首页
社区
课程
招聘
[转帖]eXPressor.1.6.0.1.UnPacked
发表于: 2008-3-8 15:53 4053

[转帖]eXPressor.1.6.0.1.UnPacked

2008-3-8 15:53
4053
eXPressor.1.6.0.1.UnPacked

by:Magic_h2001

see my Tut for 1.5.0.1 version :

c8fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3k6G2M7Y4g2E0i4K6u0W2k6i4S2W2N6r3!0G2L8s2y4Q4x3X3g2U0L8$3#2Q4x3V1k6K6K9r3!0%4N6r3S2J5k6h3q4V1i4K6u0W2M7r3S2H3i4K6y4r3N6q4)9K6c8o6p5I4x3K6R3I4

Needed Patterns for unpacking eXpressor 1.6.0.1 full protection:

Magic IAT jump:
56 57 33 FF 39 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? EB 01

Directly Imports:
83 C0 05 8B 4D F4 2B C8 8B 45 E8 89 08

ADD EAX,5
MOV ECX,DWORD PTR SS:[EBP-C] // change [EBP-C] to [EBP-2C]
SUB ECX,EAX
MOV EAX,DWORD PTR SS:[EBP-18]


near OEP:
5F 5E 5B 8B E5 5D EB 01


not cracked just unpacked for fun...

285K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4u0S2M7r3W2V1M7$3S2S2M7X3g2Q4x3X3g2U0L8$3#2Q4x3V1k6X3K9h3I4W2M7#2)9J5c8U0V1%4z5e0l9$3x3K6M7I4i4K6u0r3k6g2S2b7M7X3g2K6M7$3!0J5i4K6u0W2x3g2)9J5k6e0k6Q4x3X3f1H3i4K6u0W2x3g2)9J5k6g2g2F1f1r3q4U0K9$3g2V1i4K6u0W2M7X3q4J5i4K6u0W2K9s2c8E0L8l9`.`.

[培训]传播安全知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 1
支持
分享
最新回复 (5)
雪    币: 111951
活跃值: (203399)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
2
by:pavka

01fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4u0S2M7r3W2V1M7$3S2S2M7X3g2Q4x3X3g2U0L8$3#2Q4x3V1k6X3K9h3I4W2M7#2)9J5c8U0V1%4z5e0l9&6x3U0M7@1i4K6u0r3k6g2S2b7M7X3g2K6M7$3!0J5g2g2)9J5k6i4u0S2M7R3`.`.
2008-3-8 15:54
0
雪    币: 5090
活跃值: (4580)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
脱壳版出来真快
2008-3-8 16:00
0
雪    币: 707
活跃值: (1301)
能力值: ( LV9,RANK:190 )
在线值:
发帖
回帖
粉丝
4
咋不本地一份呢? 偶来
eXPressorU.rar
上传的附件:
2008-3-8 20:17
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
本地的呢? 晕
2008-3-17 18:40
0
雪    币: 111951
活跃值: (203399)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
6
发帖请参看版规。
2008-3-17 19:09
0
游客
登录 | 注册 方可回帖
返回