我脱一个SoftSentry 2.11 -> 20/20 Software的壳，用OD载入停在“
004EFE8F CC INT3
004EFE90 > 55 PUSH EBP ; 打开停在这里
004EFE91 8BEC MOV EBP,ESP
004EFE93 83EC 64 SUB ESP,64
004EFE96 53 PUSH EBX
004EFE97 56 PUSH ESI
004EFE98 57 PUSH EDI
004EFE99 E9 50000000 JMP Mark.004EFEEE ; 这里跳
004EFE9E 0000 ADD BYTE PTR DS:[EAX],AL
004EFEA0 90 NOP
004EFEA1 FE0E DEC BYTE PTR DS:[ESI]
004EFEA3 0000 ADD BYTE PTR DS:[EAX],AL
到这里：
004EFEEA 66:3D 0100 CMP AX,1
004EFEEE C745 E8 0000000>MOV DWORD PTR SS:[EBP-18],0 ; 到这里！F8继续
004EFEF5 8D45 BC LEA EAX,DWORD PTR SS:[EBP-44]
004EFEF8 50 PUSH EAX
004EFEF9 FF15 84944F00 CALL DWORD PTR DS:[<&KERNEL32.GetStartup>; kernel32.GetStartupInfoA
004EFEFF F645 E8 01 TEST BYTE PTR SS:[EBP-18],1
004EFF03 0F84 10000000 JE Mark.004EFF19
004EFF09 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
004EFF0C 25 FFFF0000 AND EAX,0FFFF
004EFF11 8945 14 MOV DWORD PTR SS:[EBP+14],EAX
004EFF14 E9 07000000 JMP Mark.004EFF20
004EFF19 C745 14 0A00000>MOV DWORD PTR SS:[EBP+14],0A
004EFF20 6A 00 PUSH 0
004EFF22 FF15 8C944F00 CALL DWORD PTR DS:[<&KERNEL32.GetModuleH>; kernel32.GetModuleHandleA
004EFF28 8945 08 MOV DWORD PTR SS:[EBP+8],EAX
004EFF2B C745 0C 0000000>MOV DWORD PTR SS:[EBP+C],0
004EFF32 FF15 70944F00 CALL DWORD PTR DS:[<&KERNEL32.GetCommand>; kernel32.GetCommandLineA
.
.
.
.004EFFEB /0F84 18000000 JE Mark.004F0009
004EFFF1 |66:C705 B8514F0>MOV WORD PTR DS:[4F51B8],1
004EFFFA |C705 68514F00 0>MOV DWORD PTR DS:[4F5168],1
004F0004 |E9 9A020000 JMP Mark.004F02A3
004F0009 \B9 01000000 MOV ECX,1
004F000E E8 7D2A0000 CALL Mark.004F2A90
004F0013 33C0 XOR EAX,EAX
004F0015 66:A1 428C4F00 MOV AX,WORD PTR DS:[4F8C42]
004F001B F6C4 C0 TEST AH,0C0
004F001E 0F85 2E000000 JNZ Mark.004F0052 ; 然后这里我是NOP填充
004F0024 33C0 XOR EAX,EAX
004F0026 66:A1 428C4F00 MOV AX,WORD PTR DS:[4F8C42]
004F002C F6C4 10 TEST AH,10
004F002F 0F84 1D000000 JE Mark.004F0052 ; 这里也是
004F0035 6A 00 PUSH 0 ; 按ctrl+b 输入 FF D7 6A 00
004F0037 68 03800000 PUSH 8003
004F003C 68 11010000 PUSH 111
ctrl+B后就到了：
004F038F /74 0C JE SHORT Mark.004F039D
004F0391 |66:833D C0514F0>CMP WORD PTR DS:[4F51C0],0
004F0399 |74 02 JE SHORT Mark.004F039D
004F039B |FFD7 CALL EDI ; 到这里！下断点 shift+f9 但是程序报错啊！
004F039D \6A 00 PUSH 0
004F039F 68 38524F00 PUSH Mark.004F5238 ; ASCII "softSENTRY"
004F03A4 68 28524F00 PUSH Mark.004F5228 ; ASCII "Failed to run!"
004F03A9 6A 00 PUSH 0
004F03AB FF15 10954F00 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; USER32.MessageBoxA
004F03B1 5F POP EDI
004F03B2 5E POP ESI
004F03B3 C2 0400 RETN 4
权限低了我发不了图！我截了出错的图！！！！！
帮我看看是怎么回是呀！
是不是没隐藏OD的原因呀！
我找IsDebugPresent插件也一直没找到！其他的插件不会用啊！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
