[求助]找到了关键跳转，请教一下在上边怎么没找到关键调用-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] [求助]找到了关键跳转，请教一下在上边怎么没找到关键调用 0.00雪花

发表于: 2011-10-24 18:08 1756

[旧帖] [求助]找到了关键跳转，请教一下在上边怎么没找到关键调用 0.00雪花

今夜无风

2011-10-24 18:08

1756

00408773 .  FFD6       call esi                                        ; |\__vbaVarMul
00408775 .  8B3D 2C114000 mov    edi, dword ptr [<&MSVBVM60.__vbaVarAdd>] ; |MSVBVM60.__vbaVarAdd
0040877B .  50          push eax                                        ; |/var18
0040877C .  8D85 C8FEFFFF lea    eax, dword ptr [ebp-138]                   ; ||
00408782 .  68 34A04000 push 0040A034                                  ; ||/var18 = KOYO.0040A034
00408787 .  8D4D B8    lea    ecx, dword ptr [ebp-48]                   ; |||
0040878A .  50          push eax                                        ; |||var28
0040878B .  51          push ecx                                        ; |||saveto8
0040878C .  FFD7       call edi                                        ; ||\__vbaVarAdd
0040878E .  8D55 A8    lea    edx, dword ptr [ebp-58]                   ; ||
00408791 .  50          push eax                                        ; ||var28
00408792 .  52          push edx                                        ; ||SaveTo8
00408793 .  FFD6       call esi                                        ; |\__vbaVarMul
00408795 .  50          push eax                                        ; |/var18
00408796 .  8D85 B8FEFFFF lea    eax, dword ptr [ebp-148]                   ; ||
0040879C .  68 44A04000 push 0040A044                                  ; ||/var18 = KOYO.0040A044
004087A1 .  8D4D 98    lea    ecx, dword ptr [ebp-68]                   ; |||
004087A4 .  50          push eax                                        ; |||var28
004087A5 .  51          push ecx                                        ; |||SaveTo8
004087A6 .  FFD6       call esi                                        ; ||\__vbaVarMul
004087A8 .  50          push eax                                        ; ||/var18
004087A9 .  8D55 88    lea    edx, dword ptr [ebp-78]                   ; |||
004087AC .  68 24A04000 push 0040A024                                  ; |||var28 = KOYO.0040A024
004087B1 .  52          push edx                                        ; |||SaveTo8
004087B2 .  FFD6       call esi                                        ; ||\__vbaVarMul
004087B4 .  50          push eax                                        ; ||/var18
004087B5 .  8D85 A8FEFFFF lea    eax, dword ptr [ebp-158]                   ; |||
004087BB .  8D8D 78FFFFFF lea    ecx, dword ptr [ebp-88]                   ; |||
004087C1 .  50          push eax                                        ; |||var28
004087C2 .  51          push ecx                                        ; |||SaveToST
004087C3 .  FF15 D8104000 call dword ptr [<&MSVBVM60.__vbaVarDiv>]       ; ||\__vbaVarDiv
004087C9 .  50          push eax                                        ; ||/var18
004087CA .  8D95 68FFFFFF lea    edx, dword ptr [ebp-98]                   ; |||
004087D0 .  68 64A04000 push 0040A064                                  ; |||var28 = KOYO.0040A064
004087D5 .  52          push edx                                        ; |||SaveTo8
004087D6 .  FFD6       call esi                                        ; ||\__vbaVarMul
004087D8 .  50          push eax                                        ; ||var28
004087D9 .  8D85 58FFFFFF lea    eax, dword ptr [ebp-A8]                   ; ||
004087DF .  50          push eax                                        ; ||SaveTo8
004087E0 .  FF15 00104000 call dword ptr [<&MSVBVM60.__vbaVarSub>]       ; |\__vbaVarSub
004087E6 .  50          push eax                                        ; |/var18
004087E7 .  8D8D 98FEFFFF lea    ecx, dword ptr [ebp-168]                   ; ||
004087ED .  68 54A04000 push 0040A054                                  ; ||/var18 = KOYO.0040A054
004087F2 .  8D95 48FFFFFF lea    edx, dword ptr [ebp-B8]                   ; |||
004087F8 .  51          push ecx                                        ; |||var28
004087F9 .  52          push edx                                        ; |||SaveTo8
004087FA .  FFD6       call esi                                        ; ||\__vbaVarMul
004087FC .  50          push eax                                        ; ||/var18
004087FD .  8D85 38FFFFFF lea    eax, dword ptr [ebp-C8]                   ; |||
00408803 .  68 34A04000 push 0040A034                                  ; |||var28 = KOYO.0040A034
00408808 .  50          push eax                                        ; |||SaveTo8
