有一个SF游戏客户端程序!
设置了专用的登陆器程序,用他的登陆器程序才能启动客户端程序!
如果直接启动客户端程序会提示“请先运行XXX”
请问如何用OD断开客户端程序的验证,可以直接启动客户端!
我试了几天。可能方法错误,下了断点运行都是导致程序错误(查看错误是提示 签名错误)
因为还不知道从那里下手。所以也没办法把代码发出来。
如果有空的高手朋友可以加我QQ 9959066 帮一下!
登陆器还有壳。。一直在脱。。但脱不对。。客户端的客已经脱了。。
2个程序的壳都是 ASProtect 2.3 SKE build 06.26 Beta
客户端已经用脚本脱好。。可登陆器用脚本应该是补区段不对吧。。运行都是提示内存错误。
不然可以进去看看登陆器发送的信息是怎么样的!
加上一组代码。个人认为重点是在这里。验证信息和提示错误都在这里吧!
帮看看怎么修改跳过!
004779D0 55 push ebp
004779D1 |. 8BEC mov ebp, esp
004779D3 83C4 A4 add esp, -5C
004779D6 |. 894D F4 mov dword ptr [ebp-C], ecx
004779D9 |. 8955 F8 mov dword ptr [ebp-8], edx
004779DC |. 8945 FC mov dword ptr [ebp-4], eax
004779DF E8 B0F3F8FF call <jmp.&user32.GetActiveWindow>
004779E4 |. 8945 EC mov dword ptr [ebp-14], eax
004779E7 6A 02 push 2
004779E9 8B45 EC mov eax, dword ptr [ebp-14]
004779EC |. 50 push eax
004779ED |. A1 608A4E00 mov eax, dword ptr [4E8A60]
004779F2 |. 8B00 mov eax, dword ptr [eax]
004779F4 |. FFD0 call eax
004779F6 |. 8945 E4 mov dword ptr [ebp-1C], eax
004779F9 6A 02 push 2
004779FB 8B45 FC mov eax, dword ptr [ebp-4]
004779FE |. 8B40 30 mov eax, dword ptr [eax+30]
00477A01 |. 50 push eax
00477A02 |. A1 608A4E00 mov eax, dword ptr [4E8A60]
00477A07 |. 8B00 mov eax, dword ptr [eax]
00477A09 |. FFD0 call eax
00477A0B |. 8945 E0 mov dword ptr [ebp-20], eax
00477A0E |. 8B45 E4 mov eax, dword ptr [ebp-1C]
00477A11 |. 3B45 E0 cmp eax, dword ptr [ebp-20]
00477A14 74 5E je short 00477A74
00477A16 |. C745 B4 28000000 mov dword ptr [ebp-4C], 28
00477A1D |. 8D45 B4 lea eax, dword ptr [ebp-4C]
00477A20 |. 50 push eax
00477A21 |. 8B45 E4 mov eax, dword ptr [ebp-1C]
00477A24 |. 50 push eax
00477A25 |. A1 60894E00 mov eax, dword ptr [4E8960]
00477A2A |. 8B00 mov eax, dword ptr [eax]
00477A2C |. FFD0 call eax
00477A2E |. 8D45 A4 lea eax, dword ptr [ebp-5C]
00477A31 |. 50 push eax ; /pRect
00477A32 |. 8B45 FC mov eax, dword ptr [ebp-4] ; |
00477A35 |. 8B40 30 mov eax, dword ptr [eax+30] ; |
00477A38 |. 50 push eax ; |hWnd
00477A39 E8 B6F4F8FF call <jmp.&user32.GetWindowRect>
00477A3E |. 6A 1D push 1D
00477A40 |. 6A 00 push 0
00477A42 |. 6A 00 push 0
00477A44 |. 8B45 C4 mov eax, dword ptr [ebp-3C]
00477A47 |. 2B45 BC sub eax, dword ptr [ebp-44]
00477A4A D1F8 sar eax, 1
00477A4C 79 03 jns short 00477A51
00477A4E |. 83D0 00 adc eax, 0
00477A51 |> 0345 BC add eax, dword ptr [ebp-44]
00477A54 |. 50 push eax
00477A55 |. 8B45 C0 mov eax, dword ptr [ebp-40]
00477A58 |. 2B45 B8 sub eax, dword ptr [ebp-48]
00477A5B D1F8 sar eax, 1
00477A5D 79 03 jns short 00477A62
00477A5F |. 83D0 00 adc eax, 0
00477A62 |> 0345 B8 add eax, dword ptr [ebp-48] ; |
00477A65 |. 50 push eax ; |X
