伪装壳技术
先载入程序

00401128   ====>入口

直接找块空地方,把滚动条往下拉,看到代码都是00的就是空地了

我就选00401B9C这里吧,紧贴着上面的代码呢!

双击修改指令,写入下面的代码(抄的)

push ebp
mov ebp,esp
push -1
push 666666
push 888888
mov eax,fs:[0]
push eax
mov fs:[0],esp
pop eax
mov fs:[0],eax
pop eax
pop eax
pop eax
pop eax
mov ebp,eax
jmp 401128 ====>跳到入口,自行修改

记住最后一句是跳到真正的入口,这个程序是401128

再用LordPE来修改入口点,改成1B9C后保存

深层】伪装 PEtite 2.2 -> Ian Luck 汇编代码：
============================
伪装代码部分：
============================

mov eax,0040E000
push 004153F3
push dword ptr fs:[0]
mov dword ptr fs:[0],esp
pushfw
pushad
push eax
xor ebx,ebx
pop eax
popad
popfw
pop dword ptr fs:[0]
pop eax
jmp XXXXXXXX     '执行到程序的原有OEP

0040EC8E      B8 00E04000   MOV EAX,123.0040E000                     ;  这里了写代码

3351f363a6137843a64c170359049c2a   教程.exe
a82K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3&6S2L8h3W2H3j5h3&6Q4x3X3g2U0L8$3#2Q4x3V1k6V1i4K6u0r3i4K6t1#2c8e0c8Q4x3U0g2n7b7#2)9J5y4f1q4m8i4K6t1#2c8e0S2Q4x3U0g2m8x3#2)9J5y4e0R3#2i4K6t1#2c8e0g2Q4x3U0g2m8x3#2)9J5y4f1t1K6i4K6t1#2c8e0k6Q4x3U0f1^5b7g2)9J5y4e0R3H3i4K6t1#2c8e0k6Q4x3U0f1&6b7#2)9J5y4f1q4r3i4K6u0W2M7X3q4J5i4K6u0r3j5$3b7K6k6X3x3@1z5r3f1K6j5h3c8T1z5h3t1K6z5h3j5K6j5e0f1I4x3r3g2W2j5e0b7I4x3K6j5K6j5X3y4U0j5K6l9J5z5h3b7@1k6o6M7@1k6r3p5#2x3U0l9H3

[培训]科锐逆向工程师培训第53期2025年7月8日开班！