脱Armadillo 1.xx - 2.xx
查壳Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks
<------- 25-01-2008 14:01:12 ------->
C:\Documents and Settings\LiYong\桌面\QQMobileMsg.exe
!- Protected Armadillo
Protection system (Basic)
!- <Protection Options>
Standard protection or Minimum protection
!- <Backup Key Options>
Fixed Backup Keys
!- <Compression Options>
Best/Slowest Compression
!- <Other Options>
单进程
004E0999 >/$55 PUSH EBP ;(初始 cpu 选择)
004E099A|.8BEC MOV EBP,ESP
004E099C|.6A FF PUSH -1
004E099E|.68 500C5000 PUSH QQMobile.00500C50
004E09A3|.68 80034E00 PUSH QQMobile.004E0380 ;SE 处理程序安装
004E09A8|.64:A1 0000000>MOV EAX,DWORD PTR FS:
ctrl+n
名称位于 QQMobile, 条目 58
地址=004FB184
区段=.data
类型=输入 (已知)
名称=KERNEL32.GetModuleHandleA
7C80B6A6 837D 08 00 CMP DWORD PTR SS:,0
7C80B6AA 74 18 JE SHORT kernel32.7C80B6C4断点 找返回时机
7C80B6AC FF75 08 PUSH DWORD PTR SS:
7C80B6AF E8 C0290000 CALL kernel32.7C80E074
7C80B6B4 85C0 TEST EAX,EAX
7C80B6B6 74 08 JE SHORT kernel32.7C80B6C0
0012FF34/0012FFC0
0012FF38|004E0A61返回到 QQMobile.<模块入口点>+0C8 来自 kernel32.GetModuleHandleA
0012BF20|00BEC807返回到 00BEC807 来自 kernel32.GetModuleHandleA
0012BF24|00BFD6C8ASCII "kernel32.dll"
0012BF28|00BFE67CASCII "VirtualAlloc"
0012BC98|00BD799B返回到 00BD799B 来自 kernel32.GetModuleHandleA
0012BC9C|0012BDD4ASCII "kernel32.dll"alt=f9取消断点
00BD79A9 393C06 CMP DWORD PTR DS:,EDI
00BD79AC 75 16 JNZ SHORT 00BD79C4
00BD79AE 8D85 B4FEFFFF LEA EAX,DWORD PTR SS:
00BD79B4 50 PUSH EAX
00BD79B5 FF15 CC80BF00 CALL DWORD PTR DS: ; kernel32.LoadLibraryA
00BD79BB 8B0D E011C000 MOV ECX,DWORD PTR DS:
00BD79C1 89040E MOV DWORD PTR DS:,EAX
00BD79C4 A1 E011C000 MOV EAX,DWORD PTR DS:
00BD79C9 393C06 CMP DWORD PTR DS:,EDI
00BD79CC 0F84 AD000000 JE 00BD7A7F 改 jmp
00BD7A88^\0F85 CCFEFFFF JNZ 00BD795A
00BD7A8E EB 03 JMP SHORT 00BD7A93断点
00BD7A90 D6 SALC
00BD7A91 D6 SALC
00BD79CC 0F84 AD000000 JE 00BD7A7F 改 jmp撤消
00BD7A8E EB 03 JMP SHORT 00BD7A93断点 删除断点
alt＋m
内存映射, 条目 23
地址=00401000 断点
大小=0009B000 (634880.)
属主=QQMobile 00400000
区段=CODE
类型=Imag 01001002
访问=R
初始访问=RWE
0049B434 55 PUSH EBP
0049B435 8BEC MOV EBP,ESP
0049B437 83C4 F0 ADD ESP,-10
0049B43A B8 54B14900 MOV EAX,QQMobile.0049B154
超级字串参考＋ , 条目 541
地址=00497153
反汇编=PUSH QQMobile.0049726C
文本字串=试用版
超级字串参考＋ , 条目 542
地址=004971A1
反汇编=MOV EDX,QQMobile.0049727C
文本字串=已注册！感谢您使用本软件！
00496961 E8 A2CAFFFF CALL dumped_.00493408
00496966 8B55 B8 MOV EDX,DWORD PTR SS:注册码
00496969 58 POP EAX
0049696A E8 C5E4F6FF CALL dumped_.00404E34 关键
0049696F 74 19 JE SHORT dumped_.0049698A
00496971 6A 00 PUSH 0
00496973 B9 446A4900 MOV ECX,dumped_.00496A44 ; regcode
名称位于 dumped_, 条目 174
地址=004AC394
区段=.idata
类型=输入 (已知)
名称=kernel32.GetPrivateProfileStringA ini断点
0012FD50 00000000
0012FD54 010C4044ASCII "1b8adf1d81f3d54"
0012FD58 010C55F4
0012FD5C 010C1AB8
0012FD60 010BD7A4ASCII "1b8adf1d81f3d54"
EAX 010B377C ASCII "7c223cf29737a02d9a593ccaddf359fc"
0012FD44 010B377CASCII "7c223cf29737a02d9a593ccaddf359fc"
0012FD48 010B37ACASCII "44787e44a567b431fc1112b6d7e5b797"注册码
0012FD4C 010B6874ASCII "111111111111111"
0012FD50 010C5878ASCII "111111111111111"
0012FD54 010C4044ASCII "1b8adf1d81f3d54"
cea41e1067155d78db9426759754a0c9 2.exe md5教程
脱Armadillo 1.xx - 2.xx http://www.namipan.com/d/%e8%84%b1Armadillo%201.xx%20-%202.xx.rar/2a6aec7f2afd0e125d6ea1a27e3ce97d511e42c48e60d200 真是一点都看不懂啊 有动画吗？？？？
页:
[1]