能力值:
( LV9,RANK:1140 )
2 楼
调试版有篇文章,非常适合你~~~
能力值:
( LV2,RANK:10 )
3 楼
找到了,还是fcdbe3一开始到这时在,全是数据,以为不是,跟了半天到这里才可以查到ASCLL,才知道这里就是真的OEP
004816C2 FC DB FC
004816C3 DB DB DB
004816C4 E3 DB E3
004816C5 E8 DB E8
004816C6 1E DB 1E
004816C7 E7 DB E7
004816C8 FE DB FE
004816C9 FF DB FF
004816CA 68 DB 68 ; CHAR 'h'
004816CB A5 DB A5
004816CC EB DB EB
004816CD 00 DB 00
004816CE 00 DB 00
004816CF B8 DB B8
004816D0 03 DB 03
004816D1 00 DB 00
004816D2 00 DB 00
004816D3 00 DB 00
004816D4 E8 DB E8
004816D5 3B DB 3B ; CHAR ';'
004816D6 00 DB 00
004816D7 00 DB 00
004816D8 00 DB 00
004816D9 83 DB 83
004816DA C4 DB C4
004816DB 04 DB 04
004816DC E8 DB E8
004816DD 3B DB 3B ; CHAR ';'
004816DE B2 DB B2
004816DF FE DB FE
004816E0 FF DB FF
004816E1 E8 DB E8
这里是不是做过什么处理?
能力值:
( LV6,RANK:90 )
4 楼
````````找OEP干吗?
Microsoft Visual C++ 6.0 [Overlay]``这应该没壳吧```不解
能力值:
( LV2,RANK:150 )
5 楼
应该是按部就班学习破解的结果
能力值:
( LV2,RANK:10 )
6 楼
[QUOTE=talaqi;314355]````````找OEP干吗?
Microsoft Visual C++ 6.0 [Overlay]``这应该没壳吧```不解[/QUOTE]
壳我早脱了,北斗3.7。当然要破了。要不脱了干什么?哎。
楼上啊,这个东西不找到真的OEP想破我不会,找到了,还不好找暴点呢。
后来用IDA才分析出来以上的东西应该是这样的。
:004816C2 cld
.Comet0:004816C3 fninit
.Comet0:004816C5 call sub_46FDE8
.Comet0:004816C5
.Comet0:004816CA push 0EBA5h
.Comet0:004816CF mov eax, 3
.Comet0:004816D4 jmp large dword ptr ds:30h
.Comet0:004816D4
.Comet0:004816D9 add esp, 4
.Comet0:004816DC call sub_46C91C
.Comet0:004816DC
.Comet0:004816E1 call sub_46F93D
.Comet0:004816E1
.Comet0:004816E6 push 52010001h
.Comet0:004816EB jmp large dword ptr ds:2Ch
.Comet0:004816EB
.Comet0:004816F0 add esp, 4
.Comet0:004816F3 push 0
.Comet0:004816F5 jmp large dword ptr ds:28h
.Comet0:004816F5
.Comet0:004816FA jmp large dword ptr ds:24h
.Comet0:004816FA
.Comet0:004816FF add esp, 4
.Comet0:004816FF
.Comet0:00481702
.Comet0:0046FDE8 sub_46FDE8 proc near ; CODE XREF:
.Comet0:0046FDE8 push 8
.Comet0:0046FDED jmp large dword ptr ds:18h
.Comet0:0046FDED
.Comet0:0046FDF2 add esp, 4
.Comet0:0046FDF5 mov large ds:8, eax
.Comet0:0046FDFA mov edi, eax
.Comet0:0046FDFC mov esi, 2E17Ch
.Comet0:0046FE01 lodsd
.Comet0:0046FE02 stosd
.Comet0:0046FE03 lodsd
.Comet0:0046FE04 stosd
.Comet0:0046FE05 push 4
.Comet0:0046FE0A jmp large dword ptr ds:18h
.Comet0:0046FE0A
.Comet0:0046FE0F add esp, 4
.Comet0:0046FE12 mov large ds:0Ch, eax
.Comet0:0046FE17 mov ebx, eax
.Comet0:0046FE19 mov dword ptr [ebx], 0
