【文章标题】: zapline转的CM Texme的算法分析
【文章作者】: samisgod
【作者邮箱】: [email]21gh@163.com[/email]
【下载地址】: 附件
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
前两天简单看了下这个CM，没写文，今天补上
首先查找字符串来到这里
简单分析，可以知道403166==0x10为成功条件
而00401453处是个代码调度器，我们跟进
0040128D |> \3D 13010000 cmp eax,113
00401292 |. 75 50 jnz short 004012E4
00401294 |. E8 BA010000 call 00401453
00401299 |. 0FBE05 66314000 movsx eax,byte ptr [403166]
004012A0 |. 3A05 67314000 cmp al,byte ptr [403167]
004012A6 |. 75 06 jnz short 004012AE
004012A8 |. 33C0 xor eax,eax
004012AA |. C9 leave
004012AB |. C2 1000 retn 10
004012AE |> A2 67314000 mov byte ptr [403167],al
004012B3 |. 83F8 10 cmp eax,10
004012B6 |. 74 16 je short 004012CE
004012B8 |. 68 65304000 push 403065 ; /your serial is not valid.
004012BD |. FF35 7C314000 push dword ptr [40317C]
; |hWnd = 001500F0 ('Your serial is not valid.',class='Edit',parent=001200E0)
004012C3 |. E8 66020000 call 0040152E ; \SetWindowTextA
004012C8 |. 33C0 xor eax,eax
004012CA |. C9 leave
004012CB |. C2 1000 retn 10
004012CE |> 68 7F304000 push 40307F ; /yes! you found your serial!!
004012D3 |. FF35 7C314000 push dword ptr [40317C]
; |hWnd = 001500F0 ('Your serial is not valid.',class='Edit',parent=001200E0)
004012D9 |. E8 50020000 call 0040152E ; \SetWindowTextA
004012DE |. 33C0 xor eax,eax
004012E0 |. C9 leave
004012E1 |. C2 1000 retn 1000401453 /$ 55 push ebp
00401454 |. 8BEC mov ebp,esp
00401456 |. 83C4 FC add esp,-4
00401459 |. 8925 A0314000 mov dword ptr [4031A0],esp
0040145F |. 8D25 52314000 lea esp,dword ptr [403152]
00401465 |. 0FBE05 66314000 movsx eax,byte ptr [403166]
0040146C |. 03E0 add esp,eax
0040146E \. C3 retn
00403152 0040146F Chafe_1.0040146F
00403156 00401063 Chafe_1.00401063
0040315A 00401361 Chafe_1.00401361
0040315E 0040149C Chafe_1.0040149C
00403162 004014BA Chafe_1.004014BA
0040146F . 8B25 A0314000 mov esp,dword ptr [4031A0]
00401475 . 6A 00 push 0 ; /IsSigned = FALSE
00401477 . 8D45 FC lea eax,dword ptr [ebp-4] ; |
0040147A . 50 push eax ; |pSuccess = 0054C563
0040147B . 6A 64 push 64 ; |ControlID = 64 (100.)
0040147D . FF35 70314000 push dword ptr [403170] ; |hWnd = 001200E0 ('TEXme v1.0',class='TEXcls')
00401483 . E8 64000000 call 004014EC ; \GetDlgItemInt
00401488 . A3 88314000 mov dword ptr [403188],eax
0040148D . 837D FC 00 cmp dword ptr [ebp-4],0
00401491 . 74 07 je short 0040149A ; Chafe_1.0040149A
00401493 . 8005 66314000 04 add byte ptr [403166],4
0040149A > C9 leave ; (initial cpu selection)
0040149B . C3 retn00401063 . 8B25 A0314000 mov esp,dword ptr [4031A0]
00401069 . 6A 14 push 14 ; /Count = 14 (20.)
0040106B . 68 8C314000 push 40318C ; |Buffer = Chafe_1.0040318C
00401070 . FF35 74314000 push dword ptr [403174] ; |hWnd = 00190110 (class='Edit',parent=001200E0)
00401076 . E8 7D040000 call 004014F8 ; \GetWindowTextA
0040107B . B9 14000000 mov ecx,14
00401080 . 2BC8 sub ecx,eax
00401082 . 8DB8 8C314000 lea edi,dword ptr [eax+40318C]
00401088 > C607 00 mov byte ptr [edi],0
0040108B . 47 inc edi
0040108C . 49 dec ecx
0040108D .^ 75 F9 jnz short 00401088 ; Chafe_1.00401088
0040108F . 85C0 test eax,eax
00401091 . 74 10 je short 004010A3 ; Chafe_1.004010A3
00401093 . 8005 66314000 04 add byte ptr [403166],4
0040109A . C605 68314000 00 mov byte ptr [403168],0
004010A1 . EB 06 jmp short 004010A9 ; Chafe_1.004010A9
004010A3 > 8825 66314000 mov byte ptr [403166],ah
004010A9 > C9 leave
004010AA . C3 retn
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
