dialogboxparamdialogboxparam
认识各语言的入口特征及加壳后的识别判断,及加密与压缩壳识别
C++
00408027 >/$ 55 push ebp
00408028 |. 8BEC mov ebp,esp
0040802A |. 6A FF push -0x1
0040802C |. 68 F0F14000 push C++.0040F1F0
00408031 |. 68 84AF4000 push C++.0040AF84 ; SE 处理程序安装
00408036 |. 64:A1 00000000 mov eax,dword ptr fs:[0]
0040803C |. 50 push eax
0040803D |. 64:8925 000000>mov dword ptr fs:[0],esp
00408044 |. 83EC 58 sub esp,0x58
00408047 |. 53 push ebx
00408048 |. 56 push esi
00408049 |. 57 push edi ; ntdll.7C930228
0040804A |. 8965 E8 mov [local.6],esp
0040804D |. FF15 E4F04000 call dword ptr ds:[; kernel32.GetVersion
00408053 |. 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet
00408055 |. 8AD4 mov dl,ah
00408057 |. 8915 D06B4100 mov dword ptr ds:[0x416BD0],edx ; ntdll.KiFastSystemCallRet
0040805D |. 8BC8 mov ecx,eax
0040805F |. 81E1 FF000000 and ecx,0xFF
00408065 |. 890D CC6B4100 mov dword ptr ds:[0x416BCC],ecx
0040806B |. C1E1 08 shl ecx,0x8
C++的入口函数GetVersion
C++的字符串采用ASCII码查找
C++的按钮事件采用查找SUB EAX,0A
汇编的入口
0040285E >/$ 6A 00 push 0x0 ; /pModule = NULL
00402860 |. E8 970B0000 call ; \GetModuleHandleA
00402865 |. A3 28544000 mov dword ptr ds:[0x405428],eax
0040286A |. E8 F50C0000 call ; [InitCommonControls
0040286F |. 68 9D334000 push 汇编.0040339D ; /pTopLevelFilter = 汇编.0040339D
00402874 |. E8 F50B0000 call ; \SetUnhandledExceptionFilter
本文来自电脑杂谈,转载请注明本文网址:
http://www.pc-fly.com/a/jisuanjixue/article-33496-1.html