我的破文。。。。。
好多东西不是很清楚。。。。
希望小鸟。。老鸟。。。就不奢望牛人了。。
帮助帮助我。。。完成这篇文章不理解的地方
谢谢了～～～～～
004502B4 /. 55 push ebp
004502B5 |. 8BEC mov ebp, esp
004502B7 |. 33C9 xor ecx, ecx
004502B9 |. 51 push ecx
004502BA |. 51 push ecx
004502BB |. 51 push ecx
004502BC |. 51 push ecx
004502BD |. 51 push ecx
004502BE |. 51 push ecx
004502BF |. 51 push ecx
004502C0 |. 53 push ebx
004502C1 |. 56 push esi
004502C2 |. 57 push edi
004502C3 |. 8BF0 mov esi, eax
004502C5 |. 33C0 xor eax, eax
004502C7 |. 55 push ebp
004502C8 |. 68 18044500 push 00450418
004502CD |. 64:FF30 push dword ptr fs:[eax]
004502D0 |. 64:8920 mov dword ptr fs:[eax], esp
004502D3 |. 8D55 F4 lea edx, dword ptr [ebp-C]
004502D6 |. 8B86 F8020000 mov eax, dword ptr [esi+2F8]
004502DC |. E8 17F2FDFF call 0042F4F8 ; 得到注册名
004502E1 |. 837D F4 00 cmp dword ptr [ebp-C], 0 ; 是否为零
004502E5 |. 75 1E jnz short 00450305 ; 不是就跳
004502E7 |. 6A 30 push 30
004502E9 |. 68 28044500 push 00450428 ; error:
004502EE |. 68 30044500 push 00450430 ; 请输入用户名和序列号！
004502F3 |. 8BC6 mov eax, esi
004502F5 |. E8 7258FEFF call 00435B6C
004502FA |. 50 push eax ; |hOwner
004502FB |. E8 3C6AFBFF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00450300 |. E9 DB000000 jmp 004503E0
00450305 |> 8D55 F0 lea edx, dword ptr [ebp-10]
00450308 |. 8B86 F8020000 mov eax, dword ptr [esi+2F8]
0045030E |. E8 E5F1FDFF call 0042F4F8 ; 再次CALL用户名
00450313 |. 8B45 F0 mov eax, dword ptr [ebp-10] ; 将用户名放入EAX中
00450316 |. E8 A941FBFF call 004044C4
0045031B |. 83F8 04 cmp eax, 4 ; 判断用户名是否大于4个字符
0045031E |. 7D 1E jge short 0045033E ; 大于就跳
00450320 |. 6A 30 push 30
00450322 |. 68 28044500 push 00450428 ; error:
00450327 |. 68 48044500 push 00450448 ; 用户名至少四个字符！
0045032C |. 8BC6 mov eax, esi
0045032E |. E8 3958FEFF call 00435B6C
00450333 |. 50 push eax ; |hOwner
00450334 |. E8 036AFBFF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00450339 |. E9 A2000000 jmp 004503E0
0045033E |> 8D55 F8 lea edx, dword ptr [ebp-8] ; 取地址。。放入EDX中。。。不知道放了什么
00450341 |. 8B86 F8020000 mov eax, dword ptr [esi+2F8] ; 不知道什么意思
00450347 |. E8 ACF1FDFF call 0042F4F8 ; CALL用户名
0045034C |. 8D55 EC lea edx, dword ptr [ebp-14] ; 上面是8。。。这里是14。。。不懂
0045034F |. 8B86 F8020000 mov eax, dword ptr [esi+2F8]
00450355 |. E8 9EF1FDFF call 0042F4F8 ; CALL用户名
0045035A |. 8B45 EC mov eax, dword ptr [ebp-14]
0045035D |. E8 6241FBFF call 004044C4 ; 这个是个判断CALL。。上面00450316也用到它
00450362 |. 8BD8 mov ebx, eax ; EBX是什么？？
