首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. 软件逆向
    3. 发新帖
[原创]VB Decompiler 暴破 VB P-Code 某背单词软件
发表于: 2010-3-27 22:25 14370

[原创]VB Decompiler 暴破 VB P-Code 某背单词软件

soar 活跃值
2010-3-27 22:25
14370

【文章标题】: VB Decompiler 暴破 VB P-Code 某背单词软件
【软件名称】: 某背单词软件
【软件大小】: 1.14 MB
【下载地址】: 自己搜索下载
【加壳方式】: UPX 0.80 - 0.84 -> Markus & Laszlo
【保护方式】: 壳；字符串加密，注册信息存放加密数据库中
【编写语言】: Microsoft Visual Basic 5.0 / 6.0 (P-code)
【使用工具】: FFI，SmartCheck，VB Decompiler V5.0，WKTVBDE(只用到Help文件)
【操作平台】: Win32
【软件介绍】: 使用全新记忆理念精心打造的一款高效速记背单词软件
【作者声明】: 菜鸟一个，只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------------------------------------------------
【详细过程】

  File Format Identifier (FFI) v1.4  检测为：UPX 0.80 - 0.84 -> Markus & Laszlo
  
  直接 Unpack 得到的 .EXE 大小为：3.49 MB
  FFI v1.4  再次检测为：Microsoft Visual Basic 5.0 / 6.0
  
  VB Decompiler V7.6 无法正常反编译，改用 VB Decompiler V 5.0 (gold7n) 修改版 能正常反编译
  
  
  SmartCheck 加载，大致了解下程序的运行过程，直接在 VB Decompiler 中定位可疑关键点。
  
  
  

Private Sub Form_Load() '7143AC '主窗体加载过程
    'Data Table: 44F88C
    loc_713128: On Error Goto loc_71436E
    loc_713130: Me.global_224 = &HFF
    loc_713138: Me.global_226 = 0
    loc_713143: var_90 = Unknown_647DF0("FMGO", Me.global_226)
    loc_713146: var_90 = "" 'Ignore this
    loc_71314C: NewIfNullPr frmHello 'Ignore this
    loc_71314F: Call frmHello.Loading()
    loc_713154: DoEvents
    loc_713161: var_90 = Unknown_647DF0("FMLV")
    loc_713164: var_90 = "" 'Ignore this
    loc_713167: var_A4 = "Plan"
    loc_71316C: PopAdLdVar 'Ignore this
    loc_713171: var_B8 = Me 'Ignore this
    loc_713177: LateIdCallLdVar
    loc_713181: PopAd 'Ignore this
    loc_713189:  'Ignore this
    loc_71318D: var_130 = CVar(var_C8) 'Address
    loc_7131AA: var_CC = Me 'Ignore this
    loc_7131B0: 0 = frmHello 0, %x2 'Ignore this
    loc_7131BF:  'Ignore this
    loc_7131C3: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_7131C9: Me.ListImages.Add var_D0, 1, ""
    loc_7131CE: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_7131E8: var_A4 = "Finish"
    loc_7131ED: PopAdLdVar 'Ignore this
    loc_7131F2: var_B8 = Me 'Ignore this
    loc_7131F8: LateIdCallLdVar
    loc_713202: PopAd 'Ignore this
    loc_71320A:  'Ignore this
    loc_71320E: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_71322B: var_CC = Me 'Ignore this
    loc_713231: 0 = Me 0, %x2 'Ignore this
    loc_713240:  'Ignore this
    loc_713244: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_71324A: Me.ListImages.Add var_D0, 2, ""
    loc_71324F: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_713269: var_A4 = "Deleted"
    loc_71326E: PopAdLdVar 'Ignore this
    loc_713273: var_B8 = Me 'Ignore this
    loc_713279: LateIdCallLdVar
    loc_713283: PopAd 'Ignore this
    loc_71328B:  'Ignore this
    loc_71328F: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_7132AC: var_CC = Me 'Ignore this
    loc_7132B2: 0 = Me 0, %x2 'Ignore this
    loc_7132C1:  'Ignore this
    loc_7132C5: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_7132CB: Me.ListImages.Add var_D0, 3, ""
    loc_7132D0: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_7132EA: var_A4 = "Star"
    loc_7132EF: PopAdLdVar 'Ignore this
