小弟用od手动脱壳,但是总是进行不下去,不知什么地方错了。
原地址文件是
89aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4@1N6s2m8B7i4K6u0W2j5$3!0E0i4K6u0r3x3g2)9J5k6i4u0S2M7R3`.`.
具体情况是:
00432BA2 > 60 pushad
//--- 刚载入时的入口
00432BA3 E8 00000000 call 00432BA8
//--- 近call F7 直接下运行了
00432BA8 5D pop ebp
00432BA9 81ED 06104000 sub ebp, 00401006
00432BAF 8D85 56104000 lea eax, dword ptr [ebp+401056]
00432BB5 50 push eax
00432BB6 64:FF35 0000000>push dword ptr fs:[0]
00432BBD 64:8925 0000000>mov dword ptr fs:[0], esp
00432BC4 CC int3
00432BC5 90 nop
00432BC6 64:8F05 0000000>pop dword ptr fs:[0]
00432BCD 83C4 04 add esp, 4
00432BD0 74 05 je short 00432BD7
00432BD2 75 03 jnz short 00432BD7
00432BD4 EB 07 jmp short 00432BDD
00432BD6 59 pop ecx
00432BD7 8D9D 00104000 lea ebx, dword ptr [ebp+401000]
00432BDD 53 push ebx
00432BDE 5F pop edi
00432BDF 2BFA sub edi, edx
00432BE1 57 push edi
00432BE2 8A03 mov al, byte ptr [ebx]
00432BE4 3007 xor byte ptr [edi], al
//--- 到了这里就运行不了00432BE6 43 inc ebx
00432BE7 47 inc edi
00432BE8 ^ E2 F8 loopd short 00432BE2
00432BEA 58 pop eax
00432BEB 894424 1C mov dword ptr [esp+1C], eax
00432BEF 61 popad
00432BF0 FFE0 jmp eax
00432BF2 74 60 je short 00432C54
00432BF4 75 5E jnz short 00432C54
00432BF6 EB 55 jmp short 00432C4D
00432BF8 55 push ebp
00432BF9 8BEC mov ebp, esp
00432BFB 53 push ebx
00432BFC 8B45 10 mov eax, dword ptr [ebp+10]
最好能帮小弟作个破解说明。
[培训]科锐逆向工程师培训第53期2025年7月8日开班!