00450364 |. 85DB test ebx, ebx
00450366 |. 7E 29 jle short 00450391 ; 没跳
00450368 |. BF 01000000 mov edi, 1 ; 1放入EDI
0045036D |> 8B45 F8 /mov eax, dword ptr [ebp-8] ; EBP-8中放的是用户名。。8个字符。。。终于明白了
00450370 |. 0FB64438 FF |movzx eax, byte ptr [eax+edi-1] ; 以字节方式传送字符串？？？
00450375 |. 8D4D E8 |lea ecx, dword ptr [ebp-18] ; 这里是什么？？
00450378 |. BA 02000000 |mov edx, 2 ; 将2放入EDI。。。难道要逐位比较？？
0045037D |. E8 8E7FFBFF |call 00408310
00450382 |. 8B55 E8 |mov edx, dword ptr [ebp-18] ; 堆栈出现、、、73
00450385 |. 8D45 FC |lea eax, dword ptr [ebp-4]
00450388 |. E8 3F41FBFF |call 004044CC ; 看不懂
0045038D |. 47 |inc edi ; EDI加1
0045038E |. 4B |dec ebx ; EBX减1
0045038F |.^ 75 DC \jnz short 0045036D ; 回跳，，，循环
00450391 |> 8D55 E4 lea edx, dword ptr [ebp-1C] ; 我F4到这里。。堆栈出现73756E6B6A323031
00450394 |. 8B86 00030000 mov eax, dword ptr [esi+300] ; 将什么东西放到EAX中
0045039A |. E8 59F1FDFF call 0042F4F8 ; 这里原来放注册码
0045039F |. 8B45 E4 mov eax, dword ptr [ebp-1C] ; 因为这里出现了注册码
004503A2 |. 8B55 FC mov edx, dword ptr [ebp-4] ; 将真的注册码放到EDX中。。怎么是-4呢？？好多字符呀
004503A5 |. E8 5E42FBFF call 00404608 ; 传说中的关键CALL
004503AA |. 75 1B jnz short 004503C7 ; 关键跳
004503AC |. 6A 40 push 40
004503AE |. 68 60044500 push 00450460 ; ok:
004503B3 |. 68 64044500 push 00450464 ; 恭喜你，注册成功！
004503B8 |. 8BC6 mov eax, esi
004503BA |. E8 AD57FEFF call 00435B6C
004503BF |. 50 push eax ; |hOwner
004503C0 |. E8 7769FBFF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004503C5 |. EB 19 jmp short 004503E0
004503C7 |> 6A 30 push 30
004503C9 |. 68 28044500 push 00450428 ; error:
004503CE |. 68 78044500 push 00450478 ; 序列号不对呀，请再试试！
004503D3 |. 8BC6 mov eax, esi
004503D5 |. E8 9257FEFF call 00435B6C
004503DA |. 50 push eax ; |hOwner
004503DB |. E8 5C69FBFF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
004503E0 |> 33C0 xor eax, eax
004503E2 |. 5A pop edx
004503E3 |. 59 pop ecx
004503E4 |. 59 pop ecx
004503E5 |. 64:8910 mov dword ptr fs:[eax], edx
004503E8 |. 68 1F044500 push 0045041F
004503ED |> 8D45 E4 lea eax, dword ptr [ebp-1C]
004503F0 |. E8 173EFBFF call 0040420C
004503F5 |. 8D45 E8 lea eax, dword ptr [ebp-18]
004503F8 |. E8 0F3EFBFF call 0040420C
004503FD |> 8D45 EC lea eax, dword ptr [ebp-14]
00450400 |. BA 03000000 mov edx, 3
00450405 |. E8 263EFBFF call 00404230
0045040A |> 8D45 F8 lea eax, dword ptr [ebp-8]
0045040D |. BA 02000000 mov edx, 2
00450412 |. E8 193EFBFF call 00404230
00450417 \. C3 retn
[课程]Android-CTF解题方法汇总！
