答复<span class="pediy"><span class="pediy">
这段代码在Themida里是明文,早就注意到了,只是没看过ap0x的例子,所以没有想到这就是传说中的heapMagic,一直围绕着heapalloc,heapsize那里推敲,以为是调试堆那里出了问题,始终没有进展.......
01244152 8BC0 mov eax, eax
01244154 83BD D92A3509 0>cmp dword ptr [ebp+9352AD9], 1
0124415B 0F85 C3000000 jnz 01244224
01244161 83BD 7D193509 0>cmp dword ptr [ebp+935197D], 0
01244168 0F85 B6000000 jnz 01244224
0124416E 83BD B9233509 0>cmp dword ptr [ebp+93523B9], 0
01244175 0F85 A9000000 jnz 01244224
0124417B 8D85 D4BF4409 lea eax, dword ptr [ebp+944BFD4]
01244181 50 push eax
01244182 890424 mov dword ptr [esp], eax
01244185 64:FF35 0000000>push dword ptr fs:[0]
0124418C 64:8925 0000000>mov dword ptr fs:[0], esp
01244193 64:A1 30000000 mov eax, dword ptr fs:[30]
01244199 8B40 0C mov eax, dword ptr [eax+C]
0124419C B9 30000000 mov ecx, 30
012441A1 40 inc eax
012441A2 8138 EEFEEEFE cmp dword ptr [eax], FEEEFEEE
012441A8 ^ 0F85 F3FFFFFF jnz 012441A1
012441AE 49 dec ecx
012441AF ^ 0F85 ECFFFFFF jnz 012441A1
012441B5 8BC0 mov eax, eax
012441B7 83BD 85273509 0>cmp dword ptr [ebp+9352785], 0
012441BE 75 09 jnz short 012441C9
012441C0 83BD 0D103509 0>cmp dword ptr [ebp+935100D], 0
012441C7 74 13 je short 012441DC
012441C9 50 push eax
012441CA 53 push ebx
012441CB 8BC0 mov eax, eax
012441CD B8 D1040000 mov eax, 4D1
012441D2 8D9D A2734109 lea ebx, dword ptr [ebp+94173A2]
012441D8 FFD3 call ebx
012441DA 5B pop ebx
012441DB 58 pop eax
012441DC 8BC0 mov eax, eax
012441DE C785 4D1D3509 0>mov dword ptr [ebp+9351D4D], 1
012441E8 E9 2D000000 jmp 0124421A
012441ED 8B5C24 0C mov ebx, dword ptr [esp+C]
012441F1 50 push eax
012441F2 892C24 mov dword ptr [esp], ebp
012441F5 E8 00000000 call 012441FA
012441FA 5D pop ebp
012441FB 81ED E1BF4409 sub ebp, 944BFE1
01244201 8B83 B8000000 mov eax, dword ptr [ebx+B8]
01244207 8D85 01C04409 lea eax, dword ptr [ebp+944C001]
0124420D 8983 B8000000 mov dword ptr [ebx+B8], eax
01244213 5D pop ebp
01244214 B8 00000000 mov eax, 0
01244219 C3 retn
0124421A 64:8F05 0000000>pop dword ptr fs:[0]
01244221 83C4 04 add esp, 4
01244224 8BC0 mov eax, eax
01244226 83BD 85273509 0>cmp dword ptr [ebp+9352785], 0
0124422D 75 09 jnz short 01244238
0124422F 83BD 0D103509 0>cmp dword ptr [ebp+935100D], 0
01244236 74 19 je short 01244251
01244238 50 push eax
01244239 53 push ebx
0124423A 8BC0 mov eax, eax
0124423C B8 D1040000 mov eax, 4D1
01244241 8985 95283509 mov dword ptr [ebp+9352895], eax
01244247 8D9D 9C764109 lea ebx, dword ptr [ebp+941769C]
0124424D FFD3 call ebx
0124424F 5B pop ebx
01244250 58 pop eax
01244251 83BD 0D103509 0>cmp dword ptr [ebp+935100D], 0
01244258 74 17 je short 01244271
0124425A 50 push eax
0124425B 53 push ebx
0124425C B8 D1040000 mov eax, 4D1
01244261 8985 95283509 mov dword ptr [ebp+9352895], eax
01244267 8D9D 3D734109 lea ebx, dword ptr [ebp+941733D]
0124426D FFD3 call ebx
0124426F 5B pop ebx
01244270 58 pop eax
01244271 8BC0 mov eax, eax
01244273 E9 54010000 jmp 012443CC