00477A66 |. 6A 00 push 0 ; |InsertAfter = HWND_TOP
00477A68 |. 8B45 FC mov eax, dword ptr [ebp-4] ; |
00477A6B |. 8B40 30 mov eax, dword ptr [eax+30] ; |
00477A6E |. 50 push eax ; |hWnd
00477A6F E8 88F6F8FF call <jmp.&user32.SetWindowPos>
00477A74 |> 33C0 xor eax, eax
00477A76 E8 7D4AFFFF call 0046C4F8
00477A7B 8945 E8 mov dword ptr [ebp-18], eax
00477A7E |. E8 3549FFFF call 0046C3B8
00477A83 |. 8945 DC mov dword ptr [ebp-24], eax
00477A86 |. 8B45 FC mov eax, dword ptr [ebp-4]
00477A89 E8 E2EBFFFF call 00476670
00477A8E 84C0 test al, al
00477A90 74 07 je short 00477A99
00477A92 814D 08 00001000 or dword ptr [ebp+8], 100000
00477A99 |> 33C0 xor eax, eax
00477A9B |. 55 push ebp
00477A9C 68 277B4700 push 00477B27
00477AA1 64:FF30 push dword ptr fs:[eax]
00477AA4 |. 64:8920 mov dword ptr fs:[eax], esp
00477AA7 |. 8B45 08 mov eax, dword ptr [ebp+8]
00477AAA 50 push eax
00477AAB |. 8B45 F4 mov eax, dword ptr [ebp-C] ; |
00477AAE 50 push eax
00477AAF |. 8B45 F8 mov eax, dword ptr [ebp-8] ; |
00477AB2 50 push eax
00477AB3 |. 8B45 FC mov eax, dword ptr [ebp-4] ; |
00477AB6 |. 8B40 30 mov eax, dword ptr [eax+30] ; |
00477AB9 50 push eax
00477ABA E8 0DF5F8FF call <jmp.&user32.MessageBoxA>
00477ABF |. 8945 F0 mov dword ptr [ebp-10], eax
00477AC2 33C0 xor eax, eax
00477AC4 |. 5A pop edx
00477AC5 |. 59 pop ecx
00477AC6 |. 59 pop ecx
00477AC7 |. 64:8910 mov dword ptr fs:[eax], edx
00477ACA |. 68 2E7B4700 push 00477B2E
00477ACF |> 8B45 E4 mov eax, dword ptr [ebp-1C]
00477AD2 |. 3B45 E0 cmp eax, dword ptr [ebp-20]
00477AD5 |. 74 36 je short 00477B0D
00477AD7 |. 6A 1D push 1D
00477AD9 |. 6A 00 push 0
00477ADB |. 6A 00 push 0
00477ADD |. 8B45 B0 mov eax, dword ptr [ebp-50]
00477AE0 |. 2B45 A8 sub eax, dword ptr [ebp-58]
00477AE3 D1F8 sar eax, 1
00477AE5 79 03 jns short 00477AEA
00477AE7 |. 83D0 00 adc eax, 0
00477AEA |> 0345 A8 add eax, dword ptr [ebp-58]
00477AED |. 50 push eax
00477AEE |. 8B45 AC mov eax, dword ptr [ebp-54]
00477AF1 |. 2B45 A4 sub eax, dword ptr [ebp-5C]
00477AF4 |. D1F8 sar eax, 1
00477AF6 |. 79 03 jns short 00477AFB
00477AF8 83D0 00 adc eax, 0
00477AFB |> 0345 A4 add eax, dword ptr [ebp-5C] ; |
00477AFE |. 50 push eax ; |X
00477AFF |. 6A 00 push 0 ; |InsertAfter = HWND_TOP
00477B01 |. 8B45 FC mov eax, dword ptr [ebp-4] ; |
00477B04 |. 8B40 30 mov eax, dword ptr [eax+30] ; |
00477B07 |. 50 push eax ; |hWnd
00477B08 E8 EFF5F8FF call <jmp.&user32.SetWindowPos>
00477B0D |> 8B45 E8 mov eax, dword ptr [ebp-18]
00477B10 |. E8 9B4AFFFF call 0046C5B0
00477B15 |. 8B45 EC mov eax, dword ptr [ebp-14]
00477B18 |. 50 push eax ; /hWnd
00477B19 E8 4EF5F8FF call <jmp.&user32.SetActiveWindow>
00477B1E |. 8B45 DC mov eax, dword ptr [ebp-24]
00477B21 |. E8 A648FFFF call 0046C3CC
00477B26 \. C3 retn
00477B27 .^ E9 ECC3F8FF jmp 00403F18
00477B2C .^ EB A1 jmp short 00477ACF
00477B2E . 8B45 F0 mov eax, dword ptr [ebp-10]
00477B31 . 8BE5 mov esp, ebp
00477B33 . 5D pop ebp
00477B34 . C2 0400 retn 4
00477B37 90 nop
00477B38 /$ 55 push ebp
00477B39 |. 8BEC mov ebp, esp
00477B3B |. 81C4 F0FEFFFF add esp, -110
00477B41 |. 33C9 xor ecx, ecx
00477B43 |. 898D F0FEFFFF mov dword ptr [ebp-110], ecx
00477B49 |. 894D F4 mov dword ptr [ebp-C], ecx
00477B4C |. 8955 F8 mov dword ptr [ebp-8], edx
00477B4F |. 8945 FC mov dword ptr [ebp-4], eax
00477B52 |. 33C0 xor eax, eax
00477B54 |. 55 push ebp
00477B55 |. 68 F87B4700 push 00477BF8
00477B5A |. 64:FF30 push dword ptr fs:[eax]
00477B5D |. 64:8920 mov dword ptr fs:[eax], esp
00477B60 |. 8D45 F4 lea eax, dword ptr [ebp-C]
00477B63 |. 8B55 F8 mov edx, dword ptr [ebp-8]
00477B66 |. 8B52 04 mov edx, dword ptr [edx+4]
00477B69 |. E8 C2CAF8FF call 00404630
00477B6E |. 837D F4 00 cmp dword ptr [ebp-C], 0
00477B72 |. 74 34 je short 00477BA8
00477B74 |. 8B45 F4 mov eax, dword ptr [ebp-C]
00477B77 |. E8 A818F9FF call 00409424
00477B7C |. 8BD0 mov edx, eax
00477B7E |. 8D85 F4FEFFFF lea eax, dword ptr [ebp-10C]
00477B84 |. E8 4BB7F8FF call 004032D4
00477B89 |. 8D85 F4FEFFFF lea eax, dword ptr [ebp-10C]
00477B8F |. BA 047C4700 mov edx, 00477C04
00477B94 |. E8 C7B3F8FF call 00402F60
00477B99 |. 76 0D jbe short 00477BA8
00477B9B |. 8D45 F4 lea eax, dword ptr [ebp-C]
00477B9E |. BA 107C4700 mov edx, 00477C10
00477BA3 |. E8 C8CCF8FF call 00404870
00477BA8 |> 6A 10 push 10
00477BAA |. 8D95 F0FEFFFF lea edx, dword ptr [ebp-110]
00477BB0 |. 8B45 FC mov eax, dword ptr [ebp-4]
00477BB3 |. E8 98F6FFFF call 00477250
00477BB8 |. 8B85 F0FEFFFF mov eax, dword ptr [ebp-110]
00477BBE |. E8 A5CEF8FF call 00404A68
00477BC3 |. 50 push eax
00477BC4 |. 8B45 F4 mov eax, dword ptr [ebp-C]
00477BC7 |. E8 9CCEF8FF call 00404A68
00477BCC |. 8BD0 mov edx, eax
00477BCE |. 8B45 FC mov eax, dword ptr [ebp-4]
00477BD1 |. 59 pop ecx
00477BD2 E8 F9FDFFFF call 004779D0
00477BD7 33C0 xor eax, eax
00477BD9 |. 5A pop edx
00477BDA |. 59 pop ecx
00477BDB |. 59 pop ecx
00477BDC |. 64:8910 mov dword ptr fs:[eax], edx
00477BDF |. 68 FF7B4700 push 00477BFF
00477BE4 |> 8D85 F0FEFFFF lea eax, dword ptr [ebp-110]
00477BEA |. E8 A9C9F8FF call 00404598
00477BEF |. 8D45 F4 lea eax, dword ptr [ebp-C]
00477BF2 |. E8 A1C9F8FF call 00404598
00477BF7 \. C3 retn
00477BF8 .^ E9 1BC3F8FF jmp 00403F18
00477BFD .^ EB E5 jmp short 00477BE4
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课