碰到一软件,用算法检测工具没有检测出是何算法,凭感觉应该是用了一种现成的算法,哪位兄弟看看这是什么算法?
004E5CE4 /$ 55 push ebp
004E5CE5 |. 8BEC mov ebp, esp
004E5CE7 |. 83C4 E4 add esp, -1C
004E5CEA |. 53 push ebx
004E5CEB |. 56 push esi
004E5CEC |. 57 push edi
004E5CED |. 894D F4 mov dword ptr [ebp-C], ecx
004E5CF0 |. 8955 F8 mov dword ptr [ebp-8], edx
004E5CF3 |. 8945 FC mov dword ptr [ebp-4], eax
004E5CF6 |. BA 70536200 mov edx, 00625370
004E5CFB |. C645 F3 01 mov byte ptr [ebp-D], 1
004E5CFF |. 8B75 F4 mov esi, dword ptr [ebp-C]
004E5D02 |> 33C0 /xor eax, eax
004E5D04 |. 8906 |mov dword ptr [esi], eax
004E5D06 |. C645 F2 00 |mov byte ptr [ebp-E], 0
004E5D0A |> 33C0 |/xor eax, eax
004E5D0C |. 8A45 F3 ||mov al, byte ptr [ebp-D]
004E5D0F |. 48 ||dec eax
004E5D10 |. C1E0 02 ||shl eax, 2
004E5D13 |. 33C9 ||xor ecx, ecx
004E5D15 |. 8A4D F2 ||mov cl, byte ptr [ebp-E]
004E5D18 |. 03C1 ||add eax, ecx
004E5D1A |. 0FB60402 ||movzx eax, byte ptr [edx+eax]
004E5D1E |. 8B0E ||mov ecx, dword ptr [esi]
004E5D20 |. C1E1 08 ||shl ecx, 8
004E5D23 |. 03C1 ||add eax, ecx
004E5D25 |. 8906 ||mov dword ptr [esi], eax
004E5D27 |. FE45 F2 ||inc byte ptr [ebp-E]
004E5D2A |. 807D F2 04 ||cmp byte ptr [ebp-E], 4
004E5D2E |.^ 75 DA |\jnz short 004E5D0A
004E5D30 |. FE45 F3 |inc byte ptr [ebp-D]
004E5D33 |. 83C6 04 |add esi, 4
004E5D36 |. 807D F3 13 |cmp byte ptr [ebp-D], 13
004E5D3A |.^ 75 C6 \jnz short 004E5D02
004E5D3C |. BF 48000000 mov edi, 48
004E5D41 |. C645 F3 04 mov byte ptr [ebp-D], 4
004E5D45 |. 8B45 08 mov eax, dword ptr [ebp+8]
004E5D48 |. 8945 E4 mov dword ptr [ebp-1C], eax
004E5D4B |> C645 F2 00 /mov byte ptr [ebp-E], 0
004E5D4F |. 8B45 E4 |mov eax, dword ptr [ebp-1C]
004E5D52 |. 8BF0 |mov esi, eax
004E5D54 |> 33C0 |/xor eax, eax
004E5D56 |. 8906 ||mov dword ptr [esi], eax
004E5D58 |. 33C9 ||xor ecx, ecx
004E5D5A |> 33C0 ||/xor eax, eax
004E5D5C |. 8A45 F2 |||mov al, byte ptr [ebp-E]
004E5D5F |. C1E0 02 |||shl eax, 2
004E5D62 |. 03C7 |||add eax, edi
004E5D64 |. 33DB |||xor ebx, ebx
004E5D66 |. 8AD9 |||mov bl, cl
004E5D68 |. 03C3 |||add eax, ebx
004E5D6A |. 0FB60402 |||movzx eax, byte ptr [edx+eax]
004E5D6E |. 8B1E |||mov ebx, dword ptr [esi]
004E5D70 |. C1E3 08 |||shl ebx, 8
004E5D73 |. 03C3 |||add eax, ebx
004E5D75 |. 8906 |||mov dword ptr [esi], eax
004E5D77 |. 41 |||inc ecx
004E5D78 |. 80F9 04 |||cmp cl, 4
004E5D7B |.^ 75 DD ||\jnz short 004E5D5A
004E5D7D |. FE45 F2 ||inc byte ptr [ebp-E]
004E5D80 |. 83C6 04 ||add esi, 4
004E5D83 |. 807D F2 00 ||cmp byte ptr [ebp-E], 0
004E5D87 |.^ 75 CB |\jnz short 004E5D54
004E5D89 |. 81C7 00040000 |add edi, 400
004E5D8F |. 8145 E4 00040>|add dword ptr [ebp-1C], 400
004E5D96 |. FE4D F3 |dec byte ptr [ebp-D]
004E5D99 |.^ 75 B0 \jnz short 004E5D4B
004E5D9B |. C645 F2 01 mov byte ptr [ebp-E], 1
004E5D9F |. C645 F3 12 mov byte ptr [ebp-D], 12
004E5DA3 |. 8B45 F4 mov eax, dword ptr [ebp-C]
004E5DA6 |> 33F6 /xor esi, esi
004E5DA8 |. B1 04 |mov cl, 4
004E5DAA |> 33D2 |/xor edx, edx
004E5DAC |. 8A55 F2 ||mov dl, byte ptr [ebp-E]
