200541232242.htm

这次自已做的美工,可能很难看,但主要是为提高效率,这次全部生成了静态,只有一个链接查看最新文章的列表没有生成,因为我觉得没必要生成,浪费空间大小,那是一个很少用到的功能!这次去掉了很多功能,这个版本主

              <TR>
                <td width="624" bgcolor="#CCCCCC">当前位置:<a href=../../index.htm>首页</a>--><a href=../../artical/78/1.htm>黑客攻防</a>--><a href=../../artical/98/1.htm>黑客编程</a>-->显示文章内容</td><td width="176" bgcolor="#CCCCCC"><span id="liveclock"></span></td>
 </TR></TBODY></TABLE>
<table width="800" height="406"  border="1" align="center" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF">
  <tr>
    <td width="166" height="200" valign="top" scope="col"><table width="100%" height="163"  border="0" cellpadding="0" cellspacing="0">
      <tr>
        <td height="119" valign="top" scope="col"><table width="180" border="0" cellspacing="0" cellpadding="0" align="center">
  <form action="../../search.asp" method="post" name="searchLeftForm">
    <tr bgcolor="CAF6F4" align="center"> 
      <td height="25" bgcolor="#CC9900"><font color="#cc0000"><b>□ 
        站 内 搜 索 □</b></font></td>
    </tr>
    <tr align="center"> 
      <td style="line-height:150%" height=60> 请输入查询的字符串:<br>
        <input name="search" type="text" class="button1" id="search" style="width:150">
        <select name="seaguan" size="1" class="button1" id="seaguan" style="width:150">
          <option value="">==&gt; 综合查询 &lt;==</option>
          <option value="title">标题</option>
          <option value="weiyi75">作者</option>
          <option value="artical">内容</option>
          <%call getNewsBoardTree()%>
        </select>
      </td>
    </tr>
    <tr align="center"> 
      <td> 
    
        <input type="SUBMIT" name="Action" value=" 查 询 " class="button2">
        <input type="RESET" name="Clear" value=" 重 写 " class="button2">
      </td>
    </tr>
    <tr align="center"> 
      <td height="10"></td>
    </tr>
  </form>
</table></td>
      </tr>
	  <tr>
	    <td height="20"><table width="181" height="20" cellpadding="0" cellspacing="0">
	      <tr><td width="181" height="20" align="center" bgcolor="#CC9900">分类最新文章</td>
	      </tr>
		  <tr><td><a href=20054282302.htm target=_blank>ffffffffffffff</a></td></tr><tr><td><a href=20054123551.htm target=_blank>使用C语言编写提取通用she</a></td></tr><tr><td><a href=200541232242.htm target=_blank>抛砖引玉之自己动手学写脚本</a></td></tr><tr><td><a href=20053302254.htm target=_blank>Windows XP SP2</a></td></tr>
        </table></td>
	  </tr>
	  <tr>
	    <td height="20"><table width="181" height="20" cellpadding="0" cellspacing="0">
	      <tr><td width="181" height="20" align="center" bgcolor="#CC9900">分类热门文章</td>
	      </tr>
		  <tr><td><a href=20053302254.htm target=_blank>Windows XP SP2</a></td></tr><tr><td><a href=20054123551.htm target=_blank>使用C语言编写提取通用she</a></td></tr><tr><td><a href=20054282302.htm target=_blank>ffffffffffffff</a></td></tr><tr><td><a href=200541232242.htm target=_blank>抛砖引玉之自己动手学写脚本</a></td></tr>
        </table></td>
	  </tr>
    </table></td>
