能力值：
( LV2，RANK：10 )
|
-
-
6 楼
请高手指导，彩 ・神是用磁盘标识？来生成机器码的吗？
Ordinal,Function Name,RVA, Offset, Forward
0x0001,DiskID32,0x00001780,0x00001780,
我的用户名为：北京11
我的电子邮件为：1
我的机器码为：557023552392239
我的软件版本号为 V8.0.0.11
0213166B C3 retn
0213166C 90 nop
0213166D 90 nop
0213166E 90 nop
0213166F 90 nop
02131670 53 push ebx
02131671 56 push esi
02131672 57 push edi
02131673 BF 6C801302 mov edi,NetAPICs.0213806C
02131678 83C9 FF or ecx,FFFFFFFF
0213167B 33C0 xor eax,eax
0213167D F2:AE repne scas byte ptr es:[edi]
0213167F F7D1 not ecx
02131681 2BF9 sub edi,ecx
02131683 8B5C24 14 mov ebx,dword ptr ss:[esp+14]
02131687 8BC1 mov eax,ecx
02131689 8BF7 mov esi,edi
0213168B BF 44801302 mov edi,NetAPICs.02138044 ; ASCII "ST340016A"
02131690 6A 2E push 2E
02131692 C1E9 02 shr ecx,2
02131695 F3:A5 rep movs dword ptr es:[edi],dword pt>
02131697 8BC8 mov ecx,eax
02131699 33C0 xor eax,eax
0213169B 83E1 03 and ecx,3
0213169E 6A 1B push 1B
021316A0 F3:A4 rep movs byte ptr es:[edi],byte ptr >
021316A2 BF 6C801302 mov edi,NetAPICs.0213806C
021316A7 83C9 FF or ecx,FFFFFFFF
021316AA F2:AE repne scas byte ptr es:[edi]
021316AC F7D1 not ecx
021316AE 2BF9 sub edi,ecx
021316B0 53 push ebx
021316B1 8BD1 mov edx,ecx
021316B3 8BF7 mov esi,edi
021316B5 BF 147D1302 mov edi,NetAPICs.02137D14 ; ASCII "3HS6P8AF"
021316BA C1E9 02 shr ecx,2
021316BD F3:A5 rep movs dword ptr es:[edi],dword pt>
021316BF 8BCA mov ecx,edx
021316C1 83E1 03 and ecx,3
021316C4 F3:A4 rep movs byte ptr es:[edi],byte ptr >
021316C6 E8 55000000 call NetAPICs.02131720
021316CB 8BF8 mov edi,eax
021316CD 83C9 FF or ecx,FFFFFFFF
021316D0 33C0 xor eax,eax
021316D2 6A 13 push 13
021316D4 F2:AE repne scas byte ptr es:[edi]
021316D6 F7D1 not ecx
021316D8 2BF9 sub edi,ecx
021316DA 6A 0A push 0A
021316DC 8BC1 mov eax,ecx
021316DE 8BF7 mov esi,edi
021316E0 BF 44801302 mov edi,NetAPICs.02138044 ; ASCII "ST340016A"
021316E5 53 push ebx
021316E6 C1E9 02 shr ecx,2
021316E9 F3:A5 rep movs dword ptr es:[edi],dword pt>
021316EB 8BC8 mov ecx,eax
021316ED 83E1 03 and ecx,3
021316F0 F3:A4 rep movs byte ptr es:[edi],byte ptr >
021316F2 E8 29000000 call NetAPICs.02131720
021316F7 8BF8 mov edi,eax
021316F9 83C9 FF or ecx,FFFFFFFF
021316FC 33C0 xor eax,eax
021316FE 83C4 18 add esp,18
02131701 F2:AE repne scas byte ptr es:[edi]
02131703 F7D1 not ecx
02131705 2BF9 sub edi,ecx
02131707 8BD1 mov edx,ecx
02131709 8BF7 mov esi,edi
0213170B BF 147D1302 mov edi,NetAPICs.02137D14 ; ASCII "3HS6P8AF"
02131710 C1E9 02 shr ecx,2
02131713 F3:A5 rep movs dword ptr es:[edi],dword pt>
02131715 8BCA mov ecx,edx
02131717 83E1 03 and ecx,3
0213171A F3:A4 rep movs byte ptr es:[edi],byte ptr >
0213171C 5F pop edi
0213171D 5E pop esi
0213171E 5B pop ebx
0213171F C3 retn
02131720 8B5424 0C mov edx,dword ptr ss:[esp+C]
02131724 56 push esi
02131725 8B7424 0C mov esi,dword ptr ss:[esp+C]
02131729 33C0 xor eax,eax
0213172B 3BF2 cmp esi,edx
0213172D 7F 28 jg short NetAPICs.02131757
