[求助]高手,给看看这个程序!那个地方是控制输入名字的地方?-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] [求助]高手,给看看这个程序!那个地方是控制输入名字的地方? 0.00雪花

发表于: 2008-3-29 20:22 4404

[旧帖] [求助]高手,给看看这个程序!那个地方是控制输入名字的地方? 0.00雪花

starswwz

2008-3-29 20:22

4404

这是一个试用版。不管用户名是什么，都会变成“中行”能不能把输名字的地方去掉（或破坏掉），让我自已输入名字？
00401000  /.  55          PUSH EBP
00401001  |.  8BEC       MOV EBP,ESP
00401003  |.  53          PUSH EBX
00401004  |.  57          PUSH EDI
00401005  |.  56          PUSH ESI
00401006  |.  8B45 0C    MOV EAX,DWORD PTR SS:[EBP+C]
00401009  |.  83F8 10    CMP EAX,10
0040100C  |.  75 16       JNZ SHORT xjb.00401024
0040100E  |.  6A 01       PUSH 1                                  ; /TimerID = 1
00401010  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401013  |.  E8 20020000 CALL <JMP.&user32.KillTimer>          ; \KillTimer
00401018  |.  6A 00       PUSH 0                                  ; /Result = 0
0040101A  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
0040101D  |.  E8 04020000 CALL <JMP.&user32.EndDialog>          ; \EndDialog
00401022  |.  EB 62       JMP SHORT xjb.00401086
00401024  |>  3D 10010000 CMP EAX,110
00401029  |.  75 13       JNZ SHORT xjb.0040103E
0040102B  |.  6A 00       PUSH 0                                  ; /Timerproc = NULL
0040102D  |.  68 F4010000 PUSH 1F4                               ; |Timeout = 500. ms
00401032  |.  6A 01       PUSH 1                                  ; |TimerID = 1
00401034  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401037  |.  E8 08020000 CALL <JMP.&user32.SetTimer>             ; \SetTimer
0040103C  |.  EB 48       JMP SHORT xjb.00401086
0040103E  |>  3D 13010000 CMP EAX,113
00401043  |.  75 35       JNZ SHORT xjb.0040107A
00401045  |.  6A 00       PUSH 0                                  ; /ShowState = SW_HIDE
00401047  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
0040104A  |.  E8 FB010000 CALL <JMP.&user32.ShowWindow>          ; \ShowWindow
0040104F  |.  68 00304000 PUSH xjb.00403000                      ; /Title = "请输入个人信息"
00401054  |.  6A 00       PUSH 0                                  ; |Class = 0
00401056  |.  E8 D1010000 CALL <JMP.&user32.FindWindowA>          ; \FindWindowA
0040105B  |.  0BC0       OR EAX,EAX
0040105D  |.  74 27       JE SHORT xjb.00401086
0040105F  |.  A3 FC304000 MOV DWORD PTR DS:[4030FC],EAX
00401064  |.  6A 01       PUSH 1                                  ; /TimerID = 1
00401066  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401069  |.  E8 CA010000 CALL <JMP.&user32.KillTimer>          ; \KillTimer
0040106E  |.  6A 00       PUSH 0                                  ; /Result = 0
00401070  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
00401073  |.  E8 AE010000 CALL <JMP.&user32.EndDialog>          ; \EndDialog
00401078  |.  EB 0C       JMP SHORT xjb.00401086
0040107A  |>  B8 00000000 MOV EAX,0
0040107F  |.  5E          POP ESI
00401080  |.  5F          POP EDI
00401081  |.  5B          POP EBX
00401082  |.  C9          LEAVE
00401083  |.  C2 1000    RETN 10
00401086  |>  B8 01000000 MOV EAX,1
0040108B  |.  5E          POP ESI
0040108C  |.  5F          POP EDI
0040108D  |.  5B          POP EBX
0040108E  |.  C9          LEAVE
0040108F  \.  C2 1000    RETN 10
00401092 >/$  6A 00       PUSH 0                                  ; /pModule = NULL
00401094  |.  E8 6F010000 CALL <JMP.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
00401099  |.  A3 F8304000 MOV DWORD PTR DS:[4030F8],EAX
0040109E  |.  68 00304000 PUSH xjb.00403000                      ; /Title = "请输入个人信息"
004010A3  |.  6A 00       PUSH 0                                  ; |Class = 0
004010A5  |.  E8 82010000 CALL <JMP.&user32.FindWindowA>          ; \FindWindowA
004010AA  |.  0BC0       OR EAX,EAX
004010AC  |.  75 60       JNZ SHORT xjb.0040110E
004010AE  |.  68 0F304000 PUSH xjb.0040300F                      ; /Title = "个人金融柜台业务综合测评库存备用金面值配备方案"
004010B3  |.  6A 00       PUSH 0                                  ; |Class = 0
004010B5  |.  E8 72010000 CALL <JMP.&user32.FindWindowA>          ; \FindWindowA
004010BA  |.  0BC0       OR EAX,EAX
004010BC  |.  75 49       JNZ SHORT xjb.00401107
004010BE  |.  68 3E304000 PUSH xjb.0040303E                      ; /Title = "中国银行新一代零售系统 v4.0"
004010C3  |.  6A 00       PUSH 0                                  ; |Class = 0
004010C5  |.  E8 62010000 CALL <JMP.&user32.FindWindowA>          ; \FindWindowA
004010CA  |.  0BC0       OR EAX,EAX
004010CC  |.  75 32       JNZ SHORT xjb.00401100
004010CE  |.  68 5A304000 PUSH xjb.0040305A                      ; /Title = "库存余额"
004010D3  |.  6A 00       PUSH 0                                  ; |Class = 0
004010D5  |.  E8 52010000 CALL <JMP.&user32.FindWindowA>          ; \FindWindowA
004010DA  |.  0BC0       OR EAX,EAX
004010DC  |.  75 1B       JNZ SHORT xjb.004010F9
004010DE  |.  6A 00       PUSH 0                                  ; /lParam = NULL
004010E0  |.  68 00104000 PUSH xjb.00401000                      ; |DlgProc = xjb.00401000
004010E5  |.  6A 00       PUSH 0                                  ; |hOwner = NULL
004010E7  |.  68 E8030000 PUSH 3E8                               ; |pTemplate = 3E8
004010EC  |.  FF35 F8304000 PUSH DWORD PTR DS:[4030F8]             ; |hInst = NULL
004010F2  |.  E8 29010000 CALL <JMP.&user32.DialogBoxParamA>    ; \DialogBoxParamA
004010F7  |.  EB 1A       JMP SHORT xjb.00401113
004010F9  |>  A3 FC304000 MOV DWORD PTR DS:[4030FC],EAX
004010FE  |.  EB 13       JMP SHORT xjb.00401113
00401100  |>  A3 FC304000 MOV DWORD PTR DS:[4030FC],EAX
00401105  |.  EB 0C       JMP SHORT xjb.00401113
00401107  |>  A3 FC304000 MOV DWORD PTR DS:[4030FC],EAX
0040110C  |.  EB 05       JMP SHORT xjb.00401113
0040110E  |>  A3 FC304000 MOV DWORD PTR DS:[4030FC],EAX
00401113  |>  68 00314000 PUSH xjb.00403100                      ; /pProcessID = xjb.00403100
00401118  |.  FF35 FC304000 PUSH DWORD PTR DS:[4030FC]             ; |hWnd = NULL
0040111E  |.  E8 0F010000 CALL <JMP.&user32.GetWindowThreadProcess>; \GetWindowThreadProcessId
00401123  |.  FF35 00314000 PUSH DWORD PTR DS:[403100]             ; /ProcessId = 0
00401129  |.  6A 00       PUSH 0                                  ; |Inheritable = FALSE
0040112B  |.  68 FF0F1F00 PUSH 1F0FFF                            ; |Access = PROCESS_ALL_ACCESS
00401130  |.  E8 D9000000 CALL <JMP.&kernel32.OpenProcess>       ; \OpenProcess
00401135  |.  A3 04314000 MOV DWORD PTR DS:[403104],EAX
0040113A  |.  6A 00       PUSH 0                                  ; /pBytesRead = NULL
0040113C  |.  FF35 E9304000 PUSH DWORD PTR DS:[4030E9]             ; |BytesToRead = 1
00401142  |.  68 08314000 PUSH xjb.00403108                      ; |Buffer = xjb.00403108
00401147  |.  FF35 D9304000 PUSH DWORD PTR DS:[4030D9]             ; |pBaseAddress = 5A8369
0040114D  |.  FF35 04314000 PUSH DWORD PTR DS:[403104]             ; |hProcess = NULL
00401153  |.  E8 BC000000 CALL <JMP.&kernel32.ReadProcessMemory> ; \ReadProcessMemory
00401158  |.  8D35 08314000 LEA ESI,DWORD PTR DS:[403108]
0040115E  |.  8D3D 75304000 LEA EDI,DWORD PTR DS:[403075]
00401164  |.  8B0D E9304000 MOV ECX,DWORD PTR DS:[4030E9]
0040116A  |.  F3:A6       REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>
0040116C  |.  75 7A       JNZ SHORT xjb.004011E8
0040116E  |.  6A 00       PUSH 0                                  ; /pBytesWritten = NULL
00401170  |.  FF35 ED304000 PUSH DWORD PTR DS:[4030ED]             ; |BytesToWrite = 1F (31.)
00401176  |.  68 76304000 PUSH xjb.00403076                      ; |Buffer = xjb.00403076
