop eax
00454188 36:FF30 push dword ptr ss:[eax]
0045418B E9 1C3E0200 jmp 00477FAC
00454190 58 pop eax
00454191 66:59 pop cx
00454193 D3E8 shr eax, cl
00454195 50 push eax
00454196 9C pushfd
00454197 E9 103E0200 jmp 00477FAC
0045419C 5A pop edx
0045419D 66:36:FF32 push word ptr ss:[edx]
004541A1 E9 063E0200 jmp 00477FAC
004541A6 8A06 mov al, byte ptr [esi]
004541A8 30D8 xor al, bl
004541AA 04 CB add al, 0CB
004541AC C0C0 05 rol al, 5
明显被VM了
但有些东西恶搞的人没注意,从OEP的位置往上看,所有的代码一模一样
1.5.0.1:
00454139 56 push esi
0045413A E8 48730000 call 0045B487
0045413F 8BF0 mov esi, eax
00454141 85F6 test esi, esi
00454143 75 02 jnz short 00454147
00454145 5E pop esi
00454146 C3 retn
00454147 57 push edi
00454148 56 push esi
00454149 FF7424 18 push dword ptr [esp+18]
0045414D FF7424 18 push dword ptr [esp+18]
00454151 FF7424 18 push dword ptr [esp+18]
00454155 E8 BD710000 call 0045B317
0045415A 56 push esi
0045415B 8BF8 mov edi, eax
0045415D E8 AA6A0000 call 0045AC0C
00454162 83C4 14 add esp, 14
00454165 8BC7 mov eax, edi
00454167 5F pop edi
00454168 5E pop esi
00454169 C3 retn
0045416A 6A 40 push 40
0045416C FF7424 0C push dword ptr [esp+C]
00454170 FF7424 0C push dword ptr [esp+C]
00454174 E8 C0FFFFFF call 00454139
00454179 83C4 0C add esp, 0C
0045417C C3 retn
这个:
00454139 56 push esi
0045413A E8 48730000 call 0045B487
0045413F 8BF0 mov esi, eax
00454141 85F6 test esi, esi
00454143 75 02 jnz short 00454147
00454145 5E pop esi
00454146 C3 retn
00454147 57 push edi
00454148 56 push esi
00454149 FF7424 18 push dword ptr [esp+18]
0045414D FF7424 18 push dword ptr [esp+18]
00454151 FF7424 18 push dword ptr [esp+18]
00454155 E8 BD710000 call 0045B317
0045415A 56 push esi
0045415B 8BF8 mov edi, eax
0045415D E8 AA6A0000 call 0045AC0C
00454162 83C4 14 add esp, 14
00454165 8BC7 mov eax, edi
00454167 5F pop edi
00454168 5E pop esi
00454169 C3 retn
0045416A 6A 40 push 40
0045416C FF7424 0C push dword ptr [esp+C]
00454170 FF7424 0C push dword ptr [esp+C]
00454174 E8 C0FFFFFF call 00454139
00454179 83C4 0C add esp, 0C
0045417C C3 retn
界面一样,BUG一样,OEP一样,代码一样,4.1日发布,你说是怎么回事？
|
能力值：
( LV12，RANK：2670 )
|
-
-
7 楼
原帖
http://www.unpack.cn/thread-11549-1-1.html
|
