dejunk.ini

OllyICE 1.1 反匯編工具 繁體中文版

R = 909090909090

[CODE_jmp05]

S = EB05??????????
R = 90909090909090

[CODE_jmp06]

S = EB06????????????
R = 9090909090909090

[CODE_jmp07]

S = EB07??????????????
R = 909090909090909090

[CODE_jmp08]

S = EB08????????????????
R = 90909090909090909090

[CODE_jmp09]

S = EB09??????????????????
R = 9090909090909090909090

[CODE_jmp11]

S = E901000000??
R = 909090909090

[CODE_jmp12]

S = E902000000????
R = 90909090909090

[CODE_jmp13]

S = E903000000??????
R = 9090909090909090

[CODE_jmp14]

S = E904000000????????
R = 909090909090909090

[CODE_jmp15]

S = E905000000??????????
R = 90909090909090909090


[CODE_call04]
;			call	label_1
;			db		_junkcode
;label_1:	        add	esp,4

S = E801000000??83C404
R = 909090909090909090

[CODE_telock_call02_1]

S = E802000000????3006465A
R = 9090909090909030064690

[CODE_telock_call02_2]

S = E802000000E800E8000000005E2BC9587402????
R = 90909090909090E8000000005E2BC99090909090




[CODE_call00]
;                       push    eax
;			call	label_1
;			db		_junkcode
;label_1:	        pop	eax
;                       pop     eax

S = 50E801000000??5858
R = 909090909090909090

[CODE_call01]
;			call	label_1
;			db		_junkcode
;label_1:	        add     dword ptr ss:[esp],6
;                       ret

S = E801000000??83042406C3
R = 9090909090909090909090

[CODE_call02]
;			call	label_1
;			db		_junkcode,_junkcode
;			db		_junkcode,_junkcode
;label_1:	        add	esp,4

S = E802000000????83C404
R = 90909090909090909090

[CODE_call03]
;			call	label_1
;			db		_junkcode,_junkcode
;			db		_junkcode,_junkcode
;			db		_junkcode,_junkcode
;label_1:	        add	esp,4
S = E803000000??????83C404
R = 9090909090909090909090


[CODE_clc_jnb01]
;			CLC
;			JNB 	label_1
;			db 	_junkcode
;label_1:

S = F87301??
R = 90909090

[CODE_clc_jnb02]
;			CLC
;			JNB 	label_1
;			db 	_junkcode
;			db 	_junkcode
;label_1:

S = F87302????
R = 9090909090



[CODE_slc_jb01]
;			CLC
;			JNB 	label_1
;			db 	_junkcode
;			db 	_junkcode
;label_1:

S = F97201??
R = 90909090


[CODE_slc_jb02]
;			CLC
;			JNB 	label_1
;			db 	_junkcode
;			db 	_junkcode
;label_1:

S = F97202????
R = 9090909090

[CODE_??]
;loc_3:		.....
;			jmp	loc_5
;				db	5 dup(?)
;loc_2:		pop	ecx
;			jp	loc_3
;			jmp	loc_4
;				db	1 dup(?)
;loc_4:		jnp	loc_3
;				db	1 dup(?)
;loc_1:		push	ecx
;			jmp	loc_2
;				db	7 dup(?)
;loc_0:		jmp	loc_1
;				db	? dup(?)
;loc_8:		//正常指令.....
;			jmp	loc_10
;				db	5 dup(?)
;loc_7:		pop	ecx
;			jp	loc_8
;			jmp	loc_9
;				db	1 dup(?)
;loc_9:		jnp	loc_8
;				db	1 dup(?)
;loc_6:		push	ecx
;			jmp	loc_7
;				db	7 dup(?)
;loc_5:		jmp	loc_6
;				db	? dup(?)
;loc_10:		.....

[CODE_??]
;		jmp	label
;		db	_junkcode
;label:	....
;		....

[CODE_call05]
;			call	label_1
;			db		_junkcode
;label_1:	        POP     [ESP-4]

S = E801000000??8F4424FC
R = 90909090909090909090

[CODE_call06]
;			call	label_1
;			db		_junkcode
;label_1:	        LEA     ESP, [ESP+4]

S = E801000000??8D642404
R = 90909090909090909090


/////////////////////////////////////////
/////////////////////////////////////////

ActivePatList8  =_Alex1,_Alex2,_Alex3,

[CODE_Alex1]

S = EB03EB03??EBFBE801000000??83C404
R = 90909090909090909090909090909090

[CODE_Alex2]

S = EB05??F00FC7C8
R = 90909090909090

[CODE_Alex3]

S = 85D275D661
R = ????9090??

