{"id":1933,"date":"2024-03-07T15:43:22","date_gmt":"2024-03-07T06:43:22","guid":{"rendered":"https:\/\/h4ck.kr\/?p=1933"},"modified":"2024-05-20T13:27:56","modified_gmt":"2024-05-20T04:27:56","slug":"replace","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=1933","title":{"rendered":"Replace"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Exeinfo PE<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"542\" height=\"257\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-141.png\" alt=\"\" class=\"wp-image-1934\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-141.png 542w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-141-300x142.png 300w\" sizes=\"auto, (max-width: 542px) 100vw, 542px\" \/><\/figure>\n\n\n\n<p>\ud328\ud0b9\ub418\uc5b4\uc788\uc9c0 \uc54a\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"253\" height=\"157\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-143.png\" alt=\"\" class=\"wp-image-1936\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"499\" height=\"418\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-142.png\" alt=\"\" class=\"wp-image-1935\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-142.png 499w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-142-300x251.png 300w\" sizes=\"auto, (max-width: 499px) 100vw, 499px\" \/><\/figure>\n\n\n\n<p>\uc544\ubb34 \ud328\uc2a4\uc6cc\ub4dc\ub97c \uc785\ub825\ud558\uace0 &#8220;Check&#8221; \ubc84\ud2bc\uc744 \ub204\ub974\uba74 \ucda9\ub3cc\uc774 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n<p>\ud55c\ubc88 \ubd84\uc11d\ud574\ubcf4\uc790.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Analysis<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"914\" height=\"136\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-144.png\" alt=\"\" class=\"wp-image-1937\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-144.png 914w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-144-300x45.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-144-768x114.png 768w\" sizes=\"auto, (max-width: 914px) 100vw, 914px\" \/><\/figure>\n\n\n\n<p>\ub2e8\uc21c\ud788 \ucda9\ub3cc \uc6d0\uc778\uc5d0 \ub300\ud574\uc11c\ub9cc \uc0b4\ud3b4\ubcf4\uc790\uba74, 1234\ub97c \uc785\ub825\ud558\uace0 Check \ubc84\ud2bc\uc744 \ub20c\ub800\uc744\ub54c<br>60160A9D \uba54\ubaa8\ub9ac \uc8fc\uc18c\uc5d0 \ub370\uc774\ud130\ub97c \uc4f8\ub824\uace0\ubcf4\ub2c8 \uc720\ud6a8\ud558\uc9c0 \uc54a\uc740 \uc8fc\uc18c\uc5ec\uc11c \ud06c\ub798\uc2dc\uac00 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"353\" height=\"189\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-145.png\" alt=\"\" class=\"wp-image-1938\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-145.png 353w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-145-300x161.png 300w\" sizes=\"auto, (max-width: 353px) 100vw, 353px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"84\" height=\"17\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-146.png\" alt=\"\" class=\"wp-image-1939\"\/><\/figure>\n\n\n\n<p>0x401060\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 \ud655\uc778\ud588\uc744\ub54c, eax \ub808\uc988\uc2a4\ud130\uac12\uc5d0 \uc0ac\uc6a9\uc790 \uc785\ub825\uac12\uc778 1234(=0x4D2)\uac00 \ub4e4\uc5b4\uac00\uace0,<br>\uadf8 \uac12\uc774 dword_4084D0\uc5d0 \uc800\uc7a5\ub41c\ub2e4.<br>\uadf8\ub9ac\uace0, .text:00401065 call loc_40466F\uc5d0 \uc758\ud574 loc_40466F\uc744 \ud638\ucd9c\ud55c\ub2e4. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"287\" height=\"83\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-148.png\" alt=\"\" class=\"wp-image-1941\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"395\" height=\"78\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-149.png\" alt=\"\" class=\"wp-image-1942\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-149.png 395w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-149-300x59.png 300w\" sizes=\"auto, (max-width: 395px) 100vw, 395px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"276\" height=\"148\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-150.png\" alt=\"\" class=\"wp-image-1943\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"287\" height=\"137\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-151.png\" alt=\"\" class=\"wp-image-1944\"\/><\/figure>\n\n\n\n<p>.text:0040467A mov dword ptr unk_406016, 619060EBh<br>0x406016\uc5d0\ub294 0x619060EB (EB 60 90 61) \uac12\uc774 