-
-
[旧帖] [求助]新手问题,请兄弟们帮我确认一下思路是否正确! 0.00雪花
-
发表于: 2008-8-22 09:03 4197
-
在分析爆破一个Borland Delphi 4.0 - 5.0程序的时候,发现新版本比老版(此软件需要Rock4狗)多了个注册项,似乎需要注册才能正常使用。新版跟老版一样爆掉关键跳后,已经可以正常启动,但总觉得可能会有暗桩,找来找去也没弄明白。
现有两个疑问如下:
1、哪个才是注册关键CALL?
现有两个疑问如下:
1、哪个才是注册关键CALL?
00895E5F |. E8 542FB7FF call <jmp.&kernel32.LoadLibraryA> ; \LoadLibraryA 00895E64 |. 8B15 3C2E8E00 mov edx, dword ptr [8E2E3C] ; TSMedPF_.008F11B4 00895E6A |. 8902 mov dword ptr [edx], eax 00895E6C |. 833B 00 cmp dword ptr [ebx], 0 00895E6F |. 75 12 jnz short TSMedPF_.00895E83 00895E71 |. 8BCF mov ecx, edi 00895E73 |. B2 01 mov dl, 1 00895E75 |. A1 A8F68B00 mov eax, dword ptr [8BF6A8] 00895E7A |. E8 C1AE0200 call TSMedPF_.008C0D40 00895E7F |. 8903 mov dword ptr [ebx], eax 00895E81 |. EB 0A jmp short TSMedPF_.00895E8D 00895E83 |> 8B03 mov eax, dword ptr [ebx] 00895E85 |. 8B40 24 mov eax, dword ptr [eax+24] 00895E88 |. E8 43A60200 call TSMedPF_.008C04D0 00895E8D |> 8B03 mov eax, dword ptr [ebx] 00895E8F |. 8B70 24 mov esi, dword ptr [eax+24] 00895E92 |. C686 AE040000>mov byte ptr [esi+4AE], 0 00895E99 |. C686 AF040000>mov byte ptr [esi+4AF], 2 00895EA0 |. C686 B0040000>mov byte ptr [esi+4B0], 0 00895EA7 |. 8BC6 mov eax, esi 00895EA9 |. 66:BA 1000 mov dx, 10 00895EAD |. E8 5A9F0200 call TSMedPF_.008BFE0C 00895EB2 |. 84C0 test al, al 00895EB4 0F85 CB000000 jnz TSMedPF_.00895F85 //爆破 时的关键跳 JMP 00895EBA |. 8B03 mov eax, dword ptr [ebx] 00895EBC |. 8B40 24 mov eax, dword ptr [eax+24] 00895EBF |. C680 AE040000>mov byte ptr [eax+4AE], 1 00895EC6 |. C680 AF040000>mov byte ptr [eax+4AF], 1 00895ECD |. A1 30318E00 mov eax, dword ptr [8E3130] 00895ED2 |. 33D2 xor edx, edx 00895ED4 |. 8910 mov dword ptr [eax], edx 00895ED6 |. 8B03 mov eax, dword ptr [ebx] 00895ED8 |. 8B40 24 mov eax, dword ptr [eax+24] 00895EDB |. 80B8 AF040000>cmp byte ptr [eax+4AF], 2 00895EE2 |. 74 3A je short TSMedPF_.00895F1E 00895EE4 |. A1 202C8E00 mov eax, dword ptr [8E2C20] 00895EE9 |. 8338 00 cmp dword ptr [eax], 0 00895EEC |. 76 30 jbe short TSMedPF_.00895F1E 00895EEE |. 8D4D F4 lea ecx, dword ptr [ebp-C] 00895EF1 |. BA 70638900 mov edx, TSMedPF_.00896370 00895EF6 |. B8 84638900 mov eax, TSMedPF_.00896384 ; menu 00895EFB |. E8 FC9C0200 call TSMedPF_.008BFBFC 00895F00 |. 8B45 F4 mov eax, dword ptr [ebp-C] 00895F03 |. E8 6CE7B6FF call TSMedPF_.00404674 00895F08 |. 50 push eax ; /ProcNameOrOrdinal 00895F09 |. A1 202C8E00 mov eax, dword ptr [8E2C20] ; | 00895F0E |. 