资源描述：
《双进程脱壳分析》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。
1、双进程脱壳分析Armadillo3.78-4.Xx->SiliconToolworksdoubleprocessunshellanalysis[quick!]Armadillo3.78-4・Xx->SiliconToolworksdoubleprocessunshellanalysis[quick!]PEIDdetectionisArmadi11o3.78-4.Xx->SiliconToolworksTheODloadercomesinhere:0050F000Ea>60pushad0050F001E800000000calleasydvdc.0050f0060050F0065
2、Dpopebp0050F007.50pusheax0050F00851pushecx0050F009OFCAbswapedx0050F00BF7D2notedx0050F00D9Cpushfd0050F00EF7D2notedx0050F010,OFCAbswapedx050f012EB0050F014,B9,B9,EBB80FEB0050f0197popes0050F01AB9ebOebmovecx,EB900FEB0050f08fdorch,bh050f021EB0050F023F2:prefixrepne:0050f024EBF5JMPshortEasyDVDC.0050
3、fOlb0050f026EBF6JMPshortEasyDVDC.0050fOle0050F028F2:prefixrepne:ex.0050f0290050F02BFDSTD0050f02c八EBE9JMPshortEasyDVDC.0050f0170050F02EF3:prefixrep:0050f02f八EBE4JMPshortEasyDVDC.0050f0150050F031FCCLD0050f032-e9d0fc98bJMP8C19FFD4050f037CAF7D1retf0D1F7Alt+EFind，zEasyDVDConverterz，-right-click-v
4、iewthename,andthenfind，/WriteProcessMemory，z-right-click-"followtheimportfunctioninthedisassemblywindow7C80220FkeBBBFFmovedi,edi7C80221155pushebp7C8022128BECmovebp,esp//hereisthebreakpoint7C80221451pushecx7C80221551pushecx7C8022168B45OCmoveax,dwordPTRss:[ebp+C]7C80221953pushebx7C80221A8B5D14
5、movebx,dwordPTRss:[ebp+14.7C80221D56pushesi7C80221E8B35B812807Cmovesi,dwordPTRds:[<&ntddll7C80222457pushedi7C8022258B7D2008movedi,dwordPTRss:[ebp+8]7C8022288945F8movdwordPTRss:[ebp-8],eax7C80222B8d4514leaeax,dwordPTRss:[ebp+14'7C80222E50pusheax7C80222F6A40push40Shift+f9runsafter7C802211F2.Th
6、enAlt+f9returnsBackhere:004ee8a5/707-joshorteasydvddc.004ee8aeIt's004EE8A7004EE8A9,jmp,短时间，0。004EE8B0004EE8ABE874FBEBF9调用FA3AE424004EE8B0EB5Fjmp短EasyDVDCo004EE911004EE8B28D55,dwordptrss:ebp-4004ee8b552推谱004EE8B66A2推2004EE8B86345e5200,按下。004EE8BD8B4510,dwordptrss:ebp+10004ee8c050推动eax004ee8b4
7、d08movecx,dwordptrss:ebp+8004EE8C48B11,dwordptrds:ecx004ee8c652推谱004EE8C7ffl510fl5100调用dwordptr:&KERNEL32O令状〉；kernel32・WriteProcessMemory004ee8cd50推动eax004年ee8ceF7D0eaxCtrl+—分析代码：变成下面的样了：004ee8a5o70/70,乔。短。004ee8a7o7C03jl短易达。004EE8AC004EE8A9,jmp,短时
