自ASProtect 1.23 RC1以来,ASProtect又有了ASProtect 1.23 RC4,ASProtect 1.31 0427,ASProtect 1.31 0518,ASProtect 1.31 0614这几个新版本,但是用最新版的PEiD2004(0606)查壳类型,都是
ASProtect 1.23 RC4 - 1.3.08.24 -> Alexey Solodovnikov,并且新版本ASProtect的最后一次典型异常也有了变化,经过本人的反复试验,发现可以通过ASProtect的最后一次典型异常来判断壳的类型究竟属于哪一个版本。
本人描述如有不妥之处,敬请指出!
ASProtect 1.23 RC4 按shift+f9键26次后来到典型异常,在最近处的retn处设断,跳过异常,f8步跟就会来到foep。
代码:
009439EC 3100 XOR DWORD PTR DS:[EAX],EAX 009439EE 64:8F05 00000000 POP DWORD PTR FS:[0] 009439F5 58 POP EAX 009439F6 833D B07E9400 00 CMP DWORD PTR DS:[947EB0],0 009439FD 74 14 JE SHORT 00943A13 009439FF 6A 0C PUSH 0C 00943A01 B9 B07E9400 MOV ECX,947EB0 00943A06 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 00943A09 BA 04000000 MOV EDX,4 00943A0E E8 2DD1FFFF CALL 00940B40 00943A13 FF75 FC PUSH DWORD PTR SS:[EBP-4] 00943A16 FF75 F8 PUSH DWORD PTR SS:[EBP-8] 00943A19 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] 00943A1C 8338 00 CMP DWORD PTR DS:[EAX],0 00943A1F 74 02 JE SHORT 00943A23 00943A21 FF30 PUSH DWORD PTR DS:[EAX] 00943A23 FF75 F0 PUSH DWORD PTR SS:[EBP-10] 00943A26 FF75 EC PUSH DWORD PTR SS:[EBP-14] 00943A29 C3 RETN
ASProtect 1.31 04.27 按shift+f9键36次后来到典型异常,在最近处的retn处设断,跳过异常,f8步跟就会来到foep。
代码:
0095E56E 0156 00 ADD DWORD PTR DS:[ESI],EDX 0095E571 848D 12FB0F29 TEST BYTE PTR SS:[EBP+290FFB12],CL 0095E577 BC 2AA5F123 MOV ESP,23F1A52A 0095E57C 67:64:8F06 0000 POP DWORD PTR FS:[0] 0095E582 83C4 04 ADD ESP,4 0095E585 03F7 ADD ESI,EDI 0095E587 5E POP ESI 0095E588 833D 6C3B9600 00 CMP DWORD PTR DS:[963B6C],0 0095E58F 74 14 JE SHORT 0095E5A5 0095E591 6A 0C PUSH 0C 0095E593 B9 6C3B9600 MOV ECX,963B6C 0095E598 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 0095E59B BA 04000000 MOV EDX,4 0095E5A0 E8 3B2FFFFF CALL 009514E0 0095E5A5 A1 40169600 MOV EAX,DWORD PTR DS:[961640] 0095E5AA C700 E1000000 MOV DWORD PTR DS:[EAX],0E1 0095E5B0 8BC3 MOV EAX,EBX 0095E5B2 E8 FD44FEFF CALL 00942AB4 0095E5B7 A1 C0159600 MOV EAX,DWORD PTR DS:[9615C0] 0095E5BC 8B00 MOV EAX,DWORD PTR DS:[EAX] 0095E5BE E8 6560FFFF CALL 00954628 0095E5C3 A1 40169600 MOV EAX,DWORD PTR DS:[961640] 0095E5C8 C700 E3000000 MOV DWORD PTR DS:[EAX],0E3 0095E5CE EB 01 JMP SHORT 0095E5D1 0095E5D0 E8 8B45FC8B CALL 8C922B60 0095E5D5 0085 C0752B8B ADD BYTE PTR SS:[EBP+8B2B75C0],AL 0095E5DB 0D 783B9600 OR EAX,963B78 0095E5E0 85C9 TEST ECX,ECX 0095E5E2 74 0B JE SHORT 0095E5EF 0095E5E4 8B65 F8 MOV ESP,DWORD PTR SS:[EBP-8] 0095E5E7 FF35 783B9600 PUSH DWORD PTR DS:[963B78] 0095E5ED C3 RETN
