我是个菜鸟 初学脱壳 随便找了一个练习 希望高手指点 教一下我这个菜鸟 在这里先谢谢了！
PE查壳显示 ASProtect 1.2x - 1.3x [Registered] -> Alexey Solodovnikov
可能是这个壳太复杂 不适合新手 但还是希望高手指教！下面走的肯定闹笑了(别笑俺~~)
od载入后停在 (我忽略了所有异常 隐藏了OD)
00401000 > 68 01F04600 push 小游戏.0046F001
00401005 E8 01000000 call 小游戏.0040100B ----- F7进入了
0040100A C3 retn ------ 提示返回到 0046F001
0040100B C3 retn ----- 来到这里 提示返回到 0040100A
0040100C F7BD 379BFE3D idiv dword ptr ss:[ebp+3DFE9B37]
00401012 EA B2917070 D94>jmp far 4CD9:707091B2
00401019 6C ins byte ptr es:[edi],dx
0040101A 40 inc eax
0040101B 24 67 and al,67
0040101D 24 A5 and al,0A5
0046F001 60 pushad
0046F002 E8 03000000 call 小游戏.0046F00A ----- F7进入了
0046F007 - E9 EB045D45 jmp 45A3F4F7
0046F00C 55 push ebp
0046F00D C3 retn
0046F00E E8 01000000 call 小游戏.0046F014
0046F013 EB 5D jmp short 小游戏.0046F072
0046F015 BB EDFFFFFF mov ebx,-13
0046F00A 5D pop ebp ; 小游戏.0046F007
0046F00B 45 inc ebp
0046F00C 55 push ebp
0046F00D C3 retn ------返回到 0046F008 (小游戏.0046F008)
0046F00E E8 01000000 call 小游戏.0046F014
0046F013 EB 5D jmp short 小游戏.0046F072
0046F015 BB EDFFFFFF mov ebx,-13
0046F01A 03DD add ebx,ebp
0046F01C 81EB 00F00600 sub ebx,6F000
0046F008 /EB 04 jmp short 小游戏.0046F00E -----从上面返回到了这里
0046F00A |5D pop ebp
0046F00B |45 inc ebp
0046F00C |55 push ebp
0046F00D |C3 retn
0046F00E \E8 01000000 call 小游戏.0046F014 -----又跳到这里，F7进入了
0046F013 EB 5D jmp short 小游戏.0046F072
0046F015 BB EDFFFFFF mov ebx,-13
0046F01A 03DD add ebx,ebp
0046F014 5D pop ebp ; 小游戏.0046F013
0046F015 BB EDFFFFFF mov ebx,-13
0046F01A 03DD add ebx,ebp
0046F01C 81EB 00F00600 sub ebx,6F000
0046F022 807D 4D 01 cmp byte ptr ss:[ebp+4D],1
0046F026 75 0C jnz short 小游戏.0046F034
0046F028 8B7424 28 mov esi,dword ptr ss:[esp+28]
0046F02C 83FE 01 cmp esi,1
0046F02F 895D 4E mov dword ptr ss:[ebp+4E],ebx
0046F032 75 31 jnz short 小游戏.0046F065
0046F034 8D45 53 lea eax,dword ptr ss:[ebp+53]
0046F037 50 push eax
0046F038 53 push ebx
0046F039 FFB5 F1090000 push dword ptr ss:[ebp+9F1]
0046F03F 8D45 35 lea eax,dword ptr ss:[ebp+35]
0046F042 50 push eax
0046F043 /E9 82000000 jmp 小游戏.0046F0CA --------- 一直F8走到这里
0046F048 |0000 add byte ptr ds:[eax],al
0046F04A |0000 add byte ptr ds:[eax],al
0046F04C |0000 add byte ptr ds:[eax],al
0046F04E |0000 add byte ptr ds:[eax],al
0046F050 |0000 add byte ptr ds:[eax],al
