Phone spy电话录音系统注册分析
Phone Spy为国咨软件最新荣誉出品的电话录音软件,它突破性地解决了目前市面上存在的二大类产品的缺点:1、采用语音卡或专用语音设备的电话录音系统售价高昂;2、采用MODEM 的电话录音软件只能对打进来的电话进行录音、而不能对打出去的电话进行录音。Phone Spy通过一个小巧的电话--语音转接器,用电脑声卡对电话进行录音;有声时自动启动录音,无声时自动停止。Phone Spy支持一台电脑插接最多6块声卡,通过6块声卡的12个声道,即可实现对最多12条电话的录音。
Phone Spy采用先进的软件技术,自动检测设备,无需设置,安装和使用极其简单。
Phone Spy除了可应用于对电话进行录音外,还可以对各种通过电脑声卡的声音源进行录音。到目前为止, Phone Spy已经被应用于电话、语音聊天、网络电话、电视声音信号、广播信号、报警系统等的录音。
Phone spy针对企业级用户预留了CRM接口。通过“设置”功能正确设置ODBC数据源、数据库用户名及密码、数据表等内容后,每次有电话打入时,Phone spy会自动在所设置的数据库中查找与该号码相匹配的数据,在日志管理界面下方的“来电者详细资料”中显示出来电者的相关信息,双击“来电者详细资料”中显示的信息,就可以看到来电人的详细资料。若在数据库中未找到匹配的数据,则在“来电者详细资料”中显示来电的时间、号码,并在电话号码的右边,以“陌生人”来标注。
网址:www.gooods.com
电话录音机phone spy7。1注册算法
1、注册码共15位,前6位与后6位为注册码,第8位必须为“-”,第7、9位必须对应下列运算(经下面分析后好象“-”不一定要在第8位,只要注册码中含有下列版本信息,注意版本信息要参与注册码的运算)。
9-1; 标准版1线
8-3; 标准版2线
6-1; 标准版3线
5-5; 标准版4线
6-9; 标准版5线
9-8; 标准版6线
2-6; 标准版7线
8-2; 标准版8线
4-8; 标准版9线
8-6; 标准版10线
0-2; 标准版11线
4-0; 标准版12线
2-2; 专业版1线
9-4; 专业版2线
7-2; 专业版3线
6-6; 专业版4线
7-0; 专业版5线
0-9; 专业版6线
3-7; 专业版7线
9-3; 专业版8线
5-9; 专业版9线
9-7; 专业版10线
1-3; 专业版11线
5-1; 专业版12线
3-3; 企业版1线
0-5; 企业版2线
8-8; 企业版3线
7-7; 企业版4线
8-1; 企业版5线
1-0; 企业版6线
4-4; 企业版7线
0-4; 企业版8线
6-0; 企业版9线
0-8; 企业版10线
2-4; 企业版11线
6-2; 企业版12线
该软件好象不支持12线,不知为何!!!
2、机器码处理:(123456789;123均未注册版本)
2-1:
00477B3A |> /8D85 44FFFFFF /LEA EAX,DWORD PTR SS:[EBP-BC]
00477B40 |. |50 |PUSH EAX
00477B41 |. |B9 01000000 |MOV ECX,1
00477B46 |. |8BD7 |MOV EDX,EDI
00477B48 |. |8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14] EAX=机器码:1466077574
00477B4B |. |E8 18D0F8FF |CALL BAKPHONE.00404B68
00477B50 |. |8B85 44FFFFFF |MOV EAX,DWORD PTR SS:[EBP-BC]
00477B56 |. |E8 4511F9FF |CALL BAKPHONE.00408CA0
00477B5B |. |50 |PUSH EAX ; 从最右边开始取值
00477B5C |. |B8 09000000 |MOV EAX,9 ; EAX=9
00477B61 |. |5A |POP EDX ;刚刚取的值
00477B62 |. |2BC2 |SUB EAX,EDX ;EAX=9-EDX
00477B64 |. |8D95 48FFFFFF |LEA EDX,DWORD PTR SS:[EBP-B8]
00477B6A |. |E8 F50FF9FF |CALL BAKPHONE.00408B64 ; 到下面408b2e
00477B6F |. |8B95 48FFFFFF |MOV EDX,DWORD PTR SS:[EBP-B8]
00477B75 |. |8D45 F4 |LEA EAX,DWORD PTR SS:[EBP-C]
00477B78 |. |E8 93CDF8FF |CALL BAKPHONE.00404910
00477B7D |. |4F |DEC EDI
00477B7E |. |85FF |TEST EDI,EDI
00477B80 |.^\75 B8 \JNZ SHORT BAKPHONE.00477B3A ;循环得到第一次变形值由左向右放置5242293358,下面的都是从右向左放置
2-2由00477b6a来
00408B2E |$ B9 0A000000 MOV ECX,0A
00408B33 |> 52 PUSH EDX 得到的9-EAX
00408B34 |. 56 PUSH ESI
00408B35 |> 31D2 /XOR EDX,EDX