    <td width="628" valign="top" scope="col"><table width="100%" border="0" align="center" cellspacing="0" cellpadding="5" bordercolordark="#FFFFFF" bordercolorlight="#000000" style="word-break:break-all;">
              <tr> 
                <td width="100%"> 

                </td>
              </tr>
              <tr> 
                <td width="100%"> 
                  <div align="center">
                    <p class="style7"><SPAN class=style1>抛砖引玉之自己动手学写脚本</SPAN></p>
                    <hr size="1" color="#0a778b" width="100%">                    
                    发布时间：2005-4-1  被阅览数：<SCRIPT src="../../counter.asp?id=499"></SCRIPT>  次 作者：weiyi75					
				  </div>
                </td>
              </tr>
           
              <tr> 
                <td width="100%"><p class="style6"><P>OllyScript 是 OllyDbg调试器的一个插件。我个人认为，OllyDbg是目前最好的程序级调试器。<BR><BR>这个调试器的最大的特色之一就是她的插件体系，这是使得用户能够更为有效的扩展她的功能。<BR><BR>OllyScript 是一种通过类汇编语言的脚本，来控制OllyDbg自动运行的插件。<BR><BR>在调试程序时，常常都是仅仅为了要找到某几个关键点，而不得不做大量的重复工作。 <BR><BR>而通过使用我的脚本，您就可以做到"写一次脚本，无限使用" [write a script once and for all]。<BR><BR>具备这么多好处，你是否心动。<BR><BR>另外脚本运行可以绕过部分变态壳的时间差反跟踪。<BR><BR>国产脚本大量都是loveboom写的，垄断! 这可不行，^-^<BR><BR>一起来学写吧，需要<A href="http://hackbase.com/hacker/tool" target=_blank>工具</A>，<A href="http://hackbase.com/network/zs" target=_blank>知识</A>。<BR><BR><A href="http://hackbase.com/network/zs" target=_blank>知识</A>&nbsp;&nbsp;Ollydbg 操作等级3级以上，各种断点，按键<A href="http://hackbase.com/network/zs" target=_blank>知识</A>。<BR><BR>&nbsp; &nbsp;&nbsp; &nbsp;初级汇编，初级高级语言<A href="http://hackbase.com/hacker/program" target=_blank>编程</A>经验<BR><BR>&nbsp; &nbsp;&nbsp; &nbsp;首先写脚本自己得会手动脱这个壳<BR><BR><A href="http://hackbase.com/hacker/tool" target=_blank>工具</A>&nbsp;&nbsp;Ollydbg1.10,OllyScript 0.92&nbsp;&nbsp;Oscedit -&gt; Loveboom的作品，Dfcg高级脱壳区下载<BR><BR>本<A href="http://hackbase.com/flash" target=_blank>动画</A>以北斗程序压缩1.3脱壳-简单 作例子。<BR><BR>北斗程序压缩1.3脱壳-简单 <BR><BR>【破解作者】 №微笑一刀<BR><BR>【作者邮箱】 保密<BR><BR>【作者主页】 保密<BR><BR>【使用<A href="http://hackbase.com/hacker/tool" target=_blank>工具</A>】 OD,IMPR<BR><BR>【破解平台】 <A href="http://hackbase.com/skill/XP" target=_blank>XP</A> SP2<BR><BR>【<A href="http://down.hackbase.com/" target=_blank>软件</A>名称】 北斗程序压缩1.3<BR><BR>【下载地址】 <A href="http://www.onlinedown.com/soft/36182.htm" target="<a">_</A>blank&gt;<FONT color=#003366>http://www.onlinedown.com/soft/36182.htm</FONT></A><BR><BR>【<A href="http://down.hackbase.com/" target=_blank>软件</A>简介】 首款国产Win32(Windows95/98/2000/NT/<A href="http://hackbase.com/skill/XP" target=_blank>XP</A>/2003)EXE、DLL、OCX等PE文件压缩<A href="http://hackbase.com/hacker/tool" target=_blank>工具</A>，通过压缩<A href="http://hackbase.com/hacker" target=_blank>代码</A>、数据、相关资源使压缩能达到60-70%。特点:（1）、本<A href="http://down.hackbase.com/" target=_blank>软件</A>采用当前世界顶级的压缩算法，其极高的压缩率和极快的解压速度，极大减少可执行文件大小(压缩比通常高于Aspack、UPX等同类<A href="http://down.hackbase.com/" target=_blank>软件</A>). 压缩/加密后的程序无性能损失, 经压缩/加密的程序可以用其它第三方压缩/加密<A href="http://hackbase.com/hacker/tool" target=_blank>工具</A>再加密/压缩. 在内存中解压/解密,提高了程序的安全性,本程序支持用其它第三方<A href="http://down.hackbase.com/" target=_blank>软件</A>压缩/加密后的继续压缩/加密。