能力值:
( LV2,RANK:10 )
|
-
-
2 楼
求帮忙看看
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
E语言的程序的话 你可以搜索 文本对比的特征码:
00409B41 8B5424 04 mov edx, dword ptr [esp+4]
00409B45 8B4C24 08 mov ecx, dword ptr [esp+8]
00409B49 85D2 test edx, edx
00409B4B 75 0D jnz short 00409B5A
00409B4D 33C0 xor eax, eax
00409B4F 85C9 test ecx, ecx
00409B51 74 06 je short 00409B59
00409B53 8039 00 cmp byte ptr [ecx], 0
00409B56 74 01 je short 00409B59
00409B58 48 dec eax
00409B59 C3 retn
00409B5A 85C9 test ecx, ecx
00409B5C 75 09 jnz short 00409B67
00409B5E 33C0 xor eax, eax
00409B60 803A 00 cmp byte ptr [edx], 0
00409B63 74 01 je short 00409B66
00409B65 40 inc eax
00409B66 C3 retn
00409B67 F7C2 03000000 test edx, 3
00409B6D 75 37 jnz short 00409BA6
00409B6F 8B02 mov eax, dword ptr [edx]
00409B71 3A01 cmp al, byte ptr [ecx]
00409B73 75 2B jnz short 00409BA0
00409B75 0AC0 or al, al
00409B77 74 24 je short 00409B9D
00409B79 3A61 01 cmp ah, byte ptr [ecx+1]
00409B7C 75 22 jnz short 00409BA0
00409B7E 0AE4 or ah, ah
00409B80 74 1B je short 00409B9D
00409B82 C1E8 10 shr eax, 10
00409B85 3A41 02 cmp al, byte ptr [ecx+2]
00409B88 75 16 jnz short 00409BA0
00409B8A 0AC0 or al, al
00409B8C 74 0F je short 00409B9D
00409B8E 3A61 03 cmp ah, byte ptr [ecx+3]
00409B91 75 0D jnz short 00409BA0
00409B93 83C1 04 add ecx, 4
00409B96 83C2 04 add edx, 4
00409B99 0AE4 or ah, ah
00409B9B ^ 75 D2 jnz short 00409B6F
00409B9D 33C0 xor eax, eax
00409B9F C3 retn
00409BA0 1BC0 sbb eax, eax
00409BA2 D1E0 shl eax, 1
00409BA4 40 inc eax
00409BA5 C3 retn
00409BA6 F7C2 01000000 test edx, 1
00409BAC 74 14 je short 00409BC2
00409BAE 8A02 mov al, byte ptr [edx]
00409BB0 42 inc edx
00409BB1 3A01 cmp al, byte ptr [ecx]
00409BB3 ^ 75 EB jnz short 00409BA0
00409BB5 41 inc ecx
00409BB6 0AC0 or al, al
00409BB8 ^ 74 E3 je short 00409B9D
00409BBA F7C2 02000000 test edx, 2
00409BC0 ^ 74 AD je short 00409B6F
00409BC2 66:8B02 mov ax, word ptr [edx]
00409BC5 83C2 02 add edx, 2
00409BC8 3A01 cmp al, byte ptr [ecx]
00409BCA ^ 75 D4 jnz short 00409BA0
00409BCC 0AC0 or al, al
00409BCE ^ 74 CD je short 00409B9D
00409BD0 3A61 01 cmp ah, byte ptr [ecx+1]
00409BD3 ^ 75 CB jnz short 00409BA0
00409BD5 0AE4 or ah, ah
00409BD7 ^ 74 C4 je short 00409B9D
00409BD9 83C1 02 add ecx, 2
00409BDC ^ EB 91 jmp short 00409B6F
00409BDE 55 push ebp
00409BDF 8BEC mov ebp, esp
00409BE1 81EC 08000000 sub esp, 8
00409BE7 6A FF push -1
00409BE9 6A 08 push 8
00409BEB 68 0F070116 push 1601070F
00409BF0 68 0E070152 push 5201070E
00409BF5 E8 43100000 call 0040AC3D ; 获取编辑框文本
00409BFA 83C4 10 add esp, 10
00409BFD 8945 FC mov dword ptr [ebp-4], eax
00409C00 68 46914000 push 00409146 ; ASCII "1314asdf."
00409C05 FF75 FC push dword ptr [ebp-4]
00409C08 E8 34FFFFFF call 00409B41 ; 文本比较
00409C0D 83C4 08 add esp, 8
00409C10 83F8 00 cmp eax, 0
00409C13 B8 00000000 mov eax, 0
00409C18 0F94C0 sete al
00409C1B 8945 F8 mov dword ptr [ebp-8], eax
00409C1E 8B5D FC mov ebx, dword ptr [ebp-4]
00409C21 85DB test ebx, ebx
00409C23 74 09 je short 00409C2E
00409C25 53 push ebx
00409C26 E8 FA0F0000 call 0040AC25
00409C2B 83C4 04 add esp, 4
00409C2E 837D F8 00 cmp dword ptr [ebp-8], 0
00409C32 0F84 5A000000 je 00409C92
00409C38 68 02000080 push 80000002
00409C3D 6A 00 push 0
00409C3F 68 00000000 push 0
00409C44 6A 00 push 0
00409C46 6A 00 push 0
00409C48 6A 00 push 0
00409C4A 68 01000100 push 10001
00409C4F 68 00000106 push 6010000
00409C54 68 01000152 push 52010001
00409C59 68 03000000 push 3
00409C5E BB 20030000 mov ebx, 320
00409C63 E8 DB0F0000 call 0040AC43
00409C68 83C4 28 add esp, 28
00409C6B 6A 00 push 0
00409C6D 6A 00 push 0
00409C6F 6A 00 push 0
00409C71 68 01000100 push 10001
00409C76 68 0D070106 push 601070D
00409C7B 68 0E070152 push 5201070E
00409C80 68 02000000 push 2
00409C85 BB 60030000 mov ebx, 360
00409C8A E8 B40F0000 call 0040AC43
00409C8F 83C4 1C add esp, 1C
00409C92 8BE5 mov esp, ebp
00409C94 5D pop ebp
00409C95 C3 retn
密码: 00409146=00409146 (ASCII "1314asdf.")
|
能力值:
( LV3,RANK:30 )
|
-
-
4 楼
[QUOTE=小林先生;1208342] E语言的程序的话 你可以搜索 文本对比的特征码:
00409B41 8B5424 04 mov edx, dword ptr [esp+4]
00409B45 8B4C24 08 mov ecx, dword ptr [esp+8]
...[/QUOTE]
学习了。。还能这么搞。。
|
能力值:
( LV4,RANK:50 )
|
-
-
5 楼
易语言定位按钮方法
《《《易语言程序》》》
特征码:FF 55 FC 5F 5E 89 5D F4
特征码来源:krnln.fnr
使用方法:OD载入程序---F9运行---Alt+M打开内存镜像---Ctrl+B搜索特征码---Ctrl+G跳到找到的地址---F2下断---点击按钮---断下后F7进入CALL(此处即为事件代码)
进去后代码如下。。。
00409BDE 55 push ebp
00409BDF 8BEC mov ebp, esp
00409BE1 81EC 08000000 sub esp, 8
00409BE7 6A FF push -1
00409BE9 6A 08 push 8
00409BEB 68 0F070116 push 1601070F
00409BF0 68 0E070152 push 5201070E
00409BF5 E8 43100000 call 0040AC3D
00409BFA 83C4 10 add esp, 10
00409BFD 8945 FC mov dword ptr [ebp-4], eax
00409C00 68 46914000 push 00409146 ; ASCII "1314asdf."
00409C05 FF75 FC push dword ptr [ebp-4]
00409C08 E8 34FFFFFF call 00409B41
00409C0D 83C4 08 add esp, 8
00409C10 83F8 00 cmp eax, 0
00409C13 B8 00000000 mov eax, 0
00409C18 0F94C0 sete al
00409C1B 8945 F8 mov dword ptr [ebp-8], eax
00409C1E 8B5D FC mov ebx, dword ptr [ebp-4]
00409C21 85DB test ebx, ebx
00409C23 74 09 je short 00409C2E
00409C25 53 push ebx
00409C26 E8 FA0F0000 call 0040AC25
00409C2B 83C4 04 add esp, 4
00409C2E 837D F8 00 cmp dword ptr [ebp-8], 0
00409C32 0F84 5A000000 je 00409C92
00409C38 68 02000080 push 80000002
00409C3D 6A 00 push 0
00409C3F 68 00000000 push 0
00409C44 6A 00 push 0
00409C46 6A 00 push 0
|
能力值:
( LV2,RANK:10 )
|
-
-
6 楼
楼上说的很好..易语言的特征就算加上vmp壳也没办法抹掉
|
能力值:
( LV2,RANK:10 )
|
-
-
7 楼
ok谢谢了 谢谢大家学习了
|