Article View: pl.comp.lang.asm
Article #418Sekcje .exe
From: Matuzalem
Date: Sat, 22 Jul 2006 22:05
Date: Sat, 22 Jul 2006 22:05
45 lines
2428 bytes
2428 bytes
Witam!
Jestem w trakcie analizy zabezpieczen pewnego programu (Windows;
*.exe).
Nie moge znalesc punktu zaczepienia. Jestem na 100% pewien, ze
program zostal skompresowany. Posiada SMC i chyba - jeszcze nie jestem
pewien - jakis anty-debugger.
Sekcje przed zdumpowaniem:
Section Virtual Size Virtual Offset Raw Size Raw Offset
Flags
00054000 00001000 00027400 00001000
E0000040
00012000 00055000 00006400 00028400
E0000040
0000A000 00067000 00001400 0002E800
E0000040
.rsrc 00020000 00071000 00007200 0002FC00
E0000040
.data 00041000 00091000 00040800 00036E00
E0000040
.adata 00001000 000D2000 00000000 00077600
E0000040
po zdumpowaniu:
00054000 00001000 00053258 00000600
E0000040
00012000 00055000 00011208 00053A00
E0000040
0000A000 00067000 00008CFC 00064E00
E0000040
.rsrc 00020000 00071000 0001F100 0006DC00
E0000040
.data 00041000 00091000 00040800 0008CE00
E0000040
.adata 00001000 000D2000 00000000 000CD600
E0000040
Moze ktos juz sie z czyms takim spotkal i kojazy co to moze
byc za kompresor?
Pozdrawiam.
Technical Details
Message-ID:
<1153605907.322070.48080@m73g2000cwd.googlegroups.com>Path:
mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!mat.uni.torun.pl!news.man.torun.pl!newsfeed.pionier.net.pl!news.glorb.com!postnews.google.com!m73g2000cwd.googlegroups.com!not-for-mailShow Full Headers
Complete Article Headers
Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!mat.uni.torun.pl!news.man.torun.pl!newsfeed.pionier.net.pl!news.glorb.com!postnews.google.com!m73g2000cwd.googlegroups.com!not-for-mail From: "Matuzalem" <codemaster_@op.pl> Newsgroups: pl.comp.lang.asm Subject: Sekcje .exe Date: 22 Jul 2006 15:05:07 -0700 Organization: http://groups.google.com Lines: 46 Message-ID: <1153605907.322070.48080@m73g2000cwd.googlegroups.com> NNTP-Posting-Host: 212.244.115.33 Mime-Version: 1.0 X-Trace: posting.google.com 1153605913 22021 127.0.0.1 (22 Jul 2006 22:05:13 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Sat, 22 Jul 2006 22:05:13 +0000 (UTC) User-Agent: G2/0.2 X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4,gzip(gfe),gzip(gfe) Complaints-To: groups-abuse@google.com Injection-Info: m73g2000cwd.googlegroups.com; posting-host=212.244.115.33; posting-account=HFFdEQ0AAACI08bdAnMScVqwVEj2ucOg Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit