上面001B:0056B372处又被花,纠正一下: :a 56b372 001B:0056B372 nop 001B:0056B373 : 得到: 001B:0056B372 90 NOP 001B:0056B373 6800400000 PUSH 00004000 /* 这才是001B:0056B2FD处jz的目的地 */ 001B:0056B378 6A00 PUSH 00 001B:0056B37A 57 PUSH EDI 001B:0056B37B FF9545974000 CALL [EBP+00409745] 001B:0056B381 8BBD3C964000 MOV EDI,[EBP+0040963C] 001B:0056B387 03BDE6904000 ADD EDI,[EBP+004090E6] 001B:0056B38D 8B8D40964000 MOV ECX,[EBP+00409640] 001B:0056B393 51 PUSH ECX 001B:0056B394 57 PUSH EDI 001B:0056B395 33D2 XOR EDX,EDX 001B:0056B397 33DB XOR EBX,EBX 001B:0056B399 33F6 XOR ESI,ESI 001B:0056B39B 03FE ADD EDI,ESI 001B:0056B39D 03DE ADD EBX,ESI
上一篇:Magic Utilities 2003 脱壳手记 上
下一篇:WAREZ无形帝国(2)
|