-
-
[旧帖] [求助]怎么还是不可以呢...(指点一下拉><) 0.00雪花
-
发表于: 2007-11-22 08:19
-
连续看了两天看雪..稍微懂了点了.但是还是碰到问题了..
看下面~
1000C290 . 8B41 20 mov eax, dword ptr [ecx+20] 1000C293 . 50 push eax ; /hWnd 1000C294 . FF15 00440310 call dword ptr [<&USER32.GetParent>] ; \GetParent 1000C29A . 50 push eax 1000C29B . E8 C3460000 call 10010963 1000C2A0 . 6A 02 push 2 1000C2A2 . 8BC8 mov ecx, eax 1000C2A4 . E8 8D900000 call 10015336 1000C2A9 . C3 retn 1000C2AA CC int3 1000C2AB CC int3 1000C2AC CC int3 1000C2AD CC int3 1000C2AE CC int3 1000C2AF CC int3 1000C2B0 . 56 push esi 1000C2B1 . 57 push edi 1000C2B2 . 6A 01 push 1 1000C2B4 . 8BF1 mov esi, ecx 1000C2B6 . E8 FE3F0000 call 100102B9 1000C2BB . 8B86 DC000000 mov eax, dword ptr [esi+DC] 1000C2C1 . 8DBE DC000000 lea edi, dword ptr [esi+DC] 1000C2C7 . 83E8 10 sub eax, 10 1000C2CA . B9 01000000 mov ecx, 1 1000C2CF . 2B48 0C sub ecx, dword ptr [eax+C] 1000C2D2 . 0B48 08 or ecx, dword ptr [eax+8] 1000C2D5 . 7D 09 jge short 1000C2E0 1000C2D7 . 6A 00 push 0 1000C2D9 . 8BCF mov ecx, edi 1000C2DB . E8 A0B0FFFF call 10007380 1000C2E0 > 8B17 mov edx, dword ptr [edi] 1000C2E2 . 68 F05C0410 push 10045CF0 1000C2E7 . 68 9C9E0310 push 10039E9C ; %d 1000C2EC . 52 push edx 1000C2ED . E8 E2150100 call 1001D8D4 1000C2F2 . 83C4 0C add esp, 0C 1000C2F5 . 83BE 34010000>cmp dword ptr [esi+134], 0 1000C2FC . 5F pop edi 1000C2FD . 0F95C0 setne al 1000C300 . 8BCE mov ecx, esi 1000C302 . A2 E4600410 mov byte ptr [100460E4], al 1000C307 . 5E pop esi 1000C308 . E9 CE0B0000 jmp 1000CEDB 1000C30D CC int3 1000C30E CC int3 1000C30F CC int3 1000C310 . 0FB605 E46004>movzx eax, byte ptr [100460E4] 1000C317 . 56 push esi 1000C318 . 8BF1 mov esi, ecx 1000C31A . 8986 34010000 mov dword ptr [esi+134], eax 1000C320 . E8 0B000000 call 1000C330 1000C325 . 8BCE mov ecx, esi 1000C327 . 5E pop esi 1000C328 . E9 980B0000 jmp 1000CEC5 1000C32D CC int3 1000C32E CC int3 1000C32F CC int3 1000C330 833D 988E0410>cmp dword ptr [10048E98], 1 1000C337 8D8E 88000000 lea ecx, dword ptr [esi+88] (这里因该是对比么?) 1000C33D 75 5B jnz short 1000C39A (不对则跳到c39a) 根据教程改为nop 1000C33F |. 68 D09C0310 push 10039CD0 ; 挂机半径 1000C344 |. E8 AC8F0000 call 100152F5 1000C349 |. A1 F05C0410 mov eax, dword ptr [10045CF0] 1000C34E |. 50 push eax 1000C34F |. 8D8E DC000000 lea ecx, dword ptr [esi+DC] 1000C355 |. 68 DC9C0310 push 10039CDC ; %-d 1000C35A |. 51 push ecx 1000C35B |. E8 30C6FFFF call 10008990 1000C360 |. 83C4 0C add esp, 0C 1000C363 |. 833D F45C0410>cmp dword ptr [10045CF4], 0 1000C36A |. 8D8E E0000000 lea ecx, dword ptr [esi+E0] (又是对比么?) 1000C370 75 14 jnz short 1000C386 (不对跳到c386) 根据教程再次改到nop 1000C372 |. 68 E09C0310 push 10039CE0 ; 挂机 1000C377 |. E8 798F0000 call 100152F5 1000C37C |. 