0046F052 |0000 add byte ptr ds:[eax],al
0046F054 |0000 add byte ptr ds:[eax],al
0046F056 |0000 add byte ptr ds:[eax],al
0046F058 |0000 add byte ptr ds:[eax],al
0046F05A |0000 add byte ptr ds:[eax],al
0046F05C |0000 add byte ptr ds:[eax],al
0046F05E |0000 add byte ptr ds:[eax],al
0046F060 |0000 add byte ptr ds:[eax],al
0046F062 |0000 add byte ptr ds:[eax],al
0046F064 |00B8 F8C0A523 add byte ptr ds:[eax+23A5C0F8],bh
0046F06A |50 push eax
0046F06B |50 push eax
0046F06C |0345 4E add eax,dword ptr ss:[ebp+4E]
0046F06F |5B pop ebx
0046F070 |85C0 test eax,eax
0046F072 |74 1C je short 小游戏.0046F090
0046F074 |EB 01 jmp short 小游戏.0046F077
0046F076 |E8 81FBF8C0 call C13FEBFC
0046F07B |A5 movs dword ptr es:[edi],dword ptr ds:[es>
0046F07C |237435 33 and esi,dword ptr ss:[ebp+esi+33]
0046F080 |D256 6A rcl byte ptr ds:[esi+6A],cl
0046F083 |0056 FF add byte ptr ds:[esi-1],dl
0046F086 |75 4E jnz short 小游戏.0046F0D6
0046F088 |FFD0 call eax
0046F08A |5E pop esi
0046F08B |83FE 00 cmp esi,0
0046F08E |75 24 jnz short 小游戏.0046F0B4
0046F090 |33D2 xor edx,edx
0046F092 |8B45 41 mov eax,dword ptr ss:[ebp+41]
0046F095 |85C0 test eax,eax
0046F097 |74 07 je short 小游戏.0046F0A0
0046F099 |52 push edx
0046F09A |52 push edx
0046F09B |FF75 35 push dword ptr ss:[ebp+35]
0046F09E |FFD0 call eax
0046F0A0 |8B45 35 mov eax,dword ptr ss:[ebp+35]
0046F0A3 |85C0 test eax,eax
0046F0A5 |74 0D je short 小游戏.0046F0B4
0046F0A7 |68 00800000 push 8000
0046F0AC |6A 00 push 0
0046F0AE |FF75 35 push dword ptr ss:[ebp+35]
0046F0B1 |FF55 3D call dword ptr ss:[ebp+3D]
0046F0B4 |5B pop ebx
0046F0B5 |0BDB or ebx,ebx
0046F0B7 |61 popad
0046F0B8 |75 06 jnz short 小游戏.0046F0C0
0046F0BA |6A 01 push 1
0046F0BC |58 pop eax
0046F0BD |C2 0C00 retn 0C
0046F0C0 |33C0 xor eax,eax
0046F0C2 |F7D8 neg eax
0046F0C4 |1BC0 sbb eax,eax
0046F0C6 |40 inc eax
0046F0C7 |C2 0C00 retn 0C
0046F0CA \E8 0C000000 call 小游戏.0046F0DB ------ 又跳到了这里，又F7进入了
0046F0DB 8AC1 mov al,cl
0046F0DD 58 pop eax
0046F0DE E8 0E000000 call 小游戏.0046F0F1 ----- F8走到这里 ，F7进入了
0046F0E3 FE ??? ; 未知命令
0046F0E4 5F pop edi
0046F0E5 AC lods byte ptr ds:[esi]
0046F0E6 75 0A jnz short 小游戏.0046F0F2
0046F0E8 7B 98 jpo short 小游戏.0046F082
0046F0EA F1 int1
0046F0EB D6 salc
0046F0EC 57 push edi
