[求助][求助]关于 关闭360安全卫士后, DialogBox不起作用
请在无360的机器上运行以确定是否为360的某项安全策略的影响。

[求助]UPX脱壳后运行出错，已经附加数据
正确的解决方案: upx -d PetSprite.exe

[求助]win7的随机基地址加载如何解除???
擦除exe的重定位表即可.

[求助]请专家指点迅雷方舟里面公开文件批量下载方法
Download page: 2c6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3c8&6L8X3q4E0K9h3y4Q4x3X3g2^5L8s2m8S2L8W2)9J5k6h3y4G2L8g2)9J5c8Y4m8J5k6i4k6A6k6i4N6Q4x3V1j5I4x3K6t1I4z5o6x3%4y4e0N6Q4x3V1k6X3K9h3I4W2i4K6u0r3y4e0x3@1x3e0p5&6x3r3c8Q4x3X3c8V1z5e0j5^5i4K6u0V1y4o6c8T1k6g2)9J5k6r3u0S2y4K6g2Q4x3X3b7H3j5$3j5$3y4U0x3J5x3o6M7&6y4r3x3`.

<script type="text/javascript">
data.nodeId = "5341190d-d968-44be-ba75-0cf66320794c";
data.userId = "132183757";
initData(
{
"rtn":0,
"data":
{
"theme":
{
"themeNodeId":"bfab302b-647b-487f-95e2-126eba97d85d",
"viewStatus":1,
"auth":1,
"question":"","
followingStatus":0
},
"file":
{
"name":"f(x) - LA chA TA MV GomTV 1080p WEB-DL Xvid.avi",
"ext":"avi",
"auditTips":"",
"fileAuditStatus":10,
"themeNodeName":"1080p 最性感MV",
"fromThemeNodeName":"",
"commentCount":0,
"commentList":[],
"likeCount":0,
"saveCount":4,
"fileStatus":0,
"likeStatus":-,
"followingStatus":0,
"dirStatus":0,
"thumbW":1920,
"thumbH":1080,
"feedTs":0,
"viewCount":0,
"downloadCount":0,
"vodCode":"IHCgOS6g2CfKEzchoFr5792FsQpemZeFyINgxlctiFzsdV4khZQyowAAAAAPzTJY",
"commentPagesize":10,
"commentPageNum":1,
"hotValue":70,
"recommendSWF":null,
"auditStatus":1,
"thumb":"184K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3V1J5i4K6u0W2P5r3I4H3j5h3&6Q4x3X3g2C8j5h3&6A6L8h3N6Q4x3X3g2U0L8$3#2Q4x3V1k6J5K9h3#2Y4i4K6y4r3N6h3W2Q4x3@1b7I4x3K6t1I4z5o6x3%4y4e0N6Q4x3U0k6Y4i4K6y4p5x3U0l9%4x3p5p5H3x3K6V1J5c8f1p5H3c8o6R3J5y4@1y4m8x3e0x3K6y4K6t1I4b7e0l9#2b7f1j5&6c8f1k6p5c8o6R3#2b7U0p5H3b7g2)9J5y4X3&6Q4x3@1b7#2x3K6b7I4x3e0V1H3k6q4)9J5k6r3b7&6y4U0S2Q4x3X3b7@1y4r3u0W2i4K6u0V1j5X3p5%4y4g2)9J5k6o6m8U0k6U0j5$3x3K6t1H3y4K6V1@1j5#2)9J5y4Y4y4U0L8W2)9K6c8s2b7&6i4K6t1$3M7W2)9K6c8o6f1&6y4W2)9J5y4Y4y4@1i4K6y4p5y4q4)9J5y4Y4y4A6i4K6y4p5j5i4k6A6i4K6t1$3N6q4)9K6c8o6t1`.",
"extIcon":"9d0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3W2E0k6#2)9J5k6h3y4D9K9h3g2F1N6o6u0Q4x3X3g2&6N6h3&6Q4x3X3g2^5N6h3&6D9k6h3W2Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8h3q4Y4k6i4y4Q4x3V1k6X3K9h3I4W2K9h3y4G2L8W2)9J5c8Y4k6A6k6r3g2G2i4K6u0W2M7r3&6Y4",
"pageSite":"",
"type":1,
"size":265106008,
"path":"/1080p 最性感MV/最新更新！都是精挑细选的/f(x) - LA chA TA MV GomTV 1080p WEB-DL Xvid.avi",
"lastModified":1326984200,
