●
00701C60 >pushad
00701C61 mov esi,568881.00603000 ;执行到此步，寄存器窗口，esp指针数据窗口跟随，接着下dword硬件访问断点
00701C66 lea edi,dword ptr ds:[esi-0x202000]
00701C6C push edi ; 568881.005B7C80
00701C6D mov ebp,esp
00701C6F lea ebx,dword ptr ss:[esp-0x3E80]
007027EC lea eax,dword ptr ss:[esp-0x80] ;断在此处
007027F0 push 0x0
007027F2 cmp esp,eax
007027F4 jnz short 568881.007027F0
007027F6 sub esp,-0x80
007027F9 jmp 568881.005E905C ；远跳即为OEP
007027FE add byte ptr ds:[eax],al
00702800 sbb byte ptr ds:[eax],ch
00702802 jo short 568881.00702804
00702804 pop eax ; kernel32.7C817067
Borland Delphi 6.0 - 7.0
---------------------------
警告
---------------------------
登录失败
用户服务到期.
---------------------------
确定
---------------------------
---------------------------
提示
---------------------------
此电脑已经注册过会员号，请与当地服务商联系!总部客服电话:(86)0755-83485277 83485279
---------------------------
确定
---------------------------
0045F894 FF93 10010000 call dword ptr ds:[ebx+0x110] ; 11.0058AB08 此函数中弹出警告框
0045F89A 5B pop ebx ; 00CFBD00
0058ABEB je short 11.0058ABF2
0058ABED sub eax,0x4
0058ABF0 mov eax,dword ptr ds:[eax]
0058ABF2 test eax,eax ;判断是否注册过会员账号
0058ABF4 jle short 11.0058AC10 ;小于则跳转,必须使其跳转才能跳过验证，直接暴力改为 jne jle->jne
0058ABF6 lea edx,dword ptr ss:[ebp-0xC]
0058ABF9 mov eax,11.0058ACE4
0058ABFE call 11.004993F8
0058AC03 mov eax,dword ptr ss:[ebp-0xC]
0058AC06 call 11.00496CE4
0058AC0B jmp 11.0058ACB8
0058AC10 xor ecx,ecx
0058AC12 mov dl,0x1
0058AC14 mov eax,dword ptr ds:[0x58A02C]
0058AC19 call 11.004E2EA0
---------------------------
提示
---------------------------
对不起，系统检测到本电脑已有用户注册过！A47014B09DEC2C3C6FCCF840B5A89840
---------------------------
确定
---------------------------
005891F6 mov eax,dword ptr ss:[ebp-0xC4]
005891FC lea edx,dword ptr ss:[ebp-0xC0]
00589202 call 11.0049CC98
00589207 mov ecx,dword ptr ss:[ebp-0xC0]
0058920D lea eax,dword ptr ss:[ebp-0xBC] ; CPU_ID
EAX 01277878 ASCII "00000000000000000001"
ECX 01277848
EDX 01277120
EBX 012A9CC0
ESP 0012EFA8
EBP 0012F108
ESI 00D24600
EDI 0012F204
EIP 005891FC 11.005891FC
---------------------------
提示
---------------------------
注册成功,请与当地服务商联系.
天津： 深圳：0755-83485277 83485279
---------------------------
确定
---------------------------
0047C562 push ebp
0047C563 push 11.0047C5E4
0047C568 push dword ptr fs:[ecx]
0047C56B mov dword ptr fs:[ecx],esp
0047C56E push esi
0047C56F mov eax,dword ptr ss:[ebp-0x8] ; 11.00496D3C
0047C572 push eax ; 11.00496D3C
0047C573 push edi
0047C574 push ebx
0047C575 call <jmp.&user32.MessageBoxA> ;在此处弹出服务提示
0012F8BC 001F019C |hOwner = 001F019C ('全国物流信息网大件通2012(1128)',class='jHi1bbnVbbbbFRWcQxwaXj46ltV')
0012F8C0 00DBE778 |Text = "您的服务还有3天到期，请尽快续费！"
0012F8C4 00496D3C |Title = "提示"
0012F8C8 00000040 \Style = MB_OK|MB_ICONASTERISK|MB_APPLMODAL
0012F8CC 0012F948 指向下一个 SEH 记录的指针
0012F8D0 0047C5E4 SE处理程序
0047C56F mov eax,dword ptr ss:[ebp-0x8] ; 11.00496D3C
0047C572 xor eax,eax ; 11.00496D3C
0047C574 mov eax,0x1
0047C579 nop
0047C57A mov dword ptr ss:[ebp-0xC],eax ; 11.00496D3C
0047C57D xor eax,eax
货源：
抚顺 天水 一台50装载机
电话：
189 3217 7126
时间：
10:55
0:002> s -u 00000000 L7ffffff "家到衡阳220"
001b049c 5bb6 5230 8861 9633 0032 0032 0030 6316 .[0Ra.3.2.2.0..c
001b25b4 5bb6 5230 8861 9633 0032 0032 0030 6316 .[0Ra.3.2.2.0..c
001d52c4 5bb6 5230 8861 9633 0032 0032 0030 6316 .[0Ra.3.2.2.0..c
ba w1 001c6eac
770f4b7a 57 push edi
770f4b7b 8bcb mov ecx,ebx
770f4b7d 8bd1 mov edx,ecx
770f4b7f c1e902 shr ecx,2
770f4b82 8bf8 mov edi,eax
770f4b84 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] ;断在此处，进行的是memcpy 操作
770f4b86 8bca mov ecx,edx
770f4b88 83e103 and ecx,3
770f4b8b f3a4 rep movs byte ptr es:[edi],byte ptr [esi]
770f4b8d 5f pop edi
770f4b8e 6683240300 and word ptr [ebx+eax],0
770f4b93 5b pop ebx
770f4b94 5e pop esi
770f4b95 5d pop eb
memcpy
0:000> du esi
0012e840 "衡阳220挖机马上装 绍兴到福州3吨挖机 昆明到郑州75挖机 黄"
0012e880 "山到福清2翻斗 上海到勐腊200挖机 包头到集宁50铲矒"
DLS0:00488FB4 ; 数据包-货源的解密函数
DLS0:00488FB4
DLS0:00488FB4 sub_488FB4 proc near ; CODE XREF: sub_489678+1CEp
DLS0:00488FB4
DLS0:00488FB4 var_18 = word ptr -18h
DLS0:00488FB4 var_16 = byte ptr -16h
DLS0:00488FB4 var_14 = dword ptr -14h
DLS0:00488FB4
DLS0:00488FB4 push ebx
DLS0:00488FB5 push esi
DLS0:00488FB6 push edi
DLS0:00488FB7 push ebp
DLS0:00488FB8 add esp, 0FFFFFFF8h
DLS0:00488FBB mov ebp, edx
DLS0:00488FBD mov eax, [ebp+0]
DLS0:00488FC0 mov [esp+18h+var_14], eax
DLS0:00488FC4 mov eax, [esp+18h+var_14]
.writemem c:\22.log 00ca29d8 L 100
00012f83c 00000001
0012f840 00000001
0012f844 0012f8a4 ;指向 货源信息指针
0012f848 001d7b7c ;unicode 格式的货源信息
;001d7b7c "大家好,本人专业做导航,河北河南省,进山东,进山西,进湖北,进安"
;001d7bbc "徽,进北京,进天津,有需要联系电话 强子"
0012f84c ffffffff
...
0012f8a4 001e4f3c ; unicode 格式的货源电话号码 "Tel:13673343431"
0012f8a8 001be994 ; unicode 格式的货源时间 "[21:24]"
0012f8ac 01357838 ; accii 格式的货源时间 "[21:24]"
0012f8b0 00d552f8 ; accii 格式的货源电话号码 "Tel:13673343431"
0012f8b4 013581c8
...
0012f8c8 00c929e8
0012f8cc 013567b8 ;accii 格式的全国信息 "全国(0755)"
0012f8d0 001b7754 ;unicode 格式的全国信息 "全国(0755)"
0012f8d4 00000000
0012f8d8 00000000
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
