CodeDoctor»á¾²Ì¬Êý¾ÝÆÊÎöÖ¸Áî¶øÇÒ×·×ÙÈ«²¿µÄ×Ô¶¯ÌøתָÁî¡£ÔÚ³ÌÐòÁ÷³Ì²»¶ÏµØÅÜÀ´ÅÜÈ¥µÄ³¡ËùÏ£¬ÕâÒ»×÷ÓÃÊÇÊ®·ÖÓÐÓõġ£µ±ËüÅöµ½²»¿ÉÒÔ×·×ÙµÄÖ¸Áîʱ£¬Ëü»áÖÕÖ¹ÆÊÎö£¬½«È«²¿ÔçÒÑÆÊÎö½áÊøµÄÖ¸Áµ½Ò»¿éÌض¨µÄÔËÐÐÄÚ´æÖÐÈ¥

ʹÓ÷½·¨

Èí¼þ¹¦ÄÜ

1.·´¸ã»ì#160;

ÔÚ·´±àÒë¶Ô»°¿òÖÐÌôÑ¡²¢ÊµÐÐÕâÌõÖ¸Áî¡£Ëü»áÊÔ׎«·ÏÆúÎïÖ¸ÁîÖб任±ä³ÉÇå³þµÄÖ¸Áî¡£#160;

¾ÙÀý˵Ã÷£º#160;

³õʼָÁ#160;

00874372 57 PUSH EDI#160;

00874373 BF 352AAF6A MOV EDI,6AAF2A35#160;

00874378 81E7 0D152A41 AND EDI,412A150D#160;

0087437E 81F7 01002A40 XOR EDI,402A0001#160;

00874384 01FB ADD EBX,EDI#160;

00874386 5F POP EDI#160;

·´¸ã»ìºó£º#160;

00874372 83C3 04 ADD EBX,4#160;

2.·´¸ã»ì-µ¥²½#160;

ÕâÌõÖ¸ÁîµÄ»ù±¾Ô­Àí¸úÉÏÃæÒ»ÑùÒ»ÌõÀàËÆ£¬µ«ÊÇËüÒ»´ÎÖ»ÆÊÎöÒ»ÌõÖ¸Áî¡£#160;

3.½«nopÖúó#160;

½«ÕâÀ෽ʽµÄ±àÂ룺#160;

00874396 50 PUSH EAX#160;

00874397 90 NOP#160;

00874398 90 NOP#160;

00874399 52 PUSH EDX#160;

0087439A BA 3F976B00 MOV EDX,somesoft.006B973F#160;

0087439F 90 NOP#160;

008742A0 90 NOP#160;

008742A1 90 NOP#160;

±ä»»Îª£º#160;

00874396 50 PUSH EAX#160;

00874397 52 PUSH EDX#160;

00874398 BA 3F976B00 MOV EDX,somesoft.006B973F#160;

0087439D 90 NOP#160;

0087439E 90 NOP#160;

0087439F 90 NOP#160;

008742A0 90 NOP#160;

008742A1 90 NOP#160;

ÏÞ¶¨£ºËü»áÌø³öÀ´È«²¿×Ô¶¯ÌøתָÁîºÍcallÖ¸Áî#160;

4.³·Ïû/ÔÙ´ÎʵÐÐ#160;

³·Ïû»òÔÙ¶ÈʵÐÐÇ°Ò»ÌõÖ¸Áî#160;

5.²éÕÒ×Ô¶¯Ìøת×÷ÓÃ#160;

Ëü»á¾²Ì¬Êý¾ÝÆÊÎöÖ¸Áî¶øÇÒ×·×ÙÈ«²¿µÄ×Ô¶¯ÌøתָÁî¡£ÔÚ³ÌÐòÁ÷³Ì²»¶ÏµØÅÜÀ´ÅÜÈ¥µÄ³¡ËùÏ£¬ÕâÒ»×÷ÓÃÊÇÊ®·ÖÓÐÓõġ£µ±ËüÅöµ½²»¿ÉÒÔ×·×ÙµÄÖ¸Áîʱ£¬Ëü»áÖÕÖ¹ÆÊÎö£¬½«È«²¿ÔçÒÑÆÊÎö½áÊøµÄÖ¸Áµ½Ò»¿éÌض¨µÄÔËÐÐÄÚ´æÖÐÈ¥¡£#160;