004E5DAF |. 8B5D FC ||mov ebx, dword ptr [ebp-4]
004E5DB2 |. 0FB65413 FF ||movzx edx, byte ptr [ebx+edx-1]
004E5DB7 |. C1E6 08 ||shl esi, 8
004E5DBA |. 0BD6 ||or edx, esi
004E5DBC |. 8BF2 ||mov esi, edx
004E5DBE |. FE45 F2 ||inc byte ptr [ebp-E]
004E5DC1 |. 33D2 ||xor edx, edx
004E5DC3 |. 8A55 F2 ||mov dl, byte ptr [ebp-E]
004E5DC6 |. 3B55 F8 ||cmp edx, dword ptr [ebp-8]
004E5DC9 |. 7E 04 ||jle short 004E5DCF
004E5DCB |. C645 F2 01 ||mov byte ptr [ebp-E], 1
004E5DCF |> FEC9 ||dec cl
004E5DD1 |.^ 75 D7 |\jnz short 004E5DAA
004E5DD3 |. 3130 |xor dword ptr [eax], esi
004E5DD5 |. 83C0 04 |add eax, 4
004E5DD8 |. FE4D F3 |dec byte ptr [ebp-D]
004E5DDB |.^ 75 C9 \jnz short 004E5DA6
004E5DDD |. 33C0 xor eax, eax
004E5DDF |. 8945 EC mov dword ptr [ebp-14], eax
004E5DE2 |. 33C0 xor eax, eax
004E5DE4 |. 8945 E8 mov dword ptr [ebp-18], eax
004E5DE7 |. C645 F3 01 mov byte ptr [ebp-D], 1
004E5DEB |> 8B45 08 /mov eax, dword ptr [ebp+8]
004E5DEE |. 50 |push eax
004E5DEF |. 8B4D F4 |mov ecx, dword ptr [ebp-C]
004E5DF2 |. 8D55 E8 |lea edx, dword ptr [ebp-18]
004E5DF5 |. 8D45 EC |lea eax, dword ptr [ebp-14]
004E5DF8 |. E8 D3000000 |call 004E5ED0
004E5DFD |. 33C0 |xor eax, eax
004E5DFF |. 8A45 F3 |mov al, byte ptr [ebp-D]
004E5E02 |. 03C0 |add eax, eax
004E5E04 |. 8B55 F4 |mov edx, dword ptr [ebp-C]
004E5E07 |. 8B4D EC |mov ecx, dword ptr [ebp-14]
004E5E0A |. 894C82 F8 |mov dword ptr [edx+eax*4-8], ecx
004E5E0E |. 8B55 F4 |mov edx, dword ptr [ebp-C]
004E5E11 |. 8B4D E8 |mov ecx, dword ptr [ebp-18]
004E5E14 |. 894C82 FC |mov dword ptr [edx+eax*4-4], ecx
004E5E18 |. FE45 F3 |inc byte ptr [ebp-D]
004E5E1B |. 807D F3 0A |cmp byte ptr [ebp-D], 0A
004E5E1F |.^ 75 CA \jnz short 004E5DEB
004E5E21 |. C645 F2 04 mov byte ptr [ebp-E], 4
004E5E25 |. 8B5D 08 mov ebx, dword ptr [ebp+8]
004E5E28 |. 81C3 00040000 add ebx, 400
004E5E2E |> C645 F3 00 /mov byte ptr [ebp-D], 0
004E5E32 |> 8B45 08 |mov eax, dword ptr [ebp+8]
004E5E35 |. 50 |push eax
004E5E36 |. 8B4D F4 |mov ecx, dword ptr [ebp-C]
004E5E39 |. 8D55 E8 |lea edx, dword ptr [ebp-18]
004E5E3C |. 8D45 EC |lea eax, dword ptr [ebp-14]
004E5E3F |. E8 8C000000 |call 004E5ED0
004E5E44 |. 33C0 |xor eax, eax
004E5E46 |. 8A45 F3 |mov al, byte ptr [ebp-D]
004E5E49 |. 03C0 |add eax, eax
004E5E4B |. 8B55 EC |mov edx, dword ptr [ebp-14]
004E5E4E |. 899483 00FCFF>|mov dword ptr [ebx+eax*4-400], edx
004E5E55 |. 8B55 E8 |mov edx, dword ptr [ebp-18]
004E5E58 |. 899483 04FCFF>|mov dword ptr [ebx+eax*4-3FC], edx
004E5E5F |. FE45 F3 |inc byte ptr [ebp-D]
004E5E62 |. 807D F3 80 |cmp byte ptr [ebp-D], 80
004E5E66 |.^ 75 CA |jnz short 004E5E32
004E5E68 |. 81C3 00040000 |add ebx, 400
004E5E6E |. FE4D F2 |dec byte ptr [ebp-E]
004E5E71 |.^ 75 BB \jnz short 004E5E2E
004E5E73 |. 5F pop edi
004E5E74 |. 5E pop esi
004E5E75 |. 5B pop ebx
004E5E76 |. 8BE5 mov esp, ebp
004E5E78 |. 5D pop ebp
004E5E79 \. C2 0400 retn 4
[培训]《安卓高级研修班(网课)》月薪三万计划，掌
握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
