直接用OD发现调试器,附加时会结束程序,发现下面的一程序就结束:
00401548 > \6A 00 push 0x0
0040154A . 68 00574400 push dumped.00445700 ; icu_dbgpe--diyollydbgodbydykWinDbgFrameClass
0040154F . FFD6 call esi
00401551 . 85C0 test eax,eax
00401553 .^ 75 EF jnz short dumped.00401544
00401555 . 50 push eax
00401556 . 68 08574400 push dumped.00445708 ; pe--diyollydbgodbydykWinDbgFrameClass
0040155B . FFD6 call esi
0040155D . 85C0 test eax,eax
0040155F .^ 75 E3 jnz short dumped.00401544
00401561 . 50 push eax
00401562 . 68 10574400 push dumped.00445710 ; ollydbgodbydykWinDbgFrameClass
00401567 . FFD6 call esi
00401569 . 85C0 test eax,eax
0040156B .^ 75 D7 jnz short dumped.00401544
0040156D . 50 push eax
0040156E . 68 18574400 push dumped.00445718 ; odbydykWinDbgFrameClass
00401573 . FFD6 call esi
00401575 . 85C0 test eax,eax
00401577 .^ 75 CB jnz short dumped.00401544
00401579 . 50 push eax
0040157A . 68 20574400 push dumped.00445720 ; WinDbgFrameClass
0040157F . FFD6 call esi
00401581 . 85C0 test eax,eax
00401583 .^ 75 BF jnz short dumped.00401544
00401585 . 50 push eax
00401586 . 68 34574400 push dumped.00445734 ; TDeDeMainForm
0040158B . FFD6 call esi
0040158D . 85C0 test eax,eax
0040158F .^ 75 B3 jnz short dumped.00401544
00401591 . 50 push eax
00401592 . 68 44574400 push dumped.00445744 ; TIdaWindow
00401597 . FFD6 call esi
00401599 . 85C0 test eax,eax
0040159B .^ 75 A7 jnz short dumped.00401544
0040159D . 50 push eax
0040159E . 68 50574400 push dumped.00445750 ; TESTDBGkk1Eew75
004015A3 . FFD6 call esi
004015A5 . 85C0 test eax,eax
004015A7 .^ 75 9B jnz short dumped.00401544
004015A9 . 50 push eax
004015AA . 68 58574400 push dumped.00445758 ; kk1Eew75
004015AF . FFD6 call esi
004015B1 . 85C0 test eax,eax
004015B3 .^ 75 8F jnz short dumped.00401544
004015B5 . 50 push eax
004015B6 . 68 5C574400 push dumped.0044575C ; Eew75
004015BB . FFD6 call esi
004015BD . 85C0 test eax,eax
004015BF .^ 75 83 jnz short dumped.00401544
004015C1 . 50 push eax
004015C2 . 68 64574400 push dumped.00445764 ; Shadow
004015C7 . FFD6 call esi
004015C9 . 85C0 test eax,eax
004015CB .^ 0F85 73FFFFFF jnz dumped.00401544
004015D1 . 68 6C574400 push dumped.0044576C ; PEiD v0.94
004015D6 . 50 push eax
004015D7 . FFD6 call esi
004015D9 . 85C0 test eax,eax
004015DB .^ 0F85 63FFFFFF jnz dumped.00401544
004015E1 . 68 78574400 push dumped.00445778 ; Registry Monitor - Sysinternals:
594K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4&6M7$3W2F1N6r3g2J5L8X3q4D9M7#2)9J5k6h3y4G2L8b7`.`.
004015E6 . 50 push eax
004015E7 . FFD6 call esi
004015E9 . 85C0 test eax,eax
004015EB .^ 0F85 53FFFFFF jnz dumped.00401544
004015F1 . 68 B0574400 push dumped.004457B0 ; File Monitor - Sysinternals:
1cdK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4&6M7$3W2F1N6r3g2J5L8X3q4D9M7#2)9J5k6h3y4G2L8b7`.`.
004015F6 . 50 push eax
004015F7 . FFD6 call esi
004015F9 . 85C0 test eax,eax
004015FB .^ 0F85 43FFFFFF jnz dumped.00401544
00401601 . 68 E4574400 push dumped.004457E4 ; Import REConstructor v1.6 FINAL (C) 2001-2003
MackT/uCFDX3DRipper
00401606 . 50 push eax
00401607 . FFD6 call esi
00401609 . 85C0 test eax,eax
0040160B .^ 0F85 33FFFFFF jnz dumped.00401544
00401611 . 50 push eax
00401612 . 68 1C584400 push dumped.0044581C ; DX3DRipper
00401617 . FFD6 call esi
00401619 . 85C0 test eax,eax
0040161B .^ 0F85 23FFFFFF jnz dumped.00401544
00401621 . 68 1C584400 push dumped.0044581C ; DX3DRipper
00401626 . 50 push eax
00401627 . FFD6 call esi
00401629 . 85C0 test eax,eax
0040162B .^ 0F85 13FFFFFF jnz dumped.00401544
00401631 . 68 28584400 push dumped.00445828 ; DX3DRipper.exe
00401636 . 50 push eax
00401637 . FFD6 call esi
00401639 . 85C0 test eax,eax
0040163B .^ 0F85 03FFFFFF jnz dumped.00401544
00401641 . 50 push eax
00401642 . 68 28584400 push dumped.00445828 ; DX3DRipper.exe
00401647 . FFD6 call esi
00401649 . 85C0 test eax,eax
0040164B . 0F95C0 setne al
0040164E . 5E pop esi
0040164F . C3 retn
带壳程序:
FISH.zip
[培训]科锐逆向工程师培训第53期2025年7月8日开班!