8B00 mov eax, dword ptr [eax] ; | 00895F10 |. 50 push eax ; |hModule 00895F11 |. E8 DA2DB7FF call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress 00895F16 |. 8B15 BC318E00 mov edx, dword ptr [8E31BC] ; TSMedPF_.008F11AC 00895F1C |. 8902 mov dword ptr [edx], eax 00895F1E |> 8B03 mov eax, dword ptr [ebx] 00895F20 |. 8B70 24 mov esi, dword ptr [eax+24] 00895F23 |. 80BE AF040000>cmp byte ptr [esi+4AF], 2 00895F2A |. 74 0F je short TSMedPF_.00895F3B 00895F2C |. 8BC6 mov eax, esi 00895F2E |. 66:BA 0900 mov dx, 9 00895F32 |. E8 D59E0200 call TSMedPF_.008BFE0C 00895F37 |. 84C0 test al, al 00895F39 |. 75 4A jnz short TSMedPF_.00895F85 00895F3B |> A1 382F8E00 mov eax, dword ptr [8E2F38] 00895F40 |. 8B00 mov eax, dword ptr [eax] 00895F42 |. C640 4B 00 mov byte ptr [eax+4B], 0 00895F46 |. 8D4D EC lea ecx, dword ptr [ebp-14] 00895F49 |. BA 94638900 mov edx, TSMedPF_.00896394 00895F4E |. B8 B8638900 mov eax, TSMedPF_.008963B8 ; frmmain 00895F53 |. E8 A49C0200 call TSMedPF_.008BFBFC 00895F58 |. FF75 EC push dword ptr [ebp-14] 00895F5B |. 68 C8638900 push TSMedPF_.008963C8 ; \n 00895F60 |. 8B03 mov eax, dword ptr [ebx] 00895F62 |. 8B40 24 mov eax, dword ptr [eax+24] 00895F65 |. FFB0 C4040000 push dword ptr [eax+4C4] 00895F6B |. 8D45 F0 lea eax, dword ptr [ebp-10] 00895F6E |. BA 03000000 mov edx, 3 00895F73 |. E8 F8E5B6FF call TSMedPF_.00404570 00895F78 |. 8B45 F0 mov eax, dword ptr [ebp-10] 00895F7B |. BA 88130000 mov edx, 1388 00895F80 |. E8 CB2AD5FF call TSMedPF_.005E8A50 00895F85 |> 8B03 mov eax, dword ptr [ebx] 00895F87 |. 8B40 24 mov eax, dword ptr [eax+24] 00895F8A |. 66:BA 4301 mov dx, 143 00895F8E |. E8 F1A00200 call TSMedPF_.008C0084 00895F93 |. 84C0 test al, al 00895F95 0F85 03010000 jnz TSMedPF_.0089609E //关键跳 00895F9B |. 8B03 mov eax, dword ptr [ebx] 00895F9D |. 8B40 24 mov eax, dword ptr [eax+24] 00895FA0 |. E8 2BA50200 call TSMedPF_.008C04D0 00895FA5 |. 8B03 mov eax, dword ptr [ebx] 00895FA7 |. 8B40 24 mov eax, dword ptr [eax+24] 00895FAA |. C680 AF040000>mov byte ptr [eax+4AF], 1 00895FB1 |. 8A90 AC040000 mov dl, byte ptr [eax+4AC] 00895FB7 |. 80EA 01 sub dl, 1 00895FBA |. 74 07 je short TSMedPF_.00895FC3 00895FBC |. C680 AF040000>mov byte ptr [eax+4AF], 2 00895FC3 |> 8B03 mov eax, dword ptr [ebx] 00895FC5 |. 8B40 24 mov eax, dword ptr [eax+24] 00895FC8 |. C680 AE040000>mov byte ptr [eax+4AE], 1 00895FCF |. A1 30318E00 mov eax, dword ptr [8E3130] 00895FD4 |. 33D2 xor edx, edx 00895FD6 |. 