-
-
[旧帖] [求助]EXECryptor v.2.3.1~9 怎么脱 0.00雪花
-
发表于: 2008-12-21 11:14
-
EXECryptor v.2.3.1~9 怎么脱
一个外挂的壳EXECryptor v.2.3.1~9 是这个壳 我在网上找不到 破解这个壳的教程
我悲哀啊 有高人破解这个壳吗 ？？或者找这样的教程啊
7C921231 C3 retn ; (initial cpu selection)
7C921232 8BFF mov edi, edi
7C921234 90 nop
7C921235 90 nop
7C921236 90 nop
7C921237 90 nop
7C921238 90 nop
7C921239 > CC int3
7C92123A . C3 retn
7C92123B 90 nop
7C92123C 8BFF mov edi, edi
7C92123E 90 nop
7C92123F 90 nop
7C921240 90 nop
7C921241 90 nop
7C921242 90 nop
7C921243 /$ 8B4424 04 mov eax, dword ptr [esp+4]
7C921247 |. CC int3
7C921248 \. C2 0400 retn 4
7C92124B 90 nop
7C92124C 90 nop
7C92124D 90 nop
7C92124E 90 nop
7C92124F 90 nop
7C921250 >/$ 64:A1 1800000>mov eax, dword ptr fs:[18]
7C921256 \. C3 retn
7C921257 90 nop
7C921258 90 nop
7C921259 90 nop
7C92125A 90 nop
7C92125B 90 nop
7C92125C >/$ 57 push edi
7C92125D |. 8B7C24 0C mov edi, dword ptr [esp+C]
7C921261 |. 8B5424 08 mov edx, dword ptr [esp+8]
7C921265 |. C702 00000000 mov dword ptr [edx], 0
7C92126B |. 897A 04 mov dword ptr [edx+4], edi
7C92126E |. 0BFF or edi, edi
7C921270 |. 74 1E je short 7C921290
7C921272 |. 83C9 FF or ecx, FFFFFFFF
7C921275 |. 33C0 xor eax, eax
7C921277 |. F2:AE repne scas byte ptr es:[edi]
7C921279 |. F7D1 not ecx
7C92127B |. 81F9 FFFF0000 cmp ecx, 0FFFF
7C921281 |. 76 05 jbe short 7C921288
7C921283 |. B9 FFFF0000 mov ecx, 0FFFF
7C921288 |> 66:894A 02 mov word ptr [edx+2], cx
7C92128C |. 49 dec ecx
7C92128D |. 66:890A mov word ptr [edx], cx
7C921290 |> 5F pop edi
7C921291 \. C2 0800 retn 8
7C921294 90 nop
7C921295 90 nop
7C921296 90 nop
7C921297 90 nop
7C921298 90 nop
7C921299 >/$ 57 push edi
7C92129A |. 8B7C24 0C mov edi, dword ptr [esp+C]
7C92129E |. 8B5424 08 mov edx, dword ptr [esp+8]
7C9212A2 |. C702 00000000 mov dword ptr [edx], 0
7C9212A8 |. 897A 04 mov dword ptr [edx+4], edi
7C9212AB |. 0BFF or edi, edi
7C9212AD |. 74 1E je short 7C9212CD
7C9212AF |. 83C9 FF or ecx, FFFFFFFF
7C9212B2 |. 33C0 xor eax, eax
7C9212B4 |. F2:AE repne scas byte ptr es:[edi]
7C9212B6 |. F7D1 not ecx
7C9212B8 |. 81F9 FFFF0000 cmp ecx, 0FFFF
7C9212BE |. 76 05 jbe short 7C9212C5
7C9212C0 |. B9 FFFF0000 mov ecx, 0FFFF
7C9212C5 |> 66:894A 02 mov word ptr [edx+2], cx
7C9212C9 |. 49 dec ecx
7C9212CA |. 66:890A mov word ptr [edx], cx
7C9212CD |> 5F pop edi
7C9212CE \. C2 0800 retn 8
7C9212D1 90 nop
7C9212D2 90 nop
7C9212D3 90 nop
7C9212D4 90 nop
7C9212D5 90 nop
7C9212D6 >/$ 57 push edi
7C9212D7 |. 8B7C24 0C mov edi, dword ptr [esp+C]
7C9212DB |. 8B5424 08 mov edx, dword ptr [esp+8]
7C9212DF |. C702 00000000 mov dword ptr [edx], 0
7C9212E5 |. 897A 04 mov dword ptr [edx+4], edi
7C9212E8 |. 0BFF or edi, edi
7C9212EA |. 74 22 je short 7C92130E
7C9212EC |. 83C9 FF or ecx, FFFFFFFF
