|
[分享]《飘云阁论坛07版破解基础教程》正式版发布
先下载了,有空仔细看看。 |
|
[求助]有经验的朋友进来看看
我也是,拖出来了,dump不下来,提示无法读取被调试进程. |
|
帮忙看看,自校验问题
这个程序多次进行了自校验,比较不好分析,很郁闷,功力不够!高手看看! |
|
汇编问题
哈哈,好的,新手看了怕晕 |
|
帮忙看看,自校验问题
00430678 8B85 70B6FFFF mov eax, dword ptr [ebp+FFFFB670] 0043067E 83C0 40 add eax, 40 00430681 E8 DA090000 call 00431060 00430686 50 push eax 00430687 FF15 CC535300 call dword ptr [<&kernel32.GetFileTim>; // kernel32.GetFileTime 0043068D 8B95 70B6FFFF mov edx, dword ptr [ebp+FFFFB670] 00430693 83C2 50 add edx, 50 00430696 52 push edx 00430697 8D85 3CFFFFFF lea eax, dword ptr [ebp-C4] 0043069D 50 push eax 0043069E FF15 C8535300 call dword ptr [<&kernel32.FileTimeTo>; //kernel32.FileTimeToSystemTime 004306A4 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 004306AA 66:C741 5E 0000 mov word ptr [ecx+5E], 0 004306B0 8B95 70B6FFFF mov edx, dword ptr [ebp+FFFFB670] 004306B6 66:C742 54 0000 mov word ptr [edx+54], 0 004306BC 6A 02 push 2 004306BE 6A FF push -1 004306C0 6A F4 push -0C 004306C2 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 004306C8 83C1 40 add ecx, 40 004306CB 8B85 70B6FFFF mov eax, dword ptr [ebp+FFFFB670] 004306D1 8B50 40 mov edx, dword ptr [eax+40] 004306D4 FF52 28 call dword ptr [edx+28] 004306D7 83C0 0C add eax, 0C 004306DA 8945 B0 mov dword ptr [ebp-50], eax 004306DD 6A 0C push 0C 004306DF 8D45 BC lea eax, dword ptr [ebp-44] 004306E2 50 push eax 004306E3 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 004306E9 83C1 40 add ecx, 40 004306EC 8B95 70B6FFFF mov edx, dword ptr [ebp+FFFFB670] 004306F2 8B42 40 mov eax, dword ptr [edx+40] 004306F5 FF50 34 call dword ptr [eax+34] 004306F8 8B4D C4 mov ecx, dword ptr [ebp-3C] 004306FB 890D 30D25800 mov dword ptr [58D230], ecx 00430701 813D 30D25800 3>cmp dword ptr [58D230], 35363439 0043070B 75 06 jnz short 00430713 0043070D 8B55 BC mov edx, dword ptr [ebp-44] 00430710 8955 B0 mov dword ptr [ebp-50], edx 00430713 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 00430719 83C1 40 add ecx, 40 0043071C E8 CFFDFDFF call 004104F0 00430721 6A 00 push 0 00430723 6A 00 push 0 00430725 68 80000000 push 80 0043072A 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 00430730 83C1 40 add ecx, 40 00430733 8B85 70B6FFFF mov eax, dword ptr [ebp+FFFFB670] 00430739 8B50 40 mov edx, dword ptr [eax+40] 0043073C FF52 28 call dword ptr [edx+28] 0043073F 6A 10 push 10 00430741 68 F4D15800 push 0058D1F4 00430746 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 0043074C 83C1 40 add ecx, 40 0043074F 8B85 70B6FFFF mov eax, dword ptr [ebp+FFFFB670] 00430755 8B50 40 mov edx, dword ptr [eax+40] 00430758 FF52 34 call dword ptr [edx+34] 0043075B 8B45 B0 mov eax, dword ptr [ebp-50] 0043075E 2D 90000000 sub eax, 90 00430763 8945 B8 mov dword ptr [ebp-48], eax 00430766 8D8D 44FFFFFF lea ecx, dword ptr [ebp-BC] 0043076C 51 push ecx 0043076D E8 9EAA0900 call 004CB210 00430772 83C4 04 add esp, 4 00430775 817D B8 0004000>cmp dword ptr [ebp-48], 400 0043077C 76 26 jbe short 004307A4 0043077E 68 00040000 push 400 00430783 8D95 DCB6FFFF lea edx, dword ptr [ebp+FFFFB6DC] 00430789 52 push edx 0043078A 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 00430790 83C1 40 