00408B37 |. F7F1 |DIV ECX 除A
00408B39 |. 4E |DEC ESI
00408B3A |. 80C2 30 |ADD DL,30 余数+30
00408B3D |. 80FA 3A |CMP DL,3A 比较
00408B40 |. 72 03 |JB SHORT BAKPHONE.00408B45
00408B42 |. 80C2 07 |ADD DL,7 否则+7
00408B45 |> 8816 |MOV BYTE PTR DS:[ESI],DL
00408B47 |. 09C0 |OR EAX,EAX
00408B49 |.^ 75 EA \JNZ SHORT BAKPHONE.00408B35
00408B4B |. 59 POP ECX
00408B4C |. 5A POP EDX
00408B4D |. 29F1 SUB ECX,ESI
00408B4F |. 29CA SUB EDX,ECX
00408B51 |. 76 10 JBE SHORT BAKPHONE.00408B63
00408B53 |. 01D1 ADD ECX,EDX
00408B55 |. B0 30 MOV AL,30
00408B57 |. 29D6 SUB ESI,EDX
00408B59 |. EB 03 JMP SHORT BAKPHONE.00408B5E
00408B5B |> 880432 /MOV BYTE PTR DS:[EDX+ESI],AL
00408B5E |> 4A DEC EDX
00408B5F |.^ 75 FA \JNZ SHORT BAKPHONE.00408B5B
00408B61 |. 8806 MOV BYTE PTR DS:[ESI],AL
00408B63 \> C3 RETN
00408B59 |. EB 03 JMP SHORT BAKPHONE.00408B5E
00408B5B |> 880432 /MOV BYTE PTR DS:[EDX+ESI],AL
00408B5E |> 4A DEC EDX
00408B5F |.^ 75 FA \JNZ SHORT BAKPHONE.00408B5B
00408B61 |. 8806 MOV BYTE PTR DS:[ESI],AL
00408B63 \> C3 RETN
3、第二次变形
00477703 |> /8D45 E8 /LEA EAX,DWORD PTR SS:[EBP-18]
00477706 |. |50 |PUSH EAX
00477707 |. |B9 01000000 |MOV ECX,1
0047770C |. |8BD6 |MOV EDX,ESI
0047770E |. |8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4] 第一次变形值5242293358
00477711 |. |E8 52D4F8FF |CALL BAKPHONE.00404B68
00477716 |. |8B45 E8 |MOV EAX,DWORD PTR SS:[EBP-18]
00477719 |. |E8 8215F9FF |CALL BAKPHONE.00408CA0
0047771E |. |8BD8 |MOV EBX,EAX
00477720 |. |8D45 E4 |LEA EAX,DWORD PTR SS:[EBP-1C]
00477723 |. |50 |PUSH EAX
00477724 |. |B9 01000000 |MOV ECX,1
00477729 |. |8BD6 |MOV EDX,ESI
0047772B |. |8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] 0000000094
0047772E |. |E8 35D4F8FF |CALL BAKPHONE.00404B68
00477733 |. |8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
00477736 |. |E8 6515F9FF |CALL BAKPHONE.00408CA0
0047773B |. |03D8 |ADD EBX,EAX ebx等于0047770e对应的值5242293358,从最右开始取,eax为0047772b对应的值,也是从最右开始,0000000094为注册码中“-”两边的值,共有36个
0047773D |. |035D F4 |ADD EBX,DWORD PTR SS:[EBP-C] 相除的值,开始为0,相加
00477740 |. |8BC3 |MOV EAX,EBX
00477742 |. |B9 0A000000 |MOV ECX,0A 除以0A
00477747 |. |99 |CDQ
00477748 |. |F7F9 |IDIV ECX
0047774A |. |8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX 值送给{EBP-C},上面用
0047774D |. |8BC3 |MOV EAX,EBX
0047774F |. |B9 0A000000 |MOV ECX,0A
00477754 |. |99 |CDQ
00477755 |. |F7F9 |IDIV ECX
00477757 |. |8BDA |MOV EBX,EDX 再相除得余数。
00477759 |. |8D55 E0 |LEA EDX,DWORD PTR SS:[EBP-20]
0047775C |. |8BC3 |MOV EAX,EBX
0047775E |. |E8 0114F9FF |CALL BAKPHONE.00408B64 到408B2E 最上面的分析
00477763 |. |8B55 E0 |MOV EDX,DWORD PTR SS:[EBP-20]
00477766 |. |8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00477769 |. |8B09 |MOV ECX,DWORD PTR DS:[ECX]
0047776B |. |8B45 08 |MOV EAX,DWORD PTR SS:[EBP+8]
0047776E |. |E8 E1D1F8FF |CALL BAKPHONE.00404954
00477773 |. |4E |DEC ESI
00477774 |. |85F6 |TEST ESI,ESI 循环,得到一个变值
00477776 |.^\75 8B \JNZ SHORT BAKPHONE.00477703 第二次变形值5242293452
4、第三次变形:
00477500 |> /8D45 E4 |/LEA EAX,DWORD PTR SS:[EBP-1C]
00477503 |. |50 ||PUSH EAX
00477504 |. |B9 01000000 ||MOV ECX,1
00477509 |. |8BD6 ||MOV EDX,ESI
0047750B |. |8B45 F8 ||MOV EAX,DWORD PTR SS:[EBP-8] 5242293452
0047750E |. |E8 55D6F8FF ||CALL BAKPHONE.00404B68
00477513 |. |8B45 E4 ||MOV EAX,DWORD PTR SS:[EBP-1C]
00477516 |. |E8 8517F9FF ||CALL BAKPHONE.00408CA0
0047751B |. |8BD8 ||MOV EBX,EAX
0047751D |. |8D45 E0 ||LEA EAX,DWORD PTR SS:[EBP-20]
00477520 |. |50 ||PUSH EAX
00477521 |. |B9 01000000 ||MOV ECX,1
00477526 |. |8B55 EC ||MOV EDX,DWORD PTR SS:[EBP-14]
00477529 |. |8B45 F4 ||MOV EAX,DWORD PTR SS:[EBP-C]
0047752C |. |E8 37D6F8FF ||CALL BAKPHONE.00404B68
00477531 |. |8B45 E0 ||MOV EAX,DWORD PTR SS:[EBP-20]
00477534 |. |E8 6717F9FF ||CALL BAKPHONE.00408CA0 94
00477539 |. 0FAFD8 ||IMUL EBX,EAX 从第二次变形值5242293452右取然后与4(即上面的94的4,随“-”两边数字变化)相乘
0047753C |. 035D E8 ||ADD EBX,DWORD PTR SS:[EBP-18] 相加
0047753F |. 8BC3 ||MOV EAX,EBX
00477541 |. B9 0A000000 ||MOV ECX,0A
00477546 |. 99 ||CDQ
00477547 |. F7F9 ||IDIV ECX
00477549 |. 8945 E8 ||MOV DWORD PTR SS:[EBP-18],EAX 相除的值,上面要用
0047754C |. 8BC3 ||MOV EAX,EBX
0047754E |. B9 0A000000 ||MOV ECX,0A
00477553 |. 99 ||CDQ
00477554 |. F7F9 ||IDIV ECX
00477556 |. 8BDA ||MOV EBX,EDX
00477558 |. 8D55 DC ||LEA EDX,DWORD PTR SS:[EBP-24]
0047755B |. 8BC3 ||MOV EAX,EBX
0047755D |. E8 0216F9FF ||CALL BAKPHONE.00408B64 余数即是变形码
00477562 |. 8B55 DC ||MOV EDX,DWORD PTR SS:[EBP-24]
00477565 |. 8D45 F0 ||LEA EAX,DWORD PTR SS:[EBP-10]
00477568 |. 8B4D F0 ||MOV ECX,DWORD PTR SS:[EBP-10]
0047756B |. E8 E4D3F8FF ||CALL BAKPHONE.00404954
00477570 |. 4E ||DEC ESI
00477571 |. 85F6 ||TEST ESI,ESI
00477573 |.^ 75 8B |\JNZ SHORT BAKPHONE.00477500 循环得到第三次变形值20969173808
5、第四次变形值:
