讨论
| fxyang 写道: | tr> <tr>我在OD中在OEP中直接dump下来就可以运行，不需要修复，加壳的regedt32.exe 也可以用同样的方法。
另外Krypton 0.5的主程序我也用同样的方法脱出来了。 |
tr>
嘿嘿,这样用OD直接DUMP出来Krypton 0.5的主程序,可以运行?不会吧........主程序可是有K-LOCK的啊.在它的说明书这样写道:
; -------------------------------------------------------------------------
Programmer code for manual K-Execution :
; -------------------------------------------------------------------------
db 0ebh,0eh
db 'KDES'
db 00,00,00,00,00
db 00,00,00,00,00
;这里放上你的代码
db 0ebh,0eh
db 'KDEE'
db 00,00,00,00,00
db 00,00,00,00,00
The KDES code indicates the beginning of the K-Execution, it means that
this part once executed will be deleted.
The KDEE code must be placed at the end of the routine which shall be
included into the K-Execution.
; -------------------------------------------------------------------------
db 0ebh,0eh
db 'KEES'
db 00,00,00,00,00
db 00,00,00,00,00
;这里放上你的代码
db 0ebh,0eh
db 'KEEE'
db 00,00,00,00,00
db 00,00,00,00,00
The KEES code indicates the beginning of the K-Execution, it means that
this part of the code once executed will NOT be deleted (it can be used
more than once then).
当你在入口点DUMP的时候,程序代码还没有完全解压缩完啊!我想这样DUMP出来的程序一定不能运行吧.就算是引入表修复了也是不能运行的.当程序运行到上面的K-EXE代码的时候,它会跳到壳中去再次解压缩,所以我说要如果不是自己写一个程序来解压缩代码的话,是不可能脱壳的.