7C9212EF |. 33C0 xor eax, eax
7C9212F1 |. F2:66:AF repne scas word ptr es:[edi]
7C9212F4 |. F7D1 not ecx
7C9212F6 |. D1E1 shl ecx, 1
7C9212F8 |. 81F9 FEFF0000 cmp ecx, 0FFFE
7C9212FE |. 76 05 jbe short 7C921305
7C921300 |. B9 FEFF0000 mov ecx, 0FFFE
7C921305 |> 66:894A 02 mov word ptr [edx+2], cx
7C921309 |. 49 dec ecx
7C92130A |. 49 dec ecx
7C92130B |. 66:890A mov word ptr [edx], cx
7C92130E |> 5F pop edi
7C92130F \. C2 0800 retn 8
7C921312 90 nop
7C921313 90 nop
7C921314 90 nop
7C921315 90 nop
7C921316 90 nop
7C921317 >/$ 83EC 0C sub esp, 0C
7C92131A |. DD1424 fst qword ptr [esp]
7C92131D |. E8 238A0300 call 7C959D45
7C921322 |. E8 0D000000 call 7C921334
7C921327 |. 83C4 0C add esp, 0C
7C92132A \. C3 retn
7C92132B > 8D db 8D
7C92132C 54 db 54 ; CHAR 'T'
7C92132D 24 db 24 ; CHAR '$'
7C92132E 04 db 04
7C92132F E8 db E8
7C921330 C9 db C9
7C921331 89 db 89
7C921332 03 db 03
7C921333 00 db 00
7C921334 $ 52 push edx
7C921335 . 9B wait
7C921336 . D93C24 fstcw word ptr [esp]
7C921339 . 74 50 je short 7C92138B
7C92133B . 66:813C24 7F0>cmp word ptr [esp], 27F
7C921341 . 74 06 je short 7C921349
7C921343 . D92D 4801977C fldcw word ptr [7C970148]
7C921349 > D9FF fcos
7C92134B . 9B wait
7C92134C . DFE0 fstsw ax
7C92134E . 9E sahf
7C92134F . 7A 1D jpe short 7C92136E
7C921351 > 833D 18F7997C>cmp dword ptr [7C99F718], 0
7C921358 . 0F85 028A0300 jnz 7C959D60
7C92135E . BA 12000000 mov edx, 12
7C921363 . 8D0D 20EE997C lea ecx, dword ptr [7C99EE20]
7C921369 . E9 048A0300 jmp 7C959D72
7C92136E > DB2D 4A01977C fld tbyte ptr [7C97014A]
7C921374 . D9C9 fxch st(1)
7C921376 > D9F5 fprem1
7C921378 . 9B wait
7C921379 . DFE0 fstsw ax
7C92137B . 9E sahf
7C92137C . 7A F8 jpe short 7C921376
7C92137E . DDD9 fstp st(1)
7C921380 . D9FF fcos
7C921382 .^ EB CD jmp short 7C921351
7C921384 > E8 56890300 call 7C959CDF
7C921389 . EB 1B jmp short 7C9213A6
7C92138B > A9 FFFF0F00 test eax, 0FFFFF
7C921390 .^ 75 F2 jnz short 7C921384
7C921392 . 837C24 08 00 cmp dword ptr [esp+8], 0
7C921397 .^ 75 EB jnz short 7C921384
7C921399 . DDD8 fstp st
7C92139B . DB2D 88EE997C fld tbyte ptr [7C99EE88]
7C9213A1 . B8 01000000 mov eax, 1
7C9213A6 > 833D 18F7997C>cmp dword ptr [7C99F718], 0
7C9213AD . 0F85 AD890300 jnz 7C959D60
7C9213B3 . BA 12000000 mov edx, 12
7C9213B8 . 8D0D 20EE997C lea ecx, dword ptr [7C99EE20]
7C9213BE . E8 EE8A0300 call 7C959EB1
7C9213C3 . 5A pop edx
7C9213C4 . C3 retn
7C9213C5 90 nop
7C9213C6 90 nop
7C9213C7 90 nop
7C9213C8 90 nop
7C9213C9 90 nop
7C9213CA > $ EB 1B jmp short 7C9213E7
7C9213CC 8BFF mov edi, edi
7C9213CE 90 nop
7C9213CF 90 nop
7C9213D0 90 nop
7C9213D1 90 nop
7C9213D2 90 nop
7C9213D3 >/$ 83EC 0C sub esp, 0C
7C9213D6 |. DD1424 fst qword ptr [esp]