.Comet0:0046FE1F mov dword ptr [ebx], 2F846h
.Comet0:0046FE25 push 8
.Comet0:0046FE2A jmp large dword ptr ds:18h
.Comet0:0046FE2A
.Comet0:0046FE2F add esp, 4
.Comet0:0046FE32 mov large ds:3Ch, eax
.Comet0:0046FE37 mov edi, eax
.Comet0:0046FE39 mov esi, 2E17Ch
.Comet0:0046FE3E lodsd
.Comet0:0046FE3F stosd
.Comet0:0046FE40 lodsd
.Comet0:0046FE41 stosd
.Comet0:0046FE42 push 8
.Comet0:0046FE47 jmp large dword ptr ds:18h
.Comet0:0046FE47
.Comet0:0046FE4C add esp, 4
.Comet0:0046FE4F mov large ds:40h, eax
.Comet0:0046FE54 mov edi, eax
.Comet0:0046FE56 mov esi, 2E17Ch
.Comet0:0046FE5B lodsd
.Comet0:0046FE5C stosd
.Comet0:0046FE5D lodsd
.Comet0:0046FE5E stosd
.Comet0:0046FE5F push 8
.Comet0:0046FE64 jmp large dword ptr ds:18h
.Comet0:0046FE64
.Comet0:0046FE69 add esp, 4
.Comet0:0046FE6C mov large ds:54h, eax
.Comet0:0046FE71 mov edi, eax
.Comet0:0046FE73 mov esi, 2E17Ch
.Comet0:0046FE78 lodsd
.Comet0:0046FE79 stosd
.Comet0:0046FE7A lodsd
.Comet0:0046FE7B stosd
.Comet0:0046FE7C retn
.Comet0:0046FE7C
.Comet0:0046FE7C sub_46FDE8 endp
.Comet0:0046C91C
.Comet0:0046C91C ; *************** S U B R O U T I N E ***************************************
.Comet0:0046C91C
.Comet0:0046C91C ; Attributes: bp-based frame
.Comet0:0046C91C
.Comet0:0046C91C sub_46C91C proc near ; CODE XREF: .Comet0:004816DCp
.Comet0:0046C91C push ebp
.Comet0:0046C91D mov ebp, esp
.Comet0:0046C91F call sub_46C937
.Comet0:0046C91F
.Comet0:0046C924 call sub_46F90E
.Comet0:0046C924
.Comet0:0046C929 mov eax, 0
.Comet0:0046C92E jmp $+5
.Comet0:0046C933 mov esp, ebp
.Comet0:0046C935 pop ebp
.Comet0:0046C936 retn
.Comet0:0046C936
.Comet0:0046C936 sub_46C91C endp
.Comet0:0046C936
.Comet0:0046F93D ; *************** S U B R O U T I N E ***************************************
.Comet0:0046F93D
.Comet0:0046F93D ; Attributes: bp-based frame
.Comet0:0046F93D
.Comet0:0046F93D sub_46F93D proc near ; CODE XREF: .Comet0:004816E1p
.Comet0:0046F93D push ebp
.Comet0:0046F93E mov ebp, esp
.Comet0:0046F940 call sub_46F958
.Comet0:0046F940
.Comet0:0046F945 call sub_46F95F
.Comet0:0046F945
.Comet0:0046F94A mov eax, 0
.Comet0:0046F94F jmp $+5
.Comet0:0046F954 mov esp, ebp
.Comet0:0046F956 pop ebp
.Comet0:0046F957 retn
.Comet0:0046F957
.Comet0:0046F957 sub_46F93D endp 顺便问一下,IDA有没有和OD的^+G一样的命令?
.Comet0:0046F957
能力值:
( LV2,RANK:10 )
7 楼
愕 看一下~~!
能力值:
( LV12,RANK:200 )
8 楼
阿里旺旺群发