    loc_7132F4: var_B8 = Me 'Ignore this
    loc_7132FA: LateIdCallLdVar
    loc_713304: PopAd 'Ignore this
    loc_71330C:  'Ignore this
    loc_713310: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_71332D: var_CC = Me 'Ignore this
    loc_713333: 0 = Me 0, %x2 'Ignore this
    loc_713342:  'Ignore this
    loc_713346: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_71334C: Me.ListImages.Add var_D0, 4, ""
    loc_713351: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_71336B: var_A4 = "OldPlan"
    loc_713370: PopAdLdVar 'Ignore this
    loc_713375: var_B8 = Me 'Ignore this
    loc_71337B: LateIdCallLdVar
    loc_713385: PopAd 'Ignore this
    loc_71338D:  'Ignore this
    loc_713391: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_7133AE: var_CC = Me 'Ignore this
    loc_7133B4: 0 = Me 0, %x2 'Ignore this
    loc_7133C3:  'Ignore this
    loc_7133C7: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_7133CD: Me.ListImages.Add var_D0, 5, ""
    loc_7133D2: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_7133EC: var_A4 = "StarNo"
    loc_7133F1: PopAdLdVar 'Ignore this
    loc_7133F6: var_B8 = Me 'Ignore this
    loc_7133FC: LateIdCallLdVar
    loc_713406: PopAd 'Ignore this
    loc_71340E:  'Ignore this
    loc_713412: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_71342F: var_CC = Me 'Ignore this
    loc_713435: 0 = Me 0, %x2 'Ignore this
    loc_713444:  'Ignore this
    loc_713448: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_71344E: Me.ListImages.Add var_D0, 6, ""
    loc_713453: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_713460: var_C8 = "": var_E0 = "": var_100 = "": var_120 = "" = "" 'Ignore this
    loc_713476: var_B8 = Me 'Ignore this
    loc_71347C: 0 = Me 0, %x2 'Ignore this
    loc_713484: var_C8 = CVar(var_CC) 'Address
    loc_713488: PopAdLdVar 'Ignore this
    loc_713489: VerifyVarObj
    loc_71348F: var_D0 = Me 'Ignore this
    loc_713495: LateIdStAd
    loc_71349D: var_B8 = "" = "" 'Ignore this
    loc_7134B3: var_B8 = Me 'Ignore this
    loc_7134C5: CLng(tmrMouse.DispID_FFFFFDFD) = Unknown_6565B0(&HB, var_D0, "", var_CC)
    loc_7134CA: var_B8 = vbNull 'Ignore this
    loc_7134D0: var_A4 = "WordList"
    loc_7134D5: PopAdLdVar 'Ignore this
    loc_7134DA: var_B8 = Me 'Ignore this
    loc_7134E0: LateIdCallLdVar
    loc_7134EA: PopAd 'Ignore this
    loc_7134F2:  'Ignore this
    loc_7134F6: var_130 = CVar("") 'Address
    loc_713513: var_CC = Me 'Ignore this
    loc_713519: 1 = Me 1, %x2 'Ignore this
    loc_713528:  'Ignore this
    loc_71352C: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_713532: Me.ListImages.Add var_D0, 1, ""
    loc_713537: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_713551: var_A4 = "Mean"
    loc_713556: PopAdLdVar 'Ignore this
    loc_71355B: var_B8 = Me 'Ignore this
    loc_713561: LateIdCallLdVar
    loc_71356B: PopAd 'Ignore this
    loc_713573:  'Ignore this
    loc_713577: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_713594: var_CC = Me 'Ignore this
    loc_71359A: 1 = Me 1, %x2 'Ignore this
    loc_7135A9:  'Ignore this
    loc_7135AD: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_7135B3: Me.ListImages.Add var_D0, 2, ""