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"341\" height=\"51\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-152.png\" alt=\"\" class=\"wp-image-1945\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-152.png 341w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-152-300x45.png 300w\" sizes=\"auto, (max-width: 341px) 100vw, 341px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"290\" height=\"36\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-153.png\" alt=\"\" class=\"wp-image-1946\"\/><\/figure>\n\n\n\n<p>.text:00404689 inc dword_4084D0<br>dword_4084D0\uc5d0 \uc800\uc7a5\ub418\uc5c8\ub358 1234(=0x4D2) \uac12\uc740 inc \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 1\uc99d\uac00\ud558\uc5ec,<br>dword_4084D0\ub294 0x4D3\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"316\" height=\"48\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-154.png\" alt=\"\" class=\"wp-image-1947\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-154.png 316w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-154-300x46.png 300w\" sizes=\"auto, (max-width: 316px) 100vw, 316px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"286\" height=\"32\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-155.png\" alt=\"\" class=\"wp-image-1948\"\/><\/figure>\n\n\n\n<p>\ud55c\ubc88 \ub354 \uc218\ud589\ub418\uc5b4 1 \uc99d\uac00\ud558\ubbc0\ub85c<br>dword_4084D0\ub294 0x4D4 \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"383\" height=\"123\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-156.png\" alt=\"\" class=\"wp-image-1949\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-156.png 383w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-156-300x96.png 300w\" sizes=\"auto, (max-width: 383px) 100vw, 383px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"319\" height=\"33\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-157.png\" alt=\"\" class=\"wp-image-1950\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-157.png 319w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-157-300x31.png 300w\" sizes=\"auto, (max-width: 319px) 100vw, 319px\" \/><\/figure>\n\n\n\n<p>.text:00404674 add dword_4084D0, 601605C7h<br>dword_4084D0\uc5d0 \uc800\uc7a5\ub418\uc5c8\ub358 0x4D4\uac12\uc740 0x601605C7\uac00 \ub354\ud574\uc838 <br>dword_4084D0\ub294 0x60160a9b \uac12\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<p>.text:0040467E inc eax<br>GetDlgItemInt\ub85c\ubd80\ud130 \uac00\uc838\uc628 \uc0ac\uc6a9\uc790 \uc778\ud48b\uac12 eax\uc5d0\ub294 0x4D2(=1234)\uc600\ub294\ub370,<br>\uc774\uc81c inc \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 1\uc99d\uac00\ud558\uc5ec 0x4D3\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"329\" height=\"54\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-158.png\" alt=\"\" class=\"wp-image-1951\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-158.png 329w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-158-300x49.png 300w\" sizes=\"auto, (max-width: 329px) 100vw, 329px\" \/><\/figure>\n\n\n\n<p>.text:00404689 inc dword_4084D0<br>dword_4084D0\uc5d0 1\uc774 \uc99d\uac00\ud558\uc5ec 0x60160A9B + 1 = 0x60160A9C\uac00 \ub41c\ub2e4. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"321\" height=\"50\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-159.png\" alt=\"\" class=\"wp-image-1952\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-159.png 321w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-159-300x47.png 300w\" sizes=\"auto, (max-width: 321px) 100vw, 321px\" \/><\/figure>\n\n\n\n<p>\ud55c\ubc88 \ub354 \uc99d\uac00\ud558\uc5ec dword_4084D0\ub294 0x60160A9D\uac00 \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"288\" height=\"38\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-160.png\" alt=\"\" class=\"wp-image-1953\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"352\" height=\"64\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-161.png\" alt=\"\" class=\"wp-image-1954\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-161.png 352w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-161-300x55.png 300w\" sizes=\"auto, (max-width: 352px) 100vw, 352px\" \/><\/figure>\n\n\n\n<p>.text:00404690 mov eax, dword_4084D0<br>eax\ub294 \uc774\uc81c dword_4084D0\uc5d0\uc11c \uac00\uc838\uc628 0x60160A9D \uac12\uc774 \ub418\uace0,<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"313\" height=\"52\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-162.png\" alt=\"\" class=\"wp-image-1955\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-162.png 313w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-162-300x50.png 300w\" sizes=\"auto, (max-width: 313px) 100vw, 313px\" \/><\/figure>\n\n\n\n<p>.text:00404689 inc dword_4084D0<br>dword_4084D0\uc5d0 1\uc774 \uc99d\uac00\ud558\uc5ec 0x60160A9D + 1 = 0x60160A9E\uac00 \ub41c\ub2e4. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"471\" height=\"36\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-163.png\" alt=\"\" class=\"wp-image-1956\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-163.png 471w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-163-300x23.png 300w\" sizes=\"auto, (max-width: 471px) 100vw, 471px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"380\" height=\"184\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-164.png\" alt=\"\" class=\"wp-image-1958\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-164.png 380w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-164-300x145.png 300w\" sizes=\"auto, (max-width: 380px) 100vw, 380px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"344\" height=\"100\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-165.png\" alt=\"\" class=\"wp-image-1959\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-165.png 344w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-165-300x87.png 300w\" sizes=\"auto, (max-width: 344px) 100vw, 344px\" \/><\/figure>\n\n\n\n<p>.text:0040469F mov dword ptr ds:loc_40466F, 0C39000C6h<br>0x40466F \uc8fc\uc18c\uc5d0 \uc788\ub358 opcode\uac00 \uc218\uc815\ub41c\ub2e4.<\/p>\n\n\n\n<p>\ubcf4\ub2e4\uc2dc\ud53c call\uc774\uc5c8\ub358 \uba85\ub839\uc5b4\uac00 <\/p>\n\n\n\n<p>.text:0040466F mov byte ptr [eax], 90h<br>.text:00404672 retn<\/p>\n\n\n\n<p>\uc704\uc640 \uac19\uc774 \ubcc0\uacbd\ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"358\" height=\"101\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-166.png\" alt=\"\" class=\"wp-image-1961\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-166.png 358w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-166-300x85.png 300w\" sizes=\"auto, (max-width: 358px) 100vw, 358px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"91\" height=\"21\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-167.png\" alt=\"\" class=\"wp-image-1962\"\/><\/figure>\n\n\n\n<p>\uc5ec\uae30\uac00 \ubc14\ub85c \ucda9\ub3cc\uc774 \ubc1c\uc0dd\ud588\ub358 \ucf54\ub4dc\uc774\ub2e4.<br>eax\uc778 0x60160A9D\uc5d0 0x90 \ubc14\uc774\ud2b8\ub97c \uc4f0\ub824\uace0\ud558\ub294\ub370, <br>0x60160A9D\ub294 \uc720\ud6a8\ud558\uc9c0 \uc54a\uc740 \uc8fc\uc18c\uc5ec\uc11c \ud06c\ub798\uc2dc\uac00 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n<p>\uc5ec\uae30\uc11c 0x90\uc740 nop \uba85\ub839\uc5b4\ub97c \uc758\ubbf8\ud558\ub294\ub370,<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"696\" height=\"139\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-168.png\" alt=\"\" class=\"wp-image-1963\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-168.png 696w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-168-300x60.png 300w\" sizes=\"auto, (max-width: 696px) 100vw, 696px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"249\" height=\"30\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-170.png\" alt=\"\" class=\"wp-image-1965\"\/><\/figure>\n\n\n\n<p><strong>eax\ub97c 0x401071\ub85c \uc218\uc815\ud574\uc11c<\/strong> 0x401071 \uc8fc\uc18c\ub97c nop\uc73c\ub85c opcode\ub97c \uc218\uc815\ud574\ubcf4\uc790.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"424\" height=\"97\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-169.png\" alt=\"\" class=\"wp-image-1964\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-169.png 424w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-169-300x69.png 300w\" sizes=\"auto, (max-width: 424px) 100vw, 424px\" \/><\/figure>\n\n\n\n<p>\ubc29\uae08 \uc218\uc815\ud574\uc8fc\uc5c8\ub358 eax\uac12\uc740 0x401071\uc774\uc5c8\uae30\uc5d0, 1\uc99d\uac00\ud574\uc11c<br>eax\uac12\uc740 0x401072\uac00 \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"360\" height=\"104\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-171.png\" alt=\"\" class=\"wp-image-1966\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-171.png 360w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-171-300x87.png 300w\" sizes=\"auto, (max-width: 360px) 100vw, 360px\" \/><\/figure>\n\n\n\n<p>0x401072 \uc8fc\uc18c\uc5d0\ub3c4 nop\uc73c\ub85c opcode\uac00 \ud328\uce58\ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"427\" height=\"68\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-172.png\" alt=\"\" class=\"wp-image-1967\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-172.png 