该程序为Delphi6.0~7.0,无壳,反编译查找关键字符串“注册”得到如下代码:(小弟实在是菜,找到关键call之后,竟然无从下手,用OD在关键CALL处下断,结果啥都没拦到)附代码如下:(望高手指点一二)
* Possible StringData Ref from Code Obj ->"狗狗注册成功,谢谢您的使用。"
|
:0079BBE1 681CBD7900 push 0079BD1C
:0079BBE6 8BC3 mov eax, ebx
:0079BBE8 E80B74CDFF call 00472FF8
:0079BBED 50 push eax
* Reference To: user32.MessageBoxA, Ord:0000h
|
:0079BBEE E8A9C2C6FF Call 00407E9C
:0079BBF3 C60601 mov byte ptr [esi], 01
:0079BBF6 E8D9280000 call 0079E4D4
:0079BBFB E82C2B0000 call 0079E72C
:0079BC00 A1F444A200 mov eax, dword ptr [00A244F4]
:0079BC05 833800 cmp dword ptr [eax], 00000000
:0079BC08 0F84BC000000 je 0079BCCA
:0079BC0E A1F444A200 mov eax, dword ptr [00A244F4]
:0079BC13 8B00 mov eax, dword ptr [eax]
:0079BC15 8B80D4060000 mov eax, dword ptr [eax+000006D4]
:0079BC1B 33D2 xor edx, edx
:0079BC1D E87E09CDFF call 0046C5A0
:0079BC22 E9A3000000 jmp 0079BCCA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0079BBD8(C)
|
:0079BC27 6A30 push 00000030
:0079BC29 6810BD7900 push 0079BD10
* Possible StringData Ref from Code Obj ->"注册码错误,无法注册!"
|
:0079BC2E 683CBD7900 push 0079BD3C
:0079BC33 8BC3 mov eax, ebx
:0079BC35 E8BE73CDFF call 00472FF8
:0079BC3A 50 push eax
* Reference To: user32.MessageBoxA, Ord:0000h
|
:0079BC3B E85CC2C6FF Call 00407E9C
:0079BC40 E985000000 jmp 0079BCCA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0079BBCF(C)
|
:0079BC45 6A30 push 00000030
:0079BC47 6810BD7900 push 0079BD10
* Possible StringData Ref from Code Obj ->"注册码错误,无法注册!"
|
:0079BC4C 683CBD7900 push 0079BD3C
:0079BC51 8BC3 mov eax, ebx
:0079BC53 E8A073CDFF call 00472FF8
:0079BC58 50 push eax
* Reference To: user32.MessageBoxA, Ord:0000h
|
:0079BC59 E83EC2C6FF Call 00407E9C
:0079BC5E EB6A jmp 0079BCCA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0079BBB9(C)
|
:0079BC60 8D45E4 lea eax, dword ptr [ebp-1C]
:0079BC63 E88C34F7FF call 0070F0F4
:0079BC68 8B4DE4 mov ecx, dword ptr [ebp-1C]
:0079BC6B B201 mov dl, 01
* Possible StringData Ref from Code Obj ->"XH"
|
:0079BC6D A178034800 mov eax, dword ptr [00480378]
:0079BC72 E8B147CEFF call 00480428
:0079BC77 8BF0 mov esi, eax
:0079BC79 6A01 push 00000001
* Possible StringData Ref from Code Obj ->"Flag"
|
:0079BC7B B964BD7900 mov ecx, 0079BD64
* Possible StringData Ref from Code Obj ->"Register"
|
:0079BC80 BA74BD7900 mov edx, 0079BD74
:0079BC85 8BC6 mov eax, esi
:0079BC87 8B38 mov edi, dword ptr [eax]
:0079BC89 FF5714 call [edi+14]
:0079BC8C 8BC6 mov eax, esi
:0079BC8E E82D7DC6FF call 004039C0
:0079BC93 6A40 push 00000040
:0079BC95 6810BD7900 push 0079BD10
* Possible StringData Ref from Code Obj ->"注册成功,谢谢您的使用。"
|
:0079BC9A 6880BD7900 push 0079BD80
:0079BC9F 8BC3 mov eax, ebx
:0079BCA1 E85273CDFF call 00472FF8
:0079BCA6 50 push eax
* Reference To: user32.MessageBoxA, Ord:0000h
|
:0079BCA7 E8F0C1C6FF Call 00407E9C
:0079BCAC A1F444A200 mov eax, dword ptr [00A244F4]
:0079BCB1 833800 cmp dword ptr [eax], 00000000
:0079BCB4 7414 je 0079BCCA
:0079BCB6 A1F444A200 mov eax, dword ptr [00A244F4]
:0079BCBB 8B00 mov eax, dword ptr [eax]
:0079BCBD 8B80D4060000 mov eax, dword ptr [eax+000006D4]
:0079BCC3 33D2 xor edx, edx
:0079BCC5 E8D608CDFF call 0046C5A0
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0079BB39(C), :0079BC08(C), :0079BC22(U), :0079BC40(U), :0079BC5E(U)
|:0079BCB4(C)
|
:0079BCCA 33C0 xor eax, eax
:0079BCCC 5A pop edx
:0079BCCD 59 pop ecx
:0079BCCE 59 pop ecx
:0079BCCF 648910 mov dword ptr fs:[eax], edx
:0079BCD2 6809BD7900 push 0079BD09
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0079BD07(U)
|
:0079BCD7 8D45E4 lea eax, dword ptr [ebp-1C]
:0079BCDA E8B18BC6FF call 00404890
:0079BCDF 8D45E8 lea eax, dword ptr [ebp-18]
:0079BCE2 BA03000000 mov edx, 00000003
:0079BCE7 E8C88BC6FF call 004048B4
:0079BCEC 8D45F4 lea eax, dword ptr [ebp-0C]
:0079BCEF E89C8BC6FF call 00404890
:0079BCF4 8D45F8 lea eax, dword ptr [ebp-08]
:0079BCF7 BA02000000 mov edx, 00000002
:0079BCFC E8B38BC6FF call 004048B4
:0079BD01 C3 ret
:0079BD02 E94D84C6FF jmp 00404154
:0079BD07 EBCE jmp 0079BCD7
:0079BD09 5F pop edi
:0079BD0A 5E pop esi
:0079BD0B 5B pop ebx
:0079BD0C 8BE5 mov esp, ebp
:0079BD0E 5D pop ebp
:0079BD0F C3 ret
-------------------------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403FBF(U), :00404147(U)
|
:004039C0 85C0 test eax, eax
:004039C2 7407 je 004039CB
:004039C4 B201 mov dl, 01
:004039C6 8B08 mov ecx, dword ptr [eax]
:004039C8 FF51FC call [ecx-04]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004039C2(C)
|
:004039CB C3 ret
××××××××××××××××××××××××××××××××××××××
调用OD在004039C2处下断,拦不到,用bp messageboxa断点可以拦截,可里面的代码绕来绕去,都绕不回来,唉,水平太菜。。。。埋头读书先,大侠,就拉兄弟一把吧!!!
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)