8910 mov dword ptr [eax], edx 00895FD8 |. 8B03 mov eax, dword ptr [ebx] 00895FDA |. 8B40 24 mov eax, dword ptr [eax+24] 00895FDD |. 80B8 AF040000>cmp byte ptr [eax+4AF], 2 00895FE4 |. 74 3A je short TSMedPF_.00896020 00895FE6 |. A1 202C8E00 mov eax, dword ptr [8E2C20] 00895FEB |. 8338 00 cmp dword ptr [eax], 0 00895FEE |. 76 30 jbe short TSMedPF_.00896020 00895FF0 |. 8D4D E8 lea ecx, dword ptr [ebp-18] 00895FF3 |. BA 70638900 mov edx, TSMedPF_.00896370 00895FF8 |. B8 84638900 mov eax, TSMedPF_.00896384 ; menu 00895FFD |. E8 FA9B0200 call TSMedPF_.008BFBFC 00896002 |. 8B45 E8 mov eax, dword ptr [ebp-18] 00896005 |. E8 6AE6B6FF call TSMedPF_.00404674 0089600A |. 50 push eax ; /ProcNameOrOrdinal 0089600B |. A1 202C8E00 mov eax, dword ptr [8E2C20] ; | 00896010 |. 8B00 mov eax, dword ptr [eax] ; | 00896012 |. 50 push eax ; |hModule 00896013 |. E8 D82CB7FF call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress 00896018 |. 8B15 BC318E00 mov edx, dword ptr [8E31BC] ; TSMedPF_.008F11AC 0089601E |. 8902 mov dword ptr [edx], eax 00896020 |> 8B03 mov eax, dword ptr [ebx] 00896022 |. 8B70 24 mov esi, dword ptr [eax+24] 00896025 |. 80BE AF040000>cmp byte ptr [esi+4AF], 2 0089602C |. 74 21 je short TSMedPF_.0089604F 0089602E |. 8BC6 mov eax, esi 00896030 |. 66:BA 3600 mov dx, 36 00896034 |. E8 D39D0200 call TSMedPF_.008BFE0C 00896039 |. 84C0 test al, al 0089603B |. 74 12 je short TSMedPF_.0089604F 0089603D |. 8B03 mov eax, dword ptr [ebx] 0089603F |. 8B40 24 mov eax, dword ptr [eax+24] 00896042 |. 66:BA 5E03 mov dx, 35E 00896046 |. E8 39A00200 call TSMedPF_.008C0084 0089604B |. 84C0 test al, al 0089604D |. 75 4F jnz short TSMedPF_.0089609E 0089604F |> A1 382F8E00 mov eax, dword ptr [8E2F38] 00896054 |. 8B00 mov eax, dword ptr [eax] 00896056 |. C640 4B 00 mov byte ptr [eax+4B], 0 0089605A |. 8D4D E0 lea ecx, dword ptr [ebp-20] 0089605D |. BA 94638900 mov edx, TSMedPF_.00896394 00896062 |. B8 B8638900 mov eax, TSMedPF_.008963B8 ; frmmain 00896067 |. E8 909B0200 call TSMedPF_.008BFBFC 0089606C |. FF75 E0 push dword ptr [ebp-20] 0089606F |. 68 C8638900 push TSMedPF_.008963C8 ; \n 00896074 |. 8B03 mov eax, dword ptr [ebx] 00896076 |. 8B40 24 mov eax, dword ptr [eax+24] 00896079 |. FFB0 C4040000 push dword ptr [eax+4C4] 0089607F |. 8D45 E4 lea eax, dword ptr [ebp-1C] 00896082 |. BA 03000000 mov edx, 3 00896087 |. E8 E4E4B6FF call TSMedPF_.00404570 0089608C |. 