    loc_7135B8: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_7135D2: var_A4 = "Spell"
    loc_7135D7: PopAdLdVar 'Ignore this
    loc_7135DC: var_B8 = Me 'Ignore this
    loc_7135E2: LateIdCallLdVar
    loc_7135EC: PopAd 'Ignore this
    loc_7135F4:  'Ignore this
    loc_7135F8: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_713615: var_CC = Me 'Ignore this
    loc_71361B: 1 = Me 1, %x2 'Ignore this
    loc_71362A:  'Ignore this
    loc_71362E: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_713634: Me.ListImages.Add var_D0, 3, ""
    loc_713639: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_713653: var_A4 = "Audition"
    loc_713658: PopAdLdVar 'Ignore this
    loc_71365D: var_B8 = Me 'Ignore this
    loc_713663: LateIdCallLdVar
    loc_71366D: PopAd 'Ignore this
    loc_713675:  'Ignore this
    loc_713679: var_130 = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "") 'Address
    loc_713696: var_CC = Me 'Ignore this
    loc_71369C: 1 = Me 1, %x2 'Ignore this
    loc_7136AB:  'Ignore this
    loc_7136AF: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_7136B5: Me.ListImages.Add var_D0, 4, ""
    loc_7136BA: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_7136D4: var_A4 = "Browse"
    loc_7136D9: PopAdLdVar 'Ignore this
    loc_7136DE: var_B8 = Me 'Ignore this
    loc_7136E4: LateIdCallLdVar
    loc_7136EE: PopAd 'Ignore this
    loc_7136F6:  'Ignore this
    loc_713717: var_CC = Me 'Ignore this
    loc_71371D: 1 = Me 1, %x2 'Ignore this
    loc_71372C:  'Ignore this
    loc_713730: var_134 = tmrMouse.DispID_4 'Ignore this
    loc_713736: Me.ListImages.Add var_D0, 5, ""
    loc_71373B: var_B8 = "": var_CC = "": var_D0 = "": var_134 = "" = "" 'Ignore this
    loc_713748: var_C8 = "": var_E0 = "": var_100 = "": var_120 = "" = "" 'Ignore this
    loc_71375E: var_B8 = Me 'Ignore this
    loc_713764: 1 = Me 1, %x2 'Ignore this
    loc_71376C: var_C8 = CVar(var_CC) 'Address
    loc_713770: PopAdLdVar 'Ignore this
    loc_713775: var_D0 = Me 'Ignore this
    loc_713780: var_B8 = "" = "" 'Ignore this
    loc_713792: var_90 = Unknown_647DF0("FMSI", tmrMouse.DispID_68030010, "", var_CC)
    loc_713795: var_90 = "" 'Ignore this
    loc_71379B: NewIfNullPr Clocker 'Ignore this
    loc_71379E: SetPropA
    loc_7137B1: PopAdLdVar 'Ignore this
    loc_7137B5: NewIfNullPr Me 'Ignore this
    loc_7137B8: Call {FCFB3D22-A0FA-1068-A73808002B3371B5}.Method_arg_34 (101, CInt(2), var_B8)
    loc_7137C7: var_D0 = Me 'Ignore this
    loc_7137CD: Me.label.Mouseicon = var_B8
    loc_7137D2: var_CC = "" = "" 'Ignore this
    loc_7137E0: var_B8 = Me 'Ignore this
    loc_7137F5: var_134 = Me 'Ignore this
    loc_7137FB: Me.label.Mouseicon = Me.label.Mouseicon
    loc_713800: var_B8 = "": var_D0 = "" = "" 'Ignore this
    loc_713810: var_B8 = Me 'Ignore this
    loc_713825: var_134 = Me 'Ignore this
    loc_71382B: Me.label.Mouseicon = Me.label.Mouseicon
    loc_713830: var_B8 = "": var_D0 = "" = "" 'Ignore this
    loc_713840: var_B8 = Me 'Ignore this
    loc_713855: var_134 = Me 'Ignore this
    loc_71385B: Me.Image.Mouseicon = Me.label.Mouseicon
    loc_713860: var_B8 = "": var_D0 = "" = "" 'Ignore this
    loc_71386E: PopAdLdVar 'Ignore this
