首页
社区
课程
招聘
[旧帖] [求助]反汇编时遇到的棘手的问题,请大侠帮忙 0.00雪花
发表于: 2007-10-27 22:37 5578

[旧帖] [求助]反汇编时遇到的棘手的问题,请大侠帮忙 0.00雪花

2007-10-27 22:37
5578
脱壳完成后用W32ASM和C32ASM反汇编时字符串显示成这样有什么办法,用eXeScope查资源显示字符串资源被压缩.请赐教!软件是用Borland Delphi 6.0 - 7.0语言写的
String Resource ID=65280: "Caption Text"
String Resource ID=65500: "Invalid argument"
String Resource ID=65535: "Range check error"
"  "
" AMPM"
"        "
"        "
"        EExternal嬂|t@"
"        EOleError嬂$ME"
"        EOverflow嬂爓@"
"        TDockZone嬂虄缹??
"        TErrorRec"
"        THintInfo@"
"        TIntConst嬂U嬱勔t兡痂砬?塇婱塇婱塇勔t"
"        TRegGroup嬂|aA"
"
EBitsError?PA"
"
EListError惣OA"
"
EMenuError悩D"
"
EReadError怲NA"
"
String?@"
"
TExceptRec"
"
TPEAnalyst怱VWU嬹嬝塻婥??孁?tG?"
"
TRegGroups悑@杓"
"EFilerError麺A"
"EFOpenErrorA"
"EInOutError$t@"
"ERangeError鋟@"
"EWriteError琋A"
"tagMULTI_QI"
"TFileFormat"
"TStringItem"
"TThreadListHRA"
"EOleSysError岪"
"EOutOfMemory岪"
"EResNotFound岪"
"EStreamError岪"
"tagEXCEPINFO "
"TClassFinder岪"
"TFontCharset"
"TWindowState"
"Variant岪"
"
"
"
EConvertError嬂y@"
"
EFCreateError嬂LMA"
"
EVariantError嬂詚@"
"
TVariantArray"
""
""
""
""
""
""
"--"
"#32770"
"$$"
"$TMultiReadExclusiveWriteSynchronizer岪"
"%s (%s)"
"%s_%d"
"%x"
"&&"
"&?諦^*L???U嬱3蒕QQQQQQS嬟塃?繳h毷A"
"(("
"))"
",RC"
".."
"..."
".\:"
".02"
".06"
".2"
".3"
".74"
".84"
".dll"
".wmf"
"//"
": "
":mm"
":mm:ss"
";PHu??脨SV嬺嬝婥H吚t婼D??嬈塁H吚t婼D?
"???肦P婦$?$壛婦$鱠$翄$鱠$蔣Y?"
"???"
"?B"
"?D"
"@獴"
"[Y]肬嬱兡鬝VW嬟塃
嬘婨?"
"[YY]?烂悑?G"
"[媩$(鑖&"
"\:"
"\\"
"^^"
"||"
"<"
"=="
"€        鴞2?嫽"
"€#?N?"
