004130C9 . E8 CC2B0300 CALL <JMP.&MFC80.#6236>
004130CE . 8BCE MOV ECX,ESI
004130D0 . E8 1BFEFFFF CALL AbotGrou.00412EF0
004130D5 . 85C0 TEST EAX,EAX
004130D7 . 75 3C JNZ SHORT AbotGrou.00413115
004130D9 . 68 31040000 PUSH 431
004130DE . 8BCE MOV ECX,ESI
004130E0 . E8 F92C0300 CALL <JMP.&MFC80.#2657>
004130E5 . 8BC8 MOV ECX,EAX
004130E7 . E8 EC2C0300 CALL <JMP.&MFC80.#5833>
004130EC . 6A 00 PUSH 0
004130EE . 6A 00 PUSH 0
004130F0 . 68 001C4500 PUSH AbotGrou.00451C00 ; 请输入正确的订单号!
004130F5 . E8 EE280300 CALL <JMP.&MFC80.#1123>
004130FA . 6A 00 PUSH 0
004130FC . 8BCE MOV ECX,ESI
004130FE . E8 972B0300 CALL <JMP.&MFC80.#6236>
00413103 . 8B4C24 30 MOV ECX,DWORD PTR SS:[ESP+30]
00413107 . 64:890D 00000>MOV DWORD PTR FS:[0],ECX
0041310E . 59 POP ECX
0041310F . 5F POP EDI
00413110 . 5E POP ESI
00413111 . 83C4 30 ADD ESP,30
00413114 . C3 RETN
00413115 > 8DBE B8000000 LEA EDI,DWORD PTR DS:[ESI+B8]
0041311B . 8BCF MOV ECX,EDI
0041311D . FF15 D8E54400 CALL DWORD PTR DS:[<&MFC80.#6168>] ; MFC80.781F4A2A
00413123 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
00413125 . 8B40 F4 MOV EAX,DWORD PTR DS:[EAX-C]
00413128 . 85C0 TEST EAX,EAX
0041312A . 75 3C JNZ SHORT AbotGrou.00413168
0041312C . 68 30040000 PUSH 430
00413131 . 8BCE MOV ECX,ESI
00413133 . E8 A62C0300 CALL <JMP.&MFC80.#2657>
00413138 . 8BC8 MOV ECX,EAX
0041313A . E8 992C0300 CALL <JMP.&MFC80.#5833>
0041313F . 6A 00 PUSH 0
00413141 . 6A 00 PUSH 0
00413143 . 68 EC1B4500 PUSH AbotGrou.00451BEC ; 没有输入验证码!
00413148 . E8 9B280300 CALL <JMP.&MFC80.#1123>
0041314D . 6A 00 PUSH 0
0041314F . 8BCE MOV ECX,ESI
00413151 . E8 442B0300 CALL <JMP.&MFC80.#6236>
00413156 . 8B4C24 30 MOV ECX,DWORD PTR SS:[ESP+30]
0041315A . 64:890D 00000>MOV DWORD PTR FS:[0],ECX
00413161 . 59 POP ECX
00413162 . 5F POP EDI
00413163 . 5E POP ESI
00413164 . 83C4 30 ADD ESP,30
00413167 . C3 RETN
00413168 > 6A 00 PUSH 0
0041316A . 6A 04 PUSH 4
0041316C . 68 C41B4500 PUSH AbotGrou.00451BC4 ; 你确定在这台电脑上注册和使用软件吗?
