能力值:
( LV2,RANK:10 )
|
-
-
2 楼
不管我用什么下断点:
bpx RegQueryValueExA
bpx RegOpenKeyExW
bpx d
都是连遍累犊的这样的文字,
ntermodular calls
地址 反汇编 目标文件
004036CD call <jmp.&MSVBVM60.#100> MSVBVM60.ThunRTMain
00418AE5 call eax MSVBVM60.DllFunctionCall
00418B3D call eax MSVBVM60.DllFunctionCall
00418B91 call eax MSVBVM60.DllFunctionCall
00418BE1 call eax MSVBVM60.DllFunctionCall
00418C35 call eax MSVBVM60.DllFunctionCall
00418C8D call eax MSVBVM60.DllFunctionCall
00419A89 call eax MSVBVM60.DllFunctionCall
0041E671 call eax MSVBVM60.DllFunctionCall
00440E9F call 67F3C53E
004BDDAA call 9AC8E24A
004CF0D7 call 9AC9F577
004E03B8 call 9ACB0858
004F1877 call 9ACC1D17
00558E21 call F94E770E
005FB33E call F9589C2B
00645341 call E74C3C2E
0068C555 call E750AE42
00742B92 call dword ptr [<&MSVBVM60.__vbaNew2>] MSVBVM60.__vbaNew2
00742BF7 call dword ptr [<&MSVBVM60.__vbaHresultCheckObj>] MSVBVM60.__vbaHresultCheckObj
00742C75 call dword ptr [<&MSVBVM60.__vbaEnd>] MSVBVM60.__vbaEnd
00742C8D call dword ptr [<&MSVBVM60.__vbaNew2>] MSVBVM60.__vbaNew2
00742CA3 call dword ptr [<&MSVBVM60.__vbaObjSetAddref>] MSVBVM60.__vbaObjSetAddref
00742CC0 call dword ptr [<&MSVBVM60.__vbaHresultCheckObj>] MSVBVM60.__vbaHresultCheckObj
00742CC9 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
00742CDC call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
00742DE8 call dword ptr [<&MSVBVM60.__vbaNew2>] MSVBVM60.__vbaNew2
00742DFE call dword ptr [<&MSVBVM60.__vbaObjSetAddref>] MSVBVM60.__vbaObjSetAddref
00742E1B call dword ptr [<&MSVBVM60.__vbaHresultCheckObj>] MSVBVM60.__vbaHresultCheckObj
00742E24 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
00742E37 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
00742EF0 call dword ptr [<&MSVBVM60.__vbaObjSet>] MSVBVM60.__vbaObjSet
00742F13 call dword ptr [<&MSVBVM60.__vbaHresultCheckObj>] MSVBVM60.__vbaHresultCheckObj
00742F27 call dword ptr [<&MSVBVM60.__vbaObjSet>] MSVBVM60.__vbaObjSet
00742F4A call dword ptr [<&MSVBVM60.__vbaHresultCheckObj>] MSVBVM60.__vbaHresultCheckObj
00742F65 call edi MSVBVM60.__vbaLateIdCallLd
00742F71 call esi MSVBVM60.__vbaStrVarMove
00742F7E call ebx MSVBVM60.__vbaStrMove
00742FA2 call dword ptr [<&MSVBVM60.__vbaStrComp>] MSVBVM60.__vbaStrComp
.
.
.
007B8DAE call dword ptr [<&MSVBVM60.__vbaFreeStr>] MSVBVM60.__vbaFreeStr
007B8DBE call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B8DD2 call dword ptr [<&MSVBVM60.__vbaFreeVarList>] MSVBVM60.__vbaFreeVarList
007B8EB2 call dword ptr [<&MSVBVM60.__vbaHresultCheckObj>] MSVBVM60.__vbaHresultCheckObj
007B8EED call dword ptr [<&MSVBVM60.__vbaHresultCheckObj>] MSVBVM60.__vbaHresultCheckObj
007B8F15 call dword ptr [<&MSVBVM60.__vbaErrorOverflow>] MSVBVM60.__vbaErrorOverflow
007B8F89 call ebx MSVBVM60.__vbaObjSet
007B8FB3 call edi MSVBVM60.__vbaHresultCheckObj
007B8FEF call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B906C call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B90DD call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B9158 call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B91C9 call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B923C call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B92AD call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B9320 call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B9374 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
007B93DB call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
007B9442 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
007B94A9 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
007B9510 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
007B9570 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
007B95A7 call dword ptr [<&MSVBVM60.__vbaFreeObj>] MSVBVM60.__vbaFreeObj
007B95CD call dword ptr [<&MSVBVM60.__vbaFreeObjList>] MSVBVM60.__vbaFreeObjList
007B9610 call dword ptr [<&MSVBVM60.__vbaErrorOverflow>] MSVBVM60.__vbaErrorOverflow
因为他的注册信息是写在注册表里的,需要重启认证,有什么好办法?
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
看见VB就怕,
看能不能找到注册表样的字符串...
祝你好运..
|
|
|