2----继续分析.不设任何断点,运行起来,输入试练码123456789(随便输入的),点确定,出现出错提示: "The serial you entered is not correct!",然后我们重新载入 crtl+f12,再利用罗聪大侠给我们提供的 查字符串的工具(注:大家可以再论坛里下载,自己找找吧),查找上面的这个字符串,来到这里.
0040106C |> 6A 25 push 25 ; /Count = 25 (37.) /*------------------------------------------------------------------------------------*/ /* 我们在这里设个断点,重新载入 crtl+f12,f9运行起来,输入试练码,确定后,就会停在这里 */ /* 设断点方法:[利用命令行插件,输入bp 0040106C] 或 [把光标点到此行,按f2或双击] */ /*------------------------------------------------------------------------------------*/ 0040106E |. 68 24234000 push unabexcm.00402324 ; |Buffer = unabexcm.00402324 00401073 |. 6A 68 push 68 ; |ControlID = 68 (104.) 00401075 |. FF75 08 push dword ptr ss:[ebp+8] ; |hWnd 00401078 |. E8 F4000000 call <jmp.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA /*------------------------------------------------------------------------------------*/ The GetDlgItemText function retrieves the title or text associated with a control in a dialog box. 从对话框的一个控件中(这里是文本框),得到文本串, 实际就是,我们输入的试练码123456789. UINT GetDlgItemText( HWND hDlg, // handle of dialog box 对话框句柄 int nIDDlgItem, // identifier of control 控件id号 LPTSTR lpString, // address of buffer for text 文本缓冲区地址,存放要得到的文本 int nMaxCount // maximum size of string 文本串的长度 );函数原型 函数执行完后,我们到od界面的左下内存窗口中,找到文本缓冲区地址00402324,就可以看到试练码了. 找到位置的方法: 先在内存窗口中任意点一下,使其成为当前窗口,在CRTL+G,输入00402324,回车,就到了 这就是你看到的试练码了: 00402324 31 32 33 34 35 36 37 38 12345678 0040232C 39 00 00 00 00 00 00 00 9....... 00402334 00 00 00 00 00 00 00 00 ........ /*------------------------------------------------------------------------------------*/ 0040107D |. 6A 00 push 0 ; /pFileSystemNameSize = NULL 0040107F |. 6A 00 push 0 ; |pFileSystemNameBuffer = NULL 00401081 |. 68 C8204000 push unabexcm.004020C8 ; |pFileSystemFlags = unabexcm.004020C8 00401086 |. 68 90214000 push unabexcm.00402190 ; |pMaxFilenameLength = unabexcm.00402190 0040108B |. 68 94214000 push unabexcm.00402194 ; |pVolumeSerialNumber = unabexcm.00402194 00401090 |. 6A 32 push 32 ; |MaxVolumeNameSize = 32 (50.) 00401092 |. 68 5C224000 push unabexcm.0040225C ; |VolumeNameBuffer = unabexcm.0040225C 00401097 |. 6A 00 push 0 ; |RootPathName = NULL 00401099 |. E8 B5000000 call <jmp.&KERNEL32.GetVolumeInformationA> ; \GetVolumeInformationA /*------------------------------------------------------------------------------------*/ The GetVolumeInformation function returns information about a file system and volume whose root directory is specified.返回文件系统及当前磁盘卷标信息 BOOL GetVolumeInformation( LPCTSTR lpRootPathName, // address of root directory of the file system LPTSTR lpVolumeNameBuffer, // 当前磁盘卷标的地址,里面就是读到的卷标,我的机器是CCC-1 DWORD nVolumeNameSize, // length of lpVolumeNameBuffer LPDWORD lpVolumeSerialNumber, // address of volume serial number LPDWORD lpMaximumComponentLength, // address of system's maximum filename length LPDWORD lpFileSystemFlags, // address of file system flags LPTSTR lpFileSystemNameBuffer, // address of name of file system DWORD nFileSystemNameSize // length of lpFileSystemNameBuffer ); 函数原型 /*------------------------------------------------------------------------------------*/