    loc_713879: LateIdCallLdVar
    loc_713883:  'Ignore this
    loc_713896: var_CC = Me 'Ignore this
    loc_7138A3:  'Ignore this
    loc_7138A7: var_D0 = tmrMouse.DispID_3 'Ignore this
    loc_7138AD: Call {2C787A50-E01C-11CF-8E7400A0C90F26F8}.Method_arg_24 (1, var_134, Me, "LogoIco")
    loc_7138B5: Me.Panel.Picture = CVar("": var_E0 = "": var_100 = "": var_120 = "" = "")
    loc_7138BA: var_B8 = "": var_CC = "": var_D0 = "": var_138 = "" = "" 'Ignore this
    loc_7138C7: var_C8 = "": var_E0 = "" = "" 'Ignore this
    loc_7138D5: PopAdLdVar 'Ignore this
    loc_7138E0: LateIdCallLdVar
    loc_7138EA:  'Ignore this
    loc_7138FD: var_CC = Me 'Ignore this
    loc_71390A:  'Ignore this
    loc_71390E: var_D0 = tmrMouse.DispID_3 'Ignore this
    loc_713914: Call {2C787A50-E01C-11CF-8E7400A0C90F26F8}.Method_arg_24 (3, var_134, Me)
    loc_71391C: Me.Panel.Picture = "LogoIco"
    loc_713921: var_B8 = "": var_CC = "": var_D0 = "": var_138 = "" = "" 'Ignore this
    loc_71392E: var_C8 = "": var_E0 = "" = "" 'Ignore this
    loc_713937: var_A4 = "Edit"
    loc_71393C: PopAdLdVar 'Ignore this
    loc_713947: LateIdCallLdVar
    loc_713951:  'Ignore this
    loc_713955: var_E0 = CVar(Me) 'Address
    loc_713959: PopAdLdVar 'Ignore this
    loc_71395A: VerifyVarObj
    loc_713960: var_CC = Me 'Ignore this
    loc_713966: LateIdStAd
    loc_71396E: var_B8 = "" = "" 'Ignore this
    loc_713975: var_C8 = "" = "" 'Ignore this
    loc_71397C: var_A4 = "Info"
    loc_713981: PopAdLdVar 'Ignore this
    loc_71398C: LateIdCallLdVar
    loc_713996:  'Ignore this
    loc_71399A: var_E0 = CVar(Me) 'Address
    loc_71399E: PopAdLdVar 'Ignore this
    loc_71399F: VerifyVarObj
    loc_7139A5: var_CC = Me 'Ignore this
    loc_7139AB: LateIdStAd
    loc_7139B3: var_B8 = "" = "" 'Ignore this
    loc_7139BA: var_C8 = "" = "" 'Ignore this
    loc_7139C7: NewIfNullPr Clocker 'Ignore this
    loc_7139CA: GetPropHsz
                If (var_13C > &H2140) Then '7139E2
    loc_7139DD:   &HFF = Unknown_6A29E4(var_13C, var_CC, var_E0, var_A4)
                End If
    loc_713A06: Me.global_96 = Me.Caption & " (" & "???" & ")"
    loc_713A0A: var_90 = "": var_144 = "": var_148 = "" = "" 'Ignore this
    loc_713A1B: NewIfNullPr Clocker 'Ignore this
    loc_713A1E: GetPropHsz
                If (var_13C > &H2910) Then '713A36
    loc_713A31:   &HFF = Unknown_6A29E4(var_13C, var_CC, var_E0)
                End If
    loc_713A3E: var_90 = Unknown_647DF0("FMTR", var_A4)
    loc_713A41: var_90 = "" 'Ignore this
    loc_713A4A: NewIfNullPr Clocker 'Ignore this
    loc_713A4D: GetPropHsz
                If (var_13C > &H38B0) Then '713A65
    loc_713A60:   &HFF = Unknown_6A29E4(var_13C)
                End If
  
                If Not(Unknown_62DF78(var_A4)) Then '713B07 '未注册激活版，标题显示 未激活。关键可疑过程“Unknown_62DF78”
    loc_713A7A:   var_B8 = Me 'Ignore this
    loc_713A80:   Me.label.Caption = Unknown_685B34()
    loc_713A85:   var_90 = "" 'Ignore this
    loc_713A88:   var_B8 = vbNull 'Ignore this
    loc_713AA8:   var_B8 = Me 'Ignore this
    loc_713AAE:   Me.Menu.Caption = Unknown_6B5A48("5wQwWGt7WUUmmyT5vyxf5w1WlozK5GtyPVZ9qgpr9PLZAjs") '字符串均作了加密处理
    loc_713AB3:   var_90 = "" = "" 'Ignore this
