在前面的文章里,我们通过使用UPX Stub中的代码加以手工修改PE文件导出表得到了3280byte的目标DLL(点击此处),又通过重新编译LZMA SDK将目标缩小到2970byte(点击此处)。今天我们继续精简,通过修改源代码来进一步缩小目标文件的大小。
首先我们可以看到原来LZMA解压在不加其他功能情况下的声明是:
int LzmaDecode(CLzmaDecoderState *vs, const unsigned char *inStream, SizeT inSize, SizeT *inSizeProcessed, unsigned char *outStream, SizeT outSize, SizeT *outSizeProcessed);
typedef struct _CLzmaProperties
{
int lc;
int lp;
int pb;
}CLzmaProperties;
typedef struct _CLzmaDecoderState
{
CLzmaProperties Properties;
CProb *Probs;
} CLzmaDecoderState;
这里可以去除我们不需要的部分:
1、inSizeProcessed和outSizeProcessed不需要。
2、CLzmaProperties采用默认的lc=3,lp=0,pb=2,可以硬编码到代码中。
3、Probs可以放在函数内作为局部变量。
故修改函数声明及前面局部变量声明为:
-
int __stdcall LzmaDecode(
-
const unsigned char *inStream, SizeT inSize,
-
unsigned char *outStream, SizeT outSize)
-
{
-
//CProb *p = vs->Probs;
-
SizeT nowPos = 0;
-
Byte previousByte = 0;
-
UInt32 posStateMask = (1 << (/*vs->Properties.pb*/2)) - 1;
-
UInt32 literalPosMask = (1 << (/*vs->Properties.lp*/0)) - 1;
-
int lc = /*vs->Properties.lc*/3;
-
int state = 0;
-
UInt32 rep0 = 1, rep1 = 1, rep2 = 1, rep3 = 1;
-
int len = 0;
-
const Byte *Buffer;
-
const Byte *BufferLim;
-
UInt32 Range;
-
UInt32 Code;
-
CProb Probs[LZMA_BASE_SIZE + (LZMA_LIT_SIZE << (3 + 0))];
-
CProb *p = Probs;
-
//*inSizeProcessed = 0;
-
//*outSizeProcessed = 0;
-
使用VC6编译即可。编译后需要注意一个问题:Probs数组大小为15980字节,超过了一页4kb的大小,编译出来可以看到编译器采用了mov eax,xxxxxxxx; call __chkesp的做法分配栈空间,这样可以防止发生访问越界问题。而这里我们需要将这个call手动实现,参考以前的文章:mov ecx,xxxxxxxx; push 0; loopd $-2,由于代码量较少,直接修改机器码即可。
最后除掉RET这段解压代码的大小为2296byte,生成目标DLL大小为2810字节。
ASM代码:
-
.386
-
.model flat
-
.code
-
db 55h,8Bh,0ECh,0B9h,0A8h,0Fh,0,0,6Ah,0,0E2h,0FCh,53h,56h,57h,80h
-
db 65h,0FBh,0,0B9h,9Bh,0Fh,0,0,0B8h,0,4,0,4,8Dh,0BDh,60h
-
db 0C1h,0FFh,0FFh,6Ah,1,0F3h,0ABh,8Bh,45h,8,8Bh,4Dh,0Ch,8Bh,0D0h,3
-
db 0C1h,33h,0F6h,5Bh,33h,0C9h,89h,45h,0F4h,89h,75h,0DCh,89h,75h,0FCh,89h
-
db 5Dh,0F0h,89h,5Dh,0D0h,89h,5Dh,0D4h,89h,5Dh,0CCh,89h,4Dh,8,83h,0C8h
-
db 0FFh,0EBh,3,6Ah,1,5Bh,3Bh,55h,0F4h,74h,24h,8Bh,7Dh,8,0Fh,0B6h
-
db 1Ah,0C1h,0E7h,8,0Bh,0FBh,42h,41h,89h,7Dh,8,83h,0F9h,5,89h,55h
-
db 0Ch,7Ch,0E0h,83h,7Dh,14h,0,0Fh,86h,75h,8,0,0,0EBh,0Ah,8Bh
-
db 0C3h,0E9h,6Eh,8,0,0,8Bh,55h,0Ch,8Bh,4Dh,0FCh,83h,0E6h,3,0C1h
-
db 0E1h,4,3,0CEh,3Dh,0,0,0,1,8Dh,0BCh,4Dh,60h,0C1h,0FFh,0FFh
-
db 73h,1Eh,3Bh,55h,0F4h,0Fh,84h,3Eh,8,0,0,8Bh,4Dh,8,0Fh,0B6h
-
db 1Ah,0C1h,0E1h,8,0C1h,0E0h,8,0Bh,0CBh,42h,89h,4Dh,8,89h,55h,0Ch
-
db 66h,8Bh,0Fh,8Bh,0D8h,0Fh,0B7h,0D1h,0C1h,0EBh,0Bh,0Fh,0AFh,0DAh,39h,5Dh
-
db 8,0Fh,83h,98h,1,0,0,0Fh,0B7h,0F1h,8Bh,0C3h,0BBh,0,8,0
-
db 0,2Bh,0DEh,6Ah,1,0C1h,0FBh,5,3,0D9h,5Ah,0Fh,0B6h,4Dh,0FBh,0C1h
-
db 0E9h,5,66h,89h,1Fh,8Dh,0Ch,49h,0C1h,0E1h,9,83h,7Dh,0FCh,7,8Dh
-
db 8Ch,0Dh,0CCh,0CFh,0FFh,0FFh,89h,4Dh,0E4h,0Fh,8Ch,0B5h,0,0,0,8Bh
-
db 4Dh,0DCh,8Bh,75h,10h,2Bh,4Dh,0F0h,0Fh,0B6h,0Ch,31h,89h,4Dh,0E0h,0D1h
-
db 65h,0E0h,8Bh,4Dh,0E0h,8Bh,75h,0E4h,81h,0E1h,0,1,0,0,89h,4Dh
-
db 0ECh,3,0CAh,3Dh,0,0,0,1,8Dh,0B4h,4Eh,0,2,0,0,73h
-
db 21h,8Bh,4Dh,0Ch,3Bh,4Dh,0F4h,0Fh,84h,9Ch,7,0,0,8Bh,7Dh,8
-
db 0Fh,0B6h,19h,0C1h,0E7h,8,0C1h,0E0h,8,0Bh,0FBh,41h,89h,7Dh,8,89h
-
db 4Dh,0Ch,66h,8Bh,0Eh,8Bh,0F8h,0Fh,0B7h,0D9h,0C1h,0EFh,0Bh,0Fh,0AFh,0FBh
-
db 39h,7Dh,8,73h,1Bh,8Bh,0C7h,0BFh,0,8,0,0,2Bh,0FBh,0C1h,0FFh
-
db 5,3,0F9h,0D1h,0E2h,83h,7Dh,0ECh,0,66h,89h,3Eh,75h,2Eh,0EBh,1Bh
-
