{"id":120,"date":"2022-04-18T19:50:25","date_gmt":"2022-04-18T11:50:25","guid":{"rendered":"http:\/\/www.sangco.cn\/?p=120"},"modified":"2022-04-18T19:51:46","modified_gmt":"2022-04-18T11:51:46","slug":"oep%e5%85%a5%e5%8f%a3%e7%9a%84%e7%89%b9%e5%be%81","status":"publish","type":"post","link":"https:\/\/www.sangco.cn\/?p=120","title":{"rendered":"OEP\u5165\u53e3\u7684\u7279\u5f81"},"content":{"rendered":"

\u5165\u53e3\u7279\u5f81…………
\nMicrosoft Visual C++ 6.0<\/span>
\npush ebp
\nmov ebp, esp
\npush -1
\npush 004C0618
\npush 004736F8
\nmov eax, dword ptr fs:[0]
\npush eax
\nmov dword ptr fs:[0], esp
\nsub esp, 58
\npush ebx
\npush esi
\npush edi
\nmov [local.6], esp<\/p>\n

 <\/p>\n

Microsoft Visual Basic 5.0 \/ 6.0<\/span>
\nJMP DWORD PTR DS[<&MSVBVM60.#100>]
\nPUSH Dumped.00407C14
\nCALL <JMP.&MSVBVM60.#100>
\nADD BYTE PTR DS:[EAX],AL
\nADD BYTE PTR DS:[EAX],AL
\nADD BYTE PTR DS:[EAX],AL
\nXOR BYTE PTR DS:[EAX],AL
\nVB\u8fd8\u6709\u4e00\u79cd<\/span>
\npush Dumped.0040D4D0
\ncall <jmp.&msvbvm60.ThunRTMain>
\nadd byte ptr ds:[eax],al
\nadd byte ptr ds:[eax],al
\nadd byte ptr ds:[eax],al
\nxor byte ptr ds:[eax],al
\nadd byte ptr ds:[eax],al<\/p>\n

Borland C++<\/span>
\nJMP SHORT BCLOCK.0040164E
\nDB 66 ; CHAR ‘f’
\nDB 62 ; CHAR ‘b’
\nDB 3A ; CHAR ‘:’
\nDB 43 ; CHAR ‘C’
\nDB 2B ; CHAR ‘+’
\nDB 2B ; CHAR ‘+’
\nDB 48 ; CHAR ‘H’
\nDB 4F ; CHAR ‘O’
\nDB 4F ; CHAR ‘O’
\nDB 4B ; CHAR ‘K’
\nNOP
\nDB E9
\nDD OFFSET BCLOCK.___CPPdebugHook
\nMOV EAX,DWORD PTR DS:[4EE08B]
\nSHL EAX,2
\nMOV DWORD PTR DS:[4EE08F],EAX
\nPUSH EDX
\nPUSH 0 ; \/pModule = NULL
\nCALL <JMP.&KERNEL32.GetModuleHandleA> ; \/GetModuleHandleA
\nMOV EDX,EAX<\/p>\n

Borland Delphi 6.0 – 7.0<\/span>
\nPUSH EBP
\nMOV EBP,ESP
\nADD ESP,-14
\nPUSH EBX
\nPUSH ESI
\nPUSH EDI
\nXOR EAX,EAX
\nMOV DWORD PTR SS:[EBP-14],EAX
\nMOV EAX,Dumped.00509720
\nCALL Dumped.0040694C<\/p>\n

\u6613\u8bed\u8a00\u5165\u53e3<\/span>
\ncall Dumped.0040100B
\npush eax
\ncall <jmp.&KERNEL32.ExitProcess>
\npush ebp
\nmov ebp,esp
\nadd esp,-110
\njmp Dumped.0040109C
\nimul esi,dword ptr ds:[edx+6E],6C
\nouts dx,byte ptr es:[edi]
\n\u4e5f\u662f\u6709\u4ee4\u4e00\u79cd\u5f62\u5f0f<\/span>
\nMicrosoft Visual C++ 6.0 [Overlay]\u7684E\u8bed\u8a00
\nPUSH EBP
\nMOV EBP,ESP
\nPUSH -1
\nPUSH Dumped.004062F0
\nPUSH Dumped.00404CA4 ; SE \u5904\u7406\u7a0b\u5e8f\u5b89\u88c5
\nMOV EAX,DWORD PTR FS:[0]
\nPUSH EAX
\nMOV DWORD PTR FS:[0],ESP<\/p>\n

MASM32 \/ TASM32<\/span>
\npush 0 ; \/pModule = NULL
\ncall <jmp.&kernel32.GetModuleHandleA> ; \/GetModuleHandleA
\nmov dword ptr ds:[403000],eax
\npush 0 ; \/lParam = NULL
\npush Dumped.004010DF ; |DlgProc = dump.004010DF
\npush 0 ; |hOwner = NULL
\npush 65 ; |pTemplate = 65
\npush dword ptr ds:[403000] ; |hInst = NULL
\ncall <jmp.&user32.DialogBoxParamA> ; \/DialogBoxParamA<\/p>\n

VC8<\/span>
\ncall Dumped.004ACF97
\njmp Dumped.004A28FC
\nint 3
\nint 3
\nint 3
\nint 3
\nint 3
\nint 3
\nint 3
\nint 3
\nint 3
\nint 3
\nmov ecx,dword ptr ss:[esp+4]
\ntest ecx,3
\nje short Dumped.004A2B20
\nmov al,byte ptr ds:[ecx]
\nadd ecx,1<\/p>\n","protected":false},"excerpt":{"rendered":"

\u5165\u53e3\u7279\u5f81………… Microsoft Visual C++ 6.0 push ebp mov ebp, esp push -1 push 004C0618 push 004736F8 mov …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"topic":[],"class_list":["post-120","post","type-post","status-publish","format-standard","hentry","category-6"],"_links":{"self":[{"href":"https:\/\/www.sangco.cn\/index.php?rest_route=\/wp\/v2\/posts\/120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sangco.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sangco.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sangco.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sangco.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=120"}],"version-history":[{"count":3,"href":"https:\/\/www.sangco.cn\/index.php?rest_route=\/wp\/v2\/posts\/120\/revisions"}],"predecessor-version":[{"id":123,"href":"https:\/\/www.sangco.cn\/index.php?rest_route=\/wp\/v2\/posts\/120\/revisions\/123"}],"wp:attachment":[{"href":"https:\/\/www.sangco.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sangco.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sangco.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=120"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.sangco.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftopic&post=120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}