输入bpx MessageBox(A)后弹出显示参考窗口，然后如何操作-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] 输入bpx MessageBox(A)后弹出显示参考窗口，然后如何操作 0.00雪花

发表于: 2011-9-21 10:17 3525

[旧帖] 输入bpx MessageBox(A)后弹出显示参考窗口，然后如何操作 0.00雪花

luxingxing 活跃值

2011-9-21 10:17

3525

输入bpx MessageBox(A)后弹出显示参考窗口，然后如何操作？？？

Intermodular calls
地址    反汇编                                  目标文件
00401D2D call <jmp.&MSVBVM60.#100>             MSVBVM60.ThunRTMain
00406311 call eax                            MSVBVM60.DllFunctionCall
00406365 call eax                            MSVBVM60.DllFunctionCall
004063B9 call eax                            MSVBVM60.DllFunctionCall
00406409 call eax                            MSVBVM60.DllFunctionCall
00406465 call eax                            MSVBVM60.DllFunctionCall
004064CD call eax                            MSVBVM60.DllFunctionCall
0040831B call ebx                            MSVBVM60.__vbaSetSystemError
0040832D call dword ptr [<&MSVBVM60.__vbaVarMo  MSVBVM60.__vbaVarMove
00408367 call dword ptr [<&MSVBVM60.__vbaVarSu  MSVBVM60.__vbaVarSub
00408372 call dword ptr [<&MSVBVM60.__vbaVarTs  MSVBVM60.__vbaVarTstLt
0040837D call dword ptr [<&MSVBVM60.#598>]    MSVBVM60.rtcDoEvents
00408396 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
004083A6 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVarList
004083B3 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
00408486 call dword ptr [<&MSVBVM60.__vbaVarDu  MSVBVM60.__vbaVarDup
0040849C call edi                            MSVBVM60.__vbaStrCat
004084A9 call ebx                            MSVBVM60.__vbaStrMove
004084EC call dword ptr [<&MSVBVM60.#595>]    MSVBVM60.rtcMsgBox
00408500 call dword ptr [<&MSVBVM60.__vbaFreeS  MSVBVM60.__vbaFreeStrList
00408518 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVarList
00408539 call dword ptr [<&MSVBVM60.__vbaFreeS  MSVBVM60.__vbaFreeStrList
00408551 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVarList
004085C1 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
004085E6 call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
004085EF call dword ptr [<&MSVBVM60.__vbaFreeO  MSVBVM60.__vbaFreeObj
004085FF call dword ptr [<&MSVBVM60.__vbaFreeO  MSVBVM60.__vbaFreeObj
0040863E call <jmp.&MSVBVM60.__vbaChkstk>    MSVBVM60.__vbaChkstk
00408685 call dword ptr [<&MSVBVM60.__vbaOnErr  MSVBVM60.__vbaOnError
0040869D call dword ptr [<&MSVBVM60.#716>]    MSVBVM60.rtcCreateObject2
004086A7 call dword ptr [<&MSVBVM60.__vbaObjVa  MSVBVM60.__vbaObjVar
004086B2 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSetAddref
004086BB call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
004086DB call <jmp.&MSVBVM60.__vbaChkstk>    MSVBVM60.__vbaChkstk
00408702 call dword ptr [<&MSVBVM60.__vbaLateM  MSVBVM60.__vbaLateMemSt
00408719 call dword ptr [<&MSVBVM60.__vbaStrCa  MSVBVM60.__vbaStrCat
0040872E call <jmp.&MSVBVM60.__vbaChkstk>    MSVBVM60.__vbaChkstk
00408757 call dword ptr [<&MSVBVM60.__vbaLateM  MSVBVM60.__vbaLateMemCall
00408763 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
00408776 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSetAddref
0040878D call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
00408797 call dword ptr [<&MSVBVM60.__vbaFreeO  MSVBVM60.__vbaFreeObj
0040885E call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
00408885 call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
00408899 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
004088C0 call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
004088CF call dword ptr [<&MSVBVM60.__vbaStrCm  MSVBVM60.__vbaStrCmp
004088E7 call dword ptr [<&MSVBVM60.__vbaStrCm  MSVBVM60.__vbaStrCmp
00408900 call dword ptr [<&MSVBVM60.__vbaFreeS  MSVBVM60.__vbaFreeStrList
00408910 call dword ptr [<&MSVBVM60.__vbaFreeO  MSVBVM60.__vbaFreeObjList
0040895C call esi                            MSVBVM60.__vbaVarDup
0040898A call dword ptr [<&MSVBVM60.#595>]    MSVBVM60.rtcMsgBox
004089A2 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVarList
004089BE call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
004089E5 call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
004089F9 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
00408A20 call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
00408A36 call edi                            MSVBVM60.__vbaStrCat
00408A43 call ebx                            MSVBVM60.__vbaStrMove
00408A99 call dword ptr [<&MSVBVM60.__vbaFreeS  MSVBVM60.__vbaFreeStrList
00408AA9 call dword ptr [<&MSVBVM60.__vbaFreeO  MSVBVM60.__vbaFreeObjList
00408ABD call dword ptr [<&MSVBVM60.#716>]    MSVBVM60.rtcCreateObject2
00408AC7 call dword ptr [<&MSVBVM60.__vbaObjVa  MSVBVM60.__vbaObjVar
00408AD2 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSetAddref
00408ADB call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
00408B7D call dword ptr [<&MSVBVM60.__vbaLateM  MSVBVM60.__vbaLateMemCall
00408B8E call dword ptr [<&MSVBVM60.__vbaLateM  MSVBVM60.__vbaLateMemCall
00408BBA call dword ptr [<&MSVBVM60.__vbaLateM  MSVBVM60.__vbaLateMemCallLd
00408BCB call dword ptr [<&MSVBVM60.__vbaVarTs  MSVBVM60.__vbaVarTstNe
00408BDB call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
00408BEB call dword ptr [<&MSVBVM60.#598>]    MSVBVM60.rtcDoEvents
00408C02 call dword ptr [<&MSVBVM60.__vbaLateM  MSVBVM60.__vbaLateMemCallLd
00408C0C call dword ptr [<&MSVBVM60.__vbaStrVa  MSVBVM60.__vbaStrVarMove
00408C1C call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVar
00408C2F call dword ptr [<&MSVBVM60.__vbaInStr  MSVBVM60.__vbaInStr
00408C72 call ebx                            MSVBVM60.__vbaVarDup
00408CA1 call dword ptr [<&MSVBVM60.#595>]    MSVBVM60.rtcMsgBox
00408CB9 call dword ptr [<&MSVBVM60.__vbaFreeV  MSVBVM60.__vbaFreeVarList
00408CD6 call ebx                            MSVBVM60.__vbaObjSet
00408CFA call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
00408D09 call edi                            MSVBVM60.__vbaFreeObj
00408D3D call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
00408D73 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
00408D9A call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
00408DB8 call dword ptr [<&MSVBVM60.#520>]    MSVBVM60.rtcTrimVar
00408DFA call dword ptr [<&MSVBVM60.__vbaVarCa  MSVBVM60.__vbaVarCat
00408E07 call dword ptr [<&MSVBVM60.__vbaInStr  MSVBVM60.__vbaInStrVar
00408E15 call dword ptr [<&MSVBVM60.__vbaVarTs  MSVBVM60.__vbaVarTstGt
00408E24 call dword ptr [<&MSVBVM60.__vbaFreeO  MSVBVM60.__vbaFreeObj
00408E42 call ebx                            MSVBVM60.__vbaFreeVarList
00408E8A call esi                            MSVBVM60.__vbaVarDup
00408EB9 call dword ptr [<&MSVBVM60.#595>]    MSVBVM60.rtcMsgBox
00408EF8 call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
00408F29 call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj
00408F47 call dword ptr [<&MSVBVM60.#520>]    MSVBVM60.rtcTrimVar
00408F89 call dword ptr [<&MSVBVM60.__vbaVarCa  MSVBVM60.__vbaVarCat
00408F96 call dword ptr [<&MSVBVM60.__vbaInStr  MSVBVM60.__vbaInStrVar
00408FA4 call dword ptr [<&MSVBVM60.__vbaVarTs  MSVBVM60.__vbaVarTstGt
00408FB3 call dword ptr [<&MSVBVM60.__vbaFreeO  MSVBVM60.__vbaFreeObj
0040900D call dword ptr [<&MSVBVM60.__vbaVarDu  MSVBVM60.__vbaVarDup
0040902C call dword ptr [<&MSVBVM60.__vbaVarDu  MSVBVM60.__vbaVarDup
00409044 call dword ptr [<&MSVBVM60.#595>]    MSVBVM60.rtcMsgBox
0040906F call dword ptr [<&MSVBVM60.__vbaObjSe  MSVBVM60.__vbaObjSet
00409094 call dword ptr [<&MSVBVM60.__vbaHresu  MSVBVM60.__vbaHresultCheckObj