00408809 .  FFD6       call esi                                        ; ||\__vbaVarMul
0040880B .  50          push eax                                        ; ||/var18
0040880C .  8D8D 28FFFFFF lea    ecx, dword ptr [ebp-D8]                   ; |||
00408812 .  68 34A04000 push 0040A034                                  ; |||var28 = KOYO.0040A034
00408817 .  51          push ecx                                        ; |||SaveTo8
00408818 .  FFD6       call esi                                        ; ||\__vbaVarMul
0040881A .  50          push eax                                        ; ||var28
0040881B .  8D95 18FFFFFF lea    edx, dword ptr [ebp-E8]                   ; ||
00408821 .  52          push edx                                        ; ||saveto8
00408822 .  FFD7       call edi                                        ; |\__vbaVarAdd
00408824 .  50          push eax                                        ; |/var18
00408825 .  8D85 88FEFFFF lea    eax, dword ptr [ebp-178]                   ; ||
0040882B .  68 64A04000 push 0040A064                                  ; ||/var18 = KOYO.0040A064
00408830 .  8D8D 08FFFFFF lea    ecx, dword ptr [ebp-F8]                   ; |||
00408836 .  50          push eax                                        ; |||var28
00408837 .  51          push ecx                                        ; |||saveto8
00408838 .  FFD7       call edi                                        ; ||\__vbaVarAdd
0040883A .  50          push eax                                        ; ||/var18
0040883B .  8D95 F8FEFFFF lea    edx, dword ptr [ebp-108]                   ; |||
00408841 .  68 74A04000 push 0040A074                                  ; |||var28 = KOYO.0040A074
00408846 .  52          push edx                                        ; |||SaveTo8
00408847 .  FFD6       call esi                                        ; ||\__vbaVarMul
00408849 .  50          push eax                                        ; ||var28
0040884A .  8D85 E8FEFFFF lea    eax, dword ptr [ebp-118]                   ; ||
00408850 .  50          push eax                                        ; ||saveto8
00408851 .  FFD7       call edi                                        ; |\__vbaVarAdd
00408853 .  50          push eax                                        ; |var28
00408854 .  FF15 98104000 call dword ptr [<&MSVBVM60.__vbaVarTstEq>]    ; \__vbaVarTstEq
0040885A .  8D4D E8    lea    ecx, dword ptr [ebp-18]
0040885D .  8BF0       mov    esi, eax
0040885F .  FF15 60114000 call dword ptr [<&MSVBVM60.__vbaFreeStr>]       ;  MSVBVM60.__vbaFreeStr
00408865 .  8D4D DC    lea    ecx, dword ptr [ebp-24]
00408868 .  FF15 5C114000 call dword ptr [<&MSVBVM60.__vbaFreeObj>]       ;  MSVBVM60.__vbaFreeObj
0040886E .  8D8D E8FEFFFF lea    ecx, dword ptr [ebp-118]
00408874 .  8D95 18FFFFFF lea    edx, dword ptr [ebp-E8]
0040887A .  51          push ecx
0040887B .  8D85 08FFFFFF lea    eax, dword ptr [ebp-F8]
00408881 .  52          push edx
00408882 .  8D4D B8    lea    ecx, dword ptr [ebp-48]
00408885 .  50          push eax
00408886 .  51          push ecx
00408887 .  6A 04       push 4
00408889 .  FF15 24104000 call dword ptr [<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
0040888F .  83C4 14    add    esp, 14
00408892 .  66:85F6    test si, si
00408895    0F84 28010000 je    004089C3                                  ;  关键跳转
0040889B    A1 F8A04000 mov    eax, dword ptr [40A0F8]
004088A0    85C0       test eax, eax
004088A2    75 10       jnz    short 004088B4
004088A4    68 F8A04000 push 0040A0F8
004088A9 .  68 841A4000 push 00401A84
004088AE .  FF15 FC104000 call dword ptr [<&MSVBVM60.__vbaNew2>]          ;  MSVBVM60.__vbaNew2
004088B4 >  8B35 F8A04000 mov    esi, dword ptr [40A0F8]
004088BA .  68 E82D4000 push 00402DE8                                  ;  软件注册----注册成功
004088BF .  56          push esi

[招生]系统0day安全班，企业级设备固件漏洞挖掘，Linux平台漏洞挖掘！

收藏・0

免费・0

支持

最新回复 (1)
zbzb 雪币： 59 活跃值： (1621) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 378 粉丝 0 关注私信	zbzb 2 楼算法直接就是一开头的代码了，所以也就没有关键call了，计算完了，通过 00408854 . FF15 98104000 call dword ptr [<&MSVBVM60.__vbaVarTstEq>] 进行对比了 2011-10-24 19:10 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

今夜无风

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (1)
zbzb 雪币： 59 活跃值： (1621) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 378 粉丝 0 关注私信	zbzb 2 楼算法直接就是一开头的代码了，所以也就没有关键call了，计算完了，通过 00408854 . FF15 98104000 call dword ptr [<&MSVBVM60.__vbaVarTstEq>] 进行对比了 2011-10-24 19:10 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复