    loc_713ABA:   var_B8 = vbNull 'Ignore this
    loc_713AE3:   Me.global_96 = Me.global_96 & Unknown_6B5A48("5SEFWwcuWw85", &H15A02)  '字符串均作了加密处理
    loc_713AE7:   var_90 = "": var_144 = "" = "" 'Ignore this
    loc_713AF6:   var_B8 = Me 'Ignore this
    loc_713AFC:   Me.Menu.Enabled = 0
    loc_713B01:   var_B8 = vbNull 'Ignore this
    loc_713B04:   GoTo loc_713B75
                End If
    loc_713B0D: var_B8 = Me 'Ignore this
    loc_713B13: Me.label.Visible = 0
    loc_713B18: var_B8 = vbNull 'Ignore this
    loc_713B38: var_B8 = Me 'Ignore this
    loc_713B3E: Me.Menu.Caption = Unknown_6B5A48("5SloWGe7WpIomyx3vXbB5SrFl5TJ5S9noU0L5Gty", &H15A02)
    loc_713B43: var_90 = "" = "" 'Ignore this
    loc_713B4A: var_B8 = vbNull 'Ignore this
    loc_713B53: var_B8 = Me 'Ignore this
    loc_713B59: Me.Menu.Enabled = 0
    loc_713B5E: var_B8 = vbNull 'Ignore this
    loc_713B67: var_B8 = Me 'Ignore this
    loc_713B6D: Me.Menu.Enabled = &HFF
    loc_713B72: var_B8 = vbNull 'Ignore this
    loc_713B75: ' Referenced from: 713B04
    loc_713B7D: var_90 = Unknown_647DF0("FMSF")
    loc_713B80: var_90 = "" 'Ignore this
    loc_713B8A: Me.Caption = Me.global_96
    loc_713B8F: Call SetFonts()
    loc_713B99: Me.global_208 = 0
    loc_713BA1: Me.global_92 = &HFF
    loc_713BA9: Me.global_200 = 0
    loc_713BB1: Me.global_112 = 0
    loc_713BB9: Me.global_56 = 0
    loc_713BC1: Me.global_114 = 0
    loc_713BCA: NewIfNullPr Clocker 'Ignore this
    loc_713BCD: GetPropHsz
                If (var_13C > &H4850) Then '713BE5
    loc_713BE0:   &HFF = Unknown_6A29E4(var_13C, Me.global_114, Me.global_56, Me.global_112)
                End If
    loc_713C0E: Me.global_60 = CInt(Unknown_6DB6CC("SpeechMode", 1, 0, &HFF))
    loc_713C11: var_C8 = "" 'Ignore this
    loc_713C18: var_B8 = Me 'Ignore this
    loc_713C26: var_B8 = vbNull 'Ignore this
    loc_713C29: var_A4 = True
    loc_713C2C: PopAdLdVar 'Ignore this
    loc_713C31: var_B8 = Me 'Ignore this
    loc_713C3C: var_B8 = vbNull 'Ignore this
    loc_713C69: Me.global_68 = CBool(Unknown_6DB6CC("ShowCover", 1, 0, &HFF))
    loc_713C6C: var_C8 = "" 'Ignore this
    loc_713C75: NewIfNullPr Clocker 'Ignore this
    loc_713C78: GetPropHsz
                If (var_13C > &H63A8) Then '713C90
    loc_713C8B:   &HFF = Unknown_6A29E4(var_13C, Me.global_68, 0)
                End If
    loc_713CB5: var_164 = Unknown_6DB6CC("AutoSpeak", 1, 0, &HFF) 'Variant
    loc_713CC1: HardType 'Ignore this
                If Not (var_164 = -1) Then '713CD5
    loc_713CCF:   HardType 'Ignore this
                  If (var_164 = "True") Then '713CE0
                  End If
    loc_713CDA:   Me.global_62 = &HFF
    loc_713CDD:   GoTo loc_713D1D
                End If
    loc_713CE8: HardType 'Ignore this
                If Not (var_164 = 0) Then '713CFC
    loc_713CF1:   var_B4 = "False"
    loc_713CF6:   HardType 'Ignore this
                  If (var_164 = var_B4) Then '713D07
                  End If
    loc_713D01:   Me.global_62 = 0
    loc_713D04:   GoTo loc_713D1D
                End If
    loc_713D0F: HardType 'Ignore this
                If (var_164 = 1) Then '713D1D
    loc_713D1A:   Me.global_62 = 1