"from":0,
"status":0,
"url":"715K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3N6V1L8q4)9J5k6i4N6S2L8r3E0T1L8%4S2Q4x3X3g2D9K9i4S2A6j5h3&6Q4x3X3g2$3K9i4m8Q4x3X3g2^5N6h3&6D9k6h3W2Q4x3X3g2U0L8$3#2Q4x3V1k6V1L8%4N6F1L8r3!0S2k6q4)9K6c8X3k6A6k6q4)9K6c8q4S2H3L8g2S2Z5j5$3W2p5h3f1#2K9h3p5I4k6K9r3x3%4d9q4k6W2d9V1W2i4g2f1#2I4e0W2W2y4M7K6m8b7b7f1q4m8b7f1q4o6b7Y4N6G2c8r3E0#2L8@1&6Y4L8Y4W2Z5e0e0y4u0j5f1u0S2i4K6u0n7k6g2)9J5c8X3c8Z5j5V1g2w2i4K6t1$3L8h3W2V1i4K6y4p5y4U0j5$3i4K6t1$3N6r3S2J5k6i4y4Z5L8$3I4V1i4K6y4p5x3e0f1H3i4K6t1$3N6r3W2V1i4K6y4p5c8U0m8r3x3o6k6p5c8e0t1J5x3o6b7K6c8p5b7#2c8f1f1@1y4@1u0r3z5p5f1&6x3e0x3%4b7e0q4m8x3e0k6Q4x3U0k6K6M7X3y4A6k6q4)9K6c8o6u0Q4x3U0k6$3k6i4u0F1L8#2)9K6c8o6q4Q4x3U0k6V1M7%4c8Q4x3@1b7H3i4K6t1$3k6#2)9K6c8o6t1H3y4K6m8m8x3o6x3&6x3V1g2m8x3p5b7^5x3U0N6o6b7e0p5K6x3K6M7J5x3f1p5H3y4f1q4r3z5f1g2r3c8p5b7^5y4f1t1I4x3p5q4Q4x3U0k6A6i4K6y4p5x3U0l9%4x3p5p5H3x3K6V1J5c8f1p5H3c8o6R3J5y4@1y4m8x3e0x3K6y4K6t1I4b7e0l9#2b7f1j5&6c8f1k6p5c8o6R3#2b7U0p5H3b7g2)9J5y4Y4c8Q4x3@1b7I4i4K6t1$3M7$3y4F1i4K6y4p5N6o6W2Q4x3U0k6#2K9g2)9K6c8o6p5K6x3U0p5^5x3K6M7#2y4#2)9J5y4X3c8@1i4K6y4p5x3#2)9J5y4X3&6A6i4K6y4p5y4e0x3@1x3e0p5&6x3r3c8Q4x3X3c8V1z5e0j5^5i4K6u0V1y4o6c8T1k6g2)9J5k6r3u0S2y4K6g2Q4x3X3b7H3j5$3j5$3y4U0x3J5x3o6M7&6y4r3y4Q4x3U0k6K6i4K6y4p5x3U0j5#2x3e0l9$3x3o6l9^5i4K6t1$3k6Y4k6Q4x3@1b7#2z5e0k6Q4x3U0k6K6N6q4)9K6c8o6c8Q4x3U0k6E0i4K6y4p5x3g2)9J5y4X3&6Q4x3@1b7H3z5o6m8r3y4V1p5I4b7f1y4m8b7e0x3J5b7K6t1H3y4p5x3J5z5o6j5J5x3o6p5^5b7V1x3J5x3U0p5#2y4o6b7I4y4o6V1H3c8U0x3@1b7K6y4o6y4o6k6q4y4V1b7#2y4o6y4r3y4U0t1#2x3@1b7K6b7V1t1K6x3e0M7H3x3U0l9K6c8e0l9%4x3U0m8o6c8f1x3%4y4p5b7J5x3o6f1^5x3f1j5J5b7U0l9$3b7@1c8q4x3U0M7%4y4U0V1H3x3l9`.`.",
"userId":132183757,
"nodeId":"5341190d-d968-44be-ba75-0cf66320794c",
"themeNodeId":"bfab302b-647b-487f-95e2-126eba97d85d",
"fromThemeUserId":0,
"fromThemeNodeId":"",
"gcid":"2070A0392EA0D827CA133721A05AF9EFDD85B10A",
"nickname":"问花花不语",
"auditUnknown":false,
"cid":"5E999785C88360C6572D885CEC755E24859432A3",
"desc":"",
"operatorUsername":"231095833",
"operatorNickname":"问花花不语",
"opseratorFlagV":0,
"pageUrl":"",
"operator":132183757,
"readableSize":"252.82MB",
"subFileNum":0,
"subDirNum":0,
"isOfficial":0,
"revision":596,
"storageType":4,
"extDesc":"",
"nodeProp":"",
"section":"t9",
"extFilted":0
},
"xdriveid":null
}
}
);
initPage();
</script>
</html>

when mouse stay on "Download" Botton, the "url" is displayed on status bar.