7C9213D9 |. E8 67890300 call 7C959D45
7C9213DE |. E8 0D000000 call 7C9213F0
7C9213E3 |. 83C4 0C add esp, 0C
7C9213E6 \. C3 retn
7C9213E7 > 8D5424 04 lea edx, dword ptr [esp+4]
7C9213EB . E8 0D890300 call 7C959CFD
7C9213F0 $ 52 push edx
7C9213F1 . 9B wait
7C9213F2 . D93C24 fstcw word ptr [esp]
7C9213F5 . 74 4C je short 7C921443
7C9213F7 . 8B4424 0C mov eax, dword ptr [esp+C]
7C9213FB . 66:813C24 7F0>cmp word ptr [esp], 27F
7C921401 . 74 06 je short 7C921409
7C921403 . D92D 4801977C fldcw word ptr [7C970148]
7C921409 > A9 0000F07F test eax, 7FF00000
7C92140E . 74 5E je short 7C92146E
7C921410 . A9 00000080 test eax, 80000000
7C921415 . 75 41 jnz short 7C921458
7C921417 > D9ED fldln2
7C921419 . D9C9 fxch st(1)
7C92141B . D9F1 fyl2x
7C92141D > 833D 18F7997C>cmp dword ptr [7C99F718], 0
7C921424 . 0F85 36890300 jnz 7C959D60
7C92142A . 8D0D 30EE997C lea ecx, dword ptr [7C99EE30]
7C921430 . BA 1A000000 mov edx, 1A
7C921435 . E9 38890300 jmp 7C959D72
7C92143A > A9 00000080 test eax, 80000000
7C92143F . 75 17 jnz short 7C921458
7C921441 .^ EB D4 jmp short 7C921417
7C921443 > A9 FFFF0F00 test eax, 0FFFFF
7C921448 . 75 1D jnz short 7C921467
7C92144A . 837C24 08 00 cmp dword ptr [esp+8], 0
7C92144F . 75 16 jnz short 7C921467
7C921451 . 25 00000080 and eax, 80000000
7C921456 .^ 74 C5 je short 7C92141D
7C921458 > DDD8 fstp st
这是OD载入以后的状况 希望有老大给我一个教程
一个外挂的壳EXECryptor v.2.3.1~9 是这个壳 我在网上找不到 破解这个壳的教程
我悲哀啊 有高人破解这个壳吗 ？？或者找这样的教程啊
7C921231 C3 retn ; (initial cpu selection)
7C921232 8BFF mov edi, edi
7C921234 90 nop
7C921235 90 nop
7C921236 90 nop
7C921237 90 nop
7C921238 90 nop
7C921239 > CC int3
7C92123A . C3 retn
7C92123B 90 nop
7C92123C 8BFF mov edi, edi
7C92123E 90 nop
7C92123F 90 nop
7C921240 90 nop
7C921241 90 nop
7C921242 90 nop
7C921243 /$ 8B4424 04 mov eax, dword ptr [esp+4]
7C921247 |. CC int3
7C921248 \. C2 0400 retn 4
7C92124B 90 nop
7C92124C 90 nop
7C92124D 90 nop
7C92124E 90 nop
7C92124F 90 nop
7C921250 >/$ 64:A1 1800000>mov eax, dword ptr fs:[18]
7C921256 \. C3 retn
7C921257 90 nop
7C921258 90 nop
7C921259 90 nop
7C92125A 90 nop
7C92125B 90 nop
7C92125C >/$ 57 push edi
7C92125D |. 8B7C24 0C mov edi, dword ptr [esp+C]
7C921261 |. 8B5424 08 mov edx, dword ptr [esp+8]
7C921265 |. C702 00000000 mov dword ptr [edx], 0
7C92126B |. 897A 04 mov dword ptr [edx+4], edi
7C92126E |. 0BFF or edi, edi
7C921270 |. 74 1E je short 7C921290
7C921272 |. 83C9 FF or ecx, FFFFFFFF
7C921275 |. 33C0 xor eax, eax
7C921277 |. F2:AE repne scas byte ptr es:[edi]
7C921279 |. F7D1 not ecx
7C92127B |. 81F9 FFFF0000 cmp ecx, 0FFFF
7C921281 |. 76 05 jbe short 7C921288
7C921283 |. B9 FFFF0000 mov ecx, 0FFFF
7C921288 |> 66:894A 02 mov word ptr [edx+2], cx
7C92128C |. 49 dec ecx