（2）、能够正确处理PE文件中的共享数据、Windows<A href="http://hackbase.com/skill/XP" target=_blank>XP</A>下的向量化异常(Vectored Exception Handling，VEH).（3）、界面简洁易用，支持中英文切换、右键功能、命令行。<BR><BR>【<A href="http://down.hackbase.com/" target=_blank>软件</A>大小】 173KB<BR><BR>【加壳方式】 nSpack 1.3<BR><BR>【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享：）<BR><BR>--------------------------------------------------------------------------------<BR><BR>【破解内容】<BR><BR>载入目标以后停在这里<BR>00484375 &gt;&nbsp;&nbsp;9C&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;PUSHFD &lt;-这里<BR>00484376&nbsp; &nbsp; 60&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;PUSHAD <BR>00484377&nbsp; &nbsp; E8 00000000&nbsp; &nbsp;&nbsp;&nbsp;CALL nSpack.0048437C &lt;-走到这里以后查看ESP.可以用ESP定律,<BR>在命令行下HR ESP,来到<BR>00484599&nbsp; &nbsp; 9D&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;POPFD &lt;-这里.<BR>0048459A&nbsp;&nbsp;- E9 8002FAFF&nbsp; &nbsp;&nbsp;&nbsp;JMP nSpack.0042481F &lt;-走过去看看^<A href="http://hackbase.com/hacker/tutorial/200501319757.htm#" target=_blank>_</A>^<BR><BR>0042481F&nbsp; &nbsp;&nbsp; &nbsp;55&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 55&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'U'<BR>00424820&nbsp; &nbsp;&nbsp; &nbsp;8B&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 8B<BR>00424821&nbsp; &nbsp;&nbsp; &nbsp;EC&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB EC<BR>00424822&nbsp; &nbsp;&nbsp; &nbsp;6A&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 6A&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'j'<BR>00424823&nbsp; &nbsp;&nbsp; &nbsp;FF&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB FF<BR>00424824&nbsp; &nbsp;&nbsp; &nbsp;68&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 68&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'h'<BR>00424825&nbsp; &nbsp;&nbsp; &nbsp;C8&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB C8<BR>00424826&nbsp; &nbsp;&nbsp; &nbsp;67&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 67&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'g'<BR>00424827&nbsp; &nbsp;&nbsp; &nbsp;44&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 44&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'D'<BR>00424828&nbsp; &nbsp;&nbsp; &nbsp;00&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 00<BR>00424829&nbsp; &nbsp;&nbsp; &nbsp;68&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 68&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'h'<BR>0042482A&nbsp; &nbsp;&nbsp; &nbsp;CC&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB CC<BR>0042482B&nbsp; &nbsp;&nbsp; &nbsp;3C&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 3C&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR '&lt;'<BR>0042482C&nbsp; &nbsp;&nbsp; &nbsp;42&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 42&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'B'<BR>0042482D&nbsp; &nbsp;&nbsp; &nbsp;00&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 00<BR>0042482E&nbsp; &nbsp;&nbsp; &nbsp;64&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB 64&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;CHAR 'd'<BR>0042482F&nbsp; &nbsp;&nbsp; &nbsp;A1&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;DB A1<BR><BR>怎么是这些东东,呵呵,CTRL+A分析一下<BR><BR>0042481F&nbsp;&nbsp;/.