    loc_713D1D:   ' Referenced from: 713CDD
    loc_713D1D:   ' Referenced from: 713D04
                End If
    loc_713D56: Me.global_64 = CBool(Unknown_624854(Unknown_6DB6CC("AutoRepeat", 1, 0, &HFF), False, 0))
    loc_713D59: var_C8 = "": var_E0 = "" = "" 'Ignore this
    loc_713D6C: var_B8 = Me 'Ignore this
    loc_713D72: Me.Menu.Checked = Me.global_64
    loc_713D77: var_B8 = vbNull 'Ignore this
    loc_713D80: CDargRef 0 'Ignore this
    loc_713D88: var_B8 = Me 'Ignore this
    loc_713D93: var_B8 = vbNull 'Ignore this
    loc_713D9C: NewIfNullPr Clocker 'Ignore this
    loc_713D9F: GetPropHsz
                If (var_13C > &H7730) Then '713DB7
    loc_713DB2:   &HFF = Unknown_6A29E4(var_13C, tmrMouse.DispID_68030019, Me.global_64, Me.global_64)
                End If
                For var_16C = 0 To 3: var_8C = var_16C 'Long
    loc_713DE0:   var_B8 = Me 'Ignore this
    loc_713DE6:   CInt(var_8C) = Me CInt(var_8C), %x2 'Ignore this
    loc_713DEE:   Me.Menu.Checked = var_CC
    loc_713DF3:   var_B8 = "" = "" 'Ignore this
                Next var_16C 'Long
                For var_174 = 0 To 2: var_8C = var_174 'Long
    loc_713E31:   var_B8 = Me 'Ignore this
    loc_713E37:   CInt(var_8C) = Me CInt(var_8C), %x2 'Ignore this
    loc_713E3F:   Me.Menu.Checked = var_CC
    loc_713E44:   var_B8 = "" = "" 'Ignore this
                Next var_174 'Long
    loc_713E5D: var_B8 = Me 'Ignore this
    loc_713E63: Me.Menu.Checked = Me.global_68
    loc_713E68: var_B8 = vbNull 'Ignore this
    loc_713E87: HardType 'Ignore this
    loc_713E92: var_B8 = Me 'Ignore this
    loc_713E98: Me.Menu.Checked = CBool((Unknown_635190("chkPlayMusic") = 1))
    loc_713E9D: var_90 = "" 'Ignore this
    loc_713EA0: var_B8 = vbNull 'Ignore this
    loc_713EA3: var_C8 = "" 'Ignore this
    loc_713EB2: var_B8 = Me 'Ignore this
    loc_713EB8: Me.Menu.Checked = (MemVar_728208 <> "")
    loc_713EBD: var_B8 = vbNull 'Ignore this
    loc_713EC9: var_A4 = (Me.global_62 = &HFF)
    loc_713ECD: PopAdLdVar 'Ignore this
    loc_713ED7: var_B8 = Me 'Ignore this
    loc_713EDD: 1 = Me 1, %x2 'Ignore this
    loc_713EEA: var_B8 = "" = "" 'Ignore this
    loc_713EF1: var_A4 = "" 'Ignore this
    loc_713EFB: var_B8 = Me 'Ignore this
    loc_713F09: var_A4 = Me.Menu.Checked
    loc_713F0D: PopAdLdVar 'Ignore this
    loc_713F17: var_CC = Me 'Ignore this
    loc_713F1D: 2 = Me 2, %x2 'Ignore this
    loc_713F2A: var_B8 = "": var_CC = "" = "" 'Ignore this
    loc_713F33: var_A4 = "" 'Ignore this
    loc_713F3C: CDargRef 0 'Ignore this
    loc_713F49: var_B8 = Me 'Ignore this
    loc_713F4F: 3 = Me 3, %x2 'Ignore this
    loc_713F5C: var_B8 = "" = "" 'Ignore this
    loc_713F6B: var_90 = Unknown_647DF0("FMSS", tmrMouse.DispID_68030001, var_CC, Me.global_68)
    loc_713F6E: var_90 = "" 'Ignore this
    loc_713F75: var_B8 = Me 'Ignore this
    loc_713F87: Me.global_212 = CDbl(tmrMouse.Width)
    loc_713F8A: var_B8 = vbNull 'Ignore this
    loc_713F8D: var_C8 = "" 'Ignore this
    loc_713F90: Call ArrangeLearnFrames()
    loc_713F95: Call ArrangeOptAns()
    loc_713FA2: var_90 = Unknown_647DF0("FMGS", Me.global_212, tmrMouse.DispID_68030001)
    loc_713FA5: var_90 = "" 'Ignore this