[原创]自己写的一个压缩壳
00425950    FF15 50614200   call    dword ptr [<&KERNEL32.GetTickCount>]  ; kernel32.GetTickCount
00425956    8D0D 66594200   lea     ecx, dword ptr [425966]
0042595C    8B5424 04       mov     edx, dword ptr [esp+4]
00425960    85D2            test    edx, edx
00425962    74 02           je      short 00425966
00425964    8902            mov     dword ptr [edx], eax
00425966    8BD0            mov     edx, eax
00425968    8B41 EC         mov     eax, dword ptr [ecx-14]
0042596B    8B00            mov     eax, dword ptr [eax]
0042596D    25 0000F0FF     and     eax, FFF00000    //问题在这里
00425972    33C2            xor     eax, edx
00425974    C2 0400         retn    4

问题解释：这里你的意思是通过GetTickCount的地址来获取kernel32.dll的基址。

在WinXP上
GetTickCount=7C80934A
Kernel32的基址=7C80000
你这样做是没有问题的。

在Win7上：
GetTickCount=74AD110C
Kernel32的基址=74AC0000
你这么做的话，你得到的Kernel32基址就变成了74A0000，这时候你再用这个基址去索引导出表肯定会内存访问异常的。

其它部分没有问题。

脱壳中为什么要用到"修复IAT"。
因为大多数外壳喜欢擦除IAT表以防止被脱壳。

[求助]X86汇编怎么裸机关机?
楼上是重启……

[求助]求神人破解，要付教程
外壳: SafeEngine Licenser Demo v 1.8.0.0
外挂自身内嵌驱动检测调试，如果发现，
第一次强制重启+当前目录生成文本文档，警告第二个发现将格式化硬盘。
第二次发现，格式化硬盘。

这挂你伤不起啊。

求盛大网盘批量获取下载地址的方法
Download Page:515K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2$3k6i4u0T1L8%4S2Q4x3X3g2U0L8$3#2Q4x3V1k6X3i4K6u0r3L8f1E0I4d9U0t1I4x3h3k6d9b7f1k6k6x3e0R3K6N6o6W2d9h3f1!0q4h3p5#2*7c8s2l9`.

<meta name="csrf-param" content="authenticity_token" />
<meta name="csrf-token" content="/PZY7GZpxLZhgWVYlgwPKNZSsF2otkqlfkR8hNqXLXA=" />

var data = {
"linkid":"mKqJ211fRAFY183t9RYOEXMzDp",
"code":200,
"nickname":"airplayeverbox",
"downloadLimit":0,
"editTime":"13151539102890000",
"ver":"MDAwMDAwMDAwMDAwMDAxNQ==",
"activity":
{
"href":"8b1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4c8A6L8X3N6T1L8$3!0C8i4K6u0W2j5$3!0E0i4K6u0r3b7h3y4@1K9i4k6A6N6s2W2Q4x3V1k6q4P5r3y4Z5j5h3&6Y4k6g2g2K6k6i4u0Q4x3X3g2Z5N6r3#2D9",
"title":"听书网八月回馈大放送，海量音频免费包月听，点击即获听书卡，过期不候哦~",
"target":"_blank",
"status":false
},
"type":2,
"entries":
{
"linkid":"hDzMrhNhlEzgfuM8vA1pgGinvl",
"downloadLimit":94,
"editTime":"13045164230000000",
"ver":"MDAyZTU4ODFmYzY2N2NhOQ==",
"type":2,
"downloadCount":6,
"path":"/无损音乐/《奥斯卡经典电影原声60专辑》20G",
"fileSize":"21691273410",
"fileCount":746
},
{
"linkid":"svS4YjsG9hBsP9PTPBYAIw7YNV",
"downloadLimit":100,
"editTime":"13045161280000000",
"ver":"MDAyZTU4ODE0YzhiZmY4Mg==",
"type":2,
"downloadCount":0,
"path":"/无损音乐/华语流行1-138G",
"fileSize":"148329178069",
"fileCount":3229},
......
{"linkid":"b9zXI7xYzR87QMf8ixtf78fAoM",
"downloadLimit":100,
"editTime":"13045166590000000",
"ver":"MDAyZTU4ODI4ZjBlMGM0Mw==",
"type":2,
"downloadCount":0,
"path":"/无损音乐/爵士-新世纪85G",
"fileSize":"91193162481",
"fileCount":2046},
{"editTime":"13045166720000000",
"ver":"MDAyZTU4ODI5MGRkNzYyYw==",
"type":2,
"path":"/无损音乐/赠送DTS试听",
"fileSize":"9147921119",
"fileCount":237}],
"downloadCount":300521,
"path":"/无损音乐",
"posts":[{"created_at":1335509744,
"created_on":"2012-04-26",
"title":"Haier云时代 · 分享赢好礼",
"publish_time":1335369600}],
"fileSize":"1999574947288",
"owner":"1545305283@sdo",
"fileCount":49177};