ÔÚÉèÖÃÖÐÉ趨ÕâÖÖÖ÷Òª²ÎÊý£º#160;

²½¹ýÈ«²¿µÄcall-¼ÙÈçÉ趨µÃ»°£¬Ëü»á²½¹ýÈ«²¿µÄcall¡£²»È»Ëü»á×·×ÙËûÃÇ¡£#160;

²½¹ýjcc-dtto£¨£¿£©#160;

·´¸ã»ì-ÔÚÅöµ½Jcc£¬RET,JMP£¬CALLÖ¸Áîʱ£¬Ëü»á·´¸ã»ìÖ¸Áî¡£ÔÚ³ÌÐòÁ÷³ÌÓжà֧ϵµÄÇé¿öÏÂÊ®·ÖÓÐÓá£#160;

¾ÙÀý˵Ã÷£º#160;

±ä»»Ç°£º#160;

00874389 /EB 05 JMP SHORT somesoft.00874390#160;

0087438B |43 INC EBX#160;

0087438C |41 INC ECX#160;

0087438D |42 INC EDX#160;

0087438E |EB 07 JMP SHORT somesoft.00874397#160;

00874390 \B8 07000000 MOV EAX,7#160;

00874395 ^ EB F4 JMP SHORT somesoft.0087438B#160;

00874397 C3 RET#160;

±ä»»ºó£º#160;

003B0000 B8 07000000 MOV EAX,7#160;

003B0005 43 INC EBX#160;

003B0006 41 INC ECX#160;

003B0007 42 INC EDX#160;

003B0008 C3 RET#160;

6.¸´½¨ÙYÔ´ºÍÖØÅÅÐò#160;

´Ë×÷ÓÃÔÚÍÉ¿ÇʱÓÐһЩÏÞ¶¨¡£Ëü´ÓÓ²ÅÌÉÏ¿ªÆô±»µ÷½ÚµÄÎĵµ¡£ËæºóÑ°ÕÒÈ«²¿µÄÙYÔ´²¢½«ËûÃǸ´½¨µ½Ò»¿éÇø¶Î£¨µ±½ñËü½«ÙYÔ´¸´½¨µ½exeÖеijõʼÇø¶ÎÖУ©¡£ËæºóËüÖØÐÂÅÅÐòÎĵµ£¬ÒÔÒ»¸öеÄÐÕÃûÀ´´¢´æÎĵµ¡£#160;

ºÎʱ´Ë×÷ÓÃÊÇÓÐÓõģ¿¾ÙÀýÀ´Ëµ£¬ÔÚÍÑapack/asprotect»òÊDZðµÄһЩ¿ÇµÄ¹ýºó¡£ÕâÖÖ¿Ç»á´Ó³õʼÇø¶ÎÖеÁȡһЩÙYÔ´£¬¶øÇÒ½«ËûÃÇÖ÷ŵ½×ÔÉíµÄÇø¶ÎÖС£´Ó¶ø»áÌáÉýÎĵµµÄ³ß´ç£¬¶øÇÒ±ÜÃâ Äã³ýÈ¥¿ÇµÄÇø¶Î¡£ÁíÍâËüÒ²±ÜÃâ Á˸ù¾ÝһЩÙYÔ´ºÚ¿ÍÈí¼þ¼ûµ½ÕâÖÖÙYÔ´¡£#160;

ÎÒÏàÐÅ»á³öÏÖ±ÈÕâÒ»Èí¼þ¸üÇ¿µÄרÓù¤¾ß£¬µ«Êǽ«ËüÈںϽøÈ¥ÓÐʱÊÇÊ®·Ö±ã½ÝµÄ¡£#160;

7.AsProctectÍÉ¿Ç#160;

