OD载入代码:
004BB019 60 pushad
004BB01A 0BC0 or eax, eax ;可用ESP定律
004BB01C 74 68 je short 004BB086 ; 跳转成功
004BB01E E8 00000000 call 004BB023
004BB023 58 pop eax
004BB024 05 53000000 add eax, 53
004BB029 8038 E9 cmp byte ptr [eax], 0E9
004BB02C 75 13 jnz short 004BB041
004BB02E 61 popad
004BB02F EB 45 jmp short 004BB076
004BB031 DB2D 37B04B00 fld tbyte ptr [4BB037]
004BB037 FFFF ??? ; 未知命令
004BB039 FFFF ??? ; 未知命令
004BB03B FFFF ??? ; 未知命令
004BB03D FFFF ??? ; 未知命令
004BB0B1 /E9 AF010000 jmp 004BB265 ;用ESP定律到这里
004BB0B6 |2293 C9E48878 and dl, byte ptr [ebx+7888E4C9]
004BB0BC |BC 5E69F4AD mov esp, ADF4695E
004BB0C1 |2B546E 71 sub edx, dword ptr [esi+ebp*2+71]
004BB0C5 |44 inc esp
004BB0C6 |60 pushad
004BB0C7 |EF out dx, eax
004BB0C8 |BF 0FD52AED mov edi, ED2AD50F
004BB0CD |76 3B jbe short 004BB10A
00629E47 /E9 B0330000 jmp 0062D1FC
00629E4C |0000 add byte ptr [eax], al
00629E4E |0000 add byte ptr [eax], al
00629E50 |0000 add byte ptr [eax], al
00629E52 |0000 add byte ptr [eax], al
00629E54 |0000 add byte ptr [eax], al
00629E56 |0000 add byte ptr [eax], al
00629E58 |0000 add byte ptr [eax], al
00629E5A |0000 add byte ptr [eax], al
00629E5C |0000 add byte ptr [eax], al
00629E5E |0000 add byte ptr [eax], al
0062D1FB 008B C58BD460 add byte ptr [ebx+60D48BC5], cl
0062D201 E8 00000000 call 0062D206
0062D206 5D pop ebp
0062D207 81ED BF33DC07 sub ebp, 7DC33BF
0062D20D 8995 1533DC07 mov dword ptr [ebp+7DC3315], edx
0062D213 89B5 3D11DC07 mov dword ptr [ebp+7DC113D], esi
0062D219 8985 6D03DC07 mov dword ptr [ebp+7DC036D], eax
0062D21F 83BD 8501DC07 0>cmp dword ptr [ebp+7DC0185], 0
0062D226 74 0C je short 0062D234
0062D228 8BE8 mov ebp, eax
0062D22A 8BE2 mov esp, edx
0062D22C B8 01000000 mov eax, 1
0062D231 C2 0C00 retn 0C
0062D234 8B4424 24 mov eax, dword ptr [esp+24]
0062D238 8985 CD0DDC07 mov dword ptr [ebp+7DC0DCD], eax
0062D23E 6A 45 push 45
0062D240 E8 A3000000 call 0062D2E8
0062D245 68 9A748307 push 783749A
0062D24A E8 DF000000 call 0062D32E
0062D24F 68 254B890A push 0A894B25
0062D254 E8 D5000000 call 0062D32E
0062D259 E9 14020000 jmp 0062D472
请问这里是否到了程序领空?应该怎样脱壳?
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