00477703 |> /8D45 E8 /LEA EAX,DWORD PTR SS:[EBP-18]
00477706 |. |50 |PUSH EAX
00477707 |. |B9 01000000 |MOV ECX,1
0047770C |. |8BD6 |MOV EDX,ESI
0047770E |. |8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4] 第三次变形值20969173808
00477711 |. |E8 52D4F8FF |CALL BAKPHONE.00404B68
00477716 |. |8B45 E8 |MOV EAX,DWORD PTR SS:[EBP-18]
00477719 |. |E8 8215F9FF |CALL BAKPHONE.00408CA0
0047771E |. |8BD8 |MOV EBX,EAX
00477720 |. |8D45 E4 |LEA EAX,DWORD PTR SS:[EBP-1C]
00477723 |. |50 |PUSH EAX
00477724 |. |B9 01000000 |MOV ECX,1
00477729 |. |8BD6 |MOV EDX,ESI
0047772B |. |8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] 第三次00000000000
0047772E |. |E8 35D4F8FF |CALL BAKPHONE.00404B68
00477733 |. |8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
00477736 |. |E8 6515F9FF |CALL BAKPHONE.00408CA0
0047773B |. |03D8 |ADD EBX,EAX ebx等于0047770e对应的值20969173808,从最右开始取,eax为0047772b对应的值00000000000,也是从最右开始
0047773D |. |035D F4 |ADD EBX,DWORD PTR SS:[EBP-C] 相除的值,开始为0,相加
00477740 |. |8BC3 |MOV EAX,EBX
00477742 |. |B9 0A000000 |MOV ECX,0A 除以0A
00477747 |. |99 |CDQ
00477748 |. |F7F9 |IDIV ECX
0047774A |. |8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX 值送给{EBP-C},上面用
0047774D |. |8BC3 |MOV EAX,EBX
0047774F |. |B9 0A000000 |MOV ECX,0A
00477754 |. |99 |CDQ
00477755 |. |F7F9 |IDIV ECX
00477757 |. |8BDA |MOV EBX,EDX 再相除得余数。
00477759 |. |8D55 E0 |LEA EDX,DWORD PTR SS:[EBP-20]
0047775C |. |8BC3 |MOV EAX,EBX
0047775E |. |E8 0114F9FF |CALL BAKPHONE.00408B64 到408B2E 最上面的分析
00477763 |. |8B55 E0 |MOV EDX,DWORD PTR SS:[EBP-20]
00477766 |. |8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00477769 |. |8B09 |MOV ECX,DWORD PTR DS:[ECX]
0047776B |. |8B45 08 |MOV EAX,DWORD PTR SS:[EBP+8]
0047776E |. |E8 E1D1F8FF |CALL BAKPHONE.00404954
00477773 |. |4E |DEC ESI
00477774 |. |85F6 |TEST ESI,ESI 循环,得到一个变值
00477776 |.^\75 8B \JNZ SHORT BAKPHONE.00477703 得到第四次变形值 20969173808
6、第五次变形:
00477500 |> /8D45 E4 |/LEA EAX,DWORD PTR SS:[EBP-1C]
00477503 |. |50 ||PUSH EAX
00477504 |. |B9 01000000 ||MOV ECX,1
00477509 |. |8BD6 ||MOV EDX,ESI
0047750B |. |8B45 F8 ||MOV EAX,DWORD PTR SS:[EBP-8] 5242293452
0047750E |. |E8 55D6F8FF ||CALL BAKPHONE.00404B68
00477513 |. |8B45 E4 ||MOV EAX,DWORD PTR SS:[EBP-1C]
00477516 |. |E8 8517F9FF ||CALL BAKPHONE.00408CA0
0047751B |. |8BD8 ||MOV EBX,EAX
0047751D |. |8D45 E0 ||LEA EAX,DWORD PTR SS:[EBP-20]