add ecx, 40 00430793 8B85 70B6FFFF mov eax, dword ptr [ebp+FFFFB670] 00430799 8B50 40 mov edx, dword ptr [eax+40] 0043079C FF52 34 call dword ptr [edx+34] 0043079F 8945 B4 mov dword ptr [ebp-4C], eax 004307A2 EB 23 jmp short 004307C7 004307A4 8B45 B8 mov eax, dword ptr [ebp-48] 004307A7 50 push eax 004307A8 8D8D DCB6FFFF lea ecx, dword ptr [ebp+FFFFB6DC] 004307AE 51 push ecx 004307AF 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] 004307B5 83C1 40 add ecx, 40 004307B8 8B95 70B6FFFF mov edx, dword ptr [ebp+FFFFB670] 004307BE 8B42 40 mov eax, dword ptr [edx+40] 004307C1 FF50 34 call dword ptr [eax+34] 004307C4 8945 B4 mov dword ptr [ebp-4C], eax 004307C7 8B4D B8 mov ecx, dword ptr [ebp-48] 004307CA 2B4D B4 sub ecx, dword ptr [ebp-4C] 004307CD 894D B8 mov dword ptr [ebp-48], ecx 004307D0 8B55 B4 mov edx, dword ptr [ebp-4C] 004307D3 52 push edx 004307D4 8D85 DCB6FFFF lea eax, dword ptr [ebp+FFFFB6DC] 004307DA 50 push eax 004307DB 8D8D 44FFFFFF lea ecx, dword ptr [ebp-BC] 004307E1 51 push ecx 004307E2 E8 49A60900 call 004CAE30 004307E7 83C4 0C add esp, 0C 004307EA 817D B4 0004000>cmp dword ptr [ebp-4C], 400 004307F1 ^ 74 82 je short 00430775 004307F3 8D95 44FFFFFF lea edx, dword ptr [ebp-BC] 004307F9 52 push edx 004307FA 68 04D25800 push 0058D204 004307FF E8 CCA80900 call 004CB0D0 00430804 83C4 08 add esp, 8 00430807 C785 D0B6FFFF 0>mov dword ptr [ebp+FFFFB6D0], 0 00430811 EB 0F jmp short 00430822 00430813 8B85 D0B6FFFF mov eax, dword ptr [ebp+FFFFB6D0] 00430819 83C0 01 add eax, 1 0043081C 8985 D0B6FFFF mov dword ptr [ebp+FFFFB6D0], eax 00430822 83BD D0B6FFFF 1>cmp dword ptr [ebp+FFFFB6D0], 10 00430829 7D 3E jge short 00430869 //大于等与则跳(关键跳) 0043082B 8B8D D0B6FFFF mov ecx, dword ptr [ebp+FFFFB6D0] 00430831 0FB691 F4D15800 movzx edx, byte ptr [ecx+58D1F4] 00430838 8B85 D0B6FFFF mov eax, dword ptr [ebp+FFFFB6D0] 0043083E 0FB688 04D25800 movzx ecx, byte ptr [eax+58D204] 00430845 3BD1 cmp edx, ecx 00430847 74 1E je short 00430867 00430849 64:8B0D 0400000>mov ecx, dword ptr fs:[4] 00430850 83E9 04 sub ecx, 4 00430853 8BFC mov edi, esp 00430855 8BE1 mov esp, ecx 00430857 2BCF sub ecx, edi 00430859 FC cld 0043085A F3:AA rep stos byte ptr es:[edi] 0043085C 33ED xor ebp, ebp 0043085E 8BF5 mov esi, ebp 00430860 8BFD mov edi, ebp 00430862 ^ E9 29FDFFFF jmp 00430590 // 00430867 ^ EB AA jmp short 00430813 //这两个无条件跳则挂掉 00430869 8B8D 70B6FFFF mov ecx, dword ptr [ebp+FFFFB670] //jge跳到此处 0043086F 83C1 40 add ecx, 40 00430872 E8 79FCFDFF call 004104F0 //两个jmp都跳到此处 00430590 6A 00 push 0 00430592 68 E8455600 push 005645E8 ; ASCII "Virus Alert" 00430597 68 C0455600 push 005645C0 ; ASCII "Application was modified by a virus !!!" 0043059C 6A 00 push 0 0043059E FF15 34565300 call dword ptr [<&USER32.MessageBoxA>>; USER32.MessageBoxA 004305A4 6A 00 push 0 004305A6 FF15 58535300 call dword ptr [<&kernel32.ExitProces>; kernel32.ExitProcess 004305AC CC int3 004305AD CC int3 004305AE CC int3 004305AF CC int3 保存之后运行还有问题,我也想过用其他方式高,但功底不够,没有成功,找不到程序将原来的程序修改时间时间值保存在哪里 找到了直接修改可能会更好一些,高手帮看看 附件发不上来,加qq 22318837 或留email小弟发过去 |
|
汇编问题
哈哈,终于有人回了,我还以为汇编太久没看,概念都忘记了,谢谢 |
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值