db 29h,7Dh,8,2Bh,0C7h,66h,8Bh,0F9h,8Dh,54h,12h,1,66h,0C1h,0EFh,5
-
db 2Bh,0CFh,83h,7Dh,0ECh,0,66h,89h,0Eh,74h,11h,81h,0FAh,0,1,0
-
db 0,0Fh,8Dh,81h,0,0,0,0E9h,63h,0FFh,0FFh,0FFh,81h,0FAh,0,1
-
db 0,0,7Dh,74h,8Bh,4Dh,0E4h,8Dh,3Ch,12h,89h,7Dh,0ECh,3,0F9h,3Dh
-
db 0,0,0,1,73h,21h,8Bh,4Dh,0Ch,3Bh,4Dh,0F4h,0Fh,84h,7,7
-
db 0,0,8Bh,75h,8,0Fh,0B6h,19h,0C1h,0E6h,8,0C1h,0E0h,8,0Bh,0F3h
-
db 41h,89h,75h,8,89h,4Dh,0Ch,66h,8Bh,0Fh,8Bh,0F0h,0Fh,0B7h,0D9h,0C1h
-
db 0EEh,0Bh,0Fh,0AFh,0F3h,39h,75h,8,73h,15h,8Bh,0C6h,0BEh,0,8,0
-
db 0,2Bh,0F3h,0C1h,0FEh,5,3,0F1h,66h,89h,37h,0D1h,0E2h,0EBh,9Dh,29h
-
db 75h,8,66h,8Bh,0D1h,66h,0C1h,0EAh,5,2Bh,0C6h,2Bh,0CAh,66h,89h,0Fh
-
db 8Bh,4Dh,0ECh,8Dh,51h,1,0EBh,84h,8Bh,4Dh,10h,8Bh,75h,0DCh,88h,55h
-
db 0FBh,88h,14h,0Eh,46h,83h,7Dh,0FCh,4,89h,75h,0DCh,7Dh,9,83h,65h
-
db 0FCh,0,0E9h,7Ah,6,0,0,83h,7Dh,0FCh,0Ah,7Dh,9,83h,6Dh,0FCh
-
db 3,0E9h,6Bh,6,0,0,83h,6Dh,0FCh,6,0E9h,62h,6,0,0,29h
-
db 5Dh,8,66h,8Bh,0D1h,66h,0C1h,0EAh,5,2Bh,0CAh,2Bh,0C3h,66h,89h,0Fh
-
db 8Bh,4Dh,0FCh,3Dh,0,0,0,1,8Dh,94h,4Dh,0E0h,0C2h,0FFh,0FFh,73h
-
db 21h,8Bh,4Dh,0Ch,3Bh,4Dh,0F4h,0Fh,84h,4Ch,6,0,0,8Bh,7Dh,8
-
db 0Fh,0B6h,19h,0C1h,0E7h,8,0C1h,0E0h,8,0Bh,0FBh,41h,89h,7Dh,8,89h
-
db 4Dh,0Ch,66h,8Bh,0Ah,8Bh,0F8h,0Fh,0B7h,0D9h,0C1h,0EFh,0Bh,0Fh,0AFh,0FBh
-
db 39h,7Dh,8,73h,44h,8Bh,0C7h,0BBh,0,8,0,0,0Fh,0B7h,0F9h,2Bh
-
db 0DFh,0C1h,0FBh,5,3,0D9h,8Bh,4Dh,0D4h,89h,4Dh,0CCh,8Bh,4Dh,0D0h,89h
-
db 4Dh,0D4h,8Bh,4Dh,0F0h,89h,4Dh,0D0h,33h,0C9h,83h,7Dh,0FCh,7,66h,89h
-
db 1Ah,0Fh,9Dh,0C1h,49h,83h,0E1h,0FDh,83h,0C1h,3,89h,4Dh,0FCh,8Dh,8Dh
-
db 0C4h,0C7h,0FFh,0FFh,0E9h,39h,2,0,0,29h,7Dh,8,2Bh,0C7h,66h,8Bh
-
db 0F9h,66h,0C1h,0EFh,5,2Bh,0CFh,3Dh,0,0,0,1,66h,89h,0Ah,73h
