我是新手,在大家的帮助下,把准备破解的软件(其中包含几个upx壳的.exe和.dll文件)用UPXShellEx_1RC8_SC成功脱壳,在调试的时候,该软件弹出一个显示信息的窗口,然后会在以下代码中循环,
00402CF9 BD 01000000 MOV EBP,1
00402CFE 33DB XOR EBX,EBX
00402D00 85ED TEST EBP,EBP
00402D02 74 22 JE SHORT qwfy.00402D26
00402D04 6A 00 PUSH 0
00402D06 6A 00 PUSH 0
00402D08 6A 00 PUSH 0
00402D0A 6A 00 PUSH 0
00402D0C 56 PUSH ESI
00402D0D FF15 E0E44300 CALL DWORD PTR DS:[<&USER32.PeekMessageA>; USER32.PeekMessageA
00402D13 85C0 TEST EAX,EAX
00402D15 75 0F JNZ SHORT qwfy.00402D26
00402D17 8B07 MOV EAX,DWORD PTR DS:[EDI]
00402D19 53 PUSH EBX
00402D1A 8BCF MOV ECX,EDI
00402D1C FF50 04 CALL DWORD PTR DS:[EAX+4]
00402D1F 43 INC EBX
00402D20 85C0 TEST EAX,EAX
00402D22 ^75 E0 JNZ SHORT qwfy.00402D04
00402D24 33ED XOR EBP,EBP
00402D26 6A 00 PUSH 0
00402D28 6A 00 PUSH 0
00402D2A 6A 00 PUSH 0
00402D2C 56 PUSH ESI
00402D2D FF15 E4E44300 CALL DWORD PTR DS:[<&USER32.GetMessageA>>; USER32.GetMessageA
00402D33 83F8 FF CMP EAX,-1
00402D36 ^74 C8 JE SHORT qwfy.00402D00
00402D38 85C0 TEST EAX,EAX
00402D3A 74 3A JE SHORT qwfy.00402D76
00402D3C 8B17 MOV EDX,DWORD PTR DS:[EDI]
00402D3E 56 PUSH ESI
00402D3F 8BCF MOV ECX,EDI
00402D41 FF12 CALL DWORD PTR DS:[EDX]
00402D43 85C0 TEST EAX,EAX
00402D45 75 0E JNZ SHORT qwfy.00402D55
00402D47 56 PUSH ESI
00402D48 FF15 E8E44300 CALL DWORD PTR DS:[<&USER32.TranslateMes>; USER32.TranslateMessage
00402D4E 56 PUSH ESI
00402D4F FF15 ECE44300 CALL DWORD PTR DS:[<&USER32.DispatchMess>; USER32.DispatchMessageA
00402D55 8B47 20 MOV EAX,DWORD PTR DS:[EDI+20]
00402D58 3D 18010000 CMP EAX,118
00402D5D 77 0E JA SHORT qwfy.00402D6D
00402D5F ^74 9F JE SHORT qwfy.00402D00
00402D61 83F8 0F CMP EAX,0F
00402D64 ^74 9A JE SHORT qwfy.00402D00
00402D66 3D A0000000 CMP EAX,0A0
00402D6B EB 05 JMP SHORT qwfy.00402D72
00402D6D 3D 00020000 CMP EAX,200
00402D72 ^74 8C JE SHORT qwfy.00402D00
00402D74 ^EB 83 JMP SHORT qwfy.00402CF9
如果此处没有设置断点,程序会调用另外的hook.dll和XXX.exe,不知道怎样能够跟踪hook.dll和XXX.exe中的代码,请知道的兄弟帮帮忙喽,先谢谢了!
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
