-
-
发现一个特别的壳子,压缩壳不认识
-
发表于:
2007-6-23 23:04
5244
-
发现一个特别的壳子,压缩壳不认识
入口
00410C9D > 6A 18 PUSH 18
00410C9F E8 14000000 CALL dlq0616.00410CB8
00410CA4 58 POP EAX
00410CA5 8D4A 18 LEA ECX,DWORD PTR DS:[EDX+18]
00410CA8 51 PUSH ECX
00410CA9 8D92 5CF3FEFF LEA EDX,DWORD PTR DS:[EDX+FFFEF35C]
00410CAF 64:8B08 MOV ECX,DWORD PTR FS:[EAX]
00410CB2 FF31 PUSH DWORD PTR DS:[ECX]
00410CB4 8921 MOV DWORD PTR DS:[ECX],ESP
00410CB6 8910 MOV DWORD PTR DS:[EAX],EDX
00410CB8 5A POP EDX
00410CB9 FFE2 JMP EDX
00410CBB ^ 72 8B JB SHORT dlq0616.00410C48
00410CBD 44 INC ESP
00410CBE 24 0C AND AL,0C
00410CC0 8B90 A8000000 MOV EDX,DWORD PTR DS:[EAX+A8]
00410CC6 8D8A DF0E0100 LEA ECX,DWORD PTR DS:[EDX+10EDF]
00410CCC 60 PUSHAD
00410CCD 8DBA 440F0100 LEA EDI,DWORD PTR DS:[EDX+10F44]
00410CD3 89FB MOV EBX,EDI
00410CD5 0153 FC ADD DWORD PTR DS:[EBX-4],EDX
00410CD8 83C8 FF OR EAX,FFFFFFFF
00410CDB AB STOS DWORD PTR ES:[EDI]
00410CDC 40 INC EAX
00410CDD AB STOS DWORD PTR ES:[EDI]
00410CDE 6A 04 PUSH 4
00410CE0 40 INC EAX
00410CE1 59 POP ECX
00410CE2 F3:AB REP STOS DWORD PTR ES:[EDI]
试了很多办法都不行
哪位试试,本来我有源码的,但是不如人家写的好
是个登陆器
下载地址 http://www.delphi2008.net/dlq0616.rar
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
