能力值：
( LV9，RANK：370 )
|
-
-
2 楼
+ 读取字符串的关键几个call
1002BAA6 50 push eax
1002BAA7 E8 43380800 call 100AF2EF ; 得到字符串和长度
1002BAAC 8B5424 20 mov edx, dword ptr [esp+20]
100AF2EF 56 push esi
100AF2F0 8BF1 mov esi, ecx
100AF2F2 8B4E 38 mov ecx, dword ptr [esi+38]
100AF2F5 85C9 test ecx, ecx
100AF2F7 75 2E jnz short 100AF327
100AF2F9 FF76 1C push dword ptr [esi+1C]
100AF2FC FF15 3C350C10 call dword ptr [<&USER32.GetWindowTex>; user32.GetWindowTextLengthA
100AF302 8D48 01 lea ecx, dword ptr [eax+1]
100AF305 51 push ecx
100AF306 8B4C24 0C mov ecx, dword ptr [esp+C]
100AF30A 50 push eax
100AF30B E8 6B2C0000 call 100B1F7B
100AF310 50 push eax
100AF311 FF76 1C push dword ptr [esi+1C]
100AF314 FF15 40350C10 call dword ptr [<&USER32.GetWindowTex>; 得到字符串
100AF31A 8B4C24 08 mov ecx, dword ptr [esp+8]
100AF31E 6A FF push -1
100AF320 E8 2E2C0000 call 100B1F53 ; 得到字符串长度
100AF325 EB 0C jmp short 100AF333
+ 最上层的读取字符串，计算，打印过程。。。。。。
0041D4F9 68 40924000 push 00409240
0041D4FE FF75 FC push dword ptr [ebp-4]
0041D501 E8 0FD0FFFF call 0041A515 ；计算crc
参数：
0012F2C8 0041D506 返回到 破解辅助.0041D506 来自 破解辅助.0041A515
0012F2CC 00204E38 ASCII "321321321321321321321321"
0012F2D0 00409240 破解辅助.00409240
0041D4F9 68 40924000 push 00409240
0041D4FE FF75 FC push dword ptr [ebp-4]
0041D501 E8 0FD0FFFF call 0041A515
0041D506 83C4 08 add esp, 8
0041D509 83F8 00 cmp eax, 0
0041D50C B8 00000000 mov eax, 0
0041D511 0F94C0 sete al
0041D514 8945 F8 mov dword ptr [ebp-8], eax
0041D517 8B5D FC mov ebx, dword ptr [ebp-4]
0041D51A 85DB test ebx, ebx
0041D51C 74 09 je short 0041D527
0041D51E 53 push ebx
0041D51F E8 3E740000 call 00424962
0041D524 83C4 04 add esp, 4
0041D527 837D F8 00 cmp dword ptr [ebp-8], 0
0041D52B 0F84 0A000000 je 0041D53B
0041D531 E9 1F010000 jmp 0041D655
0041D536 E9 1A010000 jmp 0041D655
0041D53B 6A FF push -1
0041D53D 6A 08 push 8
0041D53F 68 054F0116 push 16014F05
0041D544 68 01000152 push 52010001
0041D549 E8 20740000 call 0042496E
0041D54E 83C4 10 add esp, 10
0041D551 8945 FC mov dword ptr [ebp-4], eax
0041D554 68 04000080 push 80000004
0041D559 6A 00 push 0
0041D55B 8B45 FC mov eax, dword ptr [ebp-4]
0041D55E 85C0 test eax, eax
0041D560 75 05 jnz short 0041D567
0041D562 B8 40924000 mov eax, 00409240
0041D567 50 push eax
0041D568 68 01000000 push 1
0041D56D BB 30010000 mov ebx, 130
0041D572 E8 E5730000 call 0042495C
0041D577 83C4 10 add esp, 10
0041D57A 8945 F8 mov dword ptr [ebp-8], eax
0041D57D 8B5D FC mov ebx, dword ptr [ebp-4]
0041D580 85DB test ebx, ebx
0041D582 74 09 je short 0041D58D
0041D584 53 push ebx
0041D585 E8 D8730000 call 00424962
0041D58A 83C4 04 add esp, 4
0041D58D 6A FF push -1
0041D58F 6A 08 push 8
0041D591 68 054F0116 push 16014F05
0041D596 68 01000152 push 52010001
0041D59B E8 CE730000 call 0042496E
0041D5A0 83C4 10 add esp, 10
0041D5A3 8945 F4 mov dword ptr [ebp-C], eax
0041D5A6 8965 F0 mov dword ptr [ebp-10], esp
0041D5A9 FF75 F8 push dword ptr [ebp-8]
0041D5AC FF75 F4 push dword ptr [ebp-C]
0041D5AF 68 00000000 push 0
0041D5B4 B8 00000000 mov eax, 0
0041D5B9 E8 BC730000 call 0042497A
0041D5BE 3965 F0 cmp dword ptr [ebp-10], esp
0041D5C1 74 0D je short 0041D5D0
0041D5C3 68 06000000 push 6
0041D5C8 E8 89730000 call 00424956
0041D5CD 83C4 04 add esp, 4