0040117B  |.  FF35 D9304000 PUSH DWORD PTR DS:[4030D9]             ; |Address = 5A8369
00401181  |.  FF35 04314000 PUSH DWORD PTR DS:[403104]             ; |hProcess = NULL
00401187  |.  E8 8E000000 CALL <JMP.&kernel32.WriteProcessMemory>  ; \WriteProcessMemory
0040118C  |.  6A 00       PUSH 0                                  ; /pBytesWritten = NULL
0040118E  |.  FF35 ED304000 PUSH DWORD PTR DS:[4030ED]             ; |BytesToWrite = 1F (31.)
00401194  |.  68 95304000 PUSH xjb.00403095                      ; |Buffer = xjb.00403095
00401199  |.  FF35 DD304000 PUSH DWORD PTR DS:[4030DD]             ; |Address = 5A8388
0040119F  |.  FF35 04314000 PUSH DWORD PTR DS:[403104]             ; |hProcess = NULL
004011A5  |.  E8 70000000 CALL <JMP.&kernel32.WriteProcessMemory>  ; \WriteProcessMemory
004011AA  |.  6A 00       PUSH 0                                  ; /pBytesWritten = NULL
004011AC  |.  FF35 ED304000 PUSH DWORD PTR DS:[4030ED]             ; |BytesToWrite = 1F (31.)
004011B2  |.  68 B4304000 PUSH xjb.004030B4                      ; |Buffer = xjb.004030B4
004011B7  |.  FF35 E1304000 PUSH DWORD PTR DS:[4030E1]             ; |Address = 5A8480
004011BD  |.  FF35 04314000 PUSH DWORD PTR DS:[403104]             ; |hProcess = NULL
004011C3  |.  E8 52000000 CALL <JMP.&kernel32.WriteProcessMemory>  ; \WriteProcessMemory
004011C8  |.  6A 00       PUSH 0                                  ; /pBytesWritten = NULL
004011CA  |.  FF35 F1304000 PUSH DWORD PTR DS:[4030F1]             ; |BytesToWrite = 6
004011D0  |.  68 D3304000 PUSH xjb.004030D3                      ; |Buffer = xjb.004030D3
004011D5  |.  FF35 E5304000 PUSH DWORD PTR DS:[4030E5]             ; |Address = 452889
004011DB  |.  FF35 04314000 PUSH DWORD PTR DS:[403104]             ; |hProcess = NULL
004011E1  |.  E8 34000000 CALL <JMP.&kernel32.WriteProcessMemory>  ; \WriteProcessMemory
004011E6  |.  EB 13       JMP SHORT xjb.004011FB
004011E8  |>  6A 00       PUSH 0                                  ; /Style = MB_OK|MB_APPLMODAL
004011EA  |.  68 63304000 PUSH xjb.00403063                      ; |Title = "系统信息"
004011EF  |.  68 6C304000 PUSH xjb.0040306C                      ; |Text = "非法操作"
004011F4  |.  6A 00       PUSH 0                                  ; |hOwner = NULL
004011F6  |.  E8 43000000 CALL <JMP.&user32.MessageBoxA>          ; \MessageBoxA
004011FB  |>  6A 00       PUSH 0                                  ; /ExitCode = 0
004011FD  \.  E8 00000000 CALL <JMP.&kernel32.ExitProcess>       ; \ExitProcess
00401202 .- FF25 10204000 JMP DWORD PTR DS:[<&kernel32.ExitProcess>;  kernel32.ExitProcess
00401208 $- FF25 00204000 JMP DWORD PTR DS:[<&kernel32.GetModuleHa>;  kernel32.GetModuleHandleA
0040120E $- FF25 04204000 JMP DWORD PTR DS:[<&kernel32.OpenProcess>;  kernel32.OpenProcess
00401214 $- FF25 08204000 JMP DWORD PTR DS:[<&kernel32.ReadProcess>;  kernel32.ReadProcessMemory
0040121A $- FF25 0C204000 JMP DWORD PTR DS:[<&kernel32.WriteProces>;  kernel32.WriteProcessMemory
00401220 $- FF25 18204000 JMP DWORD PTR DS:[<&user32.DialogBoxPara>;  user32.DialogBoxParamA
00401226 $- FF25 1C204000 JMP DWORD PTR DS:[<&user32.EndDialog>] ;  user32.EndDialog
0040122C $- FF25 20204000 JMP DWORD PTR DS:[<&user32.FindWindowA>] ;  user32.FindWindowA
00401232 $- FF25 24204000 JMP DWORD PTR DS:[<&user32.GetWindowThre>;  user32.GetWindowThreadProcessId
00401238 $- FF25 28204000 JMP DWORD PTR DS:[<&user32.KillTimer>] ;  user32.KillTimer
0040123E $- FF25 2C204000 JMP DWORD PTR DS:[<&user32.MessageBoxA>] ;  user32.MessageBoxA
00401244 $- FF25 30204000 JMP DWORD PTR DS:[<&user32.SetTimer>] ;  user32.SetTimer
0040124A $- FF25 34204000 JMP DWORD PTR DS:[<&user32.ShowWindow>]  ;  user32.ShowWindow