8B45 E4 mov eax, dword ptr [ebp-1C] 0089608F |. BA 88130000 mov edx, 1388 00896094 |. E8 B729D5FF call TSMedPF_.005E8A50 00896099 |. E9 63020000 jmp TSMedPF_.00896301 0089609E |> A1 D0318E00 mov eax, dword ptr [8E31D0] 008960A3 |. 8B15 A82D8E00 mov edx, dword ptr [8E2DA8] ; TSMedPF_.008E269C 008960A9 |. 8B0A mov ecx, dword ptr [edx] 008960AB |. 8908 mov dword ptr [eax], ecx 008960AD |. 8B4A 04 mov ecx, dword ptr [edx+4] 008960B0 |. 8948 04 mov dword ptr [eax+4], ecx 008960B3 |. 8B03 mov eax, dword ptr [ebx] 008960B5 |. 8B40 24 mov eax, dword ptr [eax+24] 008960B8 |. 33D2 xor edx, edx 008960BA |. E8 BDA40200 call TSMedPF_.008C057C 008960BF |. 84C0 test al, al 008960C1 0F85 55010000 jnz TSMedPF_.0089621C //关键跳 008960C7 |. 8B13 mov edx, dword ptr [ebx] 008960C9 |. 8B42 24 mov eax, dword ptr [edx+24] 008960CC |. 80B8 AF040000>cmp byte ptr [eax+4AF], 2 008960D3 |. 0F85 F4000000 jnz TSMedPF_.008961CD 008960D9 |. A1 30318E00 mov eax, dword ptr [8E3130] 008960DE |. 33C9 xor ecx, ecx 008960E0 |. 8908 mov dword ptr [eax], ecx 008960E2 |. 8B42 24 mov eax, dword ptr [edx+24] 008960E5 |. C680 AF040000>mov byte ptr [eax+4AF], 1 008960EC |. C680 B0040000>mov byte ptr [eax+4B0], 9 008960F3 |. C680 AE040000>mov byte ptr [eax+4AE], 1 008960FA |. C680 AF040000>mov byte ptr [eax+4AF], 1 00896101 |. 8B03 mov eax, dword ptr [ebx] 00896103 |. 8B40 24 mov eax, dword ptr [eax+24] 00896106 |. 80B8 AF040000>cmp byte ptr [eax+4AF], 2 0089610D |. 74 3A je short TSMedPF_.00896149 0089610F |. A1 202C8E00 mov eax, dword ptr [8E2C20] 00896114 |. 8338 00 cmp dword ptr [eax], 0 00896117 |. 76 30 jbe short TSMedPF_.00896149 00896119 |. 8D4D DC lea ecx, dword ptr [ebp-24] 0089611C |. BA 70638900 mov edx, TSMedPF_.00896370 00896121 |. B8 84638900 mov eax, TSMedPF_.00896384 ; menu 00896126 |. E8 D19A0200 call TSMedPF_.008BFBFC 0089612B |. 8B45 DC mov eax, dword ptr [ebp-24] 0089612E |. E8 41E5B6FF call TSMedPF_.00404674 00896133 |. 50 push eax ; /ProcNameOrOrdinal 00896134 |. A1 202C8E00 mov eax, dword ptr [8E2C20] ; | 00896139 |. 8B00 mov eax, dword ptr [eax] ; | 0089613B |. 50 push eax ; |hModule 0089613C |. E8 AF2BB7FF call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress 00896141 |. 8B15 BC318E00 mov edx, dword ptr [8E31BC] ; TSMedPF_.008F11AC 00896147 |. 8902 mov dword ptr [edx], eax 00896149 |> 8B03 mov eax, dword ptr [ebx] 0089614B |. 8B40 24 mov eax, dword ptr [eax+24] 0089614E |. 66:BA 2400 mov dx, 24 00896152 |. E8 B59C0200 call TSMedPF_.008BFE0C 00896157 |. 