[求助]如何拦截注册表的函数？-经典问答-看雪-安全社区|安全招聘|kanxue.com

最新回复 (10)
kanxue 雪币： 44229 活跃值： (19955) 能力值： (RANK：350 ) 在线值：发帖 2369 回帖 17027 粉丝 528 关注私信	kanxue 8 2 楼用注册表相关函数下断就可 http://www.pediy.com/tutorial/chap5/Chap5-1-5.htm 2007-6-15 09:30 0
DanteLong 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 14 粉丝 0 关注私信	DanteLong 3 楼可以把软件发出来下吗一起研究下，， 2007-6-15 13:35 0
flyheart 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 35 粉丝 0 关注私信	flyheart 4 楼由于软件要与硬件配合才能在软件上找到网关设备，所以只能发一部分。下面的只是软件其中的一处加密，以后会陆续发其他部分。 http://z21.zupload.com/download.php?file=getfile&filepath=41028 1、将附件中的advdvrgateway解压到c:\adv\dvrgateway下 2、运行advcontroller显示ADV托盘；不能配置 3、注册新DVR网关 : 在“开始”“运行”里面运行c:\adv\dvrgateway\advdvrgateway.exe -service;服务和应用程序里\服务\advdvrgateway已启动，运行advcontroller显示ADV托盘，3300网关显示，服务配置可以配置，用户名admin密码12345,在注册表里生成HKEY_LOCAL_MACHINE\SOFTWARE\AVINFO\DVRGateway,密码变成了密文，在不同的电脑，注册表的二进制数值密码是不同的。如何拦截注册表的函数？程序是如何写到注册表里的，如何把注册表里的密文改成明文或跳过验证，还有什么更好的方法吗？ 2007-6-15 19:10 0
dreamxx 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 4 粉丝 0 关注私信	dreamxx 5 楼晕, 你是想拦截哪里的注册表的函数? 调试时候? HOOK API?... 2007-6-15 23:54 0
flyheart 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 35 粉丝 0 关注私信	flyheart 6 楼想截获密码转换函数调用,然后写个分析，硬件通过验证是如何添加到软件里生成AV_UNIT的，正在测试中 2007-6-16 00:09 0
whbPJ 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 100 粉丝 0 关注私信	whbPJ 7 楼来学习学习......又长见识了................... 2007-6-16 08:28 0
flyheart 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 35 粉丝 0 关注私信	flyheart 8 楼没法下断，该怎样断？ 2007-6-18 12:16 0
延续雪币： 204 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 18 粉丝 0 关注私信	延续 9 楼学习下！！！！！ 2007-6-18 21:42 0
flyheart 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 35 粉丝 0 关注私信	flyheart 10 楼应该是重启验证在下断 00409750 /$ 6A FF PUSH -1 00409752 \|. 68 0BA14100 PUSH ADVContr.0041A10B ; SE handler installation 00409757 \|. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 0040975D \|. 50 PUSH EAX 0040975E \|. 64:8925 000000>MOV DWORD PTR FS:[0],ESP 00409765 \|. 83EC 48 SUB ESP,48 00409768 \|. 55 PUSH EBP 00409769 \|. 56 PUSH ESI 0040976A \|. 8BF1 MOV ESI,ECX 0040976C \|. 6A 01 PUSH 1 0040976E \|. E8 6DF50000 CALL <JMP.&MFC42.#6334> 00409773 \|. 68 02000080 PUSH 80000002 00409778 \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 0040977C \|. E8 9F720000 CALL ADVContr.00410A20 00409781 \|. 33ED XOR EBP,EBP 00409783 \|. 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18] 00409787 \|. 896C24 58 MOV DWORD PTR SS:[ESP+58],EBP 0040978B \|. E8 2CF50000 CALL <JMP.&MFC42.#540> 00409790 \|. 68 B42F4200 PUSH ADVContr.00422FB4 ; ASCII "\SOFTWARE\AVINFO\DVRGateway\" 00409795 \|. 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18] 00409799 \|. C64424 5C 01 MOV BYTE PTR SS:[ESP+5C],1 0040979E \|. C74424 40 0200>MOV DWORD PTR SS:[ESP+40],80000002 004097A6 \|. E8 3BF50000 CALL <JMP.&MFC42.#537> 004097AB \|. 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 004097AF \|. 6A 01 PUSH 1 ; /Arg2 = 00000001 004097B1 \|. 50 PUSH EAX ; \|Arg1 004097B2 \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 004097B6 \|. C64424 60 02 MOV BYTE PTR SS:[ESP+60],2 ; \| 004097BB \|. E8 90750000 CALL ADVContr.00410D50 ; \ADVContr.00410D50 004097C0 \|. 85C0 TEST EAX,EAX 004097C2 \|. 75 0E JNZ SHORT ADVContr.004097D2 004097C4 \|. 68 B42F4200 PUSH ADVContr.00422FB4 ; ASCII "\SOFTWARE\AVINFO\DVRGateway\" 004097C9 \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 004097CD \|. E8 9E720000 CALL ADVContr.00410A70 004097D2 \|> 57 PUSH EDI 004097D3 \|. 68 AC2F4200 PUSH ADVContr.00422FAC ; /Arg1 = 00422FAC ASCII "AppGUID" 004097D8 \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 004097DC \|. E8 1F790000 CALL ADVContr.00411100 ; \ADVContr.00411100 004097E1 \|. 85C0 TEST EAX,EAX 004097E3 \|. 75 49 JNZ SHORT ADVContr.0040982E 004097E5 \|. 8DBE 90000000 LEA EDI,DWORD PTR DS:[ESI+90] 004097EB \|. 57 PUSH EDI 004097EC \|. FF15 B0C54100 CALL DWORD PTR DS:[<&ole32.CoCreateGuid>>; ole32.CoCreateGuid 004097F2 \|. 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 004097F6 \|. 51 PUSH ECX 004097F7 \|. 57 PUSH EDI 004097F8 \|. FF15 BCC54100 CALL DWORD PTR DS:[<&ole32.StringFromCLS>; ole32.StringFromCLSID 004097FE \|. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00409802 \|. 8DBE 08010000 LEA EDI,DWORD PTR DS:[ESI+108] 00409808 \|. 52 PUSH EDX 00409809 \|. 8BCF MOV ECX,EDI 0040980B \|. E8 C6F50000 CALL <JMP.&MFC42.#861> 00409810 \|. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00409814 \|. 50 PUSH EAX 00409815 \|. FF15 C4C54100 CALL DWORD PTR DS:[<&ole32.CoTaskMemFree>; ole32.CoTaskMemFree 0040981B \|. 8B3F MOV EDI,DWORD PTR DS:[EDI] 0040981D \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 00409821 \|. 57 PUSH EDI 00409822 \|. 68 AC2F4200 PUSH ADVContr.00422FAC ; ASCII "AppGUID" 00409827 \|. E8 14790000 CALL ADVContr.00411140 0040982C \|. EB 5B JMP SHORT ADVContr.00409889 0040982E \|> 8D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44] 00409832 \|. 68 AC2F4200 PUSH ADVContr.00422FAC ; /Arg2 = 00422FAC ASCII "AppGUID" 00409837 \|. 51 PUSH ECX ; \|Arg1 00409838 \|. 8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40] ; \| 0040983C \|. E8 1F790000 CALL ADVContr.00411160 ; \ADVContr.00411160 00409841 \|. 8B4424 48 MOV EAX,DWORD PTR SS:[ESP+48] 00409845 \|. C64424 5C 03 MOV BYTE PTR SS:[ESP+5C],3 0040984A \|. 3BC5 CMP EAX,EBP 0040984C \|. 75 05 JNZ SHORT ADVContr.00409853 0040984E \|. A1 20C44100 MOV EAX,DWORD PTR DS:[<&MSVCP60.?_C@?1??> 00409853 \|> 50 PUSH EAX 00409854 \|. 8D8E 08010000 LEA ECX,DWORD PTR DS:[ESI+108] 0040985A \|. E8 51F40000 CALL <JMP.&MFC42.#860> 0040985F \|. 8B4424 48 MOV EAX,DWORD PTR SS:[ESP+48] 00409863 \|. C64424 5C 02 MOV BYTE PTR SS:[ESP+5C],2 00409868 \|. 3BC5 CMP EAX,EBP 0040986A \|. 74 1D JE SHORT ADVContr.00409889 0040986C \|. 8D48 FF LEA ECX,DWORD PTR DS:[EAX-1] 0040986F \|. 8A40 FF MOV AL,BYTE PTR DS:[EAX-1] 00409872 \|. 84C0 TEST AL,AL 00409874 \|. 74 0A JE SHORT ADVContr.00409880 00409876 \|. 3C FF CMP AL,0FF 00409878 \|. 74 06 JE SHORT ADVContr.00409880 0040987A \|. FEC8 DEC AL 0040987C \|. 8801 MOV BYTE PTR DS:[ECX],AL 0040987E \|. EB 09 JMP SHORT ADVContr.00409889 00409880 \|> 51 PUSH ECX 00409881 \|. E8 42F40000 CALL <JMP.&MFC42.#825> 00409886 \|. 83C4 04 ADD ESP,4 00409889 \|> 68 84224200 PUSH ADVContr.00422284 ; /Arg1 = 00422284 ASCII "AdvWatchDog" 0040988E \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 00409892 \|. E8 69780000 CALL ADVContr.00411100 ; \ADVContr.00411100 00409897 \|. 85C0 TEST EAX,EAX 00409899 \|. 75 17 JNZ SHORT ADVContr.004098B2 0040989B \|. 8B96 1C010000 MOV EDX,DWORD PTR DS:[ESI+11C] 004098A1 \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 004098A5 \|. 