    loc_713FE9: Me.Width = CDbl(Unknown_62698C(Unknown_6DB6CC("MainWidth", 1, 0, &HFF), 0, 15000, 0))
    loc_713FEE: var_C8 = "": var_E0 = "" = "" 'Ignore this
    loc_714038: Me.Height = CDbl(Unknown_62698C(Unknown_6DB6CC("MainHeight", 1, 0, &HFF), 0, 10000, 0))
    loc_71403D: var_C8 = "": var_E0 = "" = "" 'Ignore this
    loc_71404E: var_90 = Unknown_647DF0("FMLB", var_D0)
    loc_714051: var_90 = "" 'Ignore this
    loc_714054: var_A4 = Unknown_6850C0(tmrMouse.DispID_68030001)
                If (MemVar_728188 Is Nothing) Then '714064
    loc_714063:   Exit Sub
                End If
    loc_714067: PopAdLdVar 'Ignore this
    loc_71406B: PopAdLdVar 'Ignore this
    loc_71406F: NewIfNullPr frmHello 'Ignore this
    loc_714072: frmHello.Show var_A4, var_B4
    loc_7140A1: Call OpenUserRs(CStr(Unknown_6DB6CC("CurBook", 1, 0)))
    loc_7140A6: var_90 = "" 'Ignore this
    loc_7140A9: var_C8 = "" 'Ignore this
    loc_7140B1: Call ShowProcess(0)
    loc_7140BE: var_90 = Unknown_647DF0("FMTT", &HFF)
    loc_7140C1: var_90 = "" 'Ignore this
    loc_7140C7: NewIfNullPr Clocker 'Ignore this
    loc_7140CA: SetPropA
    loc_7140D5: NewIfNullPr Clocker 'Ignore this
    loc_7140D8: GetPropHsz
                If (var_13C > &H4B0) Then '7140F0
    loc_7140EB:   &HFF = Unknown_6A29E4(var_13C)
                End If
    loc_71412E: HardType 'Ignore this
    loc_714131: var_90 = "" 'Ignore this
    loc_714134: var_C8 = "" = "" 'Ignore this
                If CBool(&HFF <> CVar(Unknown_6B1098("uC0hEHWhdAnAUHaKAbx", &H15A02, Unknown_6DB6CC("Pfix2WOWKV", 0, &HFF)))) Then '714155
    loc_714144:   var_B8 = Me 'Ignore this
    loc_71414A:   Me.Timer.Enabled = &HFF
    loc_71414F:   var_B8 = vbNull 'Ignore this
    loc_714152:   GoTo loc_7141F1
                End If
                If Not(Unknown_62DF78(&HFF)) Then '7141F1
    loc_714190:   Me.global_220 = CInt(Val(CStr(Unknown_6DB6CC("SvO96Q9HLpR", 0, &HFF))))
    loc_714193:   var_90 = "" 'Ignore this
    loc_714196:   var_C8 = "" 'Ignore this
                  If (Me.global_220 > &H1E) Then '7141AD
    loc_7141AA:     Me.global_220 = &H1E
                  End If
    loc_7141D5:   "SvO96Q9HLpR" = Unknown_6C6A64(CStr((Me.global_220 + 1)), 0, &HFF, &HFF)
    loc_7141DA:   var_90 = "" 'Ignore this
    loc_7141E3:   var_B8 = Me 'Ignore this
    loc_7141E9:   Me.Timer.Enabled = &HFF
    loc_7141EE:   var_B8 = vbNull 'Ignore this
    loc_7141F1:   ' Referenced from: 714152
                End If
    loc_7141F9: var_90 = Unknown_647DF0("FMSK", 0, Me.global_220)
    loc_7141FC: var_90 = "" 'Ignore this
    loc_714202:  'Ignore this
    loc_714205: var_B8 = Me 'Ignore this
    loc_71420B: var_B8 = Unknown_6E3494(Me.global_220)
    loc_714210: var_B8 = vbNull 'Ignore this
    loc_714213: Call SetSplitter()
    loc_71421C: var_B8 = Me 'Ignore this
    loc_71422A: var_B8 = vbNull 'Ignore this
    loc_714235: var_90 = Unknown_647DF0("FMSW", tmrMouse.DispID_6003)
    loc_714238: var_90 = "" 'Ignore this
    loc_714258: var_C8 = Unknown_6DB6CC("ShowMenu", 1, 0)
    loc_71426C: HardType 'Ignore this
                If (var_C8 = "False") Then '71427F
    loc_714277:   Call abBar_QueryUnload(5, &HFF)
    loc_71427C:   GoTo loc_714287