-
db 21h,8Bh,4Dh,0Ch,3Bh,4Dh,0F4h,0Fh,84h,0BCh,5,0,0,8Bh,55h,8
-
db 0Fh,0B6h,39h,0C1h,0E2h,8,0C1h,0E0h,8,0Bh,0D7h,41h,89h,55h,8,89h
-
db 4Dh,0Ch,8Bh,7Dh,0FCh,8Bh,0C8h,0C1h,0E9h,0Bh,66h,8Bh,94h,7Dh,0F8h,0C2h
-
db 0FFh,0FFh,0Fh,0B7h,0DAh,0Fh,0AFh,0CBh,39h,4Dh,8,0Fh,83h,0C2h,0,0
-
db 0,0BFh,0,8,0,0,8Bh,0C1h,2Bh,0FBh,0C1h,0FFh,5,3,0FAh,8Bh
-
db 55h,0FCh,66h,89h,0BCh,55h,0F8h,0C2h,0FFh,0FFh,0C1h,0E2h,4,3,0D6h,81h
-
db 0F9h,0,0,0,1,8Dh,94h,55h,40h,0C3h,0FFh,0FFh,73h,23h,8Bh,7Dh
-
db 0Ch,3Bh,7Dh,0F4h,0Fh,84h,4Fh,5,0,0,0Fh,0B6h,1Fh,0C1h,0E1h,8
-
db 8Bh,0C1h,8Bh,4Dh,8,0C1h,0E1h,8,0Bh,0CBh,47h,89h,4Dh,8,89h,7Dh
-
db 0Ch,66h,8Bh,0Ah,8Bh,0F8h,0Fh,0B7h,0D9h,0C1h,0EFh,0Bh,0Fh,0AFh,0FBh,39h
-
db 7Dh,8,73h,49h,0BEh,0,8,0,0,8Bh,0C7h,2Bh,0F3h,0C1h,0FEh,5
-
db 3,0F1h,66h,89h,32h,8Bh,75h,0DCh,85h,0F6h,0Fh,84h,9,5,0,0
-
db 33h,0C9h,83h,7Dh,0FCh,7,8Bh,55h,10h,0Fh,9Dh,0C1h,49h,83h,0E1h,0FEh
-
db 83h,0C1h,0Bh,89h,4Dh,0FCh,8Bh,0CEh,2Bh,4Dh,0F0h,8Ah,0Ch,11h,88h,0Ch
-
db 16h,46h,88h,4Dh,0FBh,89h,75h,0DCh,0E9h,0C4h,4,0,0,29h,7Dh,8
-
db 2Bh,0C7h,66h,8Bh,0F9h,66h,0C1h,0EFh,5,2Bh,0CFh,66h,89h,0Ah,0E9h,6
-
db 1,0,0,29h,4Dh,8,2Bh,0C1h,66h,8Bh,0CAh,66h,0C1h,0E9h,5,2Bh
-
db 0D1h,3Dh,0,0,0,1,66h,89h,94h,7Dh,0F8h,0C2h,0FFh,0FFh,8Dh,94h
-
db 7Dh,10h,0C3h,0FFh,0FFh,73h,21h,8Bh,4Dh,0Ch,3Bh,4Dh,0F4h,0Fh,84h,96h
-
db 4,0,0,8Bh,7Dh,8,0Fh,0B6h,19h,0C1h,0E7h,8,0C1h,0E0h,8,0Bh
-
db 0FBh,41h,89h,7Dh,8,89h,4Dh,0Ch,66h,8Bh,0Ah,8Bh,0F8h,0Fh,0B7h,0D9h
-
db 0C1h,0EFh,0Bh,0Fh,0AFh,0FBh,39h,7Dh,8,73h,19h,8Bh,0C7h,0BFh,0,8
-
db 0,0,2Bh,0FBh,0C1h,0FFh,5,3,0F9h,8Bh,4Dh,0D0h,66h,89h,3Ah,0E9h
-
db 8Ch,0,0,0,29h,7Dh,8,2Bh,0C7h,66h,8Bh,0F9h,66h,0C1h,0EFh,5
-
