http://www.56xf.cn/DT_UploadSoft/超级转换秀.exe我找到按纽事件了,可怎么也找不到关键跳和成功的提示!004017A0 . 6A FF push -1
004017A2 . 68 00E74700 push 0.0047E700 ; SE handler installation
004017A7 . 64:A1 00000>mov eax,dword ptr fs:[0]
004017AD . 50 push eax
004017AE . 64:8925 000>mov dword ptr fs:[0],esp
004017B5 . 81EC 100B00>sub esp,0B10
004017BB . 53 push ebx
004017BC . 55 push ebp
004017BD . 56 push esi
004017BE . 57 push edi
004017BF . 8BE9 mov ebp,ecx
004017C1 . 6A 01 push 1
004017C3 . E8 18BE0700 call <jmp.&MFC42.#6334>
004017C8 . 68 D41A4B00 push 0.004B1AD4
004017CD . 8D4C24 1C lea ecx,dword ptr ss:[esp+1C]
004017D1 . E8 ECBD0700 call <jmp.&MFC42.#537>
004017D6 . 68 D41A4B00 push 0.004B1AD4
004017DB . 8D4C24 20 lea ecx,dword ptr ss:[esp+20]
004017DF . C78424 2C0B>mov dword ptr ss:[esp+B2C],0
004017EA . E8 D3BD0700 call <jmp.&MFC42.#537>
004017EF . 8DB5 800200>lea esi,dword ptr ss:[ebp+280]
004017F5 . 8D4424 18 lea eax,dword ptr ss:[esp+18]
004017F9 . 50 push eax
004017FA . 8BCE mov ecx,esi
004017FC . C68424 2C0B>mov byte ptr ss:[esp+B2C],1
00401804 . E8 D1BD0700 call <jmp.&MFC42.#3874>
00401809 . 8D4C24 1C lea ecx,dword ptr ss:[esp+1C]
0040180D . 51 push ecx
0040180E . 8D8D 380200>lea ecx,dword ptr ss:[ebp+238]
00401814 . E8 C1BD0700 call <jmp.&MFC42.#3874>
00401819 . 8B5424 18 mov edx,dword ptr ss:[esp+18]
0040181D . 8B42 F8 mov eax,dword ptr ds:[edx-8]
00401820 . 85C0 test eax,eax
00401822 . 0F84 BB0200>je 0.00401AE3
00401828 . 8B4424 1C mov eax,dword ptr ss:[esp+1C]
0040182C . 8B48 F8 mov ecx,dword ptr ds:[eax-8]
0040182F . 85C9 test ecx,ecx
00401831 . 0F84 AC0200>je 0.00401AE3
00401837 . 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040183B . E8 7CBD0700 call <jmp.&MFC42.#540>
00401840 . 66:8B0D D81>mov cx,word ptr ds:[4B1AD8]
00401847 . 33C0 xor eax,eax
00401849 . 66:894C24 2>mov word ptr ss:[esp+2C],cx
0040184E . B9 40000000 mov ecx,40
00401853 . 8D7C24 2E lea edi,dword ptr ss:[esp+2E]
00401857 . 8D5424 2C lea edx,dword ptr ss:[esp+2C]
0040185B . F3:AB rep stos dword ptr es:[edi]
0040185D . 68 04010000 push 104 ; /BufSize = 104 (260.)
00401862 . BB 02000000 mov ebx,2 ; |
00401867 . 52 push edx ; |PathBuffer
00401868 . 6A 00 push 0 ; |hModule = NULL
0040186A . 889C24 340B>mov byte ptr ss:[esp+B34],bl ; |
00401871 . 66:AB stos word ptr es:[edi] ; |
00401873 . FF15 B00149>call dword ptr ds:[<&KERNEL32.GetM>; \GetModuleFileNameA
00401879 . 8D4424 2C lea eax,dword ptr ss:[esp+2C]
0040187D . 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
00401881 . 50 push eax
00401882 . E8 2FBD0700 call <jmp.&MFC42.#860>
00401887 . 83CF FF or edi,FFFFFFFF
0040188A . 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0040188E . 57 push edi
0040188F . E8 1CBD0700 call <jmp.&MFC42.#5572>
00401894 . 6A 5C push 5C
00401896 . 8D4C24 14 lea ecx,dword ptr ss:[esp+14]
0040189A . E8 0BBD0700 call <jmp.&MFC42.#5683>
0040189F . 8D4C24 28 lea ecx,dword ptr ss:[esp+28]
004018A3 . 50 push eax
004018A4 . 51 push ecx
004018A5 . 8D4C24 18 lea ecx,dword ptr ss:[esp+18]
004018A9 . E8 F6BC0700 call <jmp.&MFC42.#4129>
004018AE . 50 push eax
004018AF . 8D4C24 14 lea ecx,dword ptr ss:[esp+14]
004018B3 . C68424 2C0B>mov byte ptr ss:[esp+B2C],3
004018BB . E8 DEBC0700 call <jmp.&MFC42.#858>
004018C0 . 8D4C24 28 lea ecx,dword ptr ss:[esp+28]
004018C4 . 889C24 280B>mov byte ptr ss:[esp+B28],bl
004018CB . E8 C8BC0700 call <jmp.&MFC42.#800>
004018D0 . 8D4C24 20 lea ecx,dword ptr ss:[esp+20]
004018D4 . E8 E3BC0700 call <jmp.&MFC42.#540>
004018D9 . 8D4C24 24 lea ecx,dword ptr ss:[esp+24]
004018DD . C68424 280B>mov byte ptr ss:[esp+B28],4
004018E5 . E8 D2BC0700 call <jmp.&MFC42.#540>
004018EA . 8D5424 20 lea edx,dword ptr ss:[esp+20]
004018EE . 8BCE mov ecx,esi
004018F0 . 52 push edx
004018F1 . C68424 2C0B>mov byte ptr ss:[esp+B2C],5
004018F9 . E8 DCBC0700 call <jmp.&MFC42.#3874>
004018FE . 8D4424 20 lea eax,dword ptr ss:[esp+20]
00401902 . 8D4C24 24 lea ecx,dword ptr ss:[esp+24]
00401906 . 50 push eax
00401907 . E8 92BC0700 call <jmp.&MFC42.#858>
0040190C . 8D4C24 28 lea ecx,dword ptr ss:[esp+28]
00401910 . 6A 0A push 0A
00401912 . 51 push ecx
00401913 . 8D4C24 28 lea ecx,dword ptr ss:[esp+28]
00401917 . E8 B8BC0700 call <jmp.&MFC42.#4277>
0040191C . 8B00 mov eax,dword ptr ds:[eax]
0040191E . BE 74A34A00 mov esi,0.004AA374 ; ASCII "C6ZW"
00401923 > 8A10 mov dl,byte ptr ds:[eax]
00401925 . 8ACA mov cl,dl
00401927 . 3A16 cmp dl,byte ptr ds:[esi]
00401929 . 75 1A jnz short 0.00401945
0040192B . 84C9 test cl,cl
0040192D . 74 12 je short 0.00401941
0040192F . 8A50 01 mov dl,byte ptr ds:[eax+1]
00401932 . 8ACA mov cl,dl
00401934 . 3A56 01 cmp dl,byte ptr ds:[esi+1]
00401937 . 75 0C jnz short 0.00401945
00401939 . 03C3 add eax,ebx
0040193B . 03F3 add esi,ebx
0040193D . 84C9 test cl,cl
0040193F .^ 75 E2 jnz short 0.00401923
00401941 > 33C0 xor eax,eax
00401943 . EB 04 jmp short 0.00401949
00401945 > 1BC0 sbb eax,eax
00401947 . 1BC7 sbb eax,edi
00401949 > 85C0 test eax,eax
0040194B . 8D4C24 28 lea ecx,dword ptr ss:[esp+28]
0040194F . 0F944424 17 sete byte ptr ss:[esp+17]
00401954 . E8 3FBC0700 call <jmp.&MFC42.#800>
00401959 . 8A4424 17 mov al,byte ptr ss:[esp+17]
0040195D . 84C0 test al,al
0040195F . 74 30 je short 0.00401991
00401961 . 6A 40 push 40
00401963 . 68 68A34A00 push 0.004AA368
00401968 . 68 34A24A00 push 0.004AA234
0040196D . 8BCD mov ecx,ebp
0040196F . E8 5ABC0700 call <jmp.&MFC42.#4224>
00401974 . 6A 03 push 3 ; /IsShown = 3
00401976 . 6A 00 push 0 ; |DefDir = NULL
00401978 . 6A 00 push 0 ; |Parameters = NULL
0040197A . 68 08A24A00 push 0.004AA208 ; |FileName = "http://www.powerrsoft.com/cs/userlogin.asp"
0040197F . 68 00A24A00 push 0.004AA200 ; |Operation = "open"
00401984 . 6A 00 push 0 ; |hWnd = NULL
00401986 . FF15 600949>call dword ptr ds:[<&SHELL32.Shell>; \ShellExecuteA
0040198C . E9 06010000 jmp 0.00401A97
00401991 > 6A 41 push 41
00401993 . 68 68A34A00 push 0.004AA368
00401998 . 68 64A14A00 push 0.004AA164
0040199D . 8BCD mov ecx,ebp
0040199F . E8 2ABC0700 call <jmp.&MFC42.#4224>
004019A4 . 83F8 01 cmp eax,1
004019A7 . 0F85 EA0000>jnz 0.00401A97
004019AD . 6A 00 push 0
004019AF . 8D8C24 3401>lea ecx,dword ptr ss:[esp+134]
004019B6 . E8 05820300 call 0.00439BC0
004019BB . 8D8C24 3001>lea ecx,dword ptr ss:[esp+130]
004019C2 . C68424 280B>mov byte ptr ss:[esp+B28],26
004019CA . E8 67BA0700 call <jmp.&MFC42.#2514>
004019CF . 8D8C24 600A>lea ecx,dword ptr ss:[esp+A60]
004019D6 . C68424 280B>mov byte ptr ss:[esp+B28],2F
004019DE . E8 ADC70100 call 0.0041E190
004019E3 . 8D8C24 A009>lea ecx,dword ptr ss:[esp+9A0]
004019EA . C68424 280B>mov byte ptr ss:[esp+B28],2E
004019F2 . E8 99C70100 call 0.0041E190
004019F7 . 8D8C24 E008>lea ecx,dword ptr ss:[esp+8E0]
004019FE . C68424 280B>mov byte ptr ss:[esp+B28],2D
00401A06 . E8 85C70100 call 0.0041E190
00401A0B . 8D8C24 2008>lea ecx,dword ptr ss:[esp+820]
00401A12 . C68424 280B>mov byte ptr ss:[esp+B28],2C
00401A1A . E8 71C70100 call 0.0041E190
00401A1F . 8D8C24 7006>lea ecx,dword ptr ss:[esp+670]
00401A26 . C68424 280B>mov byte ptr ss:[esp+B28],2B
00401A2E . E8 7D950000 call 0.0040AFB0
00401A33 . 8D8C24 C004>lea ecx,dword ptr ss:[esp+4C0]
00401A3A . C68424 280B>mov byte ptr ss:[esp+B28],2A
00401A42 . E8 69950000 call 0.0040AFB0
00401A47 . 8D8C24 1003>lea ecx,dword ptr ss:[esp+310]
00401A4E . C68424 280B>mov byte ptr ss:[esp+B28],29
00401A56 . E8 55950000 call 0.0040AFB0
00401A5B . 8D8C24 5002>lea ecx,dword ptr ss:[esp+250]
00401A62 . C68424 280B>mov byte ptr ss:[esp+B28],28
00401A6A . E8 21C70100 call 0.0041E190
00401A6F . 8D8C24 9001>lea ecx,dword ptr ss:[esp+190]
00401A76 . C68424 280B>mov byte ptr ss:[esp+B28],27
00401A7E . E8 0DC70100 call 0.0041E190
00401A83 . 8D8C24 3001>lea ecx,dword ptr ss:[esp+130]
00401A8A . C68424 280B>mov byte ptr ss:[esp+B28],5
00401A92 . E8 9BBA0700 call <jmp.&MFC42.#641>
00401A97 > 8D4C24 24 lea ecx,dword ptr ss:[esp+24]
00401A9B . C68424 280B>mov byte ptr ss:[esp+B28],4
00401AA3 . E8 F0BA0700 call <jmp.&MFC42.#800>
00401AA8 . 8D4C24 20 lea ecx,dword ptr ss:[esp+20]
00401AAC . 889C24 280B>mov byte ptr ss:[esp+B28],bl
00401AB3 . E8 E0BA0700 call <jmp.&MFC42.#800>
00401AB8 . 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
00401ABC . C68424 280B>mov byte ptr ss:[esp+B28],1
00401AC4 . E8 CFBA0700 call <jmp.&MFC42.#800>
00401AC9 . 8D4C24 1C lea ecx,dword ptr ss:[esp+1C]
00401ACD . C68424 280B>mov byte ptr ss:[esp+B28],0
00401AD5 . E8 BEBA0700 call <jmp.&MFC42.#800>
00401ADA . 89BC24 280B>mov dword ptr ss:[esp+B28],edi
00401AE1 . EB 2F jmp short 0.00401B12
00401AE3 > 6A 40 push 40
00401AE5 . 68 58A14A00 push 0.004AA158
00401AEA . 68 3CA14A00 push 0.004AA13C
00401AEF . 8BCD mov ecx,ebp
00401AF1 . E8 D8BA0700 call <jmp.&MFC42.#4224>
00401AF6 . 8D4C24 1C lea ecx,dword ptr ss:[esp+1C]
00401AFA . C68424 280B>mov byte ptr ss:[esp+B28],0
00401B02 . E8 91BA0700 call <jmp.&MFC42.#800>
00401B07 . C78424 280B>mov dword ptr ss:[esp+B28],-1
00401B12 > 8D4C24 18 lea ecx,dword ptr ss:[esp+18]
00401B16 . E8 7DBA0700 call <jmp.&MFC42.#800>
00401B1B . 8B8C24 200B>mov ecx,dword ptr ss:[esp+B20]
00401B22 . 5F pop edi
00401B23 . 5E pop esi
00401B24 . 5D pop ebp
00401B25 . 5B pop ebx
00401B26 . 64:890D 000>mov dword ptr fs:[0],ecx
00401B2D . 81C4 1C0B00>add esp,0B1C
00401B33 . C3 retn
[课程]FART 脱壳王！加量不加价！FART作者讲授！
