[求助]请帮忙看下这段代码，如何破掉检测退出-软件逆向-看雪-安全社区|安全招聘|kanxue.com

[求助]请帮忙看下这段代码，如何破掉检测退出

发表于: 2010-9-4 20:10 3410

[求助]请帮忙看下这段代码，如何破掉检测退出

浪子漂漂

2010-9-4 20:10

3410

请朋友帮忙指点下，改那部分代码如何改可以去掉检测错误退出
谢谢

Private Sub Form_Load() '411A60
loc_00411A85: var_8 = &H401208
  loc_00411AF2: call MSVBVM60.DLL.__vbaAryConstruct2(var_30, 00408A78h, 00000002h, arg_8, esi, MSVBVM60.DLL.__vbaAryConstruct2)
  loc_00411AFF: call MSVBVM60.DLL.__vbaAryConstruct2(var_4C, 00408A78h, 00000002h)
loc_00411B0B: var_F4 = Main.hwnd
  loc_00411B32: SetWindowPos(var_F4, FFFFFFFFh, esi, esi, esi, esi, 00000003h)
  loc_00411B3D: call MSVBVM60.DLL.__vbaSetSystemError
  loc_00411B4F: var_B8 = SetWindowPos(var_F4, FFFFFFFFh, esi, esi, esi, esi, 00000003h)
loc_00411B58: var_C0 = 3
  loc_00411B62: call MSVBVM60.DLL.__vbaVarMove
  loc_00411B70: call MSVBVM60.DLL.__vbaNew
  loc_00411B89: call MSVBVM60.DLL.__vbaObjSetAddref(Main.GetPalette, MSVBVM60.DLL.__vbaNew, "", MSVBVM60.DLL.__vbaNew)
  loc_00411B9E: call MSVBVM60.DLL.__vbaObjSetAddref("", Main.GetPalette)
  loc_00411BCD: Main.%x3 = PropBag.ReadProperty("C:\WINDOWS" & "\test.ini", %x2)
  loc_00411C1C: Main.PropBag.WriteProperty("t1", "t2", 00415064h)
loc_00411C45: ecx = 0
  loc_00411C65: Main.PropBag.WriteProperty("tt1", "ttt1", 0041504Ch)
loc_00411C8E: ecx = 0
  loc_00411CAE: Main.PropBag.WriteProperty("tt1", "ttt2", 00415050h)
loc_00411CD7: ecx = 0
  loc_00411CF7: Main.PropBag.WriteProperty("tt1", "ttt3", 00415054h)
loc_00411D20: ecx = 0
  loc_00411D40: Main.PropBag.WriteProperty("tt1", "ttt4", 00415058h)
loc_00411D69: ecx = 0
  loc_00411D89: Main.PropBag.WriteProperty("a1", "aa1", 0041505Ch)
loc_00411DB2: ecx = 0
  loc_00411DD2: Main.PropBag.WriteProperty("a2", "aa2", 00415060h)
loc_00411DF4: var_6C = 0
loc_00411DFB: ecx = var_6C
  loc_00411E06: call MSVBVM60.DLL.__vbaObjSetAddref("", 00000000h, var_6C, var_6C, var_6C, var_6C, var_6C, var_6C, var_6C)
  loc_00411E17: 00000002h = GetHardDiskInfo(arg_8, 00000000h)
loc_00411E3E: ecx = 0
loc_00411E4E: var_C0 = 8
loc_00411E5B: var_B8 = &H407D88
loc_00411E79: var_6C = GetDiskVolume(arg_8)
loc_00411E9D: var_6C = 0
loc_00411EA4: ecx = var_6C
  loc_00411EC0: If (00415038h = 00408438h) = 0 Then
loc_00411EC8: End If
  loc_00411ED1: call MSVBVM60.DLL.__vbaStrCopy(var_6C)
  loc_00411EDF: call MSVBVM60.DLL.__vbaI2I4
  loc_00411EF0: call MSVBVM60.DLL.__vbaStrCopy
loc_00411EFE: ecx = "" + 1
loc_00411EFF: [edi] = [edi] + "" + 1
  loc_00411F04: [eax] = [eax] + 0001h
loc_00411F0C: movsx eax, ax
loc_00411F0F: var_B8 = ""
loc_00411F25: var_78 = 1
  loc_00411F3D: var_90 = @Mid$(""0, eax]+0001, 2)
  loc_00411F43: movsx esi, word ptr [41504Ah]
  loc_00411F4D: If 00401120h >= 31 Then
  loc_00411F4F: call MSVBVM60.DLL.__vbaGenerateBoundsError
loc_00411F55: End If