00477520 |. |50 ||PUSH EAX
00477521 |. |B9 01000000 ||MOV ECX,1
00477526 |. |8B55 EC ||MOV EDX,DWORD PTR SS:[EBP-14]
00477529 |. |8B45 F4 ||MOV EAX,DWORD PTR SS:[EBP-C]
0047752C |. |E8 37D6F8FF ||CALL BAKPHONE.00404B68
00477531 |. |8B45 E0 ||MOV EAX,DWORD PTR SS:[EBP-20]
00477534 |. |E8 6717F9FF ||CALL BAKPHONE.00408CA0 94
00477539 |. 0FAFD8 ||IMUL EBX,EAX 从第二次变形值5242293452右取然后与9(即上面的94的9,随“-”两边数字变化)相乘
0047753C |. 035D E8 ||ADD EBX,DWORD PTR SS:[EBP-18] 相加
0047753F |. 8BC3 ||MOV EAX,EBX
00477541 |. B9 0A000000 ||MOV ECX,0A
00477546 |. 99 ||CDQ
00477547 |. F7F9 ||IDIV ECX
00477549 |. 8945 E8 ||MOV DWORD PTR SS:[EBP-18],EAX 相除的值,上面要用
0047754C |. 8BC3 ||MOV EAX,EBX
0047754E |. B9 0A000000 ||MOV ECX,0A
00477553 |. 99 ||CDQ
00477554 |. F7F9 ||IDIV ECX
00477556 |. 8BDA ||MOV EBX,EDX
00477558 |. 8D55 DC ||LEA EDX,DWORD PTR SS:[EBP-24]
0047755B |. 8BC3 ||MOV EAX,EBX
0047755D |. E8 0216F9FF ||CALL BAKPHONE.00408B64
00477562 |. 8B55 DC ||MOV EDX,DWORD PTR SS:[EBP-24]
00477565 |. 8D45 F0 ||LEA EAX,DWORD PTR SS:[EBP-10]
00477568 |. 8B4D F0 ||MOV ECX,DWORD PTR SS:[EBP-10]
0047756B |. E8 E4D3F8FF ||CALL BAKPHONE.00404954
00477570 |. 4E ||DEC ESI
00477571 |. 85F6 ||TEST ESI,ESI
00477573 |.^ 75 8B |\JNZ SHORT BAKPHONE.00477500 循环得到第五次变形值47180641068
7、第六次变形
00477703 |> /8D45 E8 /LEA EAX,DWORD PTR SS:[EBP-18]
00477706 |. |50 |PUSH EAX
00477707 |. |B9 01000000 |MOV ECX,1
0047770C |. |8BD6 |MOV EDX,ESI
0047770E |. |8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4] ;第四次变形值020969173808注意前面加0,变成12位了
00477711 |. |E8 52D4F8FF |CALL BAKPHONE.00404B68
00477716 |. |8B45 E8 |MOV EAX,DWORD PTR SS:[EBP-18]
00477719 |. |E8 8215F9FF |CALL BAKPHONE.00408CA0
0047771E |. |8BD8 |MOV EBX,EAX
00477720 |. |8D45 E4 |LEA EAX,DWORD PTR SS:[EBP-1C]
00477723 |. |50 |PUSH EAX
00477724 |. |B9 01000000 |MOV ECX,1
00477729 |. |8BD6 |MOV EDX,ESI
0047772B |. |8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] 第五次变形值 471806410680注意后面加0 也变成12位了
0047772E |. |E8 35D4F8FF |CALL BAKPHONE.00404B68
00477733 |. |8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
00477736 |. |E8 6515F9FF |CALL BAKPHONE.00408CA0
0047773B |. |03D8 |ADD EBX,EAX ebx等于0047770e对应的值,从最右开始取,eax为0047772b对应的值,也是从最右开始,
0047773D |. |035D F4 |ADD EBX,DWORD PTR SS:[EBP-C] 相除的值,开始为0,相加
00477740 |. |8BC3 |MOV EAX,EBX
00477742 |. |B9 0A000000 |MOV ECX,0A 除以0A
00477747 |. |99 |CDQ
00477748 |. |F7F9 |IDIV ECX
0047774A |. |8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX 值送给{EBP-C},上面用
0047774D |. |8BC3 |MOV EAX,EBX
0047774F |. |B9 0A000000 |MOV ECX,0A
00477754 |. |99 |CDQ
00477755 |. |F7F9 |IDIV ECX
00477757 |. |8BDA |MOV EBX,EDX 再相除得余数。
00477759 |. |8D55 E0 |LEA EDX,DWORD PTR SS:[EBP-20]
0047775C |. |8BC3 |MOV EAX,EBX
0047775E |. |E8 0114F9FF |CALL BAKPHONE.00408B64 到408B2E 最上面的分析
00477763 |. |8B55 E0 |MOV EDX,DWORD PTR SS:[EBP-20]
00477766 |. |8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00477769 |. |8B09 |MOV ECX,DWORD PTR DS:[ECX]
0047776B |. |8B45 08 |MOV EAX,DWORD PTR SS:[EBP+8]
0047776E |. |E8 E1D1F8FF |CALL BAKPHONE.00404954
00477773 |. |4E |DEC ESI
00477774 |. |85F6 |TEST ESI,ESI 循环,得到一个变值
00477776 |.^\75 8B \JNZ SHORT BAKPHONE.00477703 得到第六次变珙值 492775584488
8、上面第六次得到的即为注册码中的12位,形式如:492775(9-4)584488。好象版本信息的位置随便,也可以为4929-4775584488,等等。
9、可以做内存注册机,在00477c05下断。
00477BFF |. 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18] 输入的注册码,其中7至9位参与了上面变形码的计算。
00477C02 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14] 变形后的正确注册码,其中7至9位参与了上面变形码的计算。需要补上
00477C05 |. E8 4ACEF8FF CALL BAKPHONE.00404A54 比较,在此处可以做内存注册机
00477C0A 75 05 JNZ SHORT BAKPHONE.00477C11
00477C0C |. 8B5D E4 MOV EBX,DWORD PTR SS:[EBP-1C] 此值决定了什么版本。
00477C0F |. EB 02 JMP SHORT BAKPHONE.00477C13
10、版本:(好象不支持12线,为何?)bug吗?
00477C0A /75 05 JNZ SHORT BAKPHONE.00477C11 注册码正确,不跳转
00477C0C |. |8B5D E4 MOV EBX,DWORD PTR SS:[EBP-1C] 此处的值决定了版本
00477C0F |. |EB 02 JMP SHORT BAKPHONE.00477C13
00477C11 |> \33DB XOR EBX,EBX 到此处则为未注册
00477C13 |> 8BC3 MOV EAX,EBX
00477C15 |. B9 0C000000 MOV ECX,0C
00477C1A |. 99 CDQ
00477C1B |. F7F9 IDIV ECX
00477C1D |. 8B15 280A4800 MOV EDX,DWORD PTR DS:[480A28] ; BAKPHONE.00481C30
00477C23 |. 8902 MOV DWORD PTR DS:[EDX],EAX 相除的值,小于0为未注册,0为标准版,1为专业版,2为企业版
00477C25 |. 8BC3 MOV EAX,EBX
00477C27 |. B9 0C000000 MOV ECX,0C ECX=0C
00477C2C |. 99 CDQ
00477C2D |. F7F9 IDIV ECX 相除
00477C2F |. 8BDA MOV EBX,EDX 余数就为多少线注册
00477C31 |. 33C0 XOR EAX,EAX
00477C33 |. 5A POP EDX
00477C34 |. 59 POP ECX
00477C35 |. 59 POP ECX
00477C36 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
00477C39 |. 68 797C4700 PUSH BAKPHONE.00477C79
11、内存注册机:
中断:00477c05
次数:1
指令:E8
长度:5
内存方式,在d edx
[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》,视频+靶场+题目!助力进入CTF世界