0046F0ED 44 inc esp
0046F0F1 B4 D8 mov ah,0D8
0046F0F3 5F pop edi
0046F0F4 E8 10000000 call 小游戏.0046F109 ----- 到了这里 我还是 F7进入了
0046F0F9 C8 618647 enter 8661,47
0046F0FD ^ 74 9D je short 小游戏.0046F09C
0046F0FF 12E3 adc ah,bl
0046F101 ^ E0 99 loopdne short 小游戏.0046F09C
0046F103 5E pop esi
0046F104 3F aas
0046F105 0C 55 or al,55
0046F107 6A 5B push 5B
来到这里后 我一直往下走
0046F109 66:81DE 0EF0 sbb si,0F00E
0046F10E 5E pop esi
0046F10F 81C7 C1080000 add edi,8C1
0046F115 BE 419D2B13 mov esi,132B9D41
0046F11A BA 00000000 mov edx,0
0046F11F 68 7DCCD35C push 5CD3CC7D
0046F124 66:81DB 1F7D sbb bx,7D1F
0046F129 5E pop esi
0046F12A FF343A push dword ptr ds:[edx+edi]
0046F12D B4 58 mov ah,58
0046F12F 59 pop ecx
0046F130 B3 81 mov bl,81
0046F132 81E9 9E78871E sub ecx,1E87789E
0046F138 0F8D 00000000 jge 小游戏.0046F13E
0046F13E 81E9 7FAFA22E sub ecx,2EA2AF7F
0046F144 0F8E 00000000 jle 小游戏.0046F14A
0046F14A 81F1 4C9BF767 xor ecx,67F79B4C
0046F150 51 push ecx
0046F151 68 59629E07 push 79E6259
0046F156 80F0 F6 xor al,0F6
0046F159 58 pop eax
0046F15A 5B pop ebx
0046F15B 890C17 mov dword ptr ds:[edi+edx],ecx
0046F15E E9 0A000000 jmp 小游戏.0046F16D
0046F163 DA0B fimul dword ptr ds:[ebx]
0046F165 E8 01A6E794 call 952E976B
0046F16A 3D 32830FB7 cmp eax,B70F8332
0046F16F F3: prefix rep:
0046F170 83EA 04 sub edx,4
0046F173 0FB7F7 movzx esi,di
0046F176 81FA F4F7FFFF cmp edx,-80C
0046F17C 0F85 0F000000 jnz 小游戏.0046F191
0046F182 BE 739F6056 mov esi,56609F73
0046F187 E9 10000000 jmp 小游戏.0046F19C
0046F18C A9 2ECF5C65 test eax,655CCF2E
0046F191 ^ E9 94FFFFFF jmp 小游戏.0046F12A -- 到了这里就不行了 在下面用F4就会运行起来
0046F196 06 push es
0046F197 C7 ??? ; 未知命令
0046F198 F4 hlt
0046F199 1D 9263E99F sbb eax,9FE96392
0046F19E 53 push ebx
0046F19F DC75 C3 fdiv qword ptr ss:[ebp-3D]
0046F1A2 21B5 DD764709 and dword ptr ss:[ebp+94776DD],esi
0046F1A8 51 push ecx
0046F1A9 F2: prefix repne:
0046F1AA 6B1D 853EDF81 F>imul ebx,dword ptr ds:[81DF3E85],-7
0046F1B1 3AA3 150D0798 cmp ah,byte ptr ds:[ebx+98070D15]
0046F1B7 F9 stc
0046F1B8 2F das
0046F1B9 9B wait
0046F1BA 0FB569 C3 lgs ebp,fword ptr ds:[ecx-3D]
0046F1BE 2F das
0046F1BF ^ 71 A9 jno short 小游戏.0046F16A
0046F1C1 8AF3 mov dh,bl
我是个菜鸟 初学脱壳 随便找了一个练习 希望高手指点 教一下我这个菜鸟 在这里先谢谢了！
[招生]科锐逆向工程师培训(2025年3月11日实地，远程教学同时开班, 第52期)！
