这个要怎么patch
用PEID0.95查不到是任何壳...看区段是写着UPX的...(估计也是忽悠人的)目标是一个dll的程序...
我没在想脱壳..我想直接patch...但是看了很多相关教程...也patch过..patch之后程序运行不起来的..
F9运行后...查看字符串看到关键的信息...
00A996D0 . /74 56 je short item30.00A99728 ;这个跳是跳向错误的..
00A996D2 . |E9 83000000 jmp item30.00A9975A ;这个跳是跳向服务器连接失败的
00A996D7 > |33C9 xor ecx,ecx ;Case 1 of switch 00A996CC
00A996D9 . |B2 01 mov dl,1
00A996DB . |A1 FC44A900 mov eax,dword ptr ds:
00A996E0 . |E8 1F1CF4FF call item30.009DB304
00A996E5 . |8B15 6C0BAA00 mov edx,dword ptr ds: ;item30.00AA56CC
00A996EB . |8902 mov dword ptr ds:,eax
00A996ED . |A1 6C0BAA00 mov eax,dword ptr ds:
00A996F2 . |8B00 mov eax,dword ptr ds:
00A996F4 . |BA BC97A900 mov edx,item30.00A997BC
00A996F9 . |E8 B283F5FF call item30.009F1AB0
00A996FE . |8BC3 mov eax,ebx
00A99700 . |E8 4F5FF4FF call item30.009DF654
00A99705 . |68 D0070000 push 7D0
00A9970A . |E8 6EE00E00 call item30.00B8777D
00A9970F . |A1 6C0BAA00 mov eax,dword ptr ds:
00A99714 . |8B00 mov eax,dword ptr ds:
00A99716 . |E8 415FF4FF call item30.009DF65C
00A9971B . |EB 6D jmp short item30.00A9978A
00A9971D |7A db 7A ;CHAR 'z'
00A9971E . |6A 53 push 53
00A99720 . |58 pop eax
00A99721 .^|E9 BAFCFFFF jmp item30.00A993E0
00A99726 . |EB 62 jmp short item30.00A9978A
00A99728 > \8B83 34030000 mov eax,dword ptr ds: ;Case 2 of switch 00A996CC
00A9972E .8B80 08020000 mov eax,dword ptr ds:
00A99734 .33D2 xor edx,edx
00A99736 .E8 A921F3FF call item30.009CB8E4
00A9973B .BA D497A900 mov edx,item30.00A997D4 ;用户名或密码错误！\r\r或本机没有绑定
00A99740 .E8 FB20F3FF call item30.009CB840
00A99745 .FF83 78030000 inc dword ptr ds:
00A9974B .8B93 78030000 mov edx,dword ptr ds:
00A99751 .8BC3 mov eax,ebx
00A99753 .E8 74FCFFFF call item30.00A993CC
00A99758 .EB 30 jmp short item30.00A9978A
00A9975A >8B83 34030000 mov eax,dword ptr ds: ;Default case of switch 00A996CC
00A99760 .8B80 08020000 mov eax,dword ptr ds:
00A99766 .33D2 xor edx,edx
00A99768 .E8 7721F3FF call item30.009CB8E4
00A9976D .BA 0098A900 mov edx,item30.00A99800 ;与服务器连接失败！
00A99772 .E8 C920F3FF call item30.009CB840
00A99777 .FF83 78030000 inc dword ptr ds:
00A9977D .8B93 78030000 mov edx,dword ptr ds:
00A99783 .8BC3 mov eax,ebx
00A99785 .E8 42FCFFFF call item30.00A993CC
00A9978A >33C0 xor eax,eax
00A9978C .5A pop edx
00A9978D .59 pop ecx
00A9978E .59 pop ecx
00A996D0 . /74 56 je short item30.00A99728 ;这个跳是跳向错误的..
00A996D2 . |E9 83000000 jmp item30.00A9975A ;这个跳是跳向服务器连接失败的
我想用补丁patch这个地方..
请各位给给思路..改怎么脱这个...
程序在这里...http://www.qiannao.com/space/show/qiannao/上传分享/2009/6/9/item30.rar/.page 对这个没有太多的研究 好像天草高级班里面说个 去看看吧
回复 2# MOV 的帖子
天草的教程我看了...搞不了我才发上来求助的.. VMProtect 1.70.4 -> *Sign by phpbb3
估计不好搞 自己再写个DLL注入这个位置~
LPK也行 lpk or loader
页:
[1]