能力值：
( LV3，RANK：20 )
|
-
-
2 楼
唉！没有人理。请问dll的壳该怎样脱呀？？
|
能力值：
( LV9，RANK：3410 )
|
-
-
3 楼
UPX
0097619F 61 popad
009761A0 90 nop
009761A1 E9 5AAEF9FF jmp pydll.00911000
//跳OEP
00911000 /EB 10 jmp short pydll.00911012//OEP
00911002 |66:623A bound di,dword ptr ds:[edx]
00911005 |43 inc ebx
00911006 |2B2B sub ebp,dword ptr ds:[ebx]
00911008 |48 dec eax
00911009 |4F dec edi
0091100A |4F dec edi
0091100B |4B dec ebx
0091100C |90 nop
0091100D -|E9 08529500 jmp 0126621A
00911012 \A1 8F519500 mov eax,dword ptr ds:[95518F]
00911017 C1E0 02 shl eax,2
0091101A A3 93519500 mov dword ptr ds:[955193],eax
0091101F 8B4424 08 mov eax,dword ptr ss:[esp+8]
00911023 A3 01529500 mov dword ptr ds:[955201],eax
00911028 FF1485 F1519500 call dword ptr ds:[eax*4+9551F1]
0091102F 833D 01529500 01 cmp dword ptr ds:[955201],1
00911036 75 5E jnz short pydll.00911096
00911038 803D 9B519500 00 cmp byte ptr ds:[95519B],0
0091103F 74 24 je short pydll.00911065
00911041 E8 5A300400 call pydll.009540A0 ; jmp to kernel32.GetVersion
00911046 BA 9C519500 mov edx,pydll.0095519C ; ASCII "Nonshared DATA segment required"
0091104B 25 00000080 and eax,80000000
00911050 74 05 je short pydll.00911057
00911052 BA BC519500 mov edx,pydll.009551BC ; ASCII "Cannot run multiple instances of a DLL under WIN32s"
00911057 52 push edx
00911058 E8 C3DA0300 call pydll.0094EB20
0091105D 58 pop eax
0091105E 33C0 xor eax,eax
00911060 E9 8F000000 jmp pydll.009110F4
|
能力值：
( LV12，RANK：2670 )
|
-
-
4 楼
看来应该是破解补丁
|
能力值：
( LV5，RANK：60 )
|
-
-
5 楼
还是fly好，能够屈尊回答我们初学者的问题 
|
能力值：
( LV3，RANK：20 )
|
-
-
6 楼
再次谢谢fly大哥给解答问题。可能是我的问题太菜了。继续慢慢学习去脱壳去。
|
|
|
|
