Shulou(Shulou.com)06/02 Report--

Big jump may jump to OEP

Beidou 1.3

1.ESP law

two。 Memory mirror image method, if there is no .rsrc case, directly find 00401000 to cut off.

3.Sfx od automatically jumps to the OEP of suspected C++.

4. Single-step tracking method

5.at GetVersion is suitable for Beidou and below 3.0.

Beidou 2.4

1.ESP 's law

two。 Memory image method

3. Single-step tracking method

4. Script stripping

Beidou 3.7

1.ESP 's law

two。 Memory mirroring

3. Single-step tracking method

After shelling

Let's turn to some articles.

Beidou 4.1 shell to shell II plus flower instruction

Http://www.2cto.com/Article/200903/36509.html

The characteristics of Beidou 3.7

Http://blog.csdn.net/xiaocaiju/article/details/6255262

NsPack3.7 analysis and static shelling machine (with source code)

Http://www.pediy.com/kssd/pediy10/94673.html

Analysis of NsPack3.7 (7.3.Update sheller and source code)

Http://www.pediy.com/kssd/pediy11/115901.html

Fast shelling method of Beidou Program Compression (nSpack) V2.0

Http://www.pediy.com/kssd/pediy07/pediy7-586.htm

Analysis of DLL shell with NsPacKV3.7 addition

Http://www.pediy.com/kssd/pediy09/pediy09-481.htm

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.