Themida/WinLicense V1.8.2.0 +的壳,用OD载入,运行了okdodo的脚本后,到达这个地方
004055FF 6A 02 push 2
00405601 FF15 C0624000 call dword ptr [4062C0] ; msvcrt.__set_app_type
00405607 59 pop ecx
00405608 830D B88C4000 F>or dword ptr [408CB8], FFFFFFFF
0040560F 830D BC8C4000 F>or dword ptr [408CBC], FFFFFFFF
00405616 FF15 BC624000 call dword ptr [4062BC] ; msvcrt.__p__fmode
0040561C 8B0D AC8C4000 mov ecx, dword ptr [408CAC]
00405622 8908 mov dword ptr [eax], ecx
00405624 FF15 E0624000 call dword ptr [4062E0] ; msvcrt.__p__commode
0040562A 8B0D A88C4000 mov ecx, dword ptr [408CA8]
00405630 8908 mov dword ptr [eax], ecx
00405632 A1 B4624000 mov eax, dword ptr [4062B4]
00405637 8B00 mov eax, dword ptr [eax]
00405639 A3 B48C4000 mov dword ptr [408CB4], eax
0040563E E8 1C010000 call 0040575F
00405643 391D C0844000 cmp dword ptr [4084C0], ebx
00405649 75 0C jnz short 00405657
0040564B 68 5C574000 push 0040575C
00405650 FF15 B0624000 call dword ptr [4062B0] ; msvcrt.__setusermatherr
00405656 59 pop ecx
00405657 E8 EE000000 call 0040574A
0040565C 68 14804000 push 00408014
00405661 68 10804000 push 00408010
00405666 E8 D9000000 call 00405744 ; jmp 到 msvcrt._initterm
0040566B A1 A48C4000 mov eax, dword ptr [408CA4]
00405670 8945 94 mov dword ptr [ebp-6C], eax
00405673 8D45 94 lea eax, dword ptr [ebp-6C]
00405676 50 push eax
00405677 FF35 A08C4000 push dword ptr [408CA0]
0040567D 8D45 9C lea eax, dword ptr [ebp-64]
00405680 50 push eax
00405681 8D45 90 lea eax, dword ptr [ebp-70]
00405684 50 push eax
00405685 8D45 A0 lea eax, dword ptr [ebp-60]
00405688 50 push eax
00405689 FF15 A8624000 call dword ptr [4062A8] ; msvcrt.__getmainargs
dump出来用ImportREC修复,运行不了,打开修复后的程序,入口代码如下..
004055FF >/$ 6A 02 push 2
00405601 |. FF15 C0026700 call dword ptr [<&msvcrt.#154>] ; msvcrt.__set_app_type
00405607 |. 59 pop ecx
00405608 |. 830D B88C4000>or dword ptr [408CB8], FFFFFFFF
0040560F |. 830D BC8C4000>or dword ptr [408CBC], FFFFFFFF
00405616 |. FF15 BC026700 call dword ptr [<&msvcrt.#135>] ; msvcrt.__p__fmode
0040561C |. 8B0D AC8C4000 mov ecx, dword ptr [408CAC]
00405622 |. 8908 mov dword ptr [eax], ecx
00405624 |. FF15 E0026700 call dword ptr [<&msvcrt.#130>] ; msvcrt.__p__commode
0040562A |. 8B0D A88C4000 mov ecx, dword ptr [408CA8]
00405630 |. 8908 mov dword ptr [eax], ecx
00405632 |. A1 B4026700 mov eax, dword ptr [<&msvcrt.#183>]
00405637 |. 8B00 mov eax, dword ptr [eax]
00405639 |. A3 B48C4000 mov dword ptr [408CB4], eax
0040563E |. E8 1C010000 call 0040575F
00405643 |. 391D C0844000 cmp dword ptr [4084C0], ebx
00405649 |. 75 0C jnz short 00405657
0040564B |. 68 5C574000 push 0040575C
00405650 |. FF15 B0026700 call dword ptr [<&msvcrt.#156>] ; msvcrt.__setusermatherr
00405656 |. 59 pop ecx
00405657 |> E8 EE000000 call 0040574A
0040565C |. 68 14804000 push 00408014
00405661 |. 68 10804000 push 00408010
00405666 |. E8 D9000000 call <jmp.&msvcrt.#316>
0040566B |. A1 A48C4000 mov eax, dword ptr [408CA4]
00405670 |. 8945 94 mov dword ptr [ebp-6C], eax
00405673 |. 8D45 94 lea eax, dword ptr [ebp-6C]
00405676 |. 50 push eax
00405677 |. FF35 A08C4000 push dword ptr [408CA0]
0040567D |. 8D45 9C lea eax, dword ptr [ebp-64]
00405680 |. 50 push eax
00405681 |. 8D45 90 lea eax, dword ptr [ebp-70]
00405684 |. 50 push eax
00405685 |. 8D45 A0 lea eax, dword ptr [ebp-60]
00405688 |. 50 push eax
00405689 |. FF15 A8026700 call dword ptr [<&msvcrt.#111>] ; msvcrt.__getmainargs
汇编不太会..问了别人,说是VB写的...我没什么经验..感觉像是VC..运行不了应该是被偷了代码..要补..但是不知道该如何补...现在连是什么写的都不知道..用PEID查..显示什么也没找到...有没有人帮忙研究一下..感谢了..
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