ASProtect 1.31 05.18 按shift+f9键40次后来到典型异常,在最近处的retn处设断,跳过异常,f8步跟就会来到foep。
代码:
0095F202 0156 00 ADD DWORD PTR DS:[ESI],EDX 0095F205 D332 SAL DWORD PTR DS:[EDX],CL 0095F207 59 POP ECX 0095F208 0B30 OR ESI,DWORD PTR DS:[EAX] 0095F20A 7C 52 JL SHORT 0095F25E 0095F20C EA 67648F06 0000 JMP FAR 0000:068F6467 ; 远距跳转 0095F213 83C4 04 ADD ESP,4 0095F216 81C6 A6916630 ADD ESI,306691A6 0095F21C 5E POP ESI 0095F21D 833D 784B9600 00 CMP DWORD PTR DS:[964B78],0 0095F224 74 14 JE SHORT 0095F23A 0095F226 6A 0C PUSH 0C 0095F228 B9 784B9600 MOV ECX,964B78 0095F22D 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 0095F230 BA 04000000 MOV EDX,4 0095F235 E8 A622FFFF CALL 009514E0 0095F23A A1 20269600 MOV EAX,DWORD PTR DS:[962620] 0095F23F 8818 MOV BYTE PTR DS:[EAX],BL 0095F241 A1 44269600 MOV EAX,DWORD PTR DS:[962644] 0095F246 C700 E1000000 MOV DWORD PTR DS:[EAX],0E1 0095F24C E8 A749FFFF CALL 00953BF8 0095F251 8B15 14269600 MOV EDX,DWORD PTR DS:[962614] 0095F257 8802 MOV BYTE PTR DS:[EDX],AL 0095F259 8BC6 MOV EAX,ESI 0095F25B E8 5438FEFF CALL 00942AB4 0095F260 A1 BC259600 MOV EAX,DWORD PTR DS:[9625BC] 0095F265 8B00 MOV EAX,DWORD PTR DS:[EAX] 0095F267 E8 FC53FFFF CALL 00954668 0095F26C A1 14269600 MOV EAX,DWORD PTR DS:[962614] 0095F271 8038 00 CMP BYTE PTR DS:[EAX],0 0095F274 74 28 JE SHORT 0095F29E 0095F276 A1 F4259600 MOV EAX,DWORD PTR DS:[9625F4] 0095F27B C700 EA000000 MOV DWORD PTR DS:[EAX],0EA 0095F281 B8 32000000 MOV EAX,32 0095F286 E8 4535FEFF CALL 009427D0 0095F28B 2905 844B9600 SUB DWORD PTR DS:[964B84],EAX 0095F291 B8 64000000 MOV EAX,64 0095F296 E8 3535FEFF CALL 009427D0 0095F29B 0145 F0 ADD DWORD PTR SS:[EBP-10],EAX 0095F29E A1 44269600 MOV EAX,DWORD PTR DS:[962644] 0095F2A3 C700 E3000000 MOV DWORD PTR DS:[EAX],0E3 0095F2A9 EB 01 JMP SHORT 0095F2AC 0095F2AB E8 8B45FC8B CALL 8C92383B 0095F2B0 0085 C0752B8B ADD BYTE PTR SS:[EBP+8B2B75C0],AL 0095F2B6 0D 844B9600 OR EAX,964B84 0095F2BB 85C9 TEST ECX,ECX 0095F2BD 74 0B JE SHORT 0095F2CA 0095F2BF 8B65 F8 MOV ESP,DWORD PTR SS:[EBP-8] 0095F2C2 FF35 844B9600 PUSH DWORD PTR DS:[964B84] 0095F2C8 C3 RETN
