运行分析
PE分析
手动脱壳
x32dbg打开程序,按一下F8,根据ESP定律,在此处下断点 按一下F9,两下F8,来到OEP处00401000 打开Scylla,点击转储保存文件 点击IAT自动搜索,点击获取导入,点击恢复转储,选择上一步保存的文件
静态分析&动态调试
算法分析
username = 'concealbear'
str_1 = 'biq2jrxc-ape3*dsynhz8gt5o7f0uml4v19w6+/k'
str_2 = '-apeoiq2jrml4xcsw6ynh7f0uv19+3/k*dbz8gt5'
str_3 = 'h7f0uv19+3/kjrml4xcsw6yn*dbz8gt5-apeoiq2' username_encode_1 = [ ]
for k in range ( len ( username) ) : v5 = 41 * ord ( username[ k] ) % 40 ; v5 = str_1[ v5] ; username_encode_1. append( v5) for i in range ( len ( username) ) : v8 = 31 * ord ( username[ i] ) % 40 ; v8 = str_2[ v8] ; username_encode_1. append( v8) for j in range ( len ( username_encode_1) ) : username_encode_1[ j] = str_3[ 11 * ord ( username_encode_1[ j] ) % 40 ] print ( "" . join( username_encode_1) )