00413171 . E8 72280300 CALL <JMP.&MFC80.#1123>
00413176 . 83F8 07 CMP EAX,7
00413179 . 0F84 94010000 JE AbotGrou.00413313
0041317F . E8 002C0300 CALL <JMP.&MFC80.#1084>
00413184 . 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
00413187 . E8 0A2C0300 CALL <JMP.&MFC80.#1308>
0041318C . 68 5FEB4400 PUSH AbotGrou.0044EB5F
00413191 . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
00413195 . C74424 3C 000>MOV DWORD PTR SS:[ESP+3C],0
0041319D . FF15 5CE64400 CALL DWORD PTR DS:[<&MFC80.#304>] ; MFC80.781F3F28
004131A3 . 8B8E B4000000 MOV ECX,DWORD PTR DS:[ESI+B4]
004131A9 . 8B96 B0000000 MOV EDX,DWORD PTR DS:[ESI+B0]
004131AF . 8B07 MOV EAX,DWORD PTR DS:[EDI]
004131B1 . 51 PUSH ECX
004131B2 . 52 PUSH EDX
004131B3 . 6A 15 PUSH 15
004131B5 . 50 PUSH EAX
004131B6 . 68 AC1B4500 PUSH AbotGrou.00451BAC ; http://lu.abot.cn/lu
004131BB . 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C]
004131BF . 68 841B4500 PUSH AbotGrou.00451B84 ; %s/sn_code.php?v=%s&p=%d&code=%s&no=%s
004131C4 . 51 PUSH ECX
004131C5 . C64424 54 01 MOV BYTE PTR SS:[ESP+54],1
004131CA . FF15 28E64400 CALL DWORD PTR DS:[<&MFC80.#2322>] ; MFC80.781F6BD9
004131D0 . 83C4 1C ADD ESP,1C
004131D3 . 68 04464600 PUSH AbotGrou.00464604
004131D8 . 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
004131DC . FF15 68E64400 CALL DWORD PTR DS:[<&MFC80.#297>] ; MFC80.781F3E65
004131E2 . 68 741B4500 PUSH AbotGrou.00451B74 ; \licence.cer
004131E7 . 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
004131EB . C64424 3C 02 MOV BYTE PTR SS:[ESP+3C],2
004131F0 . FF15 0CE64400 CALL DWORD PTR DS:[<&MFC80.#1248>] ; MFC80.781F3937
004131F6 . 68 5FEB4400 PUSH AbotGrou.0044EB5F
004131FB . 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
004131FF . C74424 20 000>MOV DWORD PTR SS:[ESP+20],0
00413207 . FF15 5CE64400 CALL DWORD PTR DS:[<&MFC80.#304>] ; MFC80.781F3F28
0041320D . 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10]
00413211 . 52 PUSH EDX
00413212 . 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20]
00413216 . 50 PUSH EAX
00413217 . 51 PUSH ECX
00413218 . 8D5424 20 LEA EDX,DWORD PTR SS:[ESP+20]
0041321C . 8BCC MOV ECX,ESP
0041321E . 896424 2C MOV DWORD PTR SS:[ESP+2C],ESP
00413222 . 52 PUSH EDX
00413223 . C64424 48 03 MOV BYTE PTR SS:[ESP+48],3
00413228 . FF15 68E64400 CALL DWORD PTR DS:[<&MFC80.#297>] ; MFC80.781F3E65
0041322E . 6A 01 PUSH 1
00413230 . 6A 00 PUSH 0
00413232 . 51 PUSH ECX
00413233 . 8BCC MOV ECX,ESP
00413235 . 896424 3C MOV DWORD PTR SS:[ESP+3C],ESP
00413239 . 68 D4FE4400 PUSH AbotGrou.0044FED4 ; abot.cn
0041323E . C64424 54 04 MOV BYTE PTR SS:[ESP+54],4
00413243 . FF15 5CE64400 CALL DWORD PTR DS:[<&MFC80.#304>] ; MFC80.781F3F28
00413249 . 51 PUSH ECX
0041324A . 8BCC MOV ECX,ESP
0041324C . 896424 44 MOV DWORD PTR SS:[ESP+44],ESP
00413250 . 68 601B4500 PUSH AbotGrou.00451B60 ; http://www.abot.cn
00413255 . C64424 58 05 MOV BYTE PTR SS:[ESP+58],5
0041325A . FF15 5CE64400 CALL DWORD PTR DS:[<&MFC80.#304>] ; MFC80.781F3F28
00413260 . 51 PUSH ECX
00413261 . 8D4424 38 LEA EAX,DWORD PTR SS:[ESP+38]
00413265 . 8BCC MOV ECX,ESP
00413267 . 896424 4C MOV DWORD PTR SS:[ESP+4C],ESP
0041326B . 50 PUSH EAX
0041326C . C64424 5C 06 MOV BYTE PTR SS:[ESP+5C],6
00413271 . FF15 68E64400 CALL DWORD PTR DS:[<&MFC80.#297>] ; MFC80.781F3E65
00413277 . 8D8E AC000000 LEA ECX,DWORD PTR DS:[ESI+AC]
0041327D . 51 PUSH ECX
0041327E . C64424 5C 03 MOV BYTE PTR SS:[ESP+5C],3
00413283 . E8 38F5FFFF CALL AbotGrou.004127C0
00413288 . 83C4 24 ADD ESP,24
0041328B . 83F8 01 CMP EAX,1
0041328E . 75 16 JNZ SHORT AbotGrou.004132A6 ; JE 004132A6
00413290 . 6A 00 PUSH 0
00413292 . 6A 00 PUSH 0
00413294 . 68 441B4500 PUSH AbotGrou.00451B44 ; 注册完成,请重启软件验证!
00413299 . E8 4A270300 CALL <JMP.&MFC80.#1123>
0041329E . 6A 00 PUSH 0 ; /status = 0
004132A0 . FF15 7CE74400 CALL DWORD PTR DS:[<&MSVCR80.exit>] ; \exit
004132A6 > 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10]
004132AA . 52 PUSH EDX
004132AB . 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20]
004132AF . 68 381B4500 PUSH AbotGrou.00451B38 ; 注册失败!
004132B4 . 50 PUSH EAX
004132B5 . E8 16F1FEFF CALL AbotGrou.004023D0
004132BA . 83C4 0C ADD ESP,0C
004132BD . 8B00 MOV EAX,DWORD PTR DS:[EAX]
004132BF . 6A 00 PUSH 0
004132C1 . 6A 00 PUSH 0
004132C3 . 50 PUSH EAX
004132C4 . C64424 44 07 MOV BYTE PTR SS:[ESP+44],7
004132C9 . E8 1A270300 CALL <JMP.&MFC80.#1123>
004132CE . 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
004132D2 . C64424 38 03 MOV BYTE PTR SS:[ESP+38],3
004132D7 . FF15 74E64400 CALL DWORD PTR DS:[<&MFC80.#578>] ; MFC80.781F4235
004132DD . 8BCE MOV ECX,ESI
004132DF . E8 92290300 CALL <JMP.&MFC80.#4212>
004132E4 . 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
004132E8 . FF15 74E64400 CALL DWORD PTR DS:[<&MFC80.#578>] ; MFC80.781F4235
004132EE . 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
004132F2 . FF15 74E64400 CALL DWORD PTR DS:[<&MFC80.#578>] ; MFC80.781F4235
004132F8 . 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18]
004132FC . FF15 74E64400 CALL DWORD PTR DS:[<&MFC80.#578>] ; MFC80.781F4235
00413302 . 8D4C24 0F LEA ECX,DWORD PTR SS:[ESP+F]
00413306 . C74424 38 FFF>MOV DWORD PTR SS:[ESP+38],-1
0041330E . E8 9D52FFFF CALL AbotGrou.004085B0
00413313 > 8B4C24 30 MOV ECX,DWORD PTR SS:[ESP+30]
00413317 . 64:890D 00000>MOV DWORD PTR FS:[0],ECX
0041331E . 59 POP ECX
0041331F . 5F POP EDI
00413320 . 5E POP ESI
00413321 . 83C4 30 ADD ESP,30
00413324 . C3 RETN
00413325 CC INT3
00413326 CC INT3
00413327 CC INT3
00413328 CC INT3
00413329 CC INT3
0041332A CC INT3
0041332B CC INT3
0041332C CC INT3
0041332D CC INT3
0041332E CC INT3
0041332F CC INT3
00413330 /$ 53 PUSH EBX
00413331 |. 55 PUSH EBP
00413332 |. 8B6C24 0C MOV EBP,DWORD PTR SS:[ESP+C]
00413336 |. 85ED TEST EBP,EBP
00413338 |. 8BD9 MOV EBX,ECX
0041333A |. 75 07 JNZ SHORT AbotGrou.00413343
0041333C |. 892B MOV DWORD PTR DS:[EBX],EBP
0041333E |. 5D POP EBP
0041333F |. 5B POP EBX
00413340 |. C2 0800 RETN 8
00413343 |> 56 PUSH ESI
00413344 |. 57 PUSH EDI
00413345 |. 55 PUSH EBP ; /String
00413346 |. FF15 5CE04400 CALL DWORD PTR DS:[<&KERNEL32.lstrlenA>] ; \lstrlenA
0041334C |. 8BF8 MOV EDI,EAX
0041334E |. 68 80000000 PUSH 80
00413353 |. 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4]
00413356 |. 50 PUSH EAX
00413357 |. 83C7 01 ADD EDI,1
0041335A |. 57 PUSH EDI
0041335B |. 53 PUSH EBX
0041335C |. E8 4FFCFFFF CALL AbotGrou.00412FB0
00413361 |. 8B03 MOV EAX,DWORD PTR DS:[EBX]
00413363 |. 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+28]
00413367 |. 83C4 10 ADD ESP,10
0041336A |. 57 PUSH EDI ; /WideBufSize
0041336B |. 50 PUSH EAX ; |WideCharBuf
0041336C |. 57 PUSH EDI ; |StringSize
0041336D |. 55 PUSH EBP ; |StringToMap
0041336E |. 6A 00 PUSH 0 ; |Options = 0
00413370 |. 51 PUSH ECX ; |CodePage
00413371 |. FF15 1CE14400 CALL DWORD PTR DS:[<&KERNEL32.MultiByteT>; \MultiByteToWideChar
00413377 |. 8BF0 MOV ESI,EAX
00413379 |. F7DE NEG ESI
004130D7 . 75 3C JNZ SHORT AbotGrou.00413115
修改,JNE,为JE,就可以,但是马上又跳出,注册失败
0041328E . 75 16 JNZ SHORT AbotGrou.004132A6 改JE,输入验证码后就可以了,但是重启验证后却无法打开,不知道怎么回事,求大鸟帮忙,,,!
[课程]Android-CTF解题方法汇总!