0213172F 8B4C24 08 mov ecx,dword ptr ss:[esp+8]
02131733 2BD6 sub edx,esi
02131735 42 inc edx
02131736 8D0CB1 lea ecx,dword ptr ds:[ecx+esi*4]
02131739 8BF2 mov esi,edx
0213173B 8B11 mov edx,dword ptr ds:[ecx]
0213173D 83C1 04 add ecx,4
02131740 C1EA 08 shr edx,8
02131743 8890 447F1302 mov byte ptr ds:[eax+2137F44],dl
02131749 8A51 FC mov dl,byte ptr ds:[ecx-4]
0213174C 40 inc eax
0213174D 8890 447F1302 mov byte ptr ds:[eax+2137F44],dl
02131753 40 inc eax
02131754 4E dec esi
02131755 ^ 75 E4 jnz short NetAPICs.0213173B
02131757 C680 447F1302>mov byte ptr ds:[eax+2137F44],0
0213175E 48 dec eax
0213175F 85C0 test eax,eax
02131761 5E pop esi
02131762 7E 16 jle short NetAPICs.0213177A
02131764 B1 20 mov cl,20
02131766 3888 447F1302 cmp byte ptr ds:[eax+2137F44],cl
0213176C 75 0C jnz short NetAPICs.0213177A
0213176E C680 447F1302>mov byte ptr ds:[eax+2137F44],0
02131775 48 dec eax
02131776 85C0 test eax,eax
02131778 ^ 7F EC jg short NetAPICs.02131766
0213177A B8 447F1302 mov eax,NetAPICs.02137F44 ; ASCII "3HS6P8AF"
0213177F C3 retn
02131780 N> E8 FBF9FFFF call NetAPICs.02131180
02131785 84C0 test al,al ;al=01
02131787 74 12 je short NetAPICs.0213179B ;跳转没有实现
02131789 E8 72F8FFFF call NetAPICs.02131000
0213178E 8BD0 mov edx,eax ;eax=00000001 edx=7C92EB94 (ntdll.KiFastSystemCallRet)
02131790 85D2 test edx,edx ;edx=00000001
02131792 75 0E jnz short NetAPICs.021317A2 ;跳转已经实现
02131794 E8 C7FDFFFF call NetAPICs.02131560
02131799 EB 05 jmp short NetAPICs.021317A0
0213179B E8 C0FCFFFF call NetAPICs.02131460
021317A0 8BD0 mov edx,eax
021317A2 56 push esi ;esi=005F07C4 (cs.005F07C4)
021317A3 57 push edi ;edi=0012E910
021317A4 BF 44801302 mov edi,NetAPICs.02138044 ; ASCII "ST340016A"
021317A9 83C9 FF or ecx,FFFFFFFF ;ecx=0012E398
021317AC 33C0 xor eax,eax ;eax=00000001
021317AE F2:AE repne scas byte ptr es:[edi] ;ecx=FFFFFFFF (十进制 4294967295.) al=00 es:[edi]=[028C8044]=53 ('S')
021317B0 F7D1 not ecx ;ecx=FFFFFFF5
021317B2 2BF9 sub edi,ecx ;ecx=0000000A edi=028C804E (NetAPICs.028C804E)
021317B4 8BC1 mov eax,ecx ;ecx=0000000A eax=00000000
021317B6 8BF7 mov esi,edi ;edi=028C8044 (NetAPICs.028C8044), ASCII "ST340016A" esi=005F07C4 (cs.005F07C4)
021317B8 8B7C24 0C mov edi,dword ptr ss:[esp+C] ;Stack ss:[0012E908]=00171110 edi=028C8044 (NetAPICs.028C8044), ASCII "ST340016A"
021317BC C1E9 02 shr ecx,2
021317BF F3:A5 rep movs dword ptr es:[edi],dword pt>
021317C1 8BC8 mov ecx,eax
021317C3 33C0 xor eax,eax
021317C5 83E1 03 and ecx,3
021317C8 F3:A4 rep movs byte ptr es:[edi],byte ptr >
021317CA BF 147D1302 mov edi,NetAPICs.02137D14 ; ASCII "3HS6P8AF"
021317CF 83C9 FF or ecx,FFFFFFFF
021317D2 F2:AE repne scas byte ptr es:[edi]
021317D4 F7D1 not ecx
021317D6 2BF9 sub edi,ecx
021317D8 8BC1 mov eax,ecx
021317DA 8BF7 mov esi,edi
021317DC 8B7C24 10 mov edi,dword ptr ss:[esp+10]
021317E0 C1E9 02 shr ecx,2
021317E3 F3:A5 rep movs dword ptr es:[edi],dword pt>
021317E5 8BC8 mov ecx,eax
021317E7 8BC2 mov eax,edx
021317E9 83E1 03 and ecx,3
021317EC F3:A4 rep movs byte ptr es:[edi],byte ptr >
021317EE 5F pop edi
021317EF 5E pop esi
021317F0 C2 0800 retn 8
028C1673 BF 6C808C02 mov edi,NetAPICs.028C806C
028C1678 83C9 FF or ecx,FFFFFFFF ;ecx=0012E900
028C167B 33C0 xor eax,eax
028C167D F2:AE repne scas byte ptr es:[edi] ;ecx=FFFFFFFF (十进制 4294967295.)al=00 es:[edi]=[028C806C]=00
028C167F F7D1 not ecx ;ecx=FFFFFFFF
028C1681 2BF9 sub edi,ecx ;ecx=00000001 edi=028C806D (NetAPICs.028C806D)
028C1683 8B5C24 14 mov ebx,dword ptr ss:[esp+14] ;ecx=00000001 edi=028C806D (NetAPICs.028C806D)
028C1687 8BC1 mov eax,ecx ;ecx=00000001 eax=00000000
028C1689 8BF7 mov esi,edi ;edi=028C806C (NetAPICs.028C806C)esi=0000016C
028C168B BF 44808C02 mov edi,NetAPICs.028C8044
028C1690 6A 2E push 2E
028C1692 C1E9 02 shr ecx,2 ;ecx=00000001
028C1695 F3:A5 rep movs dword ptr es:[edi],dword ptr d> ;ecx=00000000 (十进制 0.) ds:[esi]=[028C806C]=00000000 es:[edi]=[028C8044]=00000000
028C1697 8BC8 mov ecx,eax ;eax=00000001 ecx=00000000
028C1699 33C0 xor eax,eax ;eax=00000001
028C169B 83E1 03 and ecx,3 ;eax=00000001
028C169E 6A 1B push 1B
028C16A0 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:> ecx=00000001 (十进制 1.) ds:[esi]=[028C806C]=00 es:[edi]=[028C8044]=00
028C16A2 BF 6C808C02 mov edi,NetAPICs.028C806C ;028C806C=NetAPICs.028C806C edi=028C8045 (NetAPICs.028C8045)
028C16A7 83C9 FF or ecx,FFFFFFFF ;ecx=00000000
028C16AA F2:AE repne scas byte ptr es:[edi] ;ecx=FFFFFFFF (十进制 4294967295.)al=00 es:[edi]=[028C806C]=00
028C16AC F7D1 not ecx ;ecx=FFFFFFFE
028C16AE 2BF9 sub edi,ecx ;ecx=00000001 edi=028C806D (NetAPICs.028C806D)
028C16B0 53 push ebx ;ebx=0012E500
028C16B1 8BD1 mov edx,ecx ;ecx=00000001 edx=0000F3A5
028C16B3 8BF7 mov esi,edi ;edi=028C806C (NetAPICs.028C806C)esi=028C806D (NetAPICs.028C806D)
028C16B5 BF 147D8C02 mov edi,NetAPICs.028C7D14 ;028C7D14=NetAPICs.028C7D14 edi=028C806C (NetAPICs.028C806C)
028C16BA C1E9 02 shr ecx,2 ;ecx=00000001
028C16BD F3:A5 rep movs dword ptr es:[edi],dword ptr d> ;ecx=00000000 (十进制 0.)ds:[esi]=[028C806C]=00000000 es:[edi]=[028C7D14]=00000000
028C16BF 8BCA mov ecx,edx ;edx=00000001 ecx=00000000
028C16C1 83E1 03 and ecx,3 ;ecx=00000001
028C16C4 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:> ;ecx=00000001 (十进制 1.)ds:[esi]=[028C806C]=00 es:[edi]=[028C7D14]=00
028C16C6 E8 55000000 call NetAPICs.028C1720
028C16CB 8BF8 mov edi,eax ;eax=028C7F44 (NetAPICs.028C7F44), ASCII "ST340016A" edi=028C7D15 (NetAPICs.028C7D15)
028C16CD 83C9 FF or ecx,FFFFFFFF ;ecx=0012E520
028C16D0 33C0 xor eax,eax ;eax=028C7F44 (NetAPICs.028C7F44), ASCII "ST340016A"
028C16D2 6A 13 push 13
028C16D4 F2:AE repne scas byte ptr es:[edi] ;ecx=FFFFFFFF (十进制 4294967295.)al=00 es:[edi]=[028C7F44]=53 ('S')
028C16D6 F7D1 not ecx ;ecx=FFFFFFF5
028C16D8 2BF9 sub edi,ecx ;ecx=0000000A edi=028C7F4E (NetAPICs.028C7F4E)
028C16DA 6A 0A push 0A