[CODE_Alex4]

S = 0F312BC3
R = 9090????

[CODE_Alex5]

S = 0F318BD8
R = 9090????

[CODE_Alex6]

S = 0F3103C3
R = 9090????

[CODE_Alex7]

S = 0F31EB01C7
R = 9090909090

[CODE_Alex8]

S = 0F31EB01C9
R = 9090909090
/////////////////////////////////////////
/////////////////////////////////////////

[CODE_ASPR_jmp01]

S = 2EEB01??
R = 90909090


[CODE_ASPR_jmp02]

S = 65EB01??
R = 90909090


[CODE_ASPR_jmp03]

S = F2EB01??
R = 90909090


[CODE_ASPR_jmp04]

S = F3EB01??
R = 90909090


[CODE_ASPR_jmp05]

S = 26EB02????
R = 9090909090

[CODE_ASPR_jmp06]

S = 3EEB02????
R = 9090909090

[CODE_ASPR_jmp07]

S = F3EB02????
R = 9090909090

[CODE_ASPR_jmp08]

S = EB01??
R = 909090

/////////////////////////////////////////
/////////////////////////////////////////

[CODE_alex_push01]
S =60EB03EB03??EBFBE801000000??83C4040F318BD8EB03EB03??EBFBE801000000??83C4048BCAEB03EB03??EBFBE801000000??83C4040F312BC3EB03EB03??EBFBE801000000??83C4041BD10F3103C3EB03EB03??EBFBE801000000??83C40413D10F312BC3EB03EB03??EBFBE801000000??83C404EB05??????????EB03EB03??EBFBE801000000??83C4041BD1EB03EB03??EBFBE801000000??83C40485D275D661
R =909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090

[CODE_alex_call01]
S =E824000000EB01E98B44240CEB03EB03C7EBFBE801000000A883C4048380B80000000233C0EB01E9C35883C404EB03EB03C7EBFBE801000000A883C4045064FF350000000064892500000000EB01??FFFF
R =909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090

/////////////////////////////////////////
/////////////////////////////////////////
[CODE_Pes1]
;			jmp label1
;			
S =EB04??EB04??EBFB??
R =909090909090909090
[CODE_call0111]
;			call label1
;			db	_junkcode
S =E801000000??
R =E80100000090

[CODE_PESPIN1]
S =E803000000EB04??EBFB??
R =E803000000909090909090

[CODE_Pespin_jne01]
S =7501??
R =909090

[CODE_Pespin_JMP01]
S =EB04??EB04??EBFB??
R =909090909090909090

[CODE_PesPin_jmp02]
S = EB07??EB01??EB04??EBF8??
R = 909090909090909090909090

[CODE_PesPin_Call01]
S = 60E803000000??EB0A58EB01??40EB01??FFE061
R = 9090909090909090909090909090909090909090

[CODE_PesPin_Call02]
;			Call _label1
;			db _junkcode
;			db _junkcode
;			db _junkcode
;			db _junkcode
;			db _junkcode
;			db _junkcode
;			ADD SS:[ESP],0C
;			RETN
S = E803000000????????????8304240CC3??
R = 9090909090909090909090909090909090

[CODE_PesPin_jmpEsp01]
S = 5A588D642404FF6424FC??
R = 5A588D642404FF6424FC90


[CODE_PesPin_STC01]
S = F97208????F983042417C3E804000000??F57311EB06??72ED??EB07F5720EF572F8??EBEC83042407F5FF3424C3
R = 90909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090

[CODE_PesPin_STC02]
;				STC
;				JB SHORT 00404F4D
;				_Junkcode,_Junkcode
;				ADD DWORD PTR SS:[ESP],17
;				RETN
;				CALL 00404F56
;				_Junkcode
;				CMC
;				JNB SHORT 00404F67
;				JMP SHORT 00404F5E
;				_Junkcode
;				JB SHORT 00404F48
;				_Junkcode
;				JMP SHORT 00404F65
;				CMC
;				JB SHORT 00404F6F
;				CMC
;				JB SHORT 00404F5C
;				_Junkcode
;				JMP SHORT 00404F53
;				ADD DWORD PTR SS:[ESP],7
;				CMC
;				PUSH DWORD PTR SS:[ESP]
;				RETN

S = F97207????83042417C3E804000000??F57311EB06??72ED??EB07F5720EF572F8??EBEC83042407F5FF3424C3
R = 909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090