能力值：
( LV2，RANK：10 )
|
-
-
2 楼
就是Neolite 壳，可以自脱，也可以手脱。
举一个例子：
0049308C > $ /E9 A6000000 JMP ******.00493137
00493091 |9C494900 DD **********.0049499C
00493095 . |44304900 DD <&kernel32.LoadLibraryA>
00493099 . |48304900 DD <&kernel32.GetProcAddress>
0049309D . |00000000 DD 00000000
004930A1 . |9C390000 DD 0000399C
004930A5 |4E314900 DD *******.0049314E
004930A9 . |4E 65 6F 4C 6>ASCII "NeoLite Executab"
004930B9 . |6C 65 20 46 6>ASCII "le File Compress"
004930C9 . |6F 72 0D 0A 4>ASCII "or
Copyright (c"
004930D9 . |29 20 31 39 3>ASCII " 1998,1999 NeoW"
004930E9 . |6F 72 78 20 4>ASCII "orx Inc
Portion"
004930F9 . |73 20 43 6F 7>ASCII "s Copyright (c) "
00493109 . |31 39 39 37 2>ASCII "1997-1999 Lee Ha"
00493119 . |73 69 75 6B 0>ASCII "siuk
All Rights"
00493129 . |20 52 65 73 6>ASCII " Reserved.
",0
00493136 . |00 DB 00
00493137 > \8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
0049313B . 2305 9D304900 AND EAX,DWORD PTR DS:[49309D]
00493141 . E8 71030000 CALL ********.004934B7
00493146 . FE05 36314900 INC BYTE PTR DS:[493136]
0049314C . FFE0 JMP EAX...........................跳向oep
0049314E . 803D 36314900>CMP BYTE PTR DS:[493136],0
00493155 . 75 13 JNZ SHORT *******.0049316A
00493157 . 90 NOP
00493158 . 90 NOP
dump 即可。
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
灰鸽子？？？？
|
能力值：
( LV2，RANK：10 )
|
-
-
4 楼
0044C214 > $ /E9 A6000000 JMP mpeg4wan.0044C2BF
0044C219 |04DB4400 DD mpeg4wan.0044DB04
0044C21D . |CCC04400 DD <&KERNEL32.LoadLibraryA> ; ASCII "a馘w"
0044C221 . |C8C04400 DD <&KERNEL32.GetProcAddress> ; ASCII "2冲wa馘w"
0044C225 . |00000000 DD 00000000
0044C229 . |044B0000 DD 00004B04
0044C22D |D6C24400 DD mpeg4wan.0044C2D6 ; ASCII "?韭D"
0044C231 . |4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 ASCII "NeoLite Executab"
0044C241 . |6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 ASCII "le File Compress"
0044C251 . |6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 ASCII "or
Copyright (c"
0044C261 . |29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 ASCII ") 1998,1999 NeoW"
0044C271 . |6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E ASCII "orx Inc
Portion"
0044C281 . |73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 ASCII "s Copyright (c) "
0044C291 . |31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 ASCII "1997-1999 Lee Ha"
0044C2A1 . |73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 ASCII "siuk
All Rights"
0044C2B1 . |20 52 65 73 65 72 76 65 64 2E 0D 0A 00 ASCII " Reserved.
",0
0044C2BE . |00 DB 00
0044C2BF > \8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
0044C2C3 . 2305 25C24400 AND EAX,DWORD PTR DS:[44C225]
0044C2C9 . E8 71030000 CALL mpeg4wan.0044C63F
0044C2CE . FE05 BEC24400 INC BYTE PTR DS:[44C2BE]
0044C2D4 . FFE0 JMP NEAR EAX
0044C2D6 . 80 3D BE C2 44 00 ASCII "?韭D",0
0044C2DC . 0075 13 ADD BYTE PTR SS:[EBP+13],DH
0044C2DF . 90 NOP
0044C2E0 . 90 NOP
0044C2E1 . 90 NOP
0044C2E2 . 90 NOP
0044C2E3 . 50 PUSH EAX
0044C2E4 . 2BC0 SUB EAX,EAX
0044C2E6 . E8 54030000 CALL mpeg4wan.0044C63F
0044C2EB . 58 POP EAX
0044C2EC . FE05 BEC24400 INC BYTE PTR DS:[44C2BE]
0044C2F2 . C3 RETN
0044C2F3 . 94 9A 8D 91 9A 93 CC CD 00 ASCII "???掏",0
0044C2FC . B8 93 90 9D 9E 93 BE 93 93 90 9C 00 ASCII "??????,0
0044C308 . B8 93 90 9D 9E 93 B9 8D 9A 9A 00 ASCII "?????",0
0044C313 . B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE ASCII "????????"
|
|
|
|