52 PUSH EDX 004098A6 \|. 68 84224200 PUSH ADVContr.00422284 ; ASCII "AdvWatchDog" 004098AB \|. E8 30780000 CALL ADVContr.004110E0 004098B0 \|. EB 14 JMP SHORT ADVContr.004098C6 004098B2 \|> 68 84224200 PUSH ADVContr.00422284 ; ASCII "AdvWatchDog" 004098B7 \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 004098BB \|. E8 F0770000 CALL ADVContr.004110B0 004098C0 \|. 8986 1C010000 MOV DWORD PTR DS:[ESI+11C],EAX 004098C6 \|> 68 A42F4200 PUSH ADVContr.00422FA4 ; /Arg1 = 00422FA4 ASCII "DirIP" 004098CB \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 004098CF \|. E8 2C780000 CALL ADVContr.00411100 ; \ADVContr.00411100 004098D4 \|. 8B3D 84C54100 MOV EDI,DWORD PTR DS:[<&WS2_32.#12>] ; WS2_32.inet_ntoa 004098DA \|. 85C0 TEST EAX,EAX 004098DC \|. 75 17 JNZ SHORT ADVContr.004098F5 004098DE \|. 8B86 A4000000 MOV EAX,DWORD PTR DS:[ESI+A4] 004098E4 \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 004098E8 \|. 50 PUSH EAX 004098E9 \|. 68 A42F4200 PUSH ADVContr.00422FA4 ; ASCII "DirIP" 004098EE \|. E8 ED770000 CALL ADVContr.004110E0 004098F3 \|. EB 23 JMP SHORT ADVContr.00409918 004098F5 \|> 68 A42F4200 PUSH ADVContr.00422FA4 ; ASCII "DirIP" 004098FA \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 004098FE \|. E8 AD770000 CALL ADVContr.004110B0 00409903 \|. 50 PUSH EAX 00409904 \|. 8986 A4000000 MOV DWORD PTR DS:[ESI+A4],EAX 0040990A \|. FFD7 CALL EDI 0040990C \|. 50 PUSH EAX 0040990D \|. 8D8E 24010000 LEA ECX,DWORD PTR DS:[ESI+124] 00409913 \|. E8 98F30000 CALL <JMP.&MFC42.#860> 00409918 \|> 68 982F4200 PUSH ADVContr.00422F98 ; /Arg1 = 00422F98 ASCII "ClientIP" 0040991D \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 00409921 \|. E8 DA770000 CALL ADVContr.00411100 ; \ADVContr.00411100 00409926 \|. 85C0 TEST EAX,EAX 00409928 \|. 75 17 JNZ SHORT ADVContr.00409941 0040992A \|. 8B8E A0000000 MOV ECX,DWORD PTR DS:[ESI+A0] 00409930 \|. 51 PUSH ECX 00409931 \|. 68 982F4200 PUSH ADVContr.00422F98 ; ASCII "ClientIP" 00409936 \|. 8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40] 0040993A \|. E8 A1770000 CALL ADVContr.004110E0 0040993F \|. EB 54 JMP SHORT ADVContr.00409995 00409941 \|> 68 982F4200 PUSH ADVContr.00422F98 ; ASCII "ClientIP" 00409946 \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 0040994A \|. E8 61770000 CALL ADVContr.004110B0 0040994F \|. 50 PUSH EAX 00409950 \|. 8986 A0000000 MOV DWORD PTR DS:[ESI+A0],EAX 00409956 \|. FFD7 CALL EDI 00409958 \|. 50 PUSH EAX 00409959 \|. 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 0040995D \|. E8 84F30000 CALL <JMP.&MFC42.#537> 00409962 \|. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00409966 \|. 8B86 E4000000 MOV EAX,DWORD PTR DS:[ESI+E4] 0040996C \|. 8B3D 2CC54100 MOV EDI,DWORD PTR DS:[<&USER32.SendMessa>; USER32.SendMessageA 00409972 \|. 52 PUSH EDX ; /lParam 00409973 \|. 55 PUSH EBP ; \|wParam 00409974 \|. 68 4C010000 PUSH 14C ; \|Message = CB_FINDSTRING 00409979 \|. 50 PUSH EAX ; \|hWnd 0040997A \|. FFD7 CALL EDI ; \SendMessageA 0040997C \|. 8B8E E4000000 MOV ECX,DWORD PTR DS:[ESI+E4] 00409982 \|. 55 PUSH EBP ; /lParam 00409983 \|. 50 PUSH EAX ; \|wParam 00409984 \|. 68 4E010000 PUSH 14E ; \|Message = CB_SETCURSEL 00409989 \|. 51 PUSH ECX ; \|hWnd 0040998A \|. FFD7 CALL EDI ; \SendMessageA 0040998C \|. 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00409990 \|. E8 0FF30000 CALL <JMP.&MFC42.#800> 00409995 \|> 68 902F4200 PUSH ADVContr.00422F90 ; /Arg1 = 00422F90 ASCII "DirPort" 0040999A \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 0040999E \|. E8 5D770000 CALL ADVContr.00411100 ; \ADVContr.00411100 004099A3 \|. 85C0 TEST EAX,EAX 004099A5 \|. 5F POP EDI 004099A6 \|. 75 17 JNZ SHORT ADVContr.004099BF 004099A8 \|. 8B96 A8000000 MOV EDX,DWORD PTR DS:[ESI+A8] 004099AE \|. 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 004099B2 \|. 52 PUSH EDX 004099B3 \|. 68 902F4200 PUSH ADVContr.00422F90 ; ASCII "DirPort" 004099B8 \|. E8 23770000 CALL ADVContr.004110E0 004099BD \|. EB 26 JMP SHORT ADVContr.004099E5 004099BF \|> 68 902F4200 PUSH ADVContr.00422F90 ; ASCII "DirPort" 004099C4 \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 004099C8 \|. E8 E3760000 CALL ADVContr.004110B0 004099CD \|. 50 PUSH EAX ; /NetShort 004099CE \|. 8986 A8000000 MOV DWORD PTR DS:[ESI+A8],EAX ; \| 004099D4 \|. FF15 80C54100 CALL DWORD PTR DS:[<&WS2_32.#15>] ; \ntohs 004099DA \|. 25 FFFF0000 AND EAX,0FFFF 004099DF \|. 8986 10010000 MOV DWORD PTR DS:[ESI+110],EAX 004099E5 \|> 68 802F4200 PUSH ADVContr.00422F80 ; /Arg1 = 00422F80 ASCII "AlarmInterval" 004099EA \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] ; \| 004099EE \|. E8 0D770000 CALL ADVContr.00411100 ; \ADVContr.00411100 004099F3 \|. 85C0 TEST EAX,EAX 004099F5 \|. 75 17 JNZ SHORT ADVContr.00409A0E 004099F7 \|. 8B8E 04010000 MOV ECX,DWORD PTR DS:[ESI+104] 004099FD \|. 51 PUSH ECX 004099FE \|. 68 802F4200 PUSH ADVContr.00422F80 ; ASCII "AlarmInterval" 00409A03 \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 00409A07 \|. E8 D4760000 CALL ADVContr.004110E0 00409A0C \|. EB 14 JMP SHORT ADVContr.00409A22 00409A0E \|> 68 802F4200 PUSH ADVContr.00422F80 ; ASCII "AlarmInterval" 00409A13 \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 00409A17 \|. E8 94760000 CALL ADVContr.004110B0 00409A1C \|. 8986 04010000 MOV DWORD PTR DS:[ESI+104],EAX 00409A22 \|> 68 742F4200 PUSH ADVContr.00422F74 ; /Arg1 = 00422F74 ASCII "UserName" 00409A27 \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] ; \| 00409A2B \|. E8 D0760000 CALL ADVContr.00411100 ; \ADVContr.00411100 00409A30 \|. 85C0 TEST EAX,EAX 00409A32 \|. 75 17 JNZ SHORT ADVContr.00409A4B 00409A34 \|. 8B86 18010000 MOV EAX,DWORD PTR DS:[ESI+118] 00409A3A \|. 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 00409A3E \|. 50 PUSH EAX 00409A3F \|. 68 742F4200 PUSH ADVContr.00422F74 ; ASCII "UserName" 00409A44 \|. E8 F7760000 CALL ADVContr.00411140 00409A49 \|. EB 5B JMP SHORT ADVContr.00409AA6 00409A4B \|> 8D5424 40 LEA EDX,DWORD PTR SS:[ESP+40] 00409A4F \|. 68 742F4200 PUSH ADVContr.00422F74 ; /Arg2 = 00422F74 ASCII "UserName" 00409A54 \|. 52 PUSH EDX ; \|Arg1 00409A55 \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 00409A59 \|. E8 02770000 CALL ADVContr.00411160 ; \ADVContr.00411160 00409A5E \|. 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+44] 00409A62 \|. C64424 58 04 MOV BYTE PTR SS:[ESP+58],4 00409A67 \|. 3BC5 CMP EAX,EBP 00409A69 \|. 75 05 JNZ SHORT ADVContr.00409A70 00409A6B \|. A1 20C44100 MOV EAX,DWORD PTR DS:[<&MSVCP60.?_C@?1??> 00409A70 \|> 50 PUSH EAX 00409A71 \|. 8D8E 18010000 LEA ECX,DWORD PTR DS:[ESI+118] 00409A77 \|. E8 34F20000 CALL <JMP.&MFC42.#860> 00409A7C \|. 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+44] 00409A80 \|. C64424 58 02 MOV BYTE PTR SS:[ESP+58],2 00409A85 \|. 3BC5 CMP EAX,EBP 00409A87 \|. 74 1D JE SHORT ADVContr.00409AA6 00409A89 \|. 8D48 FF LEA ECX,DWORD PTR DS:[EAX-1] 00409A8C \|. 8A40 FF MOV AL,BYTE PTR DS:[EAX-1] 00409A8F \|. 84C0 TEST AL,AL 00409A91 \|. 74 0A JE SHORT ADVContr.00409A9D 00409A93 \|. 3C FF CMP AL,0FF 00409A95 \|. 74 06 JE SHORT ADVContr.00409A9D 00409A97 \|. FEC8 DEC AL 00409A99 \|. 8801 MOV BYTE PTR DS:[ECX],AL 00409A9B \|. EB 09 JMP SHORT ADVContr.00409AA6 00409A9D \|> 51 PUSH ECX 00409A9E \|. E8 25F20000 CALL <JMP.&MFC42.#825> 00409AA3 \|. 83C4 04 ADD ESP,4 00409AA6 \|> 68 682F4200 PUSH ADVContr.00422F68 ; /Arg1 = 00422F68 ASCII "PassWord" 00409AAB \|. 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] ; \| 00409AAF \|. E8 4C760000 CALL ADVContr.00411100 ; \ADVContr.00411100 00409AB4 \|. 85C0 TEST EAX,EAX 00409AB6 \|. 75 64 JNZ SHORT ADVContr.00409B1C 00409AB8 \|. 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C] 00409ABC \|. 8D8E 14010000 LEA ECX,DWORD PTR DS:[ESI+114] 00409AC2 \|. 50 PUSH EAX 00409AC3 \|. C64424 20 31 MOV BYTE PTR SS:[ESP+20],31 00409AC8 \|. C64424 21 32 MOV BYTE PTR SS:[ESP+21],32 00409ACD \|. C64424 22 33 MOV BYTE PTR SS:[ESP+22],33 00409AD2 \|. C64424 23 34 MOV BYTE PTR SS:[ESP+23],34 00409AD7 \|. C64424 24 35 MOV BYTE PTR SS:[ESP+24],35 00409ADC \|. 896C24 25 MOV DWORD PTR SS:[ESP+25],EBP 00409AE0 \|. E8 CBF10000 CALL <JMP.&MFC42.#860> 00409AE5 \|. 55 PUSH EBP 00409AE6 \|. 68 402F4200 PUSH ADVContr.00422F40 00409AEB \|. E8 C0E9FFFF CALL ADVContr.004084B0 00409AF0 \|. 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 00409AF4 \|. 8D5424 24 LEA EDX,DWORD PTR SS:[ESP+24] 00409AF8 \|. 51 PUSH ECX 00409AF9 \|. 52 PUSH EDX 00409AFA \|. E8 B1EBFFFF CALL ADVContr.004086B0 00409AFF \|. 83C4 10 ADD ESP,10 00409B02 \|. 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C] 00409B06 \|. 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 00409B0A \|. 6A 08 PUSH 8 00409B0C \|. 50 PUSH EAX 00409B0D \|. 68 682F4200 PUSH ADVContr.00422F68 ; ASCII "PassWord" 00409B12 \|. E8 F9760000 CALL ADVContr.00411210 00409B17 \|. E9 E3000000 JMP ADVContr.00409BFF 00409B1C \|> 8A4424 0B MOV AL,BYTE PTR SS:[ESP+B] 00409B20 \|. 33C9 XOR ECX,ECX 00409B22 \|. 33D2 XOR EDX,EDX 00409B24 \|. 894C24 29 MOV DWORD PTR SS:[ESP+29],ECX 00409B28 \|. 895424 1D MOV DWORD PTR SS:[ESP+1D],EDX 00409B2C \|. C64424 28 00 MOV BYTE PTR SS:[ESP+28],0 00409B31 \|. 894C24 2D MOV DWORD PTR SS:[ESP+2D],ECX 00409B35 \|. 884C24 1C MOV BYTE PTR SS:[ESP+1C],CL 00409B39 \|. 895424 21 MOV DWORD PTR SS:[ESP+21],EDX 00409B3D \|. 884424 40 MOV BYTE PTR SS:[ESP+40],AL 00409B41 \|. 896C24 44 MOV DWORD PTR SS:[ESP+44],EBP 00409B45 \|. 896C24 48 MOV DWORD PTR SS:[ESP+48],EBP 00409B49 \|. 896C24 4C MOV DWORD PTR SS:[ESP+4C],EBP 00409B4D \|. 8D4C24 40 LEA ECX,DWORD PTR SS:[ESP+40] 00409B51 \|. C64424 58 05 MOV BYTE PTR SS:[ESP+58],5 00409B56 \|. 51 PUSH ECX ; /Arg2 00409B57 \|. 68 682F4200 PUSH ADVContr.00422F68 ; \|Arg1 = 00422F68 ASCII "PassWord" 00409B5C \|. 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] ; \| 00409B60 \|. E8 CB700000 CALL ADVContr.00410C30 ; \ADVContr.00410C30 00409B65 \|. 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+44] 00409B69 \|. 3BC5 CMP EAX,EBP 00409B6B \|. 75 05 JNZ SHORT ADVContr.00409B72 00409B6D \|. A1 20C44100 MOV EAX,DWORD PTR DS:[<&MSVCP60.?_C@?1??> 00409B72 \|> 8B10 MOV EDX,DWORD PTR DS:[EAX] 00409B74 \|. 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] 00409B78 \|. 895424 1C MOV DWORD PTR SS:[ESP+1C],EDX 00409B7C \|. 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4] 00409B7F \|. 894424 20 MOV DWORD PTR SS:[ESP+20],EAX 00409B83 \|. E8 34F10000 CALL <JMP.&MFC42.#540> 00409B88 \|. 6A 01 PUSH 1 00409B8A \|. 68 402F4200 PUSH ADVContr.00422F40 00409B8F \|. C64424 60 06 MOV BYTE PTR SS:[ESP+60],6 00409B94 \|. E8 17E9FFFF CALL ADVContr.004084B0 00409B99 \|. 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 00409B9D \|. 8D5424 24 LEA EDX,DWORD PTR SS:[ESP+24] 00409BA1 \|. 51 PUSH ECX 00409BA2 \|. 52 PUSH EDX 00409BA3 \|. E8 08EBFFFF CALL ADVContr.004086B0 00409BA8 \|. 83C4 10 ADD ESP,10 00409BAB \|. 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28] 00409BAF \|. 8D8E 14010000 LEA ECX,DWORD PTR DS:[ESI+114] 00409BB5 \|. 50 PUSH EAX 00409BB6 \|. E8 F5F00000 CALL <JMP.&MFC42.#860> 00409BBB \|. 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] 00409BBF \|. C64424 58 05 MOV BYTE PTR SS:[ESP+58],5 00409BC4 \|. E8 DBF00000 CALL <JMP.&MFC42.#800> 00409BC9 \|. 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+44] 00409BCD \|. C64424 58 02 MOV BYTE PTR SS:[ESP+58],2 00409BD2 \|. 3BC5 CMP EAX,EBP 00409BD4 \|. 74 1D JE SHORT ADVContr.00409BF3 00409BD6 \|. 8D48 FF LEA ECX,DWORD PTR DS:[EAX-1] 00409BD9 \|. 8A40 FF MOV AL,BYTE PTR DS:[EAX-1] 00409BDC \|. 84C0 TEST AL,AL 00409BDE \|. 74 0A JE SHORT ADVContr.00409BEA 00409BE0 \|. 3C FF CMP AL,0FF 00409BE2 \|. 74 06 JE SHORT ADVContr.00409BEA 00409BE4 \|. FEC8 DEC AL 00409BE6 \|. 8801 MOV BYTE PTR DS:[ECX],AL 00409BE8 \|. EB 09 JMP SHORT ADVContr.00409BF3 00409BEA \|> 51 PUSH ECX 00409BEB \|. E8 D8F00000 CALL <JMP.&MFC42.#825> 00409BF0 \|. 83C4 04 ADD ESP,4 00409BF3 \|> 896C24 44 MOV DWORD PTR SS:[ESP+44],EBP 00409BF7 \|. 896C24 48 MOV DWORD PTR SS:[ESP+48],EBP 00409BFB \|. 896C24 4C MOV DWORD PTR SS:[ESP+4C],EBP 00409BFF \|> 55 PUSH EBP 00409C00 \|. 8BCE MOV ECX,ESI 00409C02 \|. E8 D9F00000 CALL <JMP.&MFC42.#6334> 00409C07 \|. 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 00409C0B \|. C64424 58 01 MOV BYTE PTR SS:[ESP+58],1 00409C10 \|. E8 8FF00000 CALL <JMP.&MFC42.#800> 00409C15 \|. 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18] 00409C19 \|. C64424 58 00 MOV BYTE PTR SS:[ESP+58],0 00409C1E \|. E8 81F00000 CALL <JMP.&MFC42.#800> 00409C23 \|. 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 00409C27 \|. C74424 58 FFFF>MOV DWORD PTR SS:[ESP+58],-1 00409C2F \|. E8 2C6E0000 CALL ADVContr.00410A60 00409C34 \|. 8B4C24 50 MOV ECX,DWORD PTR SS:[ESP+50] 00409C38 \|. 5E POP ESI 00409C39 \|. B8 01000000 MOV EAX,1 00409C3E \|. 5D POP EBP 00409C3F \|. 64:890D 000000>MOV DWORD PTR FS:[0],ECX 00409C46 \|. 83C4 54 ADD ESP,54 00409C49 \. C3 RETN 2007-6-27 12:47 0
wofan[OCN] 雪币： 2899 活跃值： (1753) 能力值： ( LV9，RANK：850 ) 在线值：发帖 55 回帖 810 粉丝 8 关注私信	wofan[OCN] 21 11 楼抽空打开邮箱，收到楼主的邮件：看到你分析的文章，分析的几尽完美，帮忙分析一下http://bbs.pediy.com/showthread.php?t=46344重启验证注册表的值谢谢抬举。不过我近来忙于工作，不能玩了…… 并且，以后就是工作上理清了头绪，也不会玩破解了。破解之类的事，浅尝则止。简单的工作，重复执行，其实很累的。所以，不好意思，你自已慢慢看帖子，慢慢分析吧。呵呵。 2007-7-2 23:41 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

kanxue

雪币： 44229

活跃值： (19955)

能力值：

(RANK：350 )

在线值：

发帖

2369

回帖

17027

粉丝

528

关注

私信

kanxue 8: 2 楼

用注册表相关函数下断就可
http://www.pediy.com/tutorial/chap5/Chap5-1-5.htm

2007-6-15 09:30

0

DanteLong

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

0

回帖

14

粉丝

0

关注

私信

DanteLong: 3 楼

可以把软件发出来下吗
一起研究下，，

2007-6-15 13:35

0

flyheart

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

35

粉丝

0

关注

私信

flyheart: 4 楼

由于软件要与硬件配合才能在软件上找到网关设备，所以只能发一部分。下面的只是软件其中的一处加密，以后会陆续发其他部分。
http://z21.zupload.com/download.php?file=getfile&filepath=41028
1、将附件中的advdvrgateway解压到c:\adv\dvrgateway下
2、运行advcontroller显示ADV托盘；不能配置
3、注册新DVR网关 : 在“开始”“运行”里面运行c:\adv\dvrgateway\advdvrgateway.exe -service;服务和应用程序里\服务\advdvrgateway已启动，运行advcontroller显示ADV托盘，3300网关显示，服务配置可以配置，用户名admin密码12345,在注册表里生成HKEY_LOCAL_MACHINE\SOFTWARE\AVINFO\DVRGateway,密码变成了密文，在不同的电脑，注册表的二进制数值密码是不同的。

如何拦截注册表的函数？程序是如何写到注册表里的，如何把注册表里的密文改成明文或跳过验证，还有什么更好的方法吗？

2007-6-15 19:10

0

dreamxx

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

1

回帖

4

粉丝

0

关注

私信

dreamxx: 5 楼

晕, 你是想拦截哪里的注册表的函数? 调试时候? HOOK API?...

2007-6-15 23:54

0

flyheart

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

35

粉丝

0

关注

私信

flyheart: 6 楼

想截获密码转换函数调用,然后写个分析，硬件通过验证是如何添加到软件里生成AV_UNIT的，正在测试中

2007-6-16 00:09

0

whbPJ

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

3

回帖

100

粉丝

0

关注

私信

whbPJ: 7 楼

来学习学习......又长见识了...................

2007-6-16 08:28

0

flyheart

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

35

粉丝

0

关注

私信

flyheart: 8 楼

没法下断，该怎样断？

2007-6-18 12:16

0

延续

雪币： 204

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

4

回帖

18

粉丝

0

关注

私信

延续: 9 楼

学习下！！！！！

2007-6-18 21:42

0

flyheart

雪币： 200

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

6

回帖

35

粉丝

0

关注

私信

flyheart: 10 楼

应该是重启验证在下断
00409750  /$ 6A FF       PUSH -1
00409752  |. 68 0BA14100 PUSH ADVContr.0041A10B                ;  SE handler installation
00409757  |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0040975D  |. 50          PUSH EAX
0040975E  |. 64:8925 000000>MOV DWORD PTR FS:[0],ESP
00409765  |. 83EC 48       SUB ESP,48
00409768  |. 55          PUSH EBP
00409769  |. 56          PUSH ESI
0040976A  |. 8BF1          MOV ESI,ECX
0040976C  |. 6A 01       PUSH 1
0040976E  |. E8 6DF50000 CALL <JMP.&MFC42.#6334>
00409773  |. 68 02000080 PUSH 80000002
00409778  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]
0040977C  |. E8 9F720000 CALL ADVContr.00410A20
00409781  |. 33ED          XOR EBP,EBP
00409783  |. 8D4C24 18    LEA ECX,DWORD PTR SS:[ESP+18]
00409787  |. 896C24 58    MOV DWORD PTR SS:[ESP+58],EBP
0040978B  |. E8 2CF50000 CALL <JMP.&MFC42.#540>
00409790  |. 68 B42F4200 PUSH ADVContr.00422FB4                ;  ASCII "\SOFTWARE\AVINFO\DVRGateway\"
00409795  |. 8D4C24 18    LEA ECX,DWORD PTR SS:[ESP+18]
00409799  |. C64424 5C 01 MOV BYTE PTR SS:[ESP+5C],1
0040979E  |. C74424 40 0200>MOV DWORD PTR SS:[ESP+40],80000002
004097A6  |. E8 3BF50000 CALL <JMP.&MFC42.#537>
004097AB  |. 8B4424 14    MOV EAX,DWORD PTR SS:[ESP+14]
004097AF  |. 6A 01       PUSH 1                                  ; /Arg2 = 00000001
004097B1  |. 50          PUSH EAX                               ; |Arg1
004097B2  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
004097B6  |. C64424 60 02 MOV BYTE PTR SS:[ESP+60],2             ; |
004097BB  |. E8 90750000 CALL ADVContr.00410D50                ; \ADVContr.00410D50
004097C0  |. 85C0          TEST EAX,EAX
004097C2  |. 75 0E       JNZ SHORT ADVContr.004097D2
004097C4  |. 68 B42F4200 PUSH ADVContr.00422FB4                ;  ASCII "\SOFTWARE\AVINFO\DVRGateway\"
004097C9  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]
004097CD  |. E8 9E720000 CALL ADVContr.00410A70
004097D2  |> 57          PUSH EDI
004097D3  |. 68 AC2F4200 PUSH ADVContr.00422FAC                ; /Arg1 = 00422FAC ASCII "AppGUID"
004097D8  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
004097DC  |. E8 1F790000 CALL ADVContr.00411100                ; \ADVContr.00411100
004097E1  |. 85C0          TEST EAX,EAX
004097E3  |. 75 49       JNZ SHORT ADVContr.0040982E
004097E5  |. 8DBE 90000000  LEA EDI,DWORD PTR DS:[ESI+90]
004097EB  |. 57          PUSH EDI
004097EC  |. FF15 B0C54100  CALL DWORD PTR DS:[<&ole32.CoCreateGuid>>;  ole32.CoCreateGuid
004097F2  |. 8D4C24 10    LEA ECX,DWORD PTR SS:[ESP+10]
004097F6  |. 51          PUSH ECX
004097F7  |. 57          PUSH EDI
004097F8  |. FF15 BCC54100  CALL DWORD PTR DS:[<&ole32.StringFromCLS>;  ole32.StringFromCLSID
004097FE  |. 8B5424 10    MOV EDX,DWORD PTR SS:[ESP+10]
00409802  |. 8DBE 08010000  LEA EDI,DWORD PTR DS:[ESI+108]
00409808  |. 52          PUSH EDX
00409809  |. 8BCF          MOV ECX,EDI
0040980B  |. E8 C6F50000 CALL <JMP.&MFC42.#861>
00409810  |. 8B4424 10    MOV EAX,DWORD PTR SS:[ESP+10]
00409814  |. 50          PUSH EAX
00409815  |. FF15 C4C54100  CALL DWORD PTR DS:[<&ole32.CoTaskMemFree>;  ole32.CoTaskMemFree
0040981B  |. 8B3F          MOV EDI,DWORD PTR DS:[EDI]
0040981D  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]
00409821  |. 57          PUSH EDI
00409822  |. 68 AC2F4200 PUSH ADVContr.00422FAC                ;  ASCII "AppGUID"
00409827  |. E8 14790000 CALL ADVContr.00411140
0040982C  |. EB 5B       JMP SHORT ADVContr.00409889
0040982E  |> 8D4C24 44    LEA ECX,DWORD PTR SS:[ESP+44]
00409832  |. 68 AC2F4200 PUSH ADVContr.00422FAC                ; /Arg2 = 00422FAC ASCII "AppGUID"
00409837  |. 51          PUSH ECX                               ; |Arg1
00409838  |. 8D4C24 40    LEA ECX,DWORD PTR SS:[ESP+40]          ; |
0040983C  |. E8 1F790000 CALL ADVContr.00411160                ; \ADVContr.00411160
00409841  |. 8B4424 48    MOV EAX,DWORD PTR SS:[ESP+48]
00409845  |. C64424 5C 03 MOV BYTE PTR SS:[ESP+5C],3
0040984A  |. 3BC5          CMP EAX,EBP
0040984C  |. 75 05       JNZ SHORT ADVContr.00409853
0040984E  |. A1 20C44100 MOV EAX,DWORD PTR DS:[<&MSVCP60.?_C@?1??>
00409853  |> 50          PUSH EAX
00409854  |. 8D8E 08010000  LEA ECX,DWORD PTR DS:[ESI+108]
0040985A  |. E8 51F40000 CALL <JMP.&MFC42.#860>
0040985F  |. 8B4424 48    MOV EAX,DWORD PTR SS:[ESP+48]
00409863  |. C64424 5C 02 MOV BYTE PTR SS:[ESP+5C],2
00409868  |. 3BC5          CMP EAX,EBP
0040986A  |. 74 1D       JE SHORT ADVContr.00409889
0040986C  |. 8D48 FF       LEA ECX,DWORD PTR DS:[EAX-1]
0040986F  |. 8A40 FF       MOV AL,BYTE PTR DS:[EAX-1]
00409872  |. 84C0          TEST AL,AL
00409874  |. 74 0A       JE SHORT ADVContr.00409880
00409876  |. 3C FF       CMP AL,0FF
00409878  |. 74 06       JE SHORT ADVContr.00409880
0040987A  |. FEC8          DEC AL
0040987C  |. 8801          MOV BYTE PTR DS:[ECX],AL
0040987E  |. EB 09       JMP SHORT ADVContr.00409889
00409880  |> 51          PUSH ECX
00409881  |. E8 42F40000 CALL <JMP.&MFC42.#825>
00409886  |. 83C4 04       ADD ESP,4
00409889  |> 68 84224200 PUSH ADVContr.00422284                ; /Arg1 = 00422284 ASCII "AdvWatchDog"
0040988E  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
00409892  |. E8 69780000 CALL ADVContr.00411100                ; \ADVContr.00411100
00409897  |. 85C0          TEST EAX,EAX
00409899  |. 75 17       JNZ SHORT ADVContr.004098B2
0040989B  |. 8B96 1C010000  MOV EDX,DWORD PTR DS:[ESI+11C]
004098A1  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]
004098A5  |. 52          PUSH EDX
004098A6  |. 68 84224200 PUSH ADVContr.00422284                ;  ASCII "AdvWatchDog"
004098AB  |. E8 30780000 CALL ADVContr.004110E0
004098B0  |. EB 14       JMP SHORT ADVContr.004098C6
004098B2  |> 68 84224200 PUSH ADVContr.00422284                ;  ASCII "AdvWatchDog"
004098B7  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]
004098BB  |. E8 F0770000 CALL ADVContr.004110B0
004098C0  |. 8986 1C010000  MOV DWORD PTR DS:[ESI+11C],EAX
004098C6  |> 68 A42F4200 PUSH ADVContr.00422FA4                ; /Arg1 = 00422FA4 ASCII "DirIP"
004098CB  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
004098CF  |. E8 2C780000 CALL ADVContr.00411100                ; \ADVContr.00411100
004098D4  |. 8B3D 84C54100  MOV EDI,DWORD PTR DS:[<&WS2_32.#12>]    ;  WS2_32.inet_ntoa
004098DA  |. 85C0          TEST EAX,EAX
004098DC  |. 75 17       JNZ SHORT ADVContr.004098F5
004098DE  |. 8B86 A4000000  MOV EAX,DWORD PTR DS:[ESI+A4]
004098E4  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]
004098E8  |. 50          PUSH EAX
004098E9  |. 68 A42F4200 PUSH ADVContr.00422FA4                ;  ASCII "DirIP"
004098EE  |. E8 ED770000 CALL ADVContr.004110E0
004098F3  |. EB 23       JMP SHORT ADVContr.00409918
004098F5  |> 68 A42F4200 PUSH ADVContr.00422FA4                ;  ASCII "DirIP"
004098FA  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]
004098FE  |. E8 AD770000 CALL ADVContr.004110B0
00409903  |. 50          PUSH EAX
00409904  |. 8986 A4000000  MOV DWORD PTR DS:[ESI+A4],EAX
0040990A  |. FFD7          CALL EDI
0040990C  |. 50          PUSH EAX
0040990D  |. 8D8E 24010000  LEA ECX,DWORD PTR DS:[ESI+124]
00409913  |. E8 98F30000 CALL <JMP.&MFC42.#860>
00409918  |> 68 982F4200 PUSH ADVContr.00422F98                ; /Arg1 = 00422F98 ASCII "ClientIP"
0040991D  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
00409921  |. E8 DA770000 CALL ADVContr.00411100                ; \ADVContr.00411100
00409926  |. 85C0          TEST EAX,EAX
00409928  |. 75 17       JNZ SHORT ADVContr.00409941
0040992A  |. 8B8E A0000000  MOV ECX,DWORD PTR DS:[ESI+A0]
00409930  |. 51          PUSH ECX
00409931  |. 68 982F4200 PUSH ADVContr.00422F98                ;  ASCII "ClientIP"
00409936  |. 8D4C24 40    LEA ECX,DWORD PTR SS:[ESP+40]
0040993A  |. E8 A1770000 CALL ADVContr.004110E0
0040993F  |. EB 54       JMP SHORT ADVContr.00409995
00409941  |> 68 982F4200 PUSH ADVContr.00422F98                ;  ASCII "ClientIP"
00409946  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]
0040994A  |. E8 61770000 CALL ADVContr.004110B0
0040994F  |. 50          PUSH EAX
00409950  |. 8986 A0000000  MOV DWORD PTR DS:[ESI+A0],EAX
00409956  |. FFD7          CALL EDI
00409958  |. 50          PUSH EAX
00409959  |. 8D4C24 14    LEA ECX,DWORD PTR SS:[ESP+14]
0040995D  |. E8 84F30000 CALL <JMP.&MFC42.#537>
00409962  |. 8B5424 10    MOV EDX,DWORD PTR SS:[ESP+10]
00409966  |. 8B86 E4000000  MOV EAX,DWORD PTR DS:[ESI+E4]
0040996C  |. 8B3D 2CC54100  MOV EDI,DWORD PTR DS:[<&USER32.SendMessa>;  USER32.SendMessageA
00409972  |. 52          PUSH EDX                               ; /lParam
00409973  |. 55          PUSH EBP                               ; |wParam
00409974  |. 68 4C010000 PUSH 14C                               ; |Message = CB_FINDSTRING
00409979  |. 50          PUSH EAX                               ; |hWnd
0040997A  |. FFD7          CALL EDI                               ; \SendMessageA
0040997C  |. 8B8E E4000000  MOV ECX,DWORD PTR DS:[ESI+E4]
00409982  |. 55          PUSH EBP                               ; /lParam
00409983  |. 50          PUSH EAX                               ; |wParam
00409984  |. 68 4E010000 PUSH 14E                               ; |Message = CB_SETCURSEL
00409989  |. 51          PUSH ECX                               ; |hWnd
0040998A  |. FFD7          CALL EDI                               ; \SendMessageA
0040998C  |. 8D4C24 10    LEA ECX,DWORD PTR SS:[ESP+10]
00409990  |. E8 0FF30000 CALL <JMP.&MFC42.#800>
00409995  |> 68 902F4200 PUSH ADVContr.00422F90                ; /Arg1 = 00422F90 ASCII "DirPort"
0040999A  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
0040999E  |. E8 5D770000 CALL ADVContr.00411100                ; \ADVContr.00411100
004099A3  |. 85C0          TEST EAX,EAX
004099A5  |. 5F          POP EDI
004099A6  |. 75 17       JNZ SHORT ADVContr.004099BF
004099A8  |. 8B96 A8000000  MOV EDX,DWORD PTR DS:[ESI+A8]
004099AE  |. 8D4C24 34    LEA ECX,DWORD PTR SS:[ESP+34]
004099B2  |. 52          PUSH EDX
004099B3  |. 68 902F4200 PUSH ADVContr.00422F90                ;  ASCII "DirPort"
004099B8  |. E8 23770000 CALL ADVContr.004110E0
004099BD  |. EB 26       JMP SHORT ADVContr.004099E5
004099BF  |> 68 902F4200 PUSH ADVContr.00422F90                ;  ASCII "DirPort"
004099C4  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]
004099C8  |. E8 E3760000 CALL ADVContr.004110B0
004099CD  |. 50          PUSH EAX                               ; /NetShort
004099CE  |. 8986 A8000000  MOV DWORD PTR DS:[ESI+A8],EAX          ; |
004099D4  |. FF15 80C54100  CALL DWORD PTR DS:[<&WS2_32.#15>]       ; \ntohs
004099DA  |. 25 FFFF0000 AND EAX,0FFFF
004099DF  |. 8986 10010000  MOV DWORD PTR DS:[ESI+110],EAX
004099E5  |> 68 802F4200 PUSH ADVContr.00422F80                ; /Arg1 = 00422F80 ASCII "AlarmInterval"
004099EA  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]          ; |
004099EE  |. E8 0D770000 CALL ADVContr.00411100                ; \ADVContr.00411100
004099F3  |. 85C0          TEST EAX,EAX
004099F5  |. 75 17       JNZ SHORT ADVContr.00409A0E
004099F7  |. 8B8E 04010000  MOV ECX,DWORD PTR DS:[ESI+104]
004099FD  |. 51          PUSH ECX
004099FE  |. 68 802F4200 PUSH ADVContr.00422F80                ;  ASCII "AlarmInterval"
00409A03  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]
00409A07  |. E8 D4760000 CALL ADVContr.004110E0
00409A0C  |. EB 14       JMP SHORT ADVContr.00409A22
00409A0E  |> 68 802F4200 PUSH ADVContr.00422F80                ;  ASCII "AlarmInterval"
00409A13  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]
00409A17  |. E8 94760000 CALL ADVContr.004110B0
00409A1C  |. 8986 04010000  MOV DWORD PTR DS:[ESI+104],EAX
00409A22  |> 68 742F4200 PUSH ADVContr.00422F74                ; /Arg1 = 00422F74 ASCII "UserName"
00409A27  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]          ; |
00409A2B  |. E8 D0760000 CALL ADVContr.00411100                ; \ADVContr.00411100
00409A30  |. 85C0          TEST EAX,EAX
00409A32  |. 75 17       JNZ SHORT ADVContr.00409A4B
00409A34  |. 8B86 18010000  MOV EAX,DWORD PTR DS:[ESI+118]
00409A3A  |. 8D4C24 34    LEA ECX,DWORD PTR SS:[ESP+34]
00409A3E  |. 50          PUSH EAX
00409A3F  |. 68 742F4200 PUSH ADVContr.00422F74                ;  ASCII "UserName"
00409A44  |. E8 F7760000 CALL ADVContr.00411140
00409A49  |. EB 5B       JMP SHORT ADVContr.00409AA6
00409A4B  |> 8D5424 40    LEA EDX,DWORD PTR SS:[ESP+40]
00409A4F  |. 68 742F4200 PUSH ADVContr.00422F74                ; /Arg2 = 00422F74 ASCII "UserName"
00409A54  |. 52          PUSH EDX                               ; |Arg1
00409A55  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
00409A59  |. E8 02770000 CALL ADVContr.00411160                ; \ADVContr.00411160
00409A5E  |. 8B4424 44    MOV EAX,DWORD PTR SS:[ESP+44]
00409A62  |. C64424 58 04 MOV BYTE PTR SS:[ESP+58],4
00409A67  |. 3BC5          CMP EAX,EBP
00409A69  |. 75 05       JNZ SHORT ADVContr.00409A70
00409A6B  |. A1 20C44100 MOV EAX,DWORD PTR DS:[<&MSVCP60.?_C@?1??>
00409A70  |> 50          PUSH EAX
00409A71  |. 8D8E 18010000  LEA ECX,DWORD PTR DS:[ESI+118]
00409A77  |. E8 34F20000 CALL <JMP.&MFC42.#860>
00409A7C  |. 8B4424 44    MOV EAX,DWORD PTR SS:[ESP+44]
00409A80  |. C64424 58 02 MOV BYTE PTR SS:[ESP+58],2
00409A85  |. 3BC5          CMP EAX,EBP
00409A87  |. 74 1D       JE SHORT ADVContr.00409AA6
00409A89  |. 8D48 FF       LEA ECX,DWORD PTR DS:[EAX-1]
00409A8C  |. 8A40 FF       MOV AL,BYTE PTR DS:[EAX-1]
00409A8F  |. 84C0          TEST AL,AL
00409A91  |. 74 0A       JE SHORT ADVContr.00409A9D
00409A93  |. 3C FF       CMP AL,0FF
00409A95  |. 74 06       JE SHORT ADVContr.00409A9D
00409A97  |. FEC8          DEC AL
00409A99  |. 8801          MOV BYTE PTR DS:[ECX],AL
00409A9B  |. EB 09       JMP SHORT ADVContr.00409AA6
00409A9D  |> 51          PUSH ECX
00409A9E  |. E8 25F20000 CALL <JMP.&MFC42.#825>
00409AA3  |. 83C4 04       ADD ESP,4
00409AA6  |> 68 682F4200 PUSH ADVContr.00422F68                ; /Arg1 = 00422F68 ASCII "PassWord"
00409AAB  |. 8D4C24 38    LEA ECX,DWORD PTR SS:[ESP+38]          ; |
00409AAF  |. E8 4C760000 CALL ADVContr.00411100                ; \ADVContr.00411100
00409AB4  |. 85C0          TEST EAX,EAX
00409AB6  |. 75 64       JNZ SHORT ADVContr.00409B1C
00409AB8  |. 8D4424 1C    LEA EAX,DWORD PTR SS:[ESP+1C]
00409ABC  |. 8D8E 14010000  LEA ECX,DWORD PTR DS:[ESI+114]
00409AC2  |. 50          PUSH EAX
00409AC3  |. C64424 20 31 MOV BYTE PTR SS:[ESP+20],31
00409AC8  |. C64424 21 32 MOV BYTE PTR SS:[ESP+21],32
00409ACD  |. C64424 22 33 MOV BYTE PTR SS:[ESP+22],33
00409AD2  |. C64424 23 34 MOV BYTE PTR SS:[ESP+23],34
00409AD7  |. C64424 24 35 MOV BYTE PTR SS:[ESP+24],35
00409ADC  |. 896C24 25    MOV DWORD PTR SS:[ESP+25],EBP
00409AE0  |. E8 CBF10000 CALL <JMP.&MFC42.#860>
00409AE5  |. 55          PUSH EBP
00409AE6  |. 68 402F4200 PUSH ADVContr.00422F40
00409AEB  |. E8 C0E9FFFF CALL ADVContr.004084B0
00409AF0  |. 8D4C24 14    LEA ECX,DWORD PTR SS:[ESP+14]
00409AF4  |. 8D5424 24    LEA EDX,DWORD PTR SS:[ESP+24]
00409AF8  |. 51          PUSH ECX
00409AF9  |. 52          PUSH EDX
00409AFA  |. E8 B1EBFFFF CALL ADVContr.004086B0
00409AFF  |. 83C4 10       ADD ESP,10
00409B02  |. 8D4424 0C    LEA EAX,DWORD PTR SS:[ESP+C]
00409B06  |. 8D4C24 34    LEA ECX,DWORD PTR SS:[ESP+34]
00409B0A  |. 6A 08       PUSH 8
00409B0C  |. 50          PUSH EAX
00409B0D  |. 68 682F4200 PUSH ADVContr.00422F68                ;  ASCII "PassWord"
00409B12  |. E8 F9760000 CALL ADVContr.00411210
00409B17  |. E9 E3000000 JMP ADVContr.00409BFF
00409B1C  |> 8A4424 0B    MOV AL,BYTE PTR SS:[ESP+B]
00409B20  |. 33C9          XOR ECX,ECX
00409B22  |. 33D2          XOR EDX,EDX
00409B24  |. 894C24 29    MOV DWORD PTR SS:[ESP+29],ECX
00409B28  |. 895424 1D    MOV DWORD PTR SS:[ESP+1D],EDX
00409B2C  |. C64424 28 00 MOV BYTE PTR SS:[ESP+28],0
00409B31  |. 894C24 2D    MOV DWORD PTR SS:[ESP+2D],ECX
00409B35  |. 884C24 1C    MOV BYTE PTR SS:[ESP+1C],CL
00409B39  |. 895424 21    MOV DWORD PTR SS:[ESP+21],EDX
00409B3D  |. 884424 40    MOV BYTE PTR SS:[ESP+40],AL
00409B41  |. 896C24 44    MOV DWORD PTR SS:[ESP+44],EBP
00409B45  |. 896C24 48    MOV DWORD PTR SS:[ESP+48],EBP
00409B49  |. 896C24 4C    MOV DWORD PTR SS:[ESP+4C],EBP
00409B4D  |. 8D4C24 40    LEA ECX,DWORD PTR SS:[ESP+40]
00409B51  |. C64424 58 05 MOV BYTE PTR SS:[ESP+58],5
00409B56  |. 51          PUSH ECX                               ; /Arg2
00409B57  |. 68 682F4200 PUSH ADVContr.00422F68                ; |Arg1 = 00422F68 ASCII "PassWord"
00409B5C  |. 8D4C24 3C    LEA ECX,DWORD PTR SS:[ESP+3C]          ; |
00409B60  |. E8 CB700000 CALL ADVContr.00410C30                ; \ADVContr.00410C30
00409B65  |. 8B4424 44    MOV EAX,DWORD PTR SS:[ESP+44]
00409B69  |. 3BC5          CMP EAX,EBP
00409B6B  |. 75 05       JNZ SHORT ADVContr.00409B72
00409B6D  |. A1 20C44100 MOV EAX,DWORD PTR DS:[<&MSVCP60.?_C@?1??>
00409B72  |> 8B10          MOV EDX,DWORD PTR DS:[EAX]
00409B74  |. 8D4C24 0C    LEA ECX,DWORD PTR SS:[ESP+C]
00409B78  |. 895424 1C    MOV DWORD PTR SS:[ESP+1C],EDX
00409B7C  |. 8B40 04       MOV EAX,DWORD PTR DS:[EAX+4]
00409B7F  |. 894424 20    MOV DWORD PTR SS:[ESP+20],EAX
00409B83  |. E8 34F10000 CALL <JMP.&MFC42.#540>
00409B88  |. 6A 01       PUSH 1
00409B8A  |. 68 402F4200 PUSH ADVContr.00422F40
00409B8F  |. C64424 60 06 MOV BYTE PTR SS:[ESP+60],6
00409B94  |. E8 17E9FFFF CALL ADVContr.004084B0
00409B99  |. 8D4C24 30    LEA ECX,DWORD PTR SS:[ESP+30]
00409B9D  |. 8D5424 24    LEA EDX,DWORD PTR SS:[ESP+24]
00409BA1  |. 51          PUSH ECX
00409BA2  |. 52          PUSH EDX
00409BA3  |. E8 08EBFFFF CALL ADVContr.004086B0
00409BA8  |. 83C4 10       ADD ESP,10
00409BAB  |. 8D4424 28    LEA EAX,DWORD PTR SS:[ESP+28]
00409BAF  |. 8D8E 14010000  LEA ECX,DWORD PTR DS:[ESI+114]
00409BB5  |. 50          PUSH EAX
00409BB6  |. E8 F5F00000 CALL <JMP.&MFC42.#860>
00409BBB  |. 8D4C24 0C    LEA ECX,DWORD PTR SS:[ESP+C]
00409BBF  |. C64424 58 05 MOV BYTE PTR SS:[ESP+58],5
00409BC4  |. E8 DBF00000 CALL <JMP.&MFC42.#800>
00409BC9  |. 8B4424 44    MOV EAX,DWORD PTR SS:[ESP+44]
00409BCD  |. C64424 58 02 MOV BYTE PTR SS:[ESP+58],2
00409BD2  |. 3BC5          CMP EAX,EBP
00409BD4  |. 74 1D       JE SHORT ADVContr.00409BF3
00409BD6  |. 8D48 FF       LEA ECX,DWORD PTR DS:[EAX-1]
00409BD9  |. 8A40 FF       MOV AL,BYTE PTR DS:[EAX-1]
00409BDC  |. 84C0          TEST AL,AL
00409BDE  |. 74 0A       JE SHORT ADVContr.00409BEA
00409BE0  |. 3C FF       CMP AL,0FF
00409BE2  |. 74 06       JE SHORT ADVContr.00409BEA
00409BE4  |. FEC8          DEC AL
00409BE6  |. 8801          MOV BYTE PTR DS:[ECX],AL
00409BE8  |. EB 09       JMP SHORT ADVContr.00409BF3
00409BEA  |> 51          PUSH ECX
00409BEB  |. E8 D8F00000 CALL <JMP.&MFC42.#825>
00409BF0  |. 83C4 04       ADD ESP,4
00409BF3  |> 896C24 44    MOV DWORD PTR SS:[ESP+44],EBP
00409BF7  |. 896C24 48    MOV DWORD PTR SS:[ESP+48],EBP
00409BFB  |. 896C24 4C    MOV DWORD PTR SS:[ESP+4C],EBP
00409BFF  |> 55          PUSH EBP
00409C00  |. 8BCE          MOV ECX,ESI
00409C02  |. E8 D9F00000 CALL <JMP.&MFC42.#6334>
00409C07  |. 8D4C24 14    LEA ECX,DWORD PTR SS:[ESP+14]
00409C0B  |. C64424 58 01 MOV BYTE PTR SS:[ESP+58],1
00409C10  |. E8 8FF00000 CALL <JMP.&MFC42.#800>
00409C15  |. 8D4C24 18    LEA ECX,DWORD PTR SS:[ESP+18]
00409C19  |. C64424 58 00 MOV BYTE PTR SS:[ESP+58],0
00409C1E  |. E8 81F00000 CALL <JMP.&MFC42.#800>
00409C23  |. 8D4C24 34    LEA ECX,DWORD PTR SS:[ESP+34]
00409C27  |. C74424 58 FFFF>MOV DWORD PTR SS:[ESP+58],-1
00409C2F  |. E8 2C6E0000 CALL ADVContr.00410A60
00409C34  |. 8B4C24 50    MOV ECX,DWORD PTR SS:[ESP+50]
00409C38  |. 5E          POP ESI
00409C39  |. B8 01000000 MOV EAX,1
00409C3E  |. 5D          POP EBP
00409C3F  |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
00409C46  |. 83C4 54       ADD ESP,54
00409C49  \. C3          RETN

2007-6-27 12:47

0

wofan[OCN]

雪币： 2899

活跃值： (1753)

能力值：

( LV9，RANK：850 )

在线值：

发帖

55

回帖

810

粉丝

8

关注

私信

wofan[OCN] 21: 11 楼

抽空打开邮箱，收到楼主的邮件：
看到你分析的文章，分析的几尽完美，帮忙分析一下http://bbs.pediy.com/showthread.php?t=46344重启验证注册表的值

谢谢抬举。
不过我近来忙于工作，不能玩了……
并且，以后就是工作上理清了头绪，也不会玩破解了。破解之类的事，浅尝则止。简单的工作，重复执行，其实很累的。
所以，不好意思，你自已慢慢看帖子，慢慢分析吧。呵呵。

2007-7-2 23:41

0