"€u壥媤€r        况0?蛛佹"
"0%D"
"0{A"
"00"
"0x"
"11"
"183bob"
"1M]y證?瀿"
"1蓞襱-Rf;
t f;Jtf;Jtf;Jt兟脘兟兟兟壯"
"8€B"
"8C"
"A/P"
"AAAA"
"abcdefghijklmnopqrstuvwxyz"
"am"
"AM"
"AM/PM"
"AMPM "
"AMPM"
"AnimateWindow"
"Any"
"Array "
"Bitmap"
"bmp"
"ByRef "
"C"
"C"
"CC"
"CloseThemeData"
"CoAddRefServerProcess"
"CoCreateInstanceEx"
"CoInitializeEx"
"comctl32.dll"
"commdlg_FindReplace"
"commdlg_help"
"ControlData"
"ControlOfs%.8X%.8X"
"CoReleaseServerProcess"
"CoResumeClassObjects"
"CoSuspendClassObjects"
"Data"
"ddd"
"DEB"
"Default"
"Delphi Component"
"Delphi Picture"
"Delphi%.8X"
"DesignSize"
"DISPLAY"
"DLLFILE"
"DrawThemeBackground"
"DrawThemeEdge"
"DrawThemeIcon"
"DrawThemeParentBackground"
"DrawThemeText"
"EAbort?s@"
"EAbstractError悙{@"
"EAccessViolation岪"
"EAssertionFailed岪"
"EClassNotFound?OA"
"EComponentError蠵A"
"ee"
"eeee"
"EExternalException愜t@"
"EHelpSystemException岪"
"EIniFileException嬂d鉇"
"EInvalidGraphic\鯝"
"EInvalidGraphicOperation岪"
"EInvalidOperation嬂孮A"
"EInvalidPointerTx@"
"EJPEG嬂S嬝嬎??鯝"
"emf"
"EnableThemeDialogTexture"
"EnableTheming"
"EnumDisplayMonitors"
"EOSError岪"
"EOutOfResources,QA"
"Error: the last char is NULL char."
"EStringListError岪"
"EThread刓A"
"EVariantArrayCreateError岪"
"EVariantArrayLockedError岪"
"EVariantBadIndexError嬂啼@"
"EVariantBadVarTypeErrorh銨"
"EVariantDispatchError嬂U嬱j"
"EVariantInvalidArgError銨"
"EVariantInvalidOpError愗釦"
"EVariantNotImplError岪"
"EVariantOutOfMemoryError岪"
"EVariantOverflowError嬂犮@"
"EVariantTypeCastError嬂<鉆"
"EVariantUnexpectedError替@"
"False"
"FF"
"FlatSB_EnableScrollBar"
"FlatSB_GetScrollInfo"
"FlatSB_GetScrollPos"
"FlatSB_GetScrollProp"
"FlatSB_GetScrollRange"
"FlatSB_SetScrollInfo"
"FlatSB_SetScrollPos"
"FlatSB_SetScrollProp"
"FlatSB_SetScrollRange"
"FlatSB_ShowScrollBar"
"FPUMaskValue"
"f擖?_?9"
"GetCurrentThemeName"
"GetDiskFreeSpaceExA"
"GetLongPathNameA"
"GetMonitorInfo"
"GetMonitorInfoA"
"GetMonitorInfoW"
"GetSystemMetrics"
"GetThemeAppProperties"
"GetThemeBackgroundContentRect"
"GetThemeBackgroundRegion"
"GetThemeBool"
"GetThemeColor"
"GetThemeDocumentationProperty"
"GetThemeEnumValue"
"GetThemeFilename"
"GetThemeFont"
"GetThemeInt"
"GetThemeIntList"
"GetThemeMargins"
"GetThemeMetric"
"GetThemePartSize"
"GetThemePosition"
"GetThemePropertyOrigin"
"GetThemeRect"
"GetThemeString"
"GetThemeSysBool"
"GetThemeSysColor"
"GetThemeSysColorBrush"
"GetThemeSysFont"
"GetThemeSysInt"
"GetThemeSysSize"
