能力值:
( LV2,RANK:10 )
|
-
-
2 楼
在主程序中为数据做一些运算,如加法减法乘法除法之类的,反编译后也找不到这些代码
通过设内存断点的方法找到的都是dll中的代码,感觉主程序中的代码编译后都“嵌入”到dll中去了,好是诡异!
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
设置MFC库为静态编译就好了
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
00401540 . 6A FF PUSH -1
00401542 . 68 D81A4000 PUSH strNum.00401AD8 ; SE handler installation
00401547 . 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0040154D . 50 PUSH EAX
0040154E . 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
00401555 . 51 PUSH ECX
00401556 . 56 PUSH ESI
00401557 . 8BF1 MOV ESI,ECX
00401559 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
0040155D . FF46 60 INC DWORD PTR DS:[ESI+60] ; num++
00401560 . E8 55020000 CALL <JMP.&MFC42.#540_CString::CString>
00401565 . 8B46 60 MOV EAX,DWORD PTR DS:[ESI+60]
00401568 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
0040156C . 50 PUSH EAX
0040156D . 68 20304000 PUSH strNum.00403020 ; ASCII "%d"
00401572 . 51 PUSH ECX
00401573 . C74424 1C 0000000>MOV DWORD PTR SS:[ESP+1C],0
0040157B . E8 70020000 CALL <JMP.&MFC42.#2818_CString::Format>
00401580 . 83C4 0C ADD ESP,0C
00401583 . 8D5424 04 LEA EDX,DWORD PTR SS:[ESP+4]
00401587 . 8D4E 64 LEA ECX,DWORD PTR DS:[ESI+64]
0040158A . 52 PUSH EDX
0040158B . E8 5A020000 CALL <JMP.&MFC42.#858_CString::operator=>
00401590 . 6A 00 PUSH 0
00401592 . 8BCE MOV ECX,ESI
00401594 . E8 4B020000 CALL <JMP.&MFC42.#6334_CWnd::UpdateData>
00401599 . 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4]
0040159D . C74424 10 FFFFFFF>MOV DWORD PTR SS:[ESP+10],-1
004015A5 . E8 26010000 CALL <JMP.&MFC42.#800_CString::~CString>
004015AA . 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
004015AE . 5E POP ESI ; strNum.004022F0
004015AF . 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
004015B6 . 83C4 10 ADD ESP,10
004015B9 . C3 RETN
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
谢谢EMayej ,请问你是如何做到的?
|
能力值:
( LV2,RANK:10 )
|
-
-
6 楼
在字符串参考里找"%d"
|
|
|