                End If
    loc_714284: Me.global_70 = &HFF
    loc_714287: ' Referenced from: 71427C
    loc_71428B: var_13C = Me.Hwnd
    loc_71429E: var_13C = Unknown_65B814(&HFFFFFF, Me.global_70)
    loc_7142AB: var_90 = Unknown_647DF0("FMSH", 0)
    loc_7142AE: var_90 = "" 'Ignore this
    loc_7142B3: Call ShowHome(&HFF)
    loc_7142BB: NewIfNullPr frmHello 'Ignore this
    loc_7142BE: Call frmHello.Fade()
    loc_7142C6: frmHello.Enabled = &HFF
    loc_7142CB: DoEvents
    loc_7142D6: var_B8 = Me 'Ignore this
    loc_7142DC: Me.Timer.Enabled = &HFF
    loc_7142E1: var_B8 = vbNull 'Ignore this
    loc_7142EA: var_B8 = Me 'Ignore this
    loc_7142F0: Me.Timer.Enabled = &HFF
    loc_7142F5: var_B8 = vbNull 'Ignore this
    loc_714300: var_90 = Unknown_647DF0("FMOK")
    loc_714303: var_90 = "" 'Ignore this
    loc_71430B: Me.global_224 = 0
    loc_714326: var_18C = 0
    loc_714353: var_90 = "frmAgent"
    loc_714359: var_90 = Unknown_702174("-", 5, 0, 0)
    loc_71435E: var_90 = "": var_144 = "": var_148 = "": var_14C = "": var_18C = "" = "" 'Ignore this
    loc_71436D: Exit Sub
    loc_71436E: ' Referenced from: 713128
    loc_714373: Me.global_224 = 0
    loc_714392: var_144 = Unknown_647DF0(CStr(Error(var_C8)), 0, Me.global_224, var_18C)
    loc_714395: var_144 = Unknown_6C05E0(0, 0)
    loc_71439A: var_90 = "" = "" 'Ignore this
    loc_7143A1: var_C8 = "" = "" 'Ignore this
    loc_7143A8: Exit Sub
    loc_7143A9: Me.global_224.global_-204 = %x2
  End Sub
  
  Private sub Unknown_62DF78 ' 是否激活注册用户，整个代码中有6处调用该过程
    'Data Table: 41BC10
    loc_62DF6A: HardType 'Ignore this
    loc_62DF74: var_A4 = "" 'Ignore this
    loc_62DF77: Result CBool((Unknown_6DB6CC("QgM8lSxYb", 0, &HFF) = 0)): End Sub 'Integer
  End Sub

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

收藏
免费 ・7
支持
分享
最新回复 (11)
yingyue
雪    币： 1844
活跃值： (35)
能力值： ( LV3，RANK：30 )
在线值：
发帖
回帖
粉丝
私信
2 楼
什么时候才有这种技术呢，完全不懂
2010-3-27 22:30
0
热火朝天
雪    币： 210
活跃值： (20)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
3 楼
分析的很细啊
2010-3-27 22:39
0
曹无咎
雪    币： 136
活跃值： (1465)
能力值： ( LV6，RANK：80 )
在线值：
发帖
回帖
粉丝
私信
4 楼
看不懂呀。。。继续加油ing
2010-3-28 17:24
0
moxa
雪    币： 207
活跃值： (10)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
5 楼
楼主偶请教个问题，用Vb de 反编译有winsock 的网络操作的程序你那里可以么？我用7.7的反编译后，winsock都被识别成picturebox了。不知道为什么。
你用的是啥版本呢？
2010-3-28 18:57
0
十号寝室
雪    币： 3
活跃值： (10)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
6 楼
直接反编译
2010-3-29 10:31
0
zoomlp
雪    币： 670
活跃值： (817)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
7 楼
谢谢！！！！！谢谢！！！！！！
2010-3-29 11:37
0
大头和尚
雪    币： 421
活跃值： (83)
能力值： ( LV3，RANK：20 )
在线值：
发帖
回帖
粉丝
私信
8 楼
好文章，能阅读这种天书真是牛人
2010-3-31 08:54
0
xie风腾
雪    币： 12302
活跃值： (5058)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
9 楼

要是有个视频就好了
2011-1-20 21:21
0
小P孩儿
雪    币： 23
活跃值： (10)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
10 楼
很不错的内容
2011-1-20 21:40
0
zzcc
雪    币： 243
活跃值： (247)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
11 楼
好像vb的确实很好破解了
2011-1-21 20:42
0
plgs
雪    币： 389
活跃值： (10)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
12 楼
ding ,zhichi yixia
2012-11-16 01:17
0
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回
//