.先在这里感谢一下能抽出时间看我问题的人 要是能解决 那是最好的了 再三感谢.
这是我在研究的一个网络验证的程序
分析如下:
这是我找的登陆按钮.
00406390 55 push ebp
00406391 8BEC mov ebp,esp
00406393 83C4 D4 add esp,-2C
00406396 53 push ebx
00406397 8BD8 mov ebx,eax
00406399 B8 C80A4900 mov eax,1.00490AC8
0040639E E8 D5D50700 call 1.00483978
004063A3 66:C745 E4 080>mov word ptr ss:[ebp-1C],8
004063A9 BA E6F74800 mov edx,1.0048F7E6
004063AE 8D45 FC lea eax,dword ptr ss:[ebp-4]
004063B1 E8 0A750800 call 1.0048D8C0
004063B6 FF45 F0 inc dword ptr ss:[ebp-10]
004063B9 8D55 FC lea edx,dword ptr ss:[ebp-4]
004063BC B8 38F54800 mov eax,1.0048F538
004063C1 E8 F6760800 call 1.0048DABC
004063C6 FF4D F0 dec dword ptr ss:[ebp-10]
004063C9 8D45 FC lea eax,dword ptr ss:[ebp-4]
004063CC BA 02000000 mov edx,2
004063D1 E8 B6760800 call 1.0048DA8C
004063D6 66:C745 E4 140>mov word ptr ss:[ebp-1C],14
004063DC BA E7F74800 mov edx,1.0048F7E7 ; l
004063E1 8D45 F8 lea eax,dword ptr ss:[ebp-8]
004063E4 E8 D7740800 call 1.0048D8C0
004063E9 FF45 F0 inc dword ptr ss:[ebp-10]
004063EC 8D55 F8 lea edx,dword ptr ss:[ebp-8]
004063EF B8 38F54800 mov eax,1.0048F538
004063F4 E8 C3760800 call 1.0048DABC
004063F9 FF4D F0 dec dword ptr ss:[ebp-10]
004063FC 8D45 F8 lea eax,dword ptr ss:[ebp-8]
004063FF BA 02000000 mov edx,2
00406404 E8 83760800 call 1.0048DA8C
00406409 8B83 18030000 mov eax,dword ptr ds:[ebx+318]
0040640F 8078 30 00 cmp byte ptr ds:[eax+30],0
00406413 75 07 jnz short 1.0040641C
00406415 E8 B6440000 call 1.0040A8D0 ; 网络连接CALL
0040641A EB 20 jmp short 1.0040643C
0040641C 8B83 18030000 mov eax,dword ptr ds:[ebx+318]
00406422 E8 B1440000 call 1.0040A8D8
00406427 B8 E8030000 mov eax,3E8
0040642C E8 67110000 call 1.00407598
00406431 8B83 18030000 mov eax,dword ptr ds:[ebx+318]
00406437 E8 94440000 call 1.0040A8D0 ; 网络连接CALL
0040643C 8B55 D4 mov edx,dword ptr ss:[ebp-2C]
0040643F 64:8915 000000>mov dword ptr fs:[0],edx
00406446 5B pop ebx
00406447 8BE5 mov esp,ebp
00406449 5D pop ebp
0040644A C3 retn
0040644B 90 nop
0040644C 0FBE11 movsx edx,byte ptr ds:[ecx]
0040644F 83FA 0D cmp edx,0D
00406452 75 11 jnz short 1.00406465
00406454 C601 00 mov byte ptr ds:[ecx],0
00406457 8B80 1C030000 mov eax,dword ptr ds:[eax+31C]
0040645D 8B08 mov ecx,dword ptr ds:[eax]
0040645F FF91 C0000000 call dword ptr ds:[ecx+C0]
00406465 C3 retn
上面的2个CALL 我已经注释了 下面一个没用 当我NOP掉第一CALL时 点登陆按钮 没用了.
