附件下载地址↓：
http://www.lao-dao.cn/reginf.rar
004A9940 > 60 PUSHAD //OD载入断在这里
004A9941 BE 00404700 MOV ESI,reginf.00474000
004A9946 8DBE 00D0F8FF LEA EDI,DWORD PTR DS:[ESI+FFF8D000]
004A994C 57 PUSH EDI
004A994D EB 0B JMP SHORT reginf.004A995A
004A994F 90 NOP
004A9950 8A06 MOV AL,BYTE PTR DS:[ESI]
ESP定律到
004A9ADF 8D4424 80 LEA EAX,DWORD PTR SS:[ESP-80]
004A9AE3 6A 00 PUSH 0
004A9AE5 39C4 CMP ESP,EAX
004A9AE7 ^ 75 FA JNZ SHORT reginf.004A9AE3
004A9AE9 83EC 80 SUB ESP,-80
004A9AEC - E9 2D96FAFF JMP reginf.0045311E
0045311E E8 8EA50000 CALL reginf.0045D6B1 这里是ＯＥＰ吗？
查壳 核心扫描 仍然显示 UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo [Overlay]
00453123 ^ E9 16FEFFFF JMP reginf.00452F3E
00453128 B8 D2E14500 MOV EAX,reginf.0045E1D2
0045312D A3 381E4700 MOV DWORD PTR DS:[471E38],EAX
00453132 C705 3C1E4700 C>MOV DWORD PTR DS:[471E3C],reginf.0045D8C>
0045313C C705 401E4700 8>MOV DWORD PTR DS:[471E40],reginf.0045D88>
00453146 C705 441E4700 C>MOV DWORD PTR DS:[471E44],reginf.0045D8C>
00453150 C705 481E4700 3>MOV DWORD PTR DS:[471E48],reginf.0045D83>
0045315A A3 4C1E4700 MOV DWORD PTR DS:[471E4C],EAX
0045315F C705 501E4700 4>MOV DWORD PTR DS:[471E50],reginf.0045E14>
00453169 C705 541E4700 4>MOV DWORD PTR DS:[471E54],reginf.0045D84>
00453173 C705 581E4700 B>MOV DWORD PTR DS:[471E58],reginf.0045D7B>
0045317D C705 5C1E4700 4>MOV DWORD PTR DS:[471E5C],reginf.0045D74>
00453187 C3 RETN
00453188 E8 9BFFFFFF CALL reginf.00453128
0045318D E8 C6B00000 CALL reginf.0045E258
00453192 837C24 04 00 CMP DWORD PTR SS:[ESP+4],0
00453197 A3 383B4700 MOV DWORD PTR DS:[473B38],EAX
0045319C 74 05 JE SHORT reginf.004531A3
0045319E E8 50B00000 CALL reginf.0045E1F3
004531A3 DBE2 FCLEX
004531A5 C3 RETN
004531A6 CC INT3
004531A7 CC INT3
004531A8 CC INT3
004531A9 CC INT3
004531AA CC INT3
004531AB CC INT3
004531AC CC INT3
004531AD CC INT3
004531AE CC INT3
004531AF CC INT3
004531B0 51 PUSH ECX
004531B1 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
00452F3E 6A 60 PUSH 60 这里是OEP吗？查壳仍然显示 UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo
00452F40 68 B8DD4600 PUSH reginf.0046DDB8
00452F45 E8 A21A0000 CALL reginf.004549EC
00452F4A 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
00452F4E 8D45 90 LEA EAX,DWORD PTR SS:[EBP-70]
00452F51 50 PUSH EAX
00452F52 FF15 50524600 CALL DWORD PTR DS:[465250] ; kernel32.GetStartupInfoA
00452F58 C745 FC FEFFFFF>MOV DWORD PTR SS:[EBP-4],-2
00452F5F BF 94000000 MOV EDI,94
00452F64 57 PUSH EDI
00452F65 6A 00 PUSH 0
00452F67 8B1D 4C524600 MOV EBX,DWORD PTR DS:[46524C] ; kernel32.GetProcessHeap
00452F6D FFD3 CALL EBX
00452F6F 50 PUSH EAX
00452F70 FF15 F8524600 CALL DWORD PTR DS:[4652F8] ; ntdll.RtlAllocateHeap
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