Download Page:5daK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2$3k6i4u0T1L8%4S2Q4x3X3g2U0L8$3#2Q4x3V1k6X3i4K6u0r3K9p5c8*7e0i4u0Z5e0X3S2D9c8i4A6Y4k6Y4g2y4z5s2k6m8x3i4m8Y4c8$3W2F1N6X3H3`.

<meta name="csrf-param" content="authenticity_token" />
<meta name="csrf-token" content="/PZY7GZpxLZhgWVYlgwPKNZSsF2otkqlfkR8hNqXLXA=" />

var data =
{
"linkid":"hDzMrhNhlEzgfuM8vA1pgGinvl",
"code":200,
"nickname":"airplayeverbox",
"downloadLimit":94,
"editTime":"13045164230000000",
"ver":"MDAyZTU4ODFmYzY2N2NhOQ==",
"activity":
{
"href":"c38K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4c8A6L8X3N6T1L8$3!0C8i4K6u0W2j5$3!0E0i4K6u0r3b7h3y4@1K9i4k6A6N6s2W2Q4x3V1k6q4P5r3y4Z5j5h3&6Y4k6g2g2K6k6i4u0Q4x3X3g2Z5N6r3#2D9",
"title":"听书网八月回馈大放送，海量音频免费包月听，点击即获听书卡，过期不候哦~",
"target":"_blank",
"status":false},
"type":2,
"entries":[
{
"editTime":"13045173710000000",
"ver":"MDAyZTU4ODQzMTg5YjdlMQ==",
"type":2,
"path":"/《奥斯卡经典电影原声60专辑》20G/OST 001】《飞屋环游记》",
"fileSize":"362847717",
"fileCount":56},
{"editTime":"13045211710000000",
"ver":"MDAyZTU4OGQwYTY3NmZkZg==",
"type":2,
"path":"/《奥斯卡经典电影原声60专辑》20G/OST 002】《阿凡达》(Avatar)",
"fileSize":"361808078",
"fileCount":18},
......
{"editTime":"13045241320000000",
"ver":"MDAyZTU4OTNlZjZkNDI4Nw==",
"type":2,
"path":"/《奥斯卡经典电影原声60专辑》20G/OST 066】《末代皇帝》(The Milagro Beanfield War)60届最佳配乐",
"fileSize":"203469544",
"fileCount":6
}],
"downloadCount":6,
"path":"/《奥斯卡经典电影原声60专辑》20G",
"posts":[{"created_at":1335509744,
"created_on":"2012-04-26",
"title":"Haier云时代 · 分享赢好礼",
"publish_time":1335369600}],
"fileSize":"21691273410",
"owner":"1545305283@sdo",
"fileCount":746};

Request: POST /f/status/hDzMrhNhlEzgfuM8vA1pgGinvl HTTP/1.1
Referer: 0ddK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2$3k6i4u0T1L8%4S2Q4x3X3g2U0L8$3#2Q4x3V1k6X3i4K6u0r3K9p5c8*7e0i4u0Z5e0X3S2D9c8i4A6Y4k6Y4g2y4z5s2k6m8x3i4m8Y4c8$3W2F1N6X3H3`.
authenticity_token=/PZY7GZpxLZhgWVYlgwPKNZSsF2otkqlfkR8hNqXLXA=&path=OST 001】《飞屋环游记》