´Ë×÷ÓÃÄܹ»ÍÑÕâЩ±»asprotectÔÙ¼ÓÉϿǵÄÎĵµ¶øÇÒ»Ö¸´ËûÃÇ£¬µ¼³öÀ´asprotect.dll£¬½«ÐÅÏ¢ÄÚÈÝÝ”³öµ½txtÎļþÖÐÈ¥¡£µ±´Ë×÷Óò»³É¹¦µÄÇé¿öÏ£¬ÇëµÝ½»×ÜÌåÄ¿±êÎĵµ°ïÎÒ¡£#160;

ÏÞ¶¨£º#160;

1.ÎÞ·¨ÕÒµ½ºÍ»Ö¸´SDK 1.x°æ±¾ºÅµÄº­Êý£¨ÄãÐèÒªÊÖ¶¯Ê½ÕÒÑ°ËûÃÇ£©#160;

ÕâÀïÓжþÖÖ×´¿ö¡£Ò»ÖÖÊÇÔÚOEPÒÔÇ°±»ÆôÓõĺ­Êý¡£ËûÃÇ¿ªÕ¹Ò»ÏµÁеĸ´Î»×÷Ó᣼ÙÈçËûÃDz»Ç¿ÖÆÖ´ÐУ¬³ÌÐòÁ÷³ÌºÜÓпÉÄÜ»áÌáÐÑÎÞЧ¡£Ñ°ÕÒËûÃDz¢ÊµÐÐËûÃÇ:-)#160;

µÚ¶þÖÖÊÇÔÚOEPÒÔºóʵÐеģ¬¸ù¾Ý¶ÀÌصÄÖ÷Òª²ÎÊýÑÚ²ØÔÚGetprocAddressÒÔºó£¬ÕâÖÖº­ÊýAsProtect½«ËûÃÇÔÙ´ÎתΪÀ´µ½×ÔÉíµÄ±àÂëÖС£ÄãÐèÒªÊÖ¶¯Ê½ÆÊÎöÕâÖÖ±àÂë¡£#160;

2.ÔÚ2.30-2.51ÖУ¬ÓжþÖÖ·½·¨µÄµÁÈ¡·½·¨-Ò»ÖÖΪPolyOEP·½·¨£¬Ò²ÓÐÒ»ÖÖÊÇÐéÄ⻯¼¼Êõ¡£´Ë×÷ÓÃÖ»Óлָ´Ç°ÃæÒ»ÖÖ¡£#160;

3.²»¿ÉÒÔÑ°ÕÒcrcУ¼ì»òÊÇ»ú¿Ç²éÑé¡£µ«ÊÇ´Ë×÷ÓÃÄܹ»±ÜÃâ Ò»ÖÖÖÖÀàµÄ»ú¿Ç²éÑ飺ÔÚ×Ô¶¯Ìøתµ½APIµÄÖ¸ÁîÖÐÕÒÑ°E8¡£#160;

4.Ëü²»ÈÝÒ×ÆÆÒë±»Êý¾Ý¼ÓÃܵÄÒ»²¿·Ö»òÊÇÇø¶Î¡£#160;

5.Ëü²»ÈÝÒ×Ñ°ÕÒϵÁкţ¬ÐÞ¸´Ê¹ÓðæÕâЩ¡£#160;

6.Èç¹ûÓжîÍâÊý¾ÝÐÅÏ¢µÃ»°£¬ÔÚÍɿǺóºÜÓпÉÄÜ»áË𻵡£#160;

Bugs£º#160;

²»¿ÉÒÔ¹¤×÷ÖÐÔÚÔÚһЩÌØÊâµÄ1.10°æ±¾ºÅÏ£¬ÓÐʱ¼äÎÒÄָܻ´µÄ¡£#160;

Èí¼þÎÊ´ð

ÔÚÍѱ»Asprotect 2.Xά»¤µÄÎĵµÊ±£¬ÄãºÜÓпÉÄܱØÐëaspr_ide.dll¡£´ÓÉϵõ½ ËûÃÇ£¬¼ÙÈçÐèÒªµÄ»°£¬¿ªÕ¹¸Ä¶¯¡£#160;

¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á¡Á#160;

Îĵµ±íÃ÷£º#160;

CodeDoctor.dll Ô´³ÌÐò