我知道我找错了 然后经过分析 分析过程不用说了 太麻烦
找到如下信息:
00401EA0 55 push ebp
00401EA1 8BEC mov ebp,esp
00401EA3 83C4 F0 add esp,-10
00401EA6 53 push ebx
00401EA7 56 push esi
00401EA8 57 push edi
00401EA9 8B5D 1C mov ebx,dword ptr ss:[ebp+1C]
00401EAC 8B45 14 mov eax,dword ptr ss:[ebp+14]
00401EAF 8B7D 0C mov edi,dword ptr ss:[ebp+C]
00401EB2 8B75 08 mov esi,dword ptr ss:[ebp+8]
00401EB5 85F6 test esi,esi ; (初始化 cpu 选择状态)
00401EB7 74 08 je short 1.00401EC1
00401EB9 85FF test edi,edi
00401EBB 74 04 je short 1.00401EC1
00401EBD 85C0 test eax,eax
00401EBF 75 07 jnz short 1.00401EC8
00401EC1 33C0 xor eax,eax
00401EC3 E9 B7000000 jmp 1.00401F7F
00401EC8 8B55 18 mov edx,dword ptr ss:[ebp+18]
00401ECB 52 push edx
00401ECC 50 push eax
00401ECD E8 26FBFFFF call 1.004019F8
00401ED2 83C4 08 add esp,8
00401ED5 803D 14634900 >cmp byte ptr ds:[496314],0
00401EDC 75 3D jnz short 1.00401F1B
00401EDE 33C9 xor ecx,ecx
00401EE0 894D FC mov dword ptr ss:[ebp-4],ecx
00401EE3 8B45 10 mov eax,dword ptr ss:[ebp+10]
00401EE6 C1F8 03 sar eax,3
00401EE9 8945 F8 mov dword ptr ss:[ebp-8],eax
00401EEC 8B55 FC mov edx,dword ptr ss:[ebp-4]
00401EEF 3B55 F8 cmp edx,dword ptr ss:[ebp-8]
00401EF2 0F8D 85000000 jge 1.00401F7D
00401EF8 53 push ebx
00401EF9 68 145D4900 push 1.00495D14
00401EFE 57 push edi
00401EFF 56 push esi
00401F00 E8 63FBFFFF call 1.00401A68
00401F05 83C4 10 add esp,10
00401F08 FF45 FC inc dword ptr ss:[ebp-4]
00401F0B 83C6 08 add esi,8
00401F0E 83C7 08 add edi,8
00401F11 8B4D FC mov ecx,dword ptr ss:[ebp-4]
00401F14 3B4D F8 cmp ecx,dword ptr ss:[ebp-8]
00401F17 ^ 7C DF jl short 1.00401EF8
00401F19 EB 62 jmp short 1.00401F7D
00401F1B 33C0 xor eax,eax
00401F1D 8945 F4 mov dword ptr ss:[ebp-C],eax
00401F20 8B55 10 mov edx,dword ptr ss:[ebp+10]
00401F23 C1FA 03 sar edx,3
00401F26 8955 F0 mov dword ptr ss:[ebp-10],edx
00401F29 8B4D F4 mov ecx,dword ptr ss:[ebp-C]
00401F2C 3B4D F0 cmp ecx,dword ptr ss:[ebp-10]
00401F2F 7D 4C jge short 1.00401F7D
00401F31 53 push ebx
00401F32 68 145D4900 push 1.00495D14
00401F37 57 push edi
00401F38 56 push esi
00401F39 E8 2AFBFFFF call 1.00401A68
00401F3E 83C4 10 add esp,10
00401F41 33C0 xor eax,eax
00401F43 8AC3 mov al,bl
00401F45 83F8 01 cmp eax,1
00401F48 1BD2 sbb edx,edx
00401F4A F7DA neg edx
00401F4C 52 push edx
00401F4D 68 14604900 push 1.00496014
00401F52 56 push esi
00401F53 56 push esi
00401F54 E8 0FFBFFFF call 1.00401A68
00401F59 83C4 10 add esp,10
00401F5C 53 push ebx
00401F5D 68 145D4900 push 1.00495D14
00401F62 56 push esi
00401F63 56 push esi
00401F64 E8 FFFAFFFF call 1.00401A68
00401F69 83C4 10 add esp,10
00401F6C FF45 F4 inc dword ptr ss:[ebp-C]
00401F6F 83C6 08 add esi,8
00401F72 83C7 08 add edi,8
00401F75 8B4D F4 mov ecx,dword ptr ss:[ebp-C]
00401F78 3B4D F0 cmp ecx,dword ptr ss:[ebp-10]
00401F7B ^ 7C B4 jl short 1.00401F31
00401F7D B0 01 mov al,1
00401F7F 5F pop edi
00401F80 5E pop esi
00401F81 5B pop ebx
00401F82 8BE5 mov esp,ebp
00401F84 5D pop ebp
00401F85 C3 retn
上面3个相同的CALL 就是下面这代码.
