360定位 特征码。。。如下:
MOV EAX,DWORD PTR DS:[EDI+4]
MOV DWORD PTR DS:[4A6618],EAX
使用跳转,NOP移位,换位,都可以达到免杀。。。但鸽子不上线。。。!
求各位汇编大牛。。帮忙解决下。。。万分感谢。。。!!!!
下面是一个循环。。。我复制下来了。。
00401F84
/$
53
PUSH EBX
00401F85
|.
56
PUSH ESI
00401F86
|.
57
PUSH EDI
00401F87
|.
83C4 F0
ADD ESP,-10
00401F8A
|.
8BF0
MOV ESI,EAX
00401F8C
|.
8D3C24
LEA EDI,DWORD PTR SS:[ESP]
00401F8F
|.
A5
MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ES>
00401F90
|.
A5
MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ES>
00401F91
|.
8BFC
MOV EDI,ESP
00401F93
|.
E8 A0FFFFFF
CALL CServer.00401F38
00401F98
|.
8D4C24 08
LEA ECX,DWORD PTR SS:[ESP+8]
00401F9C
|.
8BD7
MOV EDX,EDI
00401F9E
|.
B8 24664A00
MOV EAX,CServer.004A6624
00401FA3
|.
E8 10F5FFFF
CALL CServer.004014B8
00401FA8
|.
8B5C24 08
MOV EBX,DWORD PTR SS:[ESP+8]
00401FAC
|.
85DB
TEST EBX,EBX
00401FAE
|.
75 04
JNZ SHORT CServer.00401FB4
00401FB0
|.
33C0
XOR EAX,EAX
00401FB2
|.
EB 52
JMP SHORT CServer.00402006
00401FB4
|>
8B07
MOV EAX,DWORD PTR DS:[EDI]
00401FB6
|.
3BD8
CMP EBX,EAX
00401FB8
|.
73 0A
JNB SHORT CServer.00401FC4
00401FBA
|.
E8 99FDFFFF
CALL CServer.00401D58
00401FBF
|.
2907
SUB DWORD PTR DS:[EDI],EAX
00401FC1
|.
0147 04
ADD DWORD PTR DS:[EDI+4],EAX
00401FC4
|>
8B07
MOV EAX,DWORD PTR DS:[EDI]
00401FC6
|.
0347 04
ADD EAX,DWORD PTR DS:[EDI+4]
00401FC9
|.
8BF3
MOV ESI,EBX
00401FCB
|.
037424 0C
ADD ESI,DWORD PTR SS:[ESP+C]
00401FCF
|.
3BC6
CMP EAX,ESI
00401FD1
|.
73 08
JNB SHORT CServer.00401FDB
00401FD3
|.
E8 F0FDFFFF
CALL CServer.00401DC8
00401FD8
|.
0147 04
ADD DWORD PTR DS:[EDI+4],EAX
00401FDB
|>
8B07
MOV EAX,DWORD PTR DS:[EDI]
00401FDD
|.
0347 04
ADD EAX,DWORD PTR DS:[EDI+4]
00401FE0
|.
3BF0
CMP ESI,EAX
00401FE2
75 11
JNZ SHORT CServer.00401FF5
00401FE4
|.
83E8 04
SUB EAX,4
00401FE7
|.
BA 04000000
MOV EDX,4
00401FEC
|.
E8 EBFCFFFF
CALL CServer.00401CDC
00401FF1
|.
836F 04 04
SUB DWORD PTR DS:[EDI+4],4
00401FF5
8B07
MOV EAX,DWORD PTR DS:[EDI]
00401FF7
A3 1C664A00
MOV DWORD PTR DS:[4A661C],EAX
00401FFC
8B47 04
MOV EAX,DWORD PTR DS:[EDI+4]
-----特征码
00401FFF
A3 18664A00
MOV DWORD PTR DS:[4A6618],EAX
-----特征码
00402004
B0 01
MOV AL,1
00402006
83C4 10
ADD ESP,10
00402009
5F
POP EDI
0040200A
5E
POP ESI
0040200B
|.
5B
POP EBX
0040200C
\.
C3
RETN
0040200D
8D40 00
LEA EAX,DWORD PTR DS:[EAX]