破解/汇编『Crack/Asm』

Protection ID v0.6.3.5 Public DECEMBER 2009

2 条评论

protectionid

Protection ID v6.3.5 – 2009.12.24
hello folks!

we are proud to present you the next and most up2date version of protection id.

it was about time to bring this to the public, as the last version was released back in march.

during development of this version we ported it over to MASM v10,

using the latest compiler & linker available at the moment.

this version of pid features highly optimized scanning routines, resulting in very fast detections smile

i.e. a 2 GB setup.exe in processed in less then 1 second (smart mode kicks in).

we tweaked nearly all scans to benefit from our new procs.

Continue Reading

病毒分析『Virus Analysis』

Win32/AutoRun.Agent.NZ 蠕虫感染文件的简单分析和修复

2 条评论

最近几天上qq总是发现nod32 蹦出个什么发现“Win32/AutoRun.Agent.NZ 蠕虫”这么个东西的提示，刚开始还以为是浏览网页留下的也没在意，今天运行其他软件的时候也发现了这么个东东才知道情况不是自己想的那么简单了。找到被感染的程序和没有感染的做了下比较发现没什么大的差距，很明显不是捆绑了，那就是添加了新代码了,用Peid查看发现程序增加了一个区段，如下图：

qq

并且修改程序入口点为增加代码的起始位置，于是每次运行程序都会先释放病毒文件然后运行，这就是为什么每次上qq都会有病毒提示了。

Continue Reading

脱壳『Unpack』

MEW 11 1.2 -> NorthFox/HCC 脱壳脚本

没有评论 
//////////////////////////////////////////////////
//  FileName    :  MEW 11 V1.0-V1.2.osc
//  Comment     :  MEW 11 V1.0-V1.2 OEP Find
//  Environment :  WinXP SP2,OllyDbg V1.10,OllyScript V0.92
//  Author      :  fly
//  WebSite     :  http://www.unpack.cn
//  Date        :  2005-10-03 20:30
//////////////////////////////////////////////////
#log

MSGYN "Plz Clear All BreakPoints  And  Set Debugging Option Ignore All Excepions Options  !"
cmp $RESULT, 0
je TryAgain

//GameStart――――――――――――――――――――――――――――――――

sti
find eip, #C30000#
cmp $RESULT, 0
je NoFind
eob Break
bp $RESULT
log $RESULT

esto
GoOn:
esto

Break:
cmp eip,$RESULT
jne GoOn
bc $RESULT
sto

//GameOver――――――――――――――――――――――――――――――――

log eip
cmt eip, "This is the OEP! Found By: fly"
MSG "Just : OEP !  Dump and Fix IAT.  Good Luck  "
ret

NoFind:
MSG "Error! Maybe It's not MEW 11 V1.0-V1.2 ! "
ret

TryAgain:
MSG " Please  Try  Again   !   "
ret
Close Menu