ASProtect 1.31 06.14 按shift+f9键38次后来到典型异常,在最近处的retn处设断,跳过异常,f8步跟就会来到foep。
代码:
0095F145 0156 00 ADD DWORD PTR DS:[ESI],EDX 0095F148 EE OUT DX,AL ; I/O 命令 0095F149 2D 4AC2D439 SUB EAX,39D4C24A 0095F14E AE SCAS BYTE PTR ES:[EDI] 0095F14F 67:64:8F06 0000 POP DWORD PTR FS:[0] 0095F155 83C4 04 ADD ESP,4 0095F158 3E:EB 02 JMP SHORT 0095F15D ; 多余的前缀 0095F15B CD 20 INT 20 0095F15D 81C6 368C4781 ADD ESI,81478C36 0095F163 5E POP ESI 0095F164 833D 7C4B9600 00 CMP DWORD PTR DS:[964B7C],0 0095F16B 74 14 JE SHORT 0095F181 0095F16D 6A 0C PUSH 0C 0095F16F B9 7C4B9600 MOV ECX,964B7C 0095F174 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 0095F177 BA 04000000 MOV EDX,4 0095F17C E8 D326FFFF CALL 00951854 0095F181 A1 68269600 MOV EAX,DWORD PTR DS:[962668] 0095F186 8818 MOV BYTE PTR DS:[EAX],BL 0095F188 A1 8C269600 MOV EAX,DWORD PTR DS:[96268C] 0095F18D C700 E1000000 MOV DWORD PTR DS:[EAX],0E1 0095F193 E8 D44DFFFF CALL 00953F6C 0095F198 8B15 5C269600 MOV EDX,DWORD PTR DS:[96265C] 0095F19E 8802 MOV BYTE PTR DS:[EDX],AL 0095F1A0 8BC6 MOV EAX,ESI 0095F1A2 E8 0D39FEFF CALL 00942AB4 0095F1A7 A1 04269600 MOV EAX,DWORD PTR DS:[962604] 0095F1AC 8B00 MOV EAX,DWORD PTR DS:[EAX] 0095F1AE E8 7D58FFFF CALL 00954A30 0095F1B3 E8 FCB9FFFF CALL 0095ABB4 0095F1B8 A1 5C269600 MOV EAX,DWORD PTR DS:[96265C] 0095F1BD 8038 00 CMP BYTE PTR DS:[EAX],0 0095F1C0 74 28 JE SHORT 0095F1EA 0095F1C2 A1 3C269600 MOV EAX,DWORD PTR DS:[96263C] 0095F1C7 C700 EA000000 MOV DWORD PTR DS:[EAX],0EA 0095F1CD B8 32000000 MOV EAX,32 0095F1D2 E8 F935FEFF CALL 009427D0 0095F1D7 2905 884B9600 SUB DWORD PTR DS:[964B88],EAX 0095F1DD B8 64000000 MOV EAX,64 0095F1E2 E8 E935FEFF CALL 009427D0 0095F1E7 0145 F0 ADD DWORD PTR SS:[EBP-10],EAX 0095F1EA A1 8C269600 MOV EAX,DWORD PTR DS:[96268C] 0095F1EF C700 E3000000 MOV DWORD PTR DS:[EAX],0E3 0095F1F5 EB 01 JMP SHORT 0095F1F8 0095F1F7 E8 8B45FC8B CALL 8C923787 0095F1FC 0085 C0752B8B ADD BYTE PTR SS:[EBP+8B2B75C0],AL 0095F202 0D 884B9600 OR EAX,964B88 0095F207 85C9 TEST ECX,ECX 0095F209 74 0B JE SHORT 0095F216 0095F20B 8B65 F8 MOV ESP,DWORD PTR SS:[EBP-8] 0095F20E FF35 884B9600 PUSH DWORD PTR DS:[964B88] 0095F214 C3 RETN