var data = {"linkid":"hDzMrhNhlEzgfuM8vA1pgGinvl",
"code":200,
"nickname":"airplayeverbox",
"downloadLimit":94,
"editTime":"13045164230000000",
"ver":"MDAyZTU4ODFmYzY2N2NhOQ==",
"activity":{"href":"96bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4c8A6L8X3N6T1L8$3!0C8i4K6u0W2j5$3!0E0i4K6u0r3b7h3y4@1K9i4k6A6N6s2W2Q4x3V1k6q4P5r3y4Z5j5h3&6Y4k6g2g2K6k6i4u0Q4x3X3g2Z5N6r3#2D9",
"title":"听书网八月回馈大放送，海量音频免费包月听，点击即获听书卡，过期不候哦~",
"target":"_blank",
"status":false},
"type":2,
"entries":[
{
"editTime":"13045173710000000",
"ver":"MDAyZTU4ODQzMTg5YjdlMQ==",
"type":2,
"path":"/《奥斯卡经典电影原声60专辑》20G/OST 001】《飞屋环游记》",
"fileSize":"362847717",
"fileCount":56
},
{
"editTime":"13045211710000000",
"ver":"MDAyZTU4OGQwYTY3NmZkZg==",
"type":2,
"path":"/《奥斯卡经典电影原声60专辑》20G/OST 002】《阿凡达》(Avatar)",
"fileSize":"361808078",
"fileCount":18},
{
"editTime":"13045245220000000",
"ver":"MDAyZTU4OTRkN2Y0OGRhOQ==",
"type":2,
"path":"/《奥斯卡经典电影原声60专辑》20G/OST 003疠009.《贫民富翁》Slumdog Millionaire",
"fileSize":"348594738",
"fileCount":22
},
......
{
"editTime":"13045241320000000",
"ver":"MDAyZTU4OTNlZjZkNDI4Nw==",
"type":2,
"path":"/《奥斯卡经典电影原声60专辑》20G/OST 066】《末代皇帝》(The Milagro Beanfield War)60届最佳配乐",
"fileSize":"203469544",
"fileCount":6
}
],
"downloadCount":6,
"path":"/《奥斯卡经典电影原声60专辑》20G",
"posts":[{"created_at":1335509744,
"created_on":"2012-04-26",
"title":"Haier云时代 · 分享赢好礼",
"publish_time":1335369600}],
"fileSize":"21691273410",
"owner":"1545305283@sdo",
"fileCount":746};

基本就是这样子的，工具自己写吧。

[求助]这种反逆向方式怎么突破
这种东西一般是外壳采用的。

有两种方法，一去下载加壳软件，一般原始dll会以文件形式存在。
二，在壳自身解压数据的时候从内存中dump出来，但是这时候你只能祈祷壳没有把数据处理的太彻底。

[求助]如何用VB生成一个简单的抽奖程序
MyValue=Int((999 * Rnd) +1)

把这句话丢入一个Timer控件里面使用，比如你是用TEXT控件来显示号码，那就再后面加上一个TEXT.caption = CSTR(MyValue)就可以了。

[原创]这是什么壳呀·求脱
ZProtect

[求助]关于如何修复输入表
upx -d
其他不说了

[讨论]PE文件中的函数替代方法
难易程度取决于2个PE文件的特性，及2个函数的特性。

如果后一个PE文件有重定位表，那就会比较好办。
如果没有的话，那就只能用你的笨方法了。

[原创]一个简单的驱动的反编译
谢谢,最后分支排错了,然后代码就堆错地方了.

重新看了一下原来的文件，去掉Else分支，修改成这样就对了。
        if (nameinfo)         FltReleaseFileNameInformation(nameinfo);
}
return return_value;

[分享]VS11B-CHS驱动模板显示补丁
f75K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4k6A6M7%4g2S2L8s2y4@1N6h3c8A6L8#2)9J5c8U0p5I4i4K6u0r3k6h3&6Q4x3X3c8#2M7#2)9J5c8X3c8G2N6$3&6D9L8$3q4V1M7#2)9J5x3%4g2D9N6r3W2E0j5i4c8W2
左边选择英语,右边选择简体中文

[原创]一个简单的驱动的反编译
微软的驱动程序一般是只支持C语言编译的。C++据说从WDK7开始支持，但是还是算了吧。



有啊, ikbFilter.c ikbFilter.h

求在win7下知道进程ID，如何得到进程的全路径
BOOL QueryProcessImageName(DWORD ProcessID, BOOL bNativeFormat,LPTSTR Buffer,DWORD BufferSize)
{
        HANDLE hProcess=OpenProcess(PROCESS_QUERY_INFORMATION ,FALSE,ProcessID);
        if (!Buffer)
        {
                Buffer=(LPTSTR)malloc(MAX_PATH*sizeof(TCHAR));
                BufferSize=MAX_PATH;
        }
        if(!BufferSize) BufferSize=MAX_PATH;
        return QueryFullProcessImageName(hProcess,(bNativeFormat)?1:0,Buffer,BufferSize);
}

原则上，你只要传递一个ProcessID进来就可以了，后面3个参数都可以填0。

[求助]PE 文件如何调用cmd.exe
PE头部信息里面IMAGE_OPTIONAL_HEADER.Subsystem如果为IMAGE_SUBSYSTEM_WINDOWS_CUI，系统将为其自动创建一个控制台窗口。