7C92128D |. 66:890A mov word ptr [edx], cx
7C921290 |> 5F pop edi
7C921291 \. C2 0800 retn 8
7C921294 90 nop
7C921295 90 nop
7C921296 90 nop
7C921297 90 nop
7C921298 90 nop
7C921299 >/$ 57 push edi
7C92129A |. 8B7C24 0C mov edi, dword ptr [esp+C]
7C92129E |. 8B5424 08 mov edx, dword ptr [esp+8]
7C9212A2 |. C702 00000000 mov dword ptr [edx], 0
7C9212A8 |. 897A 04 mov dword ptr [edx+4], edi
7C9212AB |. 0BFF or edi, edi
7C9212AD |. 74 1E je short 7C9212CD
7C9212AF |. 83C9 FF or ecx, FFFFFFFF
7C9212B2 |. 33C0 xor eax, eax
7C9212B4 |. F2:AE repne scas byte ptr es:[edi]
7C9212B6 |. F7D1 not ecx
7C9212B8 |. 81F9 FFFF0000 cmp ecx, 0FFFF
7C9212BE |. 76 05 jbe short 7C9212C5
7C9212C0 |. B9 FFFF0000 mov ecx, 0FFFF
7C9212C5 |> 66:894A 02 mov word ptr [edx+2], cx
7C9212C9 |. 49 dec ecx
7C9212CA |. 66:890A mov word ptr [edx], cx
7C9212CD |> 5F pop edi
7C9212CE \. C2 0800 retn 8
7C9212D1 90 nop
7C9212D2 90 nop
7C9212D3 90 nop
7C9212D4 90 nop
7C9212D5 90 nop
7C9212D6 >/$ 57 push edi
7C9212D7 |. 8B7C24 0C mov edi, dword ptr [esp+C]
7C9212DB |. 8B5424 08 mov edx, dword ptr [esp+8]
7C9212DF |. C702 00000000 mov dword ptr [edx], 0
7C9212E5 |. 897A 04 mov dword ptr [edx+4], edi
7C9212E8 |. 0BFF or edi, edi
7C9212EA |. 74 22 je short 7C92130E
7C9212EC |. 83C9 FF or ecx, FFFFFFFF
7C9212EF |. 33C0 xor eax, eax
7C9212F1 |. F2:66:AF repne scas word ptr es:[edi]
7C9212F4 |. F7D1 not ecx
7C9212F6 |. D1E1 shl ecx, 1
7C9212F8 |. 81F9 FEFF0000 cmp ecx, 0FFFE
7C9212FE |. 76 05 jbe short 7C921305
7C921300 |. B9 FEFF0000 mov ecx, 0FFFE
7C921305 |> 66:894A 02 mov word ptr [edx+2], cx
7C921309 |. 49 dec ecx
7C92130A |. 49 dec ecx
7C92130B |. 66:890A mov word ptr [edx], cx
7C92130E |> 5F pop edi
7C92130F \. C2 0800 retn 8
7C921312 90 nop
7C921313 90 nop
7C921314 90 nop
7C921315 90 nop
7C921316 90 nop
7C921317 >/$ 83EC 0C sub esp, 0C
7C92131A |. DD1424 fst qword ptr [esp]
7C92131D |. E8 238A0300 call 7C959D45
7C921322 |. E8 0D000000 call 7C921334
7C921327 |. 83C4 0C add esp, 0C
7C92132A \. C3 retn
7C92132B > 8D db 8D
7C92132C 54 db 54 ; CHAR 'T'
7C92132D 24 db 24 ; CHAR '$'
7C92132E 04 db 04
7C92132F E8 db E8
7C921330 C9 db C9
7C921331 89 db 89
7C921332 03 db 03
7C921333 00 db 00
7C921334 $ 52 push edx
7C921335 . 9B wait
7C921336 . D93C24 fstcw word ptr [esp]
7C921339 . 74 50 je short 7C92138B
7C92133B . 66:813C24 7F0>cmp word ptr [esp], 27F
7C921341 . 74 06 je short 7C921349
7C921343 . D92D 4801977C fldcw word ptr [7C970148]
7C921349 > D9FF fcos
7C92134B . 9B wait
7C92134C . DFE0 fstsw ax
7C92134E . 9E sahf
7C92134F . 7A 1D jpe short 7C92136E
7C921351 > 833D 18F7997C>cmp dword ptr [7C99F718], 0
7C921358 . 0F85 028A0300 jnz 7C959D60
7C92135E . BA 12000000 mov edx, 12