[课程]Android-CTF解题方法汇总！

收藏・0

免费・0

支持

最新回复 (5)
bobylove 雪币： 4 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 21 回帖 169 粉丝 0 关注私信	bobylove 2 楼很简单呀.我都改好了 2008-3-29 20:27 0
starswwz 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 12 粉丝 0 关注私信	starswwz 3 楼是怎么改的啊，高手，能帮助我吗？谢谢 2008-3-29 21:01 0
bobylove 雪币： 4 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 21 回帖 169 粉丝 0 关注私信	bobylove 4 楼程序发给我....... 2008-3-29 21:47 0
starswwz 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 12 粉丝 0 关注私信	starswwz 5 楼有信箱吗？我有信箱吗？我 2008-3-30 20:09 0
starswwz 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 12 粉丝 0 关注私信	starswwz 6 楼？？？？？？？？？？？？？？？？ 2008-4-1 17:51 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

starswwz

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (5)
bobylove 雪币： 4 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 21 回帖 169 粉丝 0 关注私信	bobylove 2 楼很简单呀.我都改好了 2008-3-29 20:27 0
starswwz 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 12 粉丝 0 关注私信	starswwz 3 楼是怎么改的啊，高手，能帮助我吗？谢谢 2008-3-29 21:01 0
bobylove 雪币： 4 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 21 回帖 169 粉丝 0 关注私信	bobylove 4 楼程序发给我....... 2008-3-29 21:47 0
starswwz 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 12 粉丝 0 关注私信	starswwz 5 楼有信箱吗？我有信箱吗？我 2008-3-30 20:09 0
starswwz 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 12 粉丝 0 关注私信	starswwz 6 楼？？？？？？？？？？？？？？？？ 2008-4-1 17:51 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复