00401A68 55 push ebp ; (初始化 cpu 选择状态)
00401A69 8BEC mov ebp,esp
00401A6B 53 push ebx
00401A6C 56 push esi
00401A6D 57 push edi
00401A6E BF 1CF54800 mov edi,1.0048F51C ; %di
00401A73 8B75 10 mov esi,dword ptr ss:[ebp+10]
00401A76 6A 40 push 40
00401A78 8B45 0C mov eax,dword ptr ss:[ebp+C]
00401A7B 50 push eax
00401A7C 68 25644900 push 1.00496425
00401A81 E8 0E030000 call 1.00401D94
00401A86 83C4 0C add esp,0C
00401A89 6A 40 push 40
00401A8B 68 D4F14800 push 1.0048F1D4
00401A90 68 25644900 push 1.00496425
00401A95 68 25644900 push 1.00496425
00401A9A E8 41020000 call 1.00401CE0
00401A9F 83C4 10 add esp,10
00401AA2 807D 14 00 cmp byte ptr ss:[ebp+14],0
00401AA6 75 5F jnz short 1.00401B07
00401AA8 33DB xor ebx,ebx
00401AAA 6A 20 push 20
00401AAC A1 20F54800 mov eax,dword ptr ds:[48F520]
00401AB1 50 push eax
00401AB2 68 65644900 push 1.00496465
00401AB7 E8 301B0800 call 1.004835EC
00401ABC 83C4 0C add esp,0C
00401ABF 8BD3 mov edx,ebx
00401AC1 C1E2 04 shl edx,4
00401AC4 8D1452 lea edx,dword ptr ds:[edx+edx*2]
00401AC7 03D6 add edx,esi
00401AC9 52 push edx
00401ACA 8B0D 20F54800 mov ecx,dword ptr ds:[48F520] ; 1.00496445
00401AD0 51 push ecx
00401AD1 E8 4E010000 call 1.00401C24
00401AD6 83C4 08 add esp,8
00401AD9 6A 20 push 20
00401ADB 8B07 mov eax,dword ptr ds:[edi]
00401ADD 50 push eax
00401ADE 8B15 20F54800 mov edx,dword ptr ds:[48F520] ; 1.00496445
00401AE4 52 push edx
00401AE5 E8 3A020000 call 1.00401D24
00401AEA 83C4 0C add esp,0C
00401AED 6A 20 push 20
00401AEF 68 65644900 push 1.00496465
00401AF4 8B0F mov ecx,dword ptr ds:[edi]
00401AF6 51 push ecx
00401AF7 E8 F01A0800 call 1.004835EC
00401AFC 83C4 0C add esp,0C
00401AFF 43 inc ebx
00401B00 83FB 10 cmp ebx,10
00401B03 ^ 7C A5 jl short 1.00401AAA
00401B05 EB 5B jmp short 1.00401B62
00401B07 BB 0F000000 mov ebx,0F
00401B0C 6A 20 push 20
00401B0E 8B07 mov eax,dword ptr ds:[edi]
00401B10 50 push eax
00401B11 68 65644900 push 1.00496465
00401B16 E8 D11A0800 call 1.004835EC
00401B1B 83C4 0C add esp,0C
00401B1E 8BD3 mov edx,ebx
00401B20 C1E2 04 shl edx,4
00401B23 8D1452 lea edx,dword ptr ds:[edx+edx*2]
00401B26 03D6 add edx,esi
00401B28 52 push edx
00401B29 8B0F mov ecx,dword ptr ds:[edi]
00401B2B 51 push ecx
00401B2C E8 F3000000 call 1.00401C24
00401B31 83C4 08 add esp,8
00401B34 A1 20F54800 mov eax,dword ptr ds:[48F520]
00401B39 6A 20 push 20
00401B3B 50 push eax
00401B3C 8B17 mov edx,dword ptr ds:[edi]
00401B3E 52 push edx
00401B3F E8 E0010000 call 1.00401D24
00401B44 83C4 0C add esp,0C
00401B47 8B0D 20F54800 mov ecx,dword ptr ds:[48F520] ; 1.00496445
00401B4D 6A 20 push 20
00401B4F 68 65644900 push 1.00496465
00401B54 51 push ecx
00401B55 E8 921A0800 call 1.004835EC
00401B5A 83C4 0C add esp,0C
00401B5D 4B dec ebx
00401B5E 85DB test ebx,ebx
00401B60 ^ 7D AA jge short 1.00401B0C
00401B62 6A 40 push 40
00401B64 68 14F24800 push 1.0048F214
00401B69 68 25644900 push 1.00496425
00401B6E 68 25644900 push 1.00496425
00401B73 E8 68010000 call 1.00401CE0
00401B78 83C4 10 add esp,10
00401B7B 6A 40 push 40
00401B7D 68 25644900 push 1.00496425
00401B82 8B45 08 mov eax,dword ptr ss:[ebp+8]
00401B85 50 push eax
00401B86 E8 49020000 call 1.00401DD4
00401B8B 83C4 0C add esp,0C
00401B8E 5F pop edi
00401B8F 5E pop esi
00401B90 5B pop ebx
00401B91 5D pop ebp
00401B92 C3 retn
这里 是我找到的信息 在读取我随便输入的注册码
找到这. 我实在不知道该怎么办了. 我只是个初学者 不知道上面的可是加密? 对于加密 我还没有学习过. 请哪一位高手有时间 解一下我的问题
不需要详细的过程 只需要一个思路 谢谢 请提供我一个思路吧 我还是第一次发帖提问 可能说的不是很详细 如果有什么地方没看懂的 请告诉一声我哪里没说清楚.
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
