http://home.pchome.com.tw/service/djpvd/onls105.zip
1.注册码随便打
2.重新启动运行就OK?
很感谢在这里受益良多
我只是个初学者 虽然不太会脱壳不太会调试
这次令我很有成就感
使用工具:OD 1.1 HIEW 6.81 PEiD 0.93
脱壳可直接用PEiD脱 不用修复IAT
调试部分可参考此处
http://bbs.pediy.com/showthread.php?threadid=10249&highlight=tElock+0.98b1
00431A91 FF15 30C4430>call dword ptr ds:[<&MSVBVM50.__vbaLenBstr> ; 取新值的长度
00431A97 83F8 0C cmp eax,0C ；检验新值的长度是否为12位
00431A9A 75 6A jnz short locplus-.00431B06 ；跳走即失败(那就让他跳近一点)
00431A9C 8D45 DC lea eax,dword ptr ss:[ebp-24]
00431A9F 8945 C4 mov dword ptr ss:[ebp-3C],eax
00431AA2 C745 BC 0840>mov dword ptr ss:[ebp-44],4008
00431AA9 8D4D BC lea ecx,dword ptr ss:[ebp-44]
00431AAC 51 push ecx
00431AAD FF15 8CC5430>call dword ptr ds:[<&MSVBVM50.rtcIsNumeric> ; 检验新值是否为浮点数值
00431AB3 66:85C0 test ax,ax ；是就通过
00431AB6 74 4E je short locplus-.00431B06 ；跳走即失败(那就让他跳近一点)
00431AB8 8B55 DC mov edx,dword ptr ss:[ebp-24]
00431ABB 52 push edx
00431ABC FF15 58C7430>call dword ptr ds:[<&MSVBVM50.rtcR8ValFromBstr>];
00431AC2 FF15 00C7430>call dword ptr ds:[<&MSVBVM50.__vbaFpI4>] ; MSVBVM50.__vbaFpI4
00431AC8 8945 E0 mov dword ptr ss:[ebp-20],eax
00431ACB 83F8 01 cmp eax,1 ; 检验浮点数值的HEX值
00431ACE 7C 36 jl short locplus-.00431B06 ；跳走即失败(那就让他跳近一点)
00431AD0 DB45 E0 fild dword ptr ss:[ebp-20]
00431AD3 DD5D A4 fstp qword ptr ss:[ebp-5C]
00431AD6 DD45 A4 fld qword ptr ss:[ebp-5C]
00431AD9 DC1D 5020400>fcomp qword ptr ds:[402050] ; 浮点数比较
00431ADF DFE0 fstsw ax ；[402050] 既定值“9900000000.00000000”
00431AE1 F6C4 41 test ah,41
00431AE4 74 20 je short locplus-.00431B06
00431AE6 66:C705 2C91>mov word ptr ds:[43912C],0FFFF
00431AEF FF15 DCC4430>call dword ptr ds:[<&MSVBVM50.__vbaExitPr>; MSVBVM50.__vbaExitProc
00431AF5 9B wait
00431AF6 68 281B4300 push locplus-.00431B28
00431AFB EB 21 jmp short locplus-.00431B1E
00431AFD 66:C705 2C91>mov word ptr ds:[43912C],0
00431B06 FF15 DCC4430>call dword ptr ds:[<&MSVBVM50.__vbaExitPr>; MSVBVM50.__vbaExitProc
00431B0C 9B wait
00431B0D 68 281B4300 push locplus-.00431B28
00431B12 EB 0A jmp short locplus-.00431B1E
00431B14 8D4D CC lea ecx,dword ptr ss:[ebp-34]
00431B17 FF15 2CC4430>call dword ptr ds:[<&MSVBVM50.__vbaFreeVa>; MSVBVM50.__vbaFreeVar
00431B1D C3 retn
00431B1E 8D4D DC lea ecx,dword ptr ss:[ebp-24]
00431B21 - FF25 54C7430>jmp dword ptr ds:[<&MSVBVM50.__vbaFreeStr>; MSVBVM50.__vbaFreeStr
00431B27 C3 retn
00431B28 8B4D E4 mov ecx,dword ptr ss:[ebp-1C]
00431B2B 64:890D 0000>mov dword ptr fs:[0],ecx
00431B32 5F pop edi
00431B33 5E pop esi
00431B34 5B pop ebx
00431B35 8BE5 mov esp,ebp
00431B37 5D pop ebp
00431B38 C3 retn
已修改代码如下:
00431A9A 改为 75 00 jnz short locplus-.00431A9C
00431AB6 改为 74 00 je short locplus-.00431AB8
00431ACE 改为 7C 00 jl short locplus-.00431AD0
如有错误 恳求指导
[课程]Linux pwn 探索篇！