427w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-172-300x48.png 300w\" sizes=\"auto, (max-width: 427px) 100vw, 427px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"658\" height=\"146\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-173.png\" alt=\"\" class=\"wp-image-1968\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-173.png 658w, https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-173-300x67.png 300w\" sizes=\"auto, (max-width: 658px) 100vw, 658px\" \/><\/figure>\n\n\n\n<p>\uadf8\ub7ec\uba74 0x401071, 0x401072 \uc8fc\uc18c\uc5d0 \uc788\ub358 \uba85\ub839\uc5b4\uac00 nop\uc73c\ub85c \ud328\uce58\ub418\uc5c8\uae30 \ub54c\ubb38\uc5d0,<br>&#8220;Correct!&#8221;\ub77c\ub294 \ucc3d\uc744 \ub744\uc6b0\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"250\" height=\"154\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-174.png\" alt=\"\" class=\"wp-image-1969\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n\n\n<p>\uc774\ub807\uac8c eax\ub97c \ud1b5\ud574 2\uac1c\uc758 \uba54\ubaa8\ub9ac \uc8fc\uc18c\uc5d0 nop \ud328\uce58\ub418\ub294 \uac83\uc744 \ud655\uc778\ud560 \uc218 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n<p>\uadf8\ub807\ub2e4\uba74 \uc5b4\ub5bb\uac8c eax\ub97c 0x401071\ub85c \ucee8\ud2b8\ub864\ud560 \uc218 \uc788\uc744\uae4c\uc5d0 \ub300\ud574 \uc0b4\ud3b4\ubcf4\uc790\uba74,<br>\uc0ac\uc6a9\uc790 \uc778\ud48b\uac12 = 1234\ub97c \uc608\ub85c \ub4e4\uace0, \uc804 \uacfc\uc815\uc744 \ub2e4\uc2dc \uc0b4\ud3b4\ubd24\uc744\ub54c,<\/p>\n\n\n\n<p>0x4D2 (=1234) + 1 + 1 + 0x601605C7 + 1 + 1 = 0x60160A9D<br>[\uc0ac\uc6a9\uc790 \uc778\ud48b\uac12] + 1 + 1 + 0x601605C7 + 1 + 1 = [nop \ud328\uce58\ud560 \uba54\ubaa8\ub9ac \uc8fc\uc18c]<\/p>\n\n\n\n<p>[nop \ud328\uce58\ud560 \uba54\ubaa8\ub9ac \uc8fc\uc18c]\ub294 0x401071\uc774\uc5ec\uc57c \ud558\ubbc0\ub85c,<br>0x401071 &#8211; 1 &#8211; 1 &#8211; 0x601605C7 &#8211; 1 &#8211; 1 = [\uc0ac\uc6a9\uc790 \uc778\ud48b\uac12]<\/p>\n\n\n\n<p>>>> (0x401071 &#8211; 1 &#8211; 1 &#8211; 0x601605C7 &#8211; 1 &#8211; 1) &amp; 0xffffffff<br>2687109798<\/p>\n\n\n\n<p>[\uc0ac\uc6a9\uc790 \uc778\ud48b\uac12] = 2687109798<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Result<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"250\" height=\"156\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2024\/03\/image-175.png\" alt=\"\" class=\"wp-image-1972\"\/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Exeinfo PE \ud328\ud0b9\ub418\uc5b4\uc788\uc9c0 \uc54a\ub2e4. \uc544\ubb34 \ud328\uc2a4\uc6cc\ub4dc\ub97c \uc785\ub825\ud558\uace0 &#8220;Check&#8221; \ubc84\ud2bc\uc744 \ub204\ub974\uba74 \ucda9\ub3cc\uc774 \ubc1c\uc0dd\ud55c\ub2e4. \ud55c\ubc88 \ubd84\uc11d\ud574\ubcf4\uc790. Analysis \ub2e8\uc21c\ud788 \ucda9\ub3cc \uc6d0\uc778\uc5d0 \ub300\ud574\uc11c\ub9cc \uc0b4\ud3b4\ubcf4\uc790\uba74, 1234\ub97c \uc785\ub825\ud558\uace0 Check \ubc84\ud2bc\uc744 \ub20c\ub800\uc744\ub54c60160A9D \uba54\ubaa8\ub9ac \uc8fc\uc18c\uc5d0 \ub370\uc774\ud130\ub97c \uc4f8\ub824\uace0\ubcf4\ub2c8 \uc720\ud6a8\ud558\uc9c0 \uc54a\uc740 \uc8fc\uc18c\uc5ec\uc11c \ud06c\ub798\uc2dc\uac00 \ubc1c\uc0dd\ud55c\ub2e4. 0x401060\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 \ud655\uc778\ud588\uc744\ub54c, eax \ub808\uc988\uc2a4\ud130\uac12\uc5d0 \uc0ac\uc6a9\uc790 \uc785\ub825\uac12\uc778 1234(=0x4D2)\uac00 \ub4e4\uc5b4\uac00\uace0,\uadf8 \uac12\uc774 dword_4084D0\uc5d0 \uc800\uc7a5\ub41c\ub2e4.\uadf8\ub9ac\uace0, .text:00401065 call loc_40466F\uc5d0 \uc758\ud574 loc_40466F\uc744 \ud638\ucd9c\ud55c\ub2e4. .text:0040467A mov&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=1933\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">Replace<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[16],"tags":[24],"class_list":["post-1933","post","type-post","status-publish","format-standard","hentry","category-reversing-kr","tag-reversing"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1933","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1933"}],"version-history":[{"count":3,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1933\/revisions"}],"predecessor-version":[{"id":1973,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1933\/revisions\/1973"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1933"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1933"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1933"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}