db 2Bh,0CFh,3Dh,0,0,0,1,66h,89h,0Ah,8Bh,4Dh,0FCh,8Dh,94h,4Dh
-
db 28h,0C3h,0FFh,0FFh,73h,21h,8Bh,4Dh,0Ch,3Bh,4Dh,0F4h,0Fh,84h,27h,4
-
db 0,0,8Bh,7Dh,8,0Fh,0B6h,19h,0C1h,0E7h,8,0C1h,0E0h,8,0Bh,0FBh
-
db 41h,89h,7Dh,8,89h,4Dh,0Ch,66h,8Bh,0Ah,8Bh,0F8h,0Fh,0B7h,0D9h,0C1h
-
db 0EFh,0Bh,0Fh,0AFh,0FBh,39h,7Dh,8,73h,16h,8Bh,0C7h,0BFh,0,8,0
-
db 0,2Bh,0FBh,0C1h,0FFh,5,3,0F9h,8Bh,4Dh,0D4h,66h,89h,3Ah,0EBh,1Ah
-
db 29h,7Dh,8,2Bh,0C7h,66h,8Bh,0F9h,66h,0C1h,0EFh,5,2Bh,0CFh,66h,89h
-
db 0Ah,8Bh,55h,0D4h,8Bh,4Dh,0CCh,89h,55h,0CCh,8Bh,55h,0D0h,89h,55h,0D4h
-
db 8Bh,55h,0F0h,89h,4Dh,0F0h,89h,55h,0D0h,33h,0C9h,83h,7Dh,0FCh,7,0Fh
-
db 9Dh,0C1h,49h,83h,0E1h,0FDh,83h,0C1h,0Bh,89h,4Dh,0FCh,8Dh,8Dh,0C8h,0CBh
-
db 0FFh,0FFh,3Dh,0,0,0,1,73h,21h,8Bh,55h,0Ch,3Bh,55h,0F4h,0Fh
-
db 84h,94h,3,0,0,8Bh,7Dh,8,0Fh,0B6h,1Ah,0C1h,0E7h,8,0C1h,0E0h
-
db 8,0Bh,0FBh,42h,89h,7Dh,8,89h,55h,0Ch,66h,8Bh,11h,8Bh,0F8h,0Fh
-
db 0B7h,0DAh,0C1h,0EFh,0Bh,0Fh,0AFh,0FBh,39h,7Dh,8,73h,28h,8Bh,0C7h,0BFh
-
db 0,8,0,0,2Bh,0FBh,0C1h,0FFh,5,3,0FAh,0C1h,0E6h,4,83h,65h
-
db 0E0h,0,66h,89h,39h,8Dh,4Ch,0Eh,4,0C7h,45h,0E4h,3,0,0,0
-
db 0E9h,9Eh,0,0,0,29h,7Dh,8,2Bh,0C7h,66h,8Bh,0FAh,66h,0C1h,0EFh
-
db 5,2Bh,0D7h,3Dh,0,0,0,1,66h,89h,11h,73h,21h,8Bh,55h,0Ch
-
db 3Bh,55h,0F4h,0Fh,84h,20h,3,0,0,8Bh,7Dh,8,0Fh,0B6h,1Ah,0C1h
-
db 0E7h,8,0C1h,0E0h,8,0Bh,0FBh,42h,89h,7Dh,8,89h,55h,0Ch,66h,8Bh
-
db 51h,2,8Bh,0F8h,0Fh,0B7h,0DAh,0C1h,0EFh,0Bh,0Fh,0AFh,0FBh,39h,7Dh,8
-
db 73h,2Bh,8Bh,0C7h,0BBh,0,8,0,0,0Fh,0B7h,0FAh,2Bh,0DFh,0C7h,45h
-
db 0E0h,8,0,0,0,0C1h,0FBh,5,3,0DAh,0C1h,0E6h,4,66h,89h,59h
-
db 2,8Dh,8Ch,0Eh,4,1,0,0,0E9h,7Ch,0FFh,0FFh,0FFh,29h,7Dh,8
-
db 66h,8Bh,0F2h,66h,0C1h,0EEh,5,2Bh,0D6h,2Bh,0C7h,66h,89h,51h,2,81h