7C921363 . 8D0D 20EE997C lea ecx, dword ptr [7C99EE20]
7C921369 . E9 048A0300 jmp 7C959D72
7C92136E > DB2D 4A01977C fld tbyte ptr [7C97014A]
7C921374 . D9C9 fxch st(1)
7C921376 > D9F5 fprem1
7C921378 . 9B wait
7C921379 . DFE0 fstsw ax
7C92137B . 9E sahf
7C92137C . 7A F8 jpe short 7C921376
7C92137E . DDD9 fstp st(1)
7C921380 . D9FF fcos
7C921382 .^ EB CD jmp short 7C921351
7C921384 > E8 56890300 call 7C959CDF
7C921389 . EB 1B jmp short 7C9213A6
7C92138B > A9 FFFF0F00 test eax, 0FFFFF
7C921390 .^ 75 F2 jnz short 7C921384
7C921392 . 837C24 08 00 cmp dword ptr [esp+8], 0
7C921397 .^ 75 EB jnz short 7C921384
7C921399 . DDD8 fstp st
7C92139B . DB2D 88EE997C fld tbyte ptr [7C99EE88]
7C9213A1 . B8 01000000 mov eax, 1
7C9213A6 > 833D 18F7997C>cmp dword ptr [7C99F718], 0
7C9213AD . 0F85 AD890300 jnz 7C959D60
7C9213B3 . BA 12000000 mov edx, 12
7C9213B8 . 8D0D 20EE997C lea ecx, dword ptr [7C99EE20]
7C9213BE . E8 EE8A0300 call 7C959EB1
7C9213C3 . 5A pop edx
7C9213C4 . C3 retn
7C9213C5 90 nop
7C9213C6 90 nop
7C9213C7 90 nop
7C9213C8 90 nop
7C9213C9 90 nop
7C9213CA > $ EB 1B jmp short 7C9213E7
7C9213CC 8BFF mov edi, edi
7C9213CE 90 nop
7C9213CF 90 nop
7C9213D0 90 nop
7C9213D1 90 nop
7C9213D2 90 nop
7C9213D3 >/$ 83EC 0C sub esp, 0C
7C9213D6 |. DD1424 fst qword ptr [esp]
7C9213D9 |. E8 67890300 call 7C959D45
7C9213DE |. E8 0D000000 call 7C9213F0
7C9213E3 |. 83C4 0C add esp, 0C
7C9213E6 \. C3 retn
7C9213E7 > 8D5424 04 lea edx, dword ptr [esp+4]
7C9213EB . E8 0D890300 call 7C959CFD
7C9213F0 $ 52 push edx
7C9213F1 . 9B wait
7C9213F2 . D93C24 fstcw word ptr [esp]
7C9213F5 . 74 4C je short 7C921443
7C9213F7 . 8B4424 0C mov eax, dword ptr [esp+C]
7C9213FB . 66:813C24 7F0>cmp word ptr [esp], 27F
7C921401 . 74 06 je short 7C921409
7C921403 . D92D 4801977C fldcw word ptr [7C970148]
7C921409 > A9 0000F07F test eax, 7FF00000
7C92140E . 74 5E je short 7C92146E
7C921410 . A9 00000080 test eax, 80000000
7C921415 . 75 41 jnz short 7C921458
7C921417 > D9ED fldln2
7C921419 . D9C9 fxch st(1)
7C92141B . D9F1 fyl2x
7C92141D > 833D 18F7997C>cmp dword ptr [7C99F718], 0
7C921424 . 0F85 36890300 jnz 7C959D60
7C92142A . 8D0D 30EE997C lea ecx, dword ptr [7C99EE30]
7C921430 . BA 1A000000 mov edx, 1A
7C921435 . E9 38890300 jmp 7C959D72
7C92143A > A9 00000080 test eax, 80000000
7C92143F . 75 17 jnz short 7C921458
7C921441 .^ EB D4 jmp short 7C921417
7C921443 > A9 FFFF0F00 test eax, 0FFFFF
7C921448 . 75 1D jnz short 7C921467
7C92144A . 837C24 08 00 cmp dword ptr [esp+8], 0
7C92144F . 75 16 jnz short 7C921467
7C921451 . 25 00000080 and eax, 80000000
7C921456 .^ 74 C5 je short 7C92141D
7C921458 > DDD8 fstp st
这是OD载入以后的状况 希望有老大给我一个教程
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