"GetThemeSysString"
"GetThemeTextExtent"
"GetThemeTextMetrics"
"GetWindowTheme"
"gg"
"ggg"
"h6G"
"HeE"
"hh"
"HitTestThemeBackground"
"h滱"
"ico"
"IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\""
"IExtendedHelpViewer詵B"
"IgnoreFontProperty"
"ImageList_WriteEx"
"imm32.dll"
"ImmGetCompositionStringA"
"ImmGetContext"
"ImmGetConversionStatus"
"ImmIsIME"
"ImmNotifyIME"
"ImmReleaseContext"
"ImmSetCompositionFontA"
"ImmSetCompositionWindow"
"ImmSetConversionStatus"
"ImmSetOpenStatus"
"InitializeFlatSB"
"Integer"
"IsAppThemed"
"IsControl"
"ISpecialWinHelpViewer桞"
"IsThemeActive"
"IsThemeBackgroundPartiallyTransparent"
"IsThemeDialogTextureEnabled"
"IsThemePartDefined"
"j3灌G"
"jjjj??婽G?8"
"jpeg"
"jpg"
"JumpID("","%s")"
"j箑G"
"j箌
G"
"kernel32.dll"
"layout text"
"Left"
"m/d/yy"
"Magellan MSWHEEL"
"MAINICON"
"MDICLIENT"
"mmmm d, yyyy"
"MonitorFromPoint"
"MonitorFromRect"
"MonitorFromWindow"
"MouseZ"
"MS_WINHELP"
"MSH_SCROLL_LINES_MSG"
"MSH_WHEELSUPPORT_MSG"
"MSWHEEL_ROLLMSG"
"nil"
"Null"
"ok1"
"ole32.dll"
"OleCreateFontIndirect"
"OleCreatePictureIndirect"
"OleCreatePropertyFrame"
"OleLoadPicture"
"olepro32.dll"
"OpenThemeData"
"Owner"
"PixelsPerInch"
"pm"
"PM"
"p岯"
"RegisterAutomation"
"SetLayeredWindowAttributes"
"SetThemeAppProperties"
"SetWindowTheme"
"ShortCutText"
"Software\Borland\Delphi\Locales"
"SOFTWARE\Borland\Delphi\RTL"
"Software\Borland\Locales"
"String"
"Strings"
"SVWU兡??蓧$?$媭?"
"SVW兡?蓧$?$嫄d"
"SVW孁UQ媜3缐$3鰦]D呟t%?"
"SVW伳俐嬺嬝媨?t峊$@?鑽铨峊$@嬆??椠?"
"SV嬺嬝嬅璩"
"SV嬺嬝桧B?吚tj"
"SV嬺嬝嬈??f塁^[肧V嬺嬝嬈??f塁^[?稝掕"
"SV嬺嬝嬈梵墐p"
"SV嬺嬝嬈璩a?圕^^[脨夽^掕蹌?脣繳嬱婨婡鼖@ "
"SV嬺嬝嬈鐿瘘劺t        ?嬅鐹{?^[脥@"
"SV嬸3鄹鋅D"
"SV嬸冴嫗?"
"SV嬟嬸呟t#;^dt婥夽:FHu嬅鑻?嬓VL嬅瑙?^"
"System\CurrentControlSet\Control\Keyboard "
"S嬝鯟t€c?G"
"S嬝嬅VQ?
"S嬝!G"
"S擖?_?9"
"S嬟嬓ttJ€?r???G"
"TAdapterNotifier岪"
"TaskbarCreated"
"TBits嬂淩A"
"TClipboardFormats嬂SV勔t兡痂R嬟嬸?QA"
"TColor"
"TConversionFormat"
"TCursor"
"TEventDispatch愄丏$待楹2"
"TextHeight"
"TIdentMapEntry"
"TMonitor岪"
"TMouse怳嬱QS峕l
G"
"Top"
"TPatternManagerSV勔t兡痂"褒嬟嬸岶P?摭嬈?
"TResourceManager岪"
"True"
"TServerEventDispatch岪"
"TThreadLocalCounter虄涝橄T"
"UninitializeFlatSB"
"User.dll"
"USER32"
"User32.dll"
"uxtheme.dll"
"U嬱?@"
"U嬱3蒕QQQQQQQSV嬺嬝3繳hUE"
"U嬱j"
"U嬱QSVW塃?繳hRkD"
"U嬱QSVW塃?繳hzC"
"U嬱QSVW塃?繳h幑B"
"U嬱QSVW塃鼖E鼖槹"
"U嬱QSVW嬟塃鼖Et?3繳h揈"
"U嬱QSVW塎鼖貗uj"
"U嬱QS嬝VW孃塎鼉媠t?茾"
"U嬱SV3龌"
"U嬱SVW媫媇€=.9G"
"U嬱SVW媫€=/9G"
"U嬱SVW媢媇V婨PS√;G"
"U嬱S媇;?G"
"U嬱S媇€=,9G"
"U嬱S媇1繮PPP夃P岴PP3岰Pu棂?禖媇$?"
"U嬱兡?蓧M魤U鴫E?繳h膰A"
"U嬱兡腟VW塎鴫E鼖]婨鼖€?"
"U嬱兡腟VW塎鴫U鼖惾"
"U嬱兡豐VW塎鴫U鼖怽"
"U嬱兡蘏VW嫎?"
"U嬱兡蘏V塎鴫U鼖葖E鼖P菱塙詪佷"
"U嬱兡癝V嫎?"
"U嬱兡鬝VW3蓧M魤U鴫E?繳hF夾"
"U嬱兡餝VW媢媫€=09G"
"U嬱兡餝VW媢媫€=19G"
"U嬱兡餝VW媢媫€=29G"
"U嬱兡餝VW媇媢孄;wu3离F?"
"U嬱兡霺V塃鼖E?3缐U鴫E魦U鴭]魨亶殙U靿E痣K婨"
"U嬱兡許VW媫媢€=39G"
"U嬱兡許V媇媢€=-9G"
"U嬱兡鳶3缐E?繳h
蹳"
"U嬱兡窼VW3蓧M笅驄?繳hB"
"U嬱婨3覊]?"
"U嬱婾奐麐U婻鼖R4鑕?3繻脨U嬱兡鳶塃鼖E鼖Xp呟"
"U嬱伳"
"U嬱伳XSVW媭D"
"U嬱伳叁SVW塎鼖€d"
"U嬱伳SV3蓧嶘?塎鼖驄?繳h'(E"
"VarAdd"
"VarAnd"
"VarBoolFromStr"
"VarBstrFromBool"
"VarBstrFromCy"
"VarBstrFromDate"
"VarCmp"
"VarCyFromStr"
"VarDateFromStr"
"VarDiv"
"VarI4FromStr"
"VariantChangeTypeEx"
"VarIdiv"
"VarMod"
"VarMul"
"VarNeg"
"VarNot"
"VarOr"
"VarR4FromStr"
"VarR8FromStr"
"VarSub"
"VarXor"
"vcltest3.dll"
"VW孃嬸嬈杳?;鴘3蓩讒苀撅鑜潲_^脨SV嬝媠D咑t"
"WINNLSEnableIME"
"wmf"
"WndProcPtr%.8X%.8X"
"X滱"
"yy"
"yyyy"
"ぷA"
"俵俽 俹僑僔僢僋魠B"
"婦$鰼"
"蛤C"
"媩$(栾'"
"彶柋春稖"
"脨悙U嬱兡鬡W塎鴫U鼖U+U鴫U魞}?
"柬A"
"见涶?勴"
"埐柋春稖"
"婡T桫r?脥@"
"婪E"
"靂B"
"内A"
"燶ニW??"
"軟A"
"媆$?搡?婼婥t?0G"
"腝D"
"渉E"
"慉"
"劜柋春稖"
"衪A"
"圉総?嫼"
"圉総?嫼"
"嫄?"
"豒C"
"E"

[课程]FART 脱壳王!加量不加价!FART作者讲授!

收藏
免费 0
支持
分享
最新回复 (4)
雪    币: 177
活跃值: (12)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
这个好象是个游戏的外挂哦
这个乱码的问题我也很困惑
你可以用DEDE或者下API断点试下;
一般都可以的
期待有解决的方案~~
2007-10-28 10:22
0
雪    币: 201
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
DEDE吧..找到相关的东西,再用OD看看..
2007-10-28 11:17
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
各位大虾还是不行啊用DEDE只能看到模块其他什么都看不到到底问题出在哪里呢?请赐教
使用eXeScope查看先提示:"拒绝写入,以只读模式打开.确定进入以后查看资源提示:"这个可执行文件是经过压缩的,不能查看或编辑这个文件....
2007-10-28 14:39
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
顶一下下,大侠门帮一把啊
2007-10-28 19:45
0
游客
登录 | 注册 方可回帖
返回
//