-
db 0C1h,4,2,0,0,0C7h,45h,0E0h,10h,0,0,0,0C7h,45h,0E4h,8
-
db 0,0,0,8Bh,55h,0E4h,0C7h,45h,0E8h,1,0,0,0,89h,55h,0ECh
-
db 8Bh,55h,0E8h,8Dh,3Ch,12h,89h,7Dh,0D8h,3,0F9h,3Dh,0,0,0,1
-
db 73h,21h,8Bh,55h,0Ch,3Bh,55h,0F4h,0Fh,84h,7Bh,2,0,0,8Bh,75h
-
db 8,0Fh,0B6h,1Ah,0C1h,0E6h,8,0C1h,0E0h,8,0Bh,0F3h,42h,89h,75h,8
-
db 89h,55h,0Ch,66h,8Bh,17h,8Bh,0F0h,0Fh,0B7h,0DAh,0C1h,0EEh,0Bh,0Fh,0AFh
-
db 0F3h,39h,75h,8,73h,16h,8Bh,0C6h,0BEh,0,8,0,0,2Bh,0F3h,0C1h
-
db 0FEh,5,3,0F2h,0D1h,65h,0E8h,66h,89h,37h,0EBh,18h,29h,75h,8,2Bh
-
db 0C6h,66h,8Bh,0F2h,66h,0C1h,0EEh,5,2Bh,0D6h,66h,89h,17h,8Bh,55h,0D8h
-
db 42h,89h,55h,0E8h,0FFh,4Dh,0ECh,75h,87h,8Bh,4Dh,0E4h,6Ah,1,5Fh,8Bh
-
db 0D7h,0D3h,0E2h,8Bh,4Dh,0E0h,2Bh,0CAh,1,4Dh,0E8h,83h,7Dh,0FCh,4,0Fh
-
db 8Dh,0BDh,1,0,0,83h,45h,0FCh,7,83h,7Dh,0E8h,4,7Dh,5,8Bh
-
db 4Dh,0E8h,0EBh,3,6Ah,3,59h,0C1h,0E1h,7,0C7h,45h,0ECh,6,0,0
-
db 0,8Dh,8Ch,0Dh,0C0h,0C4h,0FFh,0FFh,89h,4Dh,0E4h,8Bh,55h,0E4h,8Dh,0Ch
-
db 3Fh,3Dh,0,0,0,1,89h,4Dh,0D8h,8Dh,34h,0Ah,73h,21h,8Bh,4Dh
-
db 0Ch,3Bh,4Dh,0F4h,0Fh,84h,0BFh,1,0,0,8Bh,55h,8,0Fh,0B6h,19h
-
db 0C1h,0E2h,8,0C1h,0E0h,8,0Bh,0D3h,41h,89h,55h,8,89h,4Dh,0Ch,66h
-
db 8Bh,0Eh,8Bh,0D0h,0Fh,0B7h,0D9h,0C1h,0EAh,0Bh,0Fh,0AFh,0D3h,39h,55h,8
-
db 73h,15h,8Bh,0C2h,0BAh,0,8,0,0,2Bh,0D3h,0C1h,0FAh,5,3,0D1h
-
db 66h,89h,16h,0D1h,0E7h,0EBh,17h,29h,55h,8,2Bh,0C2h,66h,8Bh,0D1h,66h
-
db 0C1h,0EAh,5,2Bh,0CAh,66h,89h,0Eh,8Bh,4Dh,0D8h,8Dh,79h,1,0FFh,4Dh
-
db 0ECh,75h,88h,83h,0EFh,40h,83h,0FFh,4,0Fh,8Ch,0Bh,1,0,0,6Ah
-
db 1,8Bh,0CFh,8Bh,0D7h,5Eh,0D1h,0F9h,23h,0D6h,49h,83h,0CAh,2,83h,0FFh
-
db 0Eh,89h,4Dh,0ECh,7Dh,13h,0D3h,0E2h,89h,55h,0F0h,2Bh,0D7h,8Dh,8Ch,55h