  loc_00411F60: var_6C = @CStr(var_90)
  loc_00411F90: movsx esi, word ptr [41504Ah]
  loc_00411F9D: If 00401120h >= 31 Then
  loc_00411F9F: call MSVBVM60.DLL.__vbaGenerateBoundsError
loc_00411FA5: End If
  loc_00411FA5: movsx ebx, word ptr [41504Ah]
  loc_00411FAF: If 00000008h >= 31 Then
  loc_00411FB1: call MSVBVM60.DLL.__vbaGenerateBoundsError
loc_00411FB7: End If
  loc_00411FC1: edx+esi*2 = edx+esi*2 + 0041504Ah
loc_00411FC8: If Err.Number <> 0 Then GoTo loc_004122DB
  loc_00411FCE: imul ax, 05h
loc_00411FD2: If Err.Number <> 0 Then GoTo loc_004122DB
  loc_00411FDA: dx = var_24 And 0003h
  loc_00411FDE: edx+esi*2 = edx+esi*2 + var_24 And 0003h
  loc_00411FE1: sar ax, 02h
  loc_00411FEC: movsx esi, word ptr [41504Ah]
loc_00411FF6: var_B8 = ""
loc_00411FFC: var_C0 = 8
  loc_00412006: If 00401120h >= 31 Then
  loc_00412008: call MSVBVM60.DLL.__vbaGenerateBoundsError
loc_0041200E: End If
  loc_00412014: movsx ecx, word ptr [eax+esi*2]
  loc_00412032: var_90 = ""0 & @Chr(var_40)
  loc_00412039: call MSVBVM60.DLL.__vbaStrVarMove(var_90)
  loc_00412044: var_68 = MSVBVM60.DLL.__vbaStrVarMove(var_90)
loc_00412061: ecx = "" + 1
  loc_00412062: [ecx+00000001h] = [ecx+00000001h] + 00000008h
  loc_0041206B: 504Ah = 504Ah + "" + 1
loc_0041206E: If Err.Number <> 0 Then GoTo loc_004122DB
loc_00412074: GoTo loc_00411EF6
loc_00412090: neg ebx
loc_00412092: sbb ebx, ebx
  loc_0041209A: ebx = (var_68 = 415064h) + 1
loc_0041209D: neg eax
loc_0041209F: sbb eax, eax
loc_004120A1: neg eax
  loc_004120A5: If (var_68 = 415064h) + 1 = 0 Then
  loc_004120B5: var_A8 = 80020004h
  loc_004120BB: var_98 = 80020004h
  loc_004120C1: var_88 = 80020004h
loc_004120E2:    var_B8 = "乱码"
loc_004120EC:    var_C0 = 8
  loc_00412117: MsgBox("? 00000000h, 10, 10, 10)
  loc_00412167: call MSVBVM60.DLL.__vbaObjSetAddref("", edi]+var_68 + )
  loc_0041216F: call Main.GetTypeInfo(MSVBVM60.DLL.__vbaObjSetAddref("", edi]+var_68 + ))
loc_00412190:    GoTo loc_00412223
loc_00412195: End If
loc_0041219F: var_C0 = 11
loc_004121A5: eax = "" Or FFFFFFFFh
loc_004121B2: var_B8 = "" Or FFFFFFFFh
  loc_004121DE: call MSVBVM60.DLL.__vbaLateIdSt(var_B4, "", var_B4, edi]+var_68 + , 00000014h)
loc_00412206: Timer1.Enabled = FFFFFFFFh
loc_00412223: 'Referenced from 00412190
loc_0041222F: GoTo loc_00412268
loc_00412267: Exit Sub
loc_00412268: 'Referenced from 0041222F
  loc_0041228C: call MSVBVM60.DLL.__vbaAryDestruct(00000000h, var_30, 004122BCh, "", edi]+var_68 + , edi]+var_68 + )
  loc_004122A0: call MSVBVM60.DLL.__vbaAryDestruct(00000000h, 0C)
loc_004122BB: Exit Sub
loc_004122D8: Exit Sub
loc_004122DB: 'Referenced from 0411FC8
  loc_004122DB: call MSVBVM60.DLL.__vbaErrorOverflow
End Sub

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

#调试逆向

收藏・0

免费・0

支持