0041D5D0 8945 EC mov dword ptr [ebp-14], eax
0041D5D3 8B5D F4 mov ebx, dword ptr [ebp-C]
0041D5D6 85DB test ebx, ebx
0041D5D8 74 09 je short 0041D5E3
0041D5DA 53 push ebx
0041D5DB E8 82730000 call 00424962
0041D5E0 83C4 04 add esp, 4
0041D5E3 68 01030080 push 80000301
0041D5E8 6A 00 push 0
0041D5EA FF75 EC push dword ptr [ebp-14]
0041D5ED 68 01000000 push 1
0041D5F2 BB D4010000 mov ebx, 1D4
0041D5F7 E8 60730000 call 0042495C
0041D5FC 83C4 10 add esp, 10
0041D5FF 8945 E8 mov dword ptr [ebp-18], eax
0041D602 FF75 E8 push dword ptr [ebp-18]
0041D605 68 D9924000 push 004092D9 ; ASCII "0x"
0041D60A B9 02000000 mov ecx, 2
0041D60F E8 0CDEFFFF call 0041B420 ; printf,打印结果
+ 计算crc
0041A53B F7C2 03000000 test edx, 3
0041A541 75 37 jnz short 0041A57A ; 计算crc的关键算法
0041A543 8B02 mov eax, dword ptr [edx]
0041A545 3A01 cmp al, byte ptr [ecx]
0041A547 75 2B jnz short 0041A574
0041A549 0AC0 or al, al
0041A54B 74 24 je short 0041A571
0041A54D 3A61 01 cmp ah, byte ptr [ecx+1]
0041A550 75 22 jnz short 0041A574
0041A552 0AE4 or ah, ah
0041A554 74 1B je short 0041A571
0041A556 C1E8 10 shr eax, 10
0041A559 3A41 02 cmp al, byte ptr [ecx+2]
0041A55C 75 16 jnz short 0041A574
0041A55E 0AC0 or al, al
0041A560 74 0F je short 0041A571
0041A562 3A61 03 cmp ah, byte ptr [ecx+3]
0041A565 75 0D jnz short 0041A574
0041A567 83C1 04 add ecx, 4
0041A56A 83C2 04 add edx, 4
0041A56D 0AE4 or ah, ah
0041A56F ^ 75 D2 jnz short 0041A543
0041A571 33C0 xor eax, eax
0041A573 C3 retn
0041A574 1BC0 sbb eax, eax
0041A576 D1E0 shl eax, 1
0041A578 40 inc eax
0041A579 C3 retn
0041A57A F7C2 01000000 test edx, 1
0041A580 74 14 je short 0041A596
0041A582 8A02 mov al, byte ptr [edx]
0041A584 42 inc edx
0041A585 3A01 cmp al, byte ptr [ecx]
0041A587 ^ 75 EB jnz short 0041A574
0041A589 41 inc ecx
0041A58A 0AC0 or al, al
0041A58C ^ 74 E3 je short 0041A571
0041A58E F7C2 02000000 test edx, 2
0041A594 ^ 74 AD je short 0041A543
0041A596 66:8B02 mov ax, word ptr [edx]
0041A599 83C2 02 add edx, 2
0041A59C 3A01 cmp al, byte ptr [ecx]
0041A59E ^ 75 D4 jnz short 0041A574
0041A5A0 0AC0 or al, al
0041A5A2 ^ 74 CD je short 0041A571
0041A5A4 3A61 01 cmp ah, byte ptr [ecx+1]
0041A5A7 ^ 75 CB jnz short 0041A574
0041A5A9 0AE4 or ah, ah
0041A5AB ^ 74 C4 je short 0041A571
0041A5AD 83C1 02 add ecx, 2
0041A5B0 ^ EB 91 jmp short 0041A543
|
能力值：
( LV7，RANK：100 )
|
-
-
4 楼
请教兄，是怎么找到下面这几个关键点的呢？谢谢！
+ 读取字符串的关键几个call
1002BAA6 50 push eax
0041D4F9 68 40924000 push 00409240
0041D4FE FF75 FC push dword ptr [ebp-4]
0041D501 E8 0FD0FFFF call 0041A515 ；计算crc
|
能力值：
( LV7，RANK：100 )
|
-
-
8 楼
终于在ntdll模块找到了熟悉的CRC32算法，7C983058开始的就是CRC32查找表
问题是，这种CRC32的调用是如何实现的，和krnln模块有什么关系？谁能帮我普及下基本知识?谢谢先 :-)
还有就是debug的时候，怎么定位到fosom兄、thinkSJ提到的关键函数？
7C983032 8B55 0C MOV EDX,DWORD PTR SS:[EBP+C]
7C983035 0FB61411 MOVZX EDX,BYTE PTR DS:[ECX+EDX]
7C983039 33D0 XOR EDX,EAX
7C98303B 81E2 FF000000 AND EDX,0FF
7C983041 C1E8 08 SHR EAX,8
7C983044 330495 5830987C XOR EAX,DWORD PTR DS:[EDX*4+7C983058]
7C98304B 41 INC ECX
7C98304C 3B4D 10 CMP ECX,DWORD PTR SS:[EBP+10]
7C98304F ^ 72 E1 JB SHORT ntdll.7C983032
|
能力值：
( LV10，RANK：170 )
|
-
-
10 楼
这个程序是用E语言写的,CRC的算法实现貌似是封装在它的模块中. 找一个E语言的工具可以很容易的定位到那个
按钮的响应函数.
PS: EDB88320 这个值是用来动态生成CRC32表的Key,但对于不同实现的CRC算法,这个值可能不太一样.
|