028C16DC 8BC1 mov eax,ecx ;ecx=0000000A eax=00000000
028C16DE 8BF7 mov esi,edi ;edi=028C7F44 (NetAPICs.028C7F44), ASCII "ST340016A" esi=028C806D (NetAPICs.028C806D)
028C16E0 BF 44808C02 mov edi,NetAPICs.028C8044 ;028C8044=NetAPICs.028C8044 edi=028C7F44 (NetAPICs.028C7F44), ASCII "ST340016A"
028C16E5 53 push ebx ;ebx=0012E500
028C16E6 C1E9 02 shr ecx,2 ;ecx=0000000A
028C16E9 F3:A5 rep movs dword ptr es:[edi],dword ptr d> ;ecx=00000002 (十进制 2.)ds:[esi]=[028C7F44]=34335453 es:[edi]=[028C8044]=00000000
028C16EB 8BC8 mov ecx,eax ;eax=0000000A ecx=00000000
028C16ED 83E1 03 and ecx,3 ;eax=0000000A
028C16F0 F3:A4 rep movs byte ptr es:[edi],byte ptr ds:> ;ecx=00000002 (十进制 2.)ds:[esi]=[028C7F4C]=41 ('A') es:[edi]=[028C804C]=00
028C16F2 E8 29000000 call NetAPICs.028C1720
028C16F7 8BF8 mov edi,eax ;eax=028C7F44 (NetAPICs.028C7F44), ASCII "3HS6P8AF" edi=028C804E (NetAPICs.028C804E)
028C16F9 83C9 FF or ecx,FFFFFFFF ;ecx=0012E520
028C16FC 33C0 xor eax,eax ;eax=028C7F44 (NetAPICs.028C7F44), ASCII "3HS6P8AF"
028C16FE 83C4 18 add esp,18 ;esp=0012E380
028C1701 F2:AE repne scas byte ptr es:[edi] ;ecx=FFFFFFFF (十进制 4294967295.)al=00 es:[edi]=[028C7F44]=33 ('3')
028C1703 F7D1 not ecx ;ecx=FFFFFFF6
028C1705 2BF9 sub edi,ecx ;ecx=00000009 edi=028C7F4D (NetAPICs.028C7F4D)
028C1707 8BD1 mov edx,ecx ;ecx=00000009 edx=00000020
028C1709 8BF7 mov esi,edi ;edi=028C7F44 (NetAPICs.028C7F44), ASCII "3HS6P8AF" esi=028C7F4E (NetAPICs.028C7F4E)
028C170B BF 147D8C02 mov edi,NetAPICs.028C7D14 ;028C7D14=NetAPICs.028C7D14 edi=028C7F44 (NetAPICs.028C7F44), ASCII "3HS6P8AF"
028C1710 C1E9 02 shr ecx,2 ;ecx=00000009
028C1713 F3:A5 rep movs dword ptr es:[edi],dword ptr d> ;ecx=00000002 (十进制 2.)ds:[esi]=[028C7F44]=36534833 es:[edi]=[028C7D14]=00000000
028C1715 8BCA mov ecx,edx ;edx=00000009 ecx=00000000
028C1717 83E1 03 and ecx,3 ;ecx=00000009
028C171A F3:A4 rep movs byte ptr es:[edi],byte ptr ds:> ;ecx=00000001 (十进制 1.)ds:[esi]=[028C7F4C]=00 es:[edi]=[028C7D1C]=00
028C171C 5F pop edi ;Stack [0012E398]=028C7F44 (NetAPICs.028C7F44), ASCII "3HS6P8AF" edi=028C7D1D (NetAPICs.028C7D1D)
028C171D 5E pop esi ;Stack [0012E39C]=0000016C esi=028C7F4D (NetAPICs.028C7F4D)
028C171E 5B pop ebx ;Stack [0012E3A0]=00000000 ebx=0012E500
028C171F C3 retn
028C10F3 83C4 08 add esp,8 ;esp=0012E3A8
028C10F6 BB 01000000 mov ebx,1 ;ebx=00000000
028C10FB 56 push esi ;esi=0000016C
028C10FC FF15 84608C02 call dword ptr ds:[<&KERNEL32.CloseHand>; kernel32.CloseHandle ;ds:[028C6084]=7C809B77 (kernel32.CloseHandle)
028C1102 5F pop edi Stack [0012E3B0]=0012E910 (0012E910) edi=028C7F44 (NetAPICs.028C7F44), ASCII "3HS6P8AF"
028C1103 8BC3 mov eax,ebx ;ebx=00000001 eax=00000001
028C1105 5E pop esi ;Stack [0012E3B4]=005F07C4 (cs.005F07C4) esi=0000016C
028C1106 5B pop ebx ;Stack [0012E3B8]=00171110 (00171110) ebx=00000001
028C1107 81C4 44050000 add esp,544 ;esp=0012E3BC
028C110D C3 retn
[8 楼] | Posted: 2006-05-10 23:46
|
