常见程序OEP处代码整理Word下载.docx

1、00496EC7 |. 64:A1 0000000MOV EAX,DWORD PTR FS:000496ECD |. 50 PUSH EAX00496ECE |. 64:8925 00000MOV DWORD PTR FS:0,ESP00496ED5 |. 83EC 58 SUB ESP,58Microsoft Visual C+ 6.0 Overlay E语言00403831 /$ 55 PUSH EBP00403832 |. 8BEC MOV EBP,ESP00403834 |. 6A FF PUSH -100403836 |. 68 F0624000 PUSH Nisy521.00406

2、2F00040383B |. 68 A44C4000 PUSH Nisy521.00404CA4 ;00403840 |. 64:00403846 |. 50 PUSH EAX00403847 |. 64:Microsoft Visual Basic 5.0 / 6.000401FBC 68 D0D44000 push dumped_.0040D4D000401FC1 E8 EEFFFFFF call 00401FC6 0000 add byte ptr ds:eax,al00401FC8 0000 add byte ptr ds:00401FCA 0000 add byte ptr ds:0

3、0401FCC 3000 xor byte ptr ds:00401FCE 0000 add byte ptr ds:BC+0040163C $ /EB 10 JMP SHORT BCLOCK.0040164E0040163E |66 DB 66 ; CHAR f0040163F |62 DB 62 ;b00401640 |3A DB 3A ;:00401641 |43 DB 43 ;C00401642 |2B DB 2B ;+00401643 |2B DB 2B ;00401644 |48 DB 48 ;H00401645 |4F DB 4F ;O00401646 |4F DB 4F ;00

4、401647 |4B DB 4B ;K00401648 |90 NOP00401649 |E9 DB E90040164A . |98E04E00 DD OFFSET BCLOCK._CPPdebugHook0040164E A1 8BE04E00 MOV EAX,DWORD PTR DS:4EE08B00401653 . C1E0 02 SHL EAX,200401656 . A3 8FE04E00 MOV DWORD PTR DS:4EE08F,EAX0040165B . 52 PUSH EDX0040165C . 6A 00 PUSH 0 ; /pModule = NULL0040165

5、E . E8 DFBC0E00 CALL ; GetModuleHandleA00401663 . 8BD0 MOV EDX,EAXDasm:00401000 /$ 6A 00 PUSH 0 ;00401002 |. E8 C50A0000 CALL 00401007 |. A3 0C354000 MOV DWORD PTR DS:40350C,EAX0040100C |. E8 B50A0000 CALL GetCommandLineA00401011 |. A3 10354000 MOV DWORD PTR DS:403510,EAX00401016 |. 6A 0A PUSH 0A ;

6、/Arg4 = 0000000A00401018 |. FF35 10354000 PUSH DWORD PTR DS:403510 ; |Arg3 = 000000000040101E |. 6A 00 PUSH 0 ; |Arg2 = 0000000000401020 |. FF35 0C354000 PUSH DWORD PTR DS:40350C ; |Arg1 = 00000000Borland Delphi 6.0 - 7.0 （³õEcirc;frac14; cpu Ñiexcl;Ocirc;ntilde;） SE ´brvbar

7、;Agrave;Igrave;ETH;sup2;Microsoft Visual C+ 6.0 Overlay EÓiuml;Borland C+（EB1066623A）0040163C B /EB 10 jmp short Borland_.0040164E0040163E |66623A bound di,dword ptr ds:edx00401641 |43 inc ebx00401642 |2B2B sub ebp,dword ptr ds:ebx00401644 |48 dec eax00401645 |4F dec edi00401646 |4F dec edi00

8、401647 |4B dec ebx00401648 |90 nop00401649 -|E9 98E04E00 jmp SHELL32.008EF6E60040164E A1 8BE04E00 mov eax,dword ptr ds:00401653 C1E0 02 shl eax,200401656 A3 8FE04E00 mov dword ptr ds:4EE08F,eax0040165B 52 push edx0040165C 6A 00 push 00040165E E8 DFBC0E00 call 55 push ebp00458651 8BEC mov ebp,esp0045

9、8653 83C4 F0 add esp,-1000458656 B8 70844500 mov eax,Delphi.004584700045865B E8 00D6FAFF call Delphi.00405C6000458660 A1 58A14500 mov eax,dword ptr ds:45A15800458665 8B00 mov eax,dword ptr ds:eax00458667 E8 E0E1FFFF call Delphi.0045684C0045866C A1 58A14500 mov eax,dword ptr ds:00458671 8B00 mov eax,

10、dword ptr ds:00458673 BA B0864500 mov edx,Delphi.004586B000458678 E8 DFDDFFFF call Delphi.0045645C0045867D 8B0D 48A24500 mov ecx,dword ptr ds:45A248 ; Delphi.0045BC0000458683 A1 58A14500 mov eax,dword ptr ds:00458688 8B00 mov eax,dword ptr ds:0045868A 8B15 EC7D4500 mov edx,dword ptr ds:457DEC ; Delp

11、hi.00457E3800458690 E8 CFE1FFFF call Delphi.0045686400458695 A1 58A14500 mov eax,dword ptr ds:0045869A 8B00 mov eax,dword ptr ds:0045869C E8 43E2FFFF call Delphi.004568E4Visual C+（558BEC6AFF68）0046C07B U0046C07C 8BEC mov ebp,esp0046C07E 6A FF push -10046C080 68 18064C00 push UltraSna.004C06180046C08

12、5 68 F8364700 push UltraSna.004736F80046C08A 64:A1 00000000 mov eax,dword ptr fs:0046C090 50 push eax0046C091 64:8925 00000000 mov dword ptr fs:0,esp0046C098 83EC 58 sub esp,580046C09B 53 push ebx0046C09C 56 push esi0046C09D 57 push edi0046C09E 8965 E8 mov dword ptr ss:ebp-18,esp0046C0A1 FF15 74824A

13、00 call dword ptr ds: ; kernel32.GetVersion 获取windown版本0046C0A7 33D2 xor edx,edx0046C0A9 8AD4 mov dl,ah0046C0AB 8915 403F4F00 mov dword ptr ds:4F3F40,edx0046C0B1 8BC8 mov ecx,eax0046C0B3 81E1 FF000000 and ecx,0FF0046C0B9 890D 3C3F4F00 mov dword ptr ds:4F3F3C,ecx汇编（6A00E8C50A0000） 6A 00 push 00040100

14、2 E8 C50A0000 call 00401007 A3 0C354000 mov dword ptr ds:40350C,eax0040100C E8 B50A0000 call 00401011 A3 10354000 mov dword ptr ds:403510,eax00401016 6A 0A push 0A00401018 FF35 10354000 push dword ptr ds:4035100040101E 6A 00 push 000401020 FF35 0C354000 push dword ptr ds:40350C00401026 E8 06000000 c

15、all 汇编.004010310040102B 50 push eax0040102C E8 8F0A0000 call 00401031 55 push ebp00401032 8BEC mov ebp,esp00401034 83C4 B0 add esp,-5000401037 C745 D0 30000000 mov dword ptr ss:ebp-30,300040103E C745 D4 0B000000 mov dword ptr ss:ebp-2C,0B00401045 C745 D8 37114000 mov dword ptr ss:ebp-28,汇编.00401137V

16、B0040116C V/$ 68 147C4000 push VB.00407C1400401171 |. E8 F0FFFFFF call 00401176 |. 0000 add byte ptr ds:00401178 |. 0000 add byte ptr ds:0040117A |. 0000 add byte ptr ds:0040117C |. 3000 xor byte ptr ds:易语言入口 E8 06000000 call dump_.0040100B00401005 50 push eax00401006 E8 BB010000 call 0040100B 55 push ebp0040100C 8BEC mov ebp,esp0040100E 81C4 F0FEFFFF add esp,-11000401014 E9 83000000 jmp dump_.0040109C00401019 6B72 6E 6C imul esi,dword ptr ds:edx+6E,6C0040101D 6E outs dx,byte ptr es:edi也可能是这样的入口（558BEC6AFF68）00403834 |. 6A FF P