|

楼主 |
发表于 2018-1-9 05:19:35
|
显示全部楼层
00484B40 55 push ebp ; <== Original Entry Point
00484B41 8BEC mov ebp,esp
00484B43 6A FF push -0x1
00484B45 68 00BA5900 push DSPYCMEQ.0059BA00
00484B4A 68 B8774800 push DSPYCMEQ.004877B8
00484B4F 64:A1 00000000 mov eax,dword ptr fs:[0]
00484B55 50 push eax
00484B56 64:8925 0000000>mov dword ptr fs:[0],esp
00484B5D 83EC 58 sub esp,0x58
00484B60 53 push ebx
00484B61 56 push esi
00484B62 57 push edi
00484B63 8965 E8 mov dword ptr ss:[ebp-0x18],esp
00484B66 FF15 9C614A00 call dword ptr ds:[0x4A619C] ; kernel32.GetVersion
00484B6C 33D2 xor edx,edx
00484B6E 8AD4 mov dl,ah
00484B70 8915 F4B45E00 mov dword ptr ds:[0x5EB4F4],edx
00484B76 8BC8 mov ecx,eax
00484B78 81E1 FF000000 and ecx,0xFF
00484B7E 890D F0B45E00 mov dword ptr ds:[0x5EB4F0],ecx
00484B84 C1E1 08 shl ecx,0x8
00484B87 03CA add ecx,edx
00484B89 890D ECB45E00 mov dword ptr ds:[0x5EB4EC],ecx
00484B8F C1E8 10 shr eax,0x10
00484B92 A3 E8B45E00 mov dword ptr ds:[0x5EB4E8],eax
00484B97 6A 01 push 0x1
00484B99 E8 1D510000 call DSPYCMEQ.00489CBB
00484B9E 59 pop ecx
00484B9F 85C0 test eax,eax
00484BA1 75 08 jnz XDSPYCMEQ.00484BAB
后来网上找了下教程,发现有脱壳脚本这种东西,好像说这个东西就是OEP什么的了 |
|