-
db 0BEh,0C6h,0FFh,0FFh,89h,4Dh,0E4h,0EBh,51h,83h,0E9h,4,3Dh,0,0,0
-
db 1,73h,20h,8Bh,7Dh,0Ch,3Bh,7Dh,0F4h,0Fh,84h,1Fh,1,0,0,8Bh
-
db 5Dh,8,0Fh,0B6h,3Fh,0C1h,0E3h,8,0Bh,0DFh,0C1h,0E0h,8,0FFh,45h,0Ch
-
db 89h,5Dh,8,0D1h,0E8h,0D1h,0E2h,39h,45h,8,72h,5,29h,45h,8,0Bh
-
db 0D6h,49h,75h,0C8h,8Dh,8Dh,0A4h,0C7h,0FFh,0FFh,0C7h,45h,0ECh,4,0,0
-
db 0,0C1h,0E2h,4,89h,4Dh,0E4h,89h,55h,0F0h,89h,75h,0D8h,89h,75h,0E0h
-
db 0EBh,3,6Ah,1,5Eh,8Bh,4Dh,0E0h,8Bh,55h,0E4h,3,0C9h,3Dh,0,0
-
db 0,1,8Dh,3Ch,11h,73h,21h,8Bh,55h,0Ch,3Bh,55h,0F4h,0Fh,84h,0BBh
-
db 0,0,0,8Bh,75h,8,0Fh,0B6h,1Ah,0C1h,0E6h,8,0C1h,0E0h,8,0Bh
-
db 0F3h,42h,89h,75h,8,89h,55h,0Ch,66h,8Bh,17h,8Bh,0F0h,0Fh,0B7h,0DAh
-
db 0C1h,0EEh,0Bh,0Fh,0AFh,0F3h,39h,75h,8,73h,16h,0B9h,0,8,0,0
-
db 8Bh,0C6h,2Bh,0CBh,0C1h,0F9h,5,3,0CAh,0D1h,65h,0E0h,66h,89h,0Fh,0EBh
-
db 1Bh,29h,75h,8,2Bh,0C6h,66h,8Bh,0F2h,66h,0C1h,0EEh,5,2Bh,0D6h,41h
-
db 89h,4Dh,0E0h,8Bh,4Dh,0D8h,9,4Dh,0F0h,66h,89h,17h,0D1h,65h,0D8h,0FFh
-
db 4Dh,0ECh,0Fh,85h,7Ah,0FFh,0FFh,0FFh,0EBh,3,89h,7Dh,0F0h,0FFh,45h,0F0h
-
db 74h,38h,8Bh,75h,0DCh,83h,45h,0E8h,2,39h,75h,0F0h,77h,3Bh,8Bh,55h
-
db 10h,8Bh,0CEh,2Bh,4Dh,0F0h,0FFh,4Dh,0E8h,8Ah,0Ch,11h,88h,0Ch,16h,46h
-
db 83h,7Dh,0E8h,0,88h,4Dh,0FBh,89h,75h,0DCh,74h,5,3Bh,75h,14h,72h
-
db 0E0h,3Bh,75h,14h,0Fh,82h,0ACh,0F7h,0FFh,0FFh,3Dh,0,0,0,1,73h
-
db 11h,8Bh,45h,0F4h,39h,45h,0Ch,75h,9,6Ah,1,58h,0EBh,6,8Bh,0C6h
-
db 0EBh,2,33h,0C0h,5Fh,5Eh,5Bh,0C9h
-
retn 10h
-
end
记得dwing大的upack壳里lzma解压代码优化到大概300多字节
网上的LZMA的版本太多了,不知道阁下的解的是哪个版本的?
我用delphi版的压缩,然后用阁下的代码,居然解不开。
7z官网LZMA SDK中的lzmaenc命令行,另外好像是要去掉头,字典大小不宜过大
我的delphi跟LZMA SDK中的lzma.exe可以互相加解压,但是用阁下的代码着实不能解压,不知道是什么原因。或许应该要设置某些压缩参数吧?谢谢