-
-
[旧帖] [求助]根据此断点能否写出注册机? 0.00雪花
-
发表于: 2009-5-1 22:40 2095
-
下列是我在分析某软件时,下的一个断点代码,请问能否根据此设计出注册机
bp GetPrivateProfileStringA下断----F9运行----直接断下----Alt+F9返回就到关键地方了
[quote]
004381CB . 53 push ebx
004381CC . 55 push ebp
004381CD . 56 push esi
004381CE . 57 push edi
004381CF . 8BF1 mov esi,ecx
004381D1 . E8 FC7A0200 call <jmp.&MFC42.#4710_CDialog::OnInitDialog
004381D6 . C786 E8010000>mov dword ptr ds:[esi+1E8],50
004381E0 . E8 E77A0200 call <jmp.&MFC42.#1168_AfxGetModuleState
004381E5 . 8B40 04 mov eax,dword ptr ds:[eax+4]
004381E8 . 33DB xor ebx,ebx
004381EA . 53 push ebx
004381EB . 68 8CBB4700 push kingdaom.0047BB8C ; ASCII "times"
004381F0 . 68 44924700 push kingdaom.00479244 ; ASCII "MyPara
004381F5 . 8BC8 mov ecx,eax
004381F7 . E8 CA7A0200 call <jmp.&MFC42.#3521_CWinApp::GetProfileIntA>
004381FC . 8BF8 mov edi,eax
004381FE . 3BFB cmp edi,ebx
00438200 . 0F85 84000000 jnz kingdaom.0043828A
00438206 . 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0043820A . E8 E3750200 call <jmp.&MFC42.#540_CString::CString>
0043820F . 68 ECB94700 push kingdaom.0047B9EC
[quote]
源文件地址:http://yuejuan.ys168.com/
bp GetPrivateProfileStringA下断----F9运行----直接断下----Alt+F9返回就到关键地方了
[quote]
004381CB . 53 push ebx
004381CC . 55 push ebp
004381CD . 56 push esi
004381CE . 57 push edi
004381CF . 8BF1 mov esi,ecx
004381D1 . E8 FC7A0200 call <jmp.&MFC42.#4710_CDialog::OnInitDialog
004381D6 . C786 E8010000>mov dword ptr ds:[esi+1E8],50
004381E0 . E8 E77A0200 call <jmp.&MFC42.#1168_AfxGetModuleState
004381E5 . 8B40 04 mov eax,dword ptr ds:[eax+4]
004381E8 . 33DB xor ebx,ebx
004381EA . 53 push ebx
004381EB . 68 8CBB4700 push kingdaom.0047BB8C ; ASCII "times"
004381F0 . 68 44924700 push kingdaom.00479244 ; ASCII "MyPara
004381F5 . 8BC8 mov ecx,eax
004381F7 . E8 CA7A0200 call <jmp.&MFC42.#3521_CWinApp::GetProfileIntA