&nbsp;&nbsp;55&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;PUSH EBP &lt;-在此DUMP<BR>00424820&nbsp;&nbsp;|.&nbsp;&nbsp;8BEC&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; MOV EBP,ESP<BR>00424822&nbsp;&nbsp;|.&nbsp;&nbsp;6A FF&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;PUSH -1<BR>00424824&nbsp;&nbsp;|.&nbsp;&nbsp;68 C8674400&nbsp; &nbsp;PUSH nSpack.004467C8<BR>00424829&nbsp;&nbsp;|.&nbsp;&nbsp;68 CC3C4200&nbsp; &nbsp;PUSH nSpack.00423CCC&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;SE handler installation<BR>0042482E&nbsp;&nbsp;|.&nbsp;&nbsp;64:A1 0000000&gt;MOV EAX,DWORD PTR FS:[0]<BR>00424834&nbsp;&nbsp;|.&nbsp;&nbsp;50&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;PUSH EAX<BR>00424835&nbsp;&nbsp;|.&nbsp;&nbsp;64:8925 00000&gt;MOV DWORD PTR FS:[0],ESP<BR>0042483C&nbsp;&nbsp;|.&nbsp;&nbsp;83EC 58&nbsp; &nbsp;&nbsp; &nbsp; SUB ESP,58<BR>0042483F&nbsp;&nbsp;|.&nbsp;&nbsp;53&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;PUSH EBX<BR>00424840&nbsp;&nbsp;|.&nbsp;&nbsp;56&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;PUSH ESI<BR>00424841&nbsp;&nbsp;|.&nbsp;&nbsp;57&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;PUSH EDI<BR>00424842&nbsp;&nbsp;|.&nbsp;&nbsp;8965 E8&nbsp; &nbsp;&nbsp; &nbsp; MOV DWORD PTR SS:[EBP-18],ESP<BR>00424845&nbsp;&nbsp;|.&nbsp;&nbsp;FF15 A0224400 CALL DWORD PTR DS:[4422A0]&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;;&nbsp;&nbsp;kernel32.GetVersion<BR><BR>出现了吧.嘿嘿.在0042481F 处DUMP.然后使用IMPR修复,在偶机器上有一个无效的.剪切掉就OK了.<BR>主程序VC编译.这个壳是二哥推荐的.压缩能力据说超过UPX和ASPACK哦<BR><BR>--------------------------------------------------------------------------------<BR>【版权声明】 本文纯属<A href="http://hackbase.com/network" target=_blank>技术</A>交流, 转载请注明作者并保持文章的完整, 谢谢!<BR><BR>Btw: 写<A href="http://hackbase.com/flash" target=_blank>动画</A>前，我也不会做脚本，但有前辈们无私的经验和<A href="http://hackbase.com/hacker/tool" target=_blank>工具</A>，怒力就可以实现任何梦想。<BR><BR>第一次要熟读<BR><BR>OllyScript0.92.txt&nbsp;&nbsp;//已经汉化<BR><BR>快速入手就是用别人写好的脚本用OSEditor.exe逐句分析每句的意思，从而可以自己写脚本。<BR><BR>脱壳脚本<BR><BR>开始<BR><BR>// NSpack 1.3 OEP Finder v0.1<BR>// by ★LOCKLOSE★&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;* //是脚本注释，这些行不会执行 <BR>// <A href="http://bbs.pediy.com/" target="<a">_</A>blank&gt;<FONT color=#003366>http://bbs.pediy.com</FONT></A><BR><BR>&nbsp;&nbsp;var addr&nbsp; &nbsp;* VAR 在脚本中，声明一个变量,必须在变量使用先声明。这句什么用途呢，看第四行<BR>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;由于不同系统用Esp定律，Esp值不同，为了使脚本通用，就得用变量保存Esp值。<BR><BR>&nbsp;&nbsp;sto&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;*&nbsp;&nbsp;相当于在OllyDbg中按 F8，单步过<BR>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; '我们看手动脱壳不也是F8两次后利用Esp定律的<BR>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;是同样的原理<BR><BR>&nbsp;&nbsp;sto&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;*&nbsp;&nbsp;相当于在OllyDbg中按 F8，单步过 <BR><BR>&nbsp;&nbsp;mov addr,esp *保存当前Esp值到变量addr中<BR><BR>&nbsp;&nbsp;bphws addr,"r" * 在指定地址，设置硬件断点。