开宾馆记录可以查到吗(查开宾馆记录app安卓或苹果)
发现有MBX@XZXXXS之类的名称,而且有_BOX_区段名,可以肯定这个就是被捆绑并参与程序运行的文件(DLL),
我们下面就有把这个DLL给弄出来.
-----------------------------------------------------------------------------
②抓取捆绑的DLL。
-----------------------------------------------------------------------------
再次载入
0047EB53 > E8 00000000 call Allok_Vi.0047EB58 《停在EP处。
0047EB58 60 pushad
0047EB59 E8 4F000000 call Allok_Vi.0047EBAD
0047EB5E FD std
0047EB5F BE 208F9F0F mov esi,0F9F8F20
0047EB64 ED in eax,dx
0047EB65 ^ 7F 91 jg short Allok_Vi.0047EAF8
-----------------------------------------------------------------------------------------------
我们再验证下我刚才的猜想
BP GetFileTime ,中断后取消断点返回到
00484C92 C745 AC 0000000>mov dword ptr ss:[ebp-54],0
00484C99 EB 09 jmp short Allok_Vi.00484CA4
00484C9B 8B4D AC mov ecx,dword ptr ss:[ebp-54]
00484C9E 83C1 01 add ecx,1
00484CA1 894D AC mov dword ptr ss:[ebp-54],ecx
00484CA4 8B55 AC mov edx,dword ptr ss:[ebp-54]
00484CA7 3B55 9C cmp edx,dword ptr ss:[ebp-64]
00484CAA 0F83 E3000000 jnb Allok_Vi.00484D93
00484CB0 8B45 AC mov eax,dword ptr ss:[ebp-54]
00484CB3 C1E0 04 shl eax,4
00484CB6 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
00484CB9 8B51 04 mov edx,dword ptr ds:[ecx+4]
00484CBC 8B4D DC mov ecx,dword ptr ss:[ebp-24]
00484CBF 030C02 add ecx,dword ptr ds:[edx+eax]
--------------------------------------------------------------------------------------------------
00484CA7 3B55 9C cmp edx,dword ptr ss:[ebp-64]
堆栈 ss:[0012FBB8]=00000001 ;捆绑文件数1
edx=00000000
--------------------------------------------------------------------------------------------------
00484CBC 8B4D DC mov ecx,dword ptr ss:[ebp-24]
堆栈 ss:[0012FBF8]=003C2330, (ASCII "SkinMagic.dll") ;捆绑文件名
ecx=003C2370
---------------------------------------------------------------------------------------------------
现在我们要为下面的主程序脱壳做准备.
查找字符可以找到2个”EXECUTABLE“双击来到
0048596D 68 C40B4900 push Allok_Vi.00490BC4 ; ASCII "EXECUTABLE"
00485972 8B0D 90184900 mov ecx,dword ptr ds:[491890] ; Allok_Vi.00400108
00485978 51 push ecx
00485979 8B55 E8 mov edx,dword ptr ss:[ebp-18]
0048597C 52 push edx
004859F0 8BE5 mov esp,ebp
004859F2 5D pop ebp
(责任编辑:网络)