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・1

免费・0

支持

最新回复 (3)
lostion 雪币： 191 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 16 粉丝 0 关注私信	lostion 2 楼 VB语句。。。 2011-9-21 11:14 0
FishSeeWater 雪币： 768 活跃值： (515) 能力值： ( LV13，RANK：460 ) 在线值：发帖 60 回帖 859 粉丝 8 关注私信	FishSeeWater 11 3 楼提问的艺术。。。。楼主想要做哈，目的是什么？　这些都没交待清楚，怎么回答你呀？　 2011-9-21 11:58 0
MyWOW 雪币： 4 活跃值： (25) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 47 粉丝 0 关注私信	MyWOW 4 楼我知道楼主要问什么。。其实不用，你那个就是右键>>查找>>所有模块间的调用而已啦。你可以直接bp MessageBoxA 然后断下来的是你想要断的那个的话，Alt+F9就可以到Call 也就是调用MessageBox的下一句指令处。再分析下流程就可以啦 2011-9-21 12:12 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

luxingxing

发帖

回帖

RANK

关注

私信

他的文章

输入bpx MessageBox(A)后弹出显示参考窗口，然后如何操作 3526

关于我们

联系我们

企业服务

看雪公众号

最新回复 (3)
lostion 雪币： 191 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 16 粉丝 0 关注私信	lostion 2 楼 VB语句。。。 2011-9-21 11:14 0
FishSeeWater 雪币： 768 活跃值： (515) 能力值： ( LV13，RANK：460 ) 在线值：发帖 60 回帖 859 粉丝 8 关注私信	FishSeeWater 11 3 楼提问的艺术。。。。楼主想要做哈，目的是什么？　这些都没交待清楚，怎么回答你呀？　 2011-9-21 11:58 0
MyWOW 雪币： 4 活跃值： (25) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 47 粉丝 0 关注私信	MyWOW 4 楼我知道楼主要问什么。。其实不用，你那个就是右键>>查找>>所有模块间的调用而已啦。你可以直接bp MessageBoxA 然后断下来的是你想要断的那个的话，Alt+F9就可以到Call 也就是调用MessageBox的下一句指令处。再分析下流程就可以啦 2011-9-21 12:12 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复