有三种模式： "r" - 读取, "w" - 写入 或者 "x" - 执行.<BR>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp; 这里是硬件访问<BR><BR>&nbsp;&nbsp;run&nbsp; &nbsp;&nbsp;&nbsp;* 相当于在OllyDbg中按 F9<BR>&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;<BR>&nbsp;&nbsp;sto&nbsp; &nbsp;&nbsp;&nbsp;*&nbsp;&nbsp;相当于在OllyDbg中按 F8，单步过 <BR><BR>&nbsp;&nbsp;sto&nbsp; &nbsp;&nbsp;&nbsp;*&nbsp;&nbsp;相当于在OllyDbg中按 F8，单步过 对比脱壳过程，是一样的<BR><BR>&nbsp;&nbsp;an eip&nbsp;&nbsp;*&nbsp;&nbsp;指定处，对<A href="http://hackbase.com/hacker" target=_blank>代码</A>进行分析。按Ctrl+A 整理<A href="http://hackbase.com/hacker" target=_blank>代码</A><BR><BR>&nbsp;&nbsp;BPHWC addr&nbsp;&nbsp;* 删除指定地址处的的硬件断点 脱完壳，当然删除临时的硬件断点了<BR><BR>&nbsp;&nbsp;MSG "You can dump it here!" * 将指定消息，显示到一个对话框 广告脚本作者,通常不建议写。<BR>&nbsp;&nbsp;<BR>&nbsp; &nbsp;我先演示一下手动脱壳，然后脚本脱壳<BR><BR>最后将脚本命名，然后保存放到脚本库里面<BR><BR>// NSpack 1.3 OEP Finder v0.1<BR>// by ★LOCKLOSE★&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;<BR>// <A href="http://bbs.pediy.com/" target="<a">_</A>blank&gt;<FONT color=#003366>http://bbs.pediy.com</FONT></A><BR><BR>&nbsp;&nbsp;var addr&nbsp; &nbsp;<BR>&nbsp;&nbsp;sto&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;<BR>&nbsp;&nbsp;sto&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;<BR>&nbsp;&nbsp;mov addr,esp <BR>&nbsp;&nbsp;bphws addr,"r"<BR>&nbsp;&nbsp;run<BR>&nbsp;&nbsp;sto<BR>&nbsp;&nbsp;sto<BR>&nbsp;&nbsp;an eip<BR>&nbsp;&nbsp;BPHWC addr<BR>&nbsp;&nbsp;MSG "You can dump it here!"<BR><BR>看清楚没有，再见!<BR></P></p>
                  <p><img src="http://www.koyee.com/images/dgg.gif" height="70" width="587">　</p></td>
              </tr>
              <tr>
                <td width="628" bordercolor="0" class="font1"><p>
                  <hr size="1" color="#0a778b" width="100%">
				  <table><tr><td width="269" align="center">上一篇:  <a href=../95/200541232013.htm title=简单更改W2K的Telnet端口>简单更改W2K的Telnet端口</a>  </td>
				  <td width="285" align="center">下一篇:  <a href=../90/200542823048.htm title=gew>gew</a></td>
				  </tr></table>

<hr size="1" color="#0a778b" width="100%">
<div align="right">  <a href="javascript:window.print()"><img src="../../images/printer.gif" width="16" height="14" border="0" align="absmiddle">打印本页</a> |  <a href="javascript:window.close()"><img src="../../images/close.gif" width="14" height="14" border="0" align="absmiddle">关闭窗口</a> </div>
<p></p></td>
              </tr>
    </table></td>
  </tr>
</table>
<TABLE height=62 cellSpacing=0 cellPadding=0 width="800" 
            align=center background=../../images/webtop_bg.gif 
            border=0>
              <TBODY>
              <TR>
                <TD><div align="center" class="style4">Copyright @ 2004-2008&nbsp; http://www.koyee.com 可以网络在线版权所有<br>
                    公司地址:江西南昌 电话:[phone] 邮编:330029<br>
                  email:[e-mail]</div></TD>
 </TR></TBODY></TABLE>
</BODY></HTML>