6A 00 push 0 1000C37E |. 8BCE mov ecx, esi 1000C380 |. E8 343F0000 call 100102B9 1000C385 |. C3 retn 1000C386 |> 68 E89C0310 push 10039CE8 ; 取消挂机 1000C38B |. E8 658F0000 call 100152F5 1000C390 |. 6A 00 push 0 1000C392 |. 8BCE mov ecx, esi 1000C394 |. E8 203F0000 call 100102B9 1000C399 |. C3 retn 1000C39A |> 68 F49C0310 push 10039CF4 ; 输入密码 1000C39F |. E8 518F0000 call 100152F5 1000C3A4 |. 8B15 FC5C0410 mov edx, dword ptr [10045CFC] 1000C3AA |. A1 F85C0410 mov eax, dword ptr [10045CF8] 1000C3AF |. 52 push edx 1000C3B0 |. 50 push eax 1000C3B1 |. 8D8E DC000000 lea ecx, dword ptr [esi+DC] 1000C3B7 |. 68 009D0310 push 10039D00 ; %08x%08x 1000C3BC |. 51 push ecx 1000C3BD |. E8 CEC5FFFF call 10008990 1000C3C2 |. 83C4 10 add esp, 10 1000C3C5 |. 68 0C9D0310 push 10039D0C ; 注册 1000C3CA |. 8D8E E0000000 lea ecx, dword ptr [esi+E0] 1000C3D0 |. E8 208F0000 call 100152F5 1000C3D5 |. 6A 00 push 0 1000C3D7 |. 8BCE mov ecx, esi 1000C3D9 |. E8 DB3E0000 call 100102B9 1000C3DE \. C3 retn 1000C3DF CC int3 1000C3E0 . 833D 988E0410>cmp dword ptr [10048E98], 1 1000C3E7 . 56 push esi 1000C3E8 . 8BF1 mov esi, ecx 1000C3EA 75 41 jnz short 1000C42D 1000C3EC . 6A 01 push 1 1000C3EE . E8 C63E0000 call 100102B9 1000C3F3 . 8B86 DC000000 mov eax, dword ptr [esi+DC] 1000C3F9 . 81C6 DC000000 add esi, 0DC 1000C3FF . 83E8 10 sub eax, 10 1000C402 . B9 01000000 mov ecx, 1 1000C407 . 2B48 0C sub ecx, dword ptr [eax+C] 1000C40A . 0B48 08 or ecx, dword ptr [eax+8] 1000C40D 7D 09 jge short 1000C418 1000C40F . 6A 00 push 0 1000C411 . 8BCE mov ecx, esi 1000C413 . E8 68AFFFFF call 10007380 1000C418 > 8B16 mov edx, dword ptr [esi] 1000C41A . 68 F05C0410 push 10045CF0 1000C41F . 68 9C9E0310 push 10039E9C ; %d 1000C424 . 52 push edx 1000C425 . E8 AA140100 call 1001D8D4 1000C42A . 83C4 0C add esp, 0C 1000C42D > 5E pop esi 1000C42E . C3 retn 1000C42F CC int3 1000C430 . 56 push esi 1000C431 . 6A 01 push 1 1000C433 . 8BF1 mov esi, ecx 1000C435 . E8 7F3E0000 call 100102B9 1000C43A . DB86 38010000 fild dword ptr [esi+138] 1000C440 . D91D 24F70410 fstp dword ptr [1004F724] 1000C446 . DB86 3C010000 fild dword ptr [esi+13C] 1000C44C . D91D 28F70410 fstp dword ptr [1004F728] 1000C452 . C786 40010000>mov dword ptr [esi+140], 0
改了上面那两个,运行后不要注册码了.可是没有效果,点挂机没反映..
指点下拉><
新人没办法啊..苯..
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
[QUOTE=noper;383750]
连续看了两天看雪..稍微懂了点了.但是还是碰到问题了.. 看下面~ 1000C290 . 8B41 20 mov eax, dword ptr [ecx+20] 1000C293 . 50 push eax ...[/QUOTE] 拜托拉,高手指点一下下就好了 ... |
|
|
[QUOTE=noper;383750]
连续看了两天看雪..稍微懂了点了.但是还是碰到问题了.. 看下面~ 1000C290 . 8B41 20 mov eax, dword ptr [ecx+20] 1000C293 . 50 push eax ...[/QUOTE] 诶，解决了。 ><。。。 |
