-
-
[旧帖] [求助]新手脱ASProtect的问题 0.00雪花
-
发表于: 2008-4-5 00:32
-
对GetProcAddress下断
一路F8 F4来到这里
到这里。。。不知道怎么办了，第一次脱壳，很迷茫啊
刚刚参考
962K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4g2F1M7r3q4U0K9#2)9J5k6h3y4F1i4K6u0r3N6X3W2W2N6%4c8Z5M7X3g2S2k6q4)9J5k6i4m8Z5M7q4)9K6c8Y4c8A6k6q4)9K6c8o6t1J5x3e0M7K6i4K6t1$3k6i4S2@1M7X3q4Q4x3@1c8H3j5h3N6W2i4K6t1#2x3@1b7I4
又绕过ITA加密……然后对代码段下内存访问断点，F9F9F9……然后出错了，OD提示我什么哦，忘了，反正有‘更改EIP’几个字
文件地址：d88K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3k6K6x3Y4W2G2N6g2)9J5k6h3y4G2L8g2)9J5c8X3k6A6L8r3g2K6i4K6u0r3z5e0t1%4k6X3c8U0z5e0N6Q4x3X3b7H3x3U0j5#2i4K6u0V1x3e0q4V1k6q4)9J5k6r3t1K6j5K6q4Q4x3X3b7H3x3o6p5@1x3U0t1I4z5r3k6U0y4X3g2Q4x3V1j5`.
一路F8 F4来到这里
015F95BB MOV DWORD PTR SS:[EBP+442F11],EAX
015F95C1 POPAD
015F95C2 JNZ SHORT 015F95CC //跳转实现
015F95C4 MOV EAX,1
015F95C9 RETN 0C
015F95CC PUSH 15F1D4C
015F95D1 RETN
到这里。。。不知道怎么办了，第一次脱壳，很迷茫啊
刚刚参考
962K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4g2F1M7r3q4U0K9#2)9J5k6h3y4F1i4K6u0r3N6X3W2W2N6%4c8Z5M7X3g2S2k6q4)9J5k6i4m8Z5M7q4)9K6c8Y4c8A6k6q4)9K6c8o6t1J5x3e0M7K6i4K6t1$3k6i4S2@1M7X3q4Q4x3@1c8H3j5h3N6W2i4K6t1#2x3@1b7I4
又绕过ITA加密……然后对代码段下内存访问断点，F9F9F9……然后出错了，OD提示我什么哦，忘了，反正有‘更改EIP’几个字
文件地址：d88K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3k6K6x3Y4W2G2N6g2)9J5k6h3y4G2L8g2)9J5c8X3k6A6L8r3g2K6i4K6u0r3z5e0t1%4k6X3c8U0z5e0N6Q4x3X3b7H3x3U0j5#2i4K6u0V1x3e0q4V1k6q4)9J5k6r3t1K6j5K6q4Q4x3X3b7H3x3o6p5@1x3U0t1I4z5r3k6U0y4X3g2Q4x3V1j5`.
|
|
|---|---|
