UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo [Overlay]
00414980 > $ 60 pushad
00414981 . BE 00C04000 mov esi, 0040C000
00414986 . 8DBE 0050FFFF lea edi, dword ptr [esi+FFFF5000]
0041498C . 57 push edi
0041498D . 83CD FF or ebp, FFFFFFFF
00414990 . EB 10 jmp short 004149A2
00414992 90 nop
00414993 90 nop
00414994 90 nop
00414995 90 nop
00414996 90 nop
00414997 90 nop
00414998 > 8A06 mov al, byte ptr [esi]
0041499A . 46 inc esi
0041499B . 8807 mov byte ptr [edi], al
0041499D . 47 inc edi
0041499E > 01DB add ebx, ebx
004149A0 . 75 07 jnz short 004149A9
004149A2 > 8B1E mov ebx, dword ptr [esi]
004149A4 . 83EE FC sub esi, -4
004149A7 . 11DB adc ebx, ebx
004149A9 >^ 72 ED jb short 00414998
004149AB . B8 01000000 mov eax, 1 /// F4断点,F8继续
00414A25 . 8D142F lea edx, dword ptr [edi+ebp]
00414A28 . 83FD FC cmp ebp, -4
00414A2B . 76 0F jbe short 00414A3C
00414A2D > 8A02 mov al, byte ptr [edx]
00414A2F . 42 inc edx
00414A30 . 8807 mov byte ptr [edi], al
00414A32 . 47 inc edi
00414A33 . 49 dec ecx
00414A34 .^ 75 F7 jnz short 00414A2D
00414A36 .^ E9 63FFFFFF jmp 0041499E
00414A3B 90 nop
00414A3C > 8B02 mov eax, dword ptr [edx]
00414A3E . 83C2 04 add edx, 4
00414A41 . 8907 mov dword ptr [edi], eax
00414A43 . 83C7 04 add edi, 4
00414A46 . 83E9 04 sub ecx, 4
00414A49 .^ 77 F1 ja short 00414A3C
00414A4B . 01CF add edi, ecx
00414A4D .^ E9 4CFFFFFF jmp 0041499E
00414A52 > 5E pop esi ///F4断点
00414AB1 . 57 push edi
00414AB2 . FFD5 call ebp
00414AB4 . 8D87 1F020000 lea eax, dword ptr [edi+21F]
00414ABA . 8020 7F and byte ptr [eax], 7F
00414ABD . 8060 28 7F and byte ptr [eax+28], 7F
00414AC1 . 58 pop eax
00414AC2 . 50 push eax
00414AC3 . 54 push esp
00414AC4 . 50 push eax
00414AC5 . 53 push ebx
00414AC6 . 57 push edi
00414AC7 . FFD5 call ebp
00414AC9 . 58 pop eax
00414ACA . 61 popad
00414ACB . 8D4424 80 lea eax, dword ptr [esp-80]
00414ACF > 6A 00 push 0
00414AD1 . 39C4 cmp esp, eax
00414AD3 .^ 75 FA jnz short 00414ACF
00414AD5 . 83EC 80 sub esp, -80
00414AD8 .^ E9 57D5FFFF jmp 00412034 ////找到OEP
00412034 > /60 pushad
00412035 . |51 push ecx
00412036 . |51 push ecx
00412037 |11 db 11
00412038 |D9 db D9
00412039 |51 db 51 ; CHAR 'Q'
0041203A |51 db 51 ; CHAR 'Q'
0041203B |51 db 51 ; CHAR 'Q'
0041203C |21 db 21 ; CHAR '!'
0041203D |C0 db C0
0041203E |51 db 51 ; CHAR 'Q'
0041203F |50 db 50 ; CHAR 'P'
00412040 |51 db 51 ; CHAR 'Q'
00412041 |2B db 2B ; CHAR '+'
00412042 |D0 db D0
00412043 |53 db 53 ; CHAR 'S'
00412044 |50 db 50 ; CHAR 'P'
00412045 |51 db 51 ; CHAR 'Q'
....
然后脱壳出文件，PE查什么都没找到 * EP段还是UPX1,,,卡巴查到是PE_Patch.MaskPE
接下来还有还有什么问题？
原文件和脱壳文件已打包 www.zuogm.com/wj.rar(注意下这个是个马，大家当心点！)，望高手们看下！小弟感激！！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
