我要评论
破解:
破解它可难倒了我,我用kwdsm反汇编后,半天都摸不着头脑
没有办法只有载入已加壳的notepad.exe跟踪,发现多了一段代码
0187:0040d3ea 6a30 push byte 30 //就是多了这么一段
0187:0040d3ec 8d9d4d324000 lea ebx,[ebp 0040324d] //
0187:0040d3f2 53 push ebx //
0187:0040d3f3 8d9d61324000 lea ebx,[ebp 00403261] //
0187:0040d3f9 53 push ebx //
0187:0040d3fa 6a00 push byte 00 //
0187:0040d3fc ff95d5314000 call near [ebp 004031d5] //这里弹出提示窗口
0187:0040d402 8b9565344000 mov edx,[ebp 00403465]
0187:0040d408 8b85ed314000 mov eax,[ebp 004031ed]
0187:0040d40e 03c2 add eax,edx
0187:0040d410 8944241c mov [esp 1c],eax
0187:0040d414 61 popa
0187:0040d415 50 push eax
0187:0040d416 c3 ret
再次使用kwdsm反汇编,找到
* referenced by a (u)nconditional or (c)onditional jump at addresses:
|:00402be8(c), :00402e57(c)
|
:00402faa 6a30 push 00000030 //
:00402fac 8d9d4d324000 lea ebx, dword ptr [ebp 0040324d]
:00402fb2 53 push ebx
:00402fb3 8d9d61324000 lea ebx, dword ptr [ebp 00403261]
:00402fb9 53 push ebx
:00402fba 6a00 push 00000000
:00402fbc ff95d5314000 call dword ptr [ebp 004031d5] //这断和那断多的代码不是一样吗?
:00402fc2 8b9565344000 mov edx, dword ptr [ebp 00403465]
:00402fc8 8b85ed314000 mov eax, dword ptr [ebp 004031ed]
:00402fce 03c2 add eax, edx
:00402fd0 8944241c mov dword ptr [esp 1c], eax
:00402fd4 61 popad
:00402fd5 50 push eax
:00402fd6 c3 ret
于是跳转到402e57
- 站内搜索
发表评论