84C0 test al, al 00896159 |. 74 26 je short TSMedPF_.00896181 0089615B |. 8B03 mov eax, dword ptr [ebx] 0089615D |. 8B40 24 mov eax, dword ptr [eax+24] 00896160 |. 66:BA 9F0C mov dx, 0C9F 00896164 |. E8 1B9F0200 call TSMedPF_.008C0084 00896169 |. 84C0 test al, al 0089616B |. 74 14 je short TSMedPF_.00896181 0089616D |. 8B03 mov eax, dword ptr [ebx] 0089616F |. 8B40 24 mov eax, dword ptr [eax+24] 00896172 |. E8 A1B00200 call TSMedPF_.008C1218 00896177 |. 66:83F8 02 cmp ax, 2 0089617B |. 0F83 9B000000 jnb TSMedPF_.0089621C 00896181 |> A1 382F8E00 mov eax, dword ptr [8E2F38] 00896186 |. 8B00 mov eax, dword ptr [eax] 00896188 |. C640 4B 00 mov byte ptr [eax+4B], 0 0089618C |. 8D4D D4 lea ecx, dword ptr [ebp-2C] 0089618F |. BA 94638900 mov edx, TSMedPF_.00896394 00896194 |. B8 B8638900 mov eax, TSMedPF_.008963B8 ; frmmain 00896199 |. E8 5E9A0200 call TSMedPF_.008BFBFC 0089619E |. FF75 D4 push dword ptr [ebp-2C] 008961A1 |. 68 C8638900 push TSMedPF_.008963C8 ; \n 008961A6 |. 8B03 mov eax, dword ptr [ebx] 008961A8 |. 8B40 24 mov eax, dword ptr [eax+24] 008961AB |. FFB0 C4040000 push dword ptr [eax+4C4] 008961B1 |. 8D45 D8 lea eax, dword ptr [ebp-28] 008961B4 |. BA 03000000 mov edx, 3 008961B9 |. E8 B2E3B6FF call TSMedPF_.00404570 008961BE |. 8B45 D8 mov eax, dword ptr [ebp-28] 008961C1 |. BA 88130000 mov edx, 1388 008961C6 |. E8 8528D5FF call TSMedPF_.005E8A50 008961CB |. EB 4F jmp short TSMedPF_.0089621C 008961CD |> A1 382F8E00 mov eax, dword ptr [8E2F38] 008961D2 |. 8B00 mov eax, dword ptr [eax] 008961D4 |. C640 4B 00 mov byte ptr [eax+4B], 0 008961D8 |. 8D4D CC lea ecx, dword ptr [ebp-34] 008961DB |. BA 94638900 mov edx, TSMedPF_.00896394 008961E0 |. B8 B8638900 mov eax, TSMedPF_.008963B8 ; frmmain 008961E5 |. E8 129A0200 call TSMedPF_.008BFBFC 008961EA |. FF75 CC push dword ptr [ebp-34] 008961ED |. 68 C8638900 push TSMedPF_.008963C8 ; \n 008961F2 |. 8B03 mov eax, dword ptr [ebx] 008961F4 |. 8B40 24 mov eax, dword ptr [eax+24] 008961F7 |. FFB0 C4040000 push dword ptr [eax+4C4] 008961FD |. 8D45 D0 lea eax, dword ptr [ebp-30] 00896200 |. BA 03000000 mov edx, 3 00896205 |. E8 66E3B6FF call TSMedPF_.00404570 0089620A |. 8B45 D0 mov eax, dword ptr [ebp-30] 0089620D |. BA 88130000 mov edx, 1388 00896212 |. E8 3928D5FF call TSMedPF_.005E8A50 00896217 |. E9 E5000000 jmp TSMedPF_.00896301 0089621C |> 8D55 C8 lea edx, dword ptr [ebp-38]
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
看原图
赞赏
雪币:
留言: