模拟跟踪+修复方法之ACProtect脱壳——完美卸载XP V9.12_安全中国

004B1BAF     81C7 A00F0000        add edi,0FA0
004B1BB5     50                   push eax
004B1BB6     B9 70170000          mov ecx,1770
004B1BBB     8DB5 05204000        lea esi,dword ptr ss:[ebp+402005]
004B1BC1     F3:A4                rep movs byte ptr es:[edi],byte ptr ds:[esi]
004B1BC3     5A                   pop edx
004B1BC4     8BF2                 mov esi,edx
004B1BC6     81C6 A00F0000        add esi,0FA0
004B1BCC     8BFE                 mov edi,esi
004B1BCE     B9 70170000          mov ecx,1770
004B1BD3     AC                   lods byte ptr ds:[esi]
004B1BD4     32C3                 xor al,bl
004B1BD6     AA                   stos byte ptr es:[edi]
004B1BD7     E2 FA                loopd short NetClean.004B1BD3
004B1BD9     8BFA                 mov edi,edx
004B1BDB     B9 E8030000          mov ecx,3E8
004B1BE0     8BC2                 mov eax,edx
004B1BE2     05 A00F0000          add eax,0FA0
004B1BE7     AB                   stos dword ptr es:[edi]
004B1BE8     83C0 06              add eax,6
004B1BEB     E2 FA                loopd short NetClean.004B1BE7
004B1BED     B9 E8030000          mov ecx,3E8
004B1BF2     8DBD 05204000        lea edi,dword ptr ss:[ebp+402005]
004B1BF8     8BC2                 mov eax,edx
004B1BFA     66:C707 FF25         mov word ptr ds:[edi],25FF
004B1BFF     8947 02              mov dword ptr ds:[edi+2],eax
004B1C02     83C7 06              add edi,6
004B1C05     83C0 04              add eax,4
004B1C08     E2 F0                loopd short NetClean.004B1BFA
004B1C0A     60                   pushad
004B1C0B     E8 00000000          call NetClean.004B1C10
004B1C10     5E                   pop esi
004B1C11     83EE 06              sub esi,6
004B1C14     B9 92000000          mov ecx,92
004B1C19     29CE                 sub esi,ecx
004B1C1B     BA 5FBEACA3          mov edx,A3ACBE5F
004B1C20     C1E9 02              shr ecx,2
004B1C23     83E9 02              sub ecx,2
004B1C26     83F9 00              cmp ecx,0
004B1C29     7C 1A                jl short NetClean.004B1C45
004B1C2B     8B048E               mov eax,dword ptr ds:[esi+ecx*4]
004B1C2E     8B5C8E 04            mov ebx,dword ptr ds:[esi+ecx*4+4]
004B1C32     33C3                 xor eax,ebx
004B1C34     C1C0 11              rol eax,11
004B1C37     03C2                 add eax,edx
004B1C39     81F2 47137A8D        xor edx,8D7A1347
004B1C3F     89048E               mov dword ptr ds:[esi+ecx*4],eax
004B1C42     49                   dec ecx
004B1C43     EB E1                jmp short NetClean.004B1C26
004B1C45     61                   popad
004B1C46     61                   popad
004B1C47     C3                   retn

现在丢失代码已经全部还原在偶新增的区段内了，跑不了了

在OEP值00445E14处下内存访问断点，F9运行程序，直达入口！DUMP出程序！重新修复输入表，正常运行！

☆☆☆☆☆  三千丈红尘   苍茫人世   吾将何处翱翔  ☆☆☆☆☆

—————————————————————————————————


         ,     _/
        /| _.-~/            \_     ,        青春都一饷
       ( /~   /              \~-._ |\
       `\\  _/                \   ~\ )          忍把浮名
   _-~~~-.)  )__/;;,.          \_  //'
  /'_,\   --~   \ ~~~-  ,;;\___(  (.-~~~-.        换了破解轻狂
`~ _( ,_..--\ (     ,;'' /    ~--   /._`\
  /~~//'   /' `~\         ) /--.._, )_  `~
  "  `~"  "      `"      /~'`\    `\\~~\
                         "     "   "~'  ""



     Cracked By 巢水工作坊——fly [OCN][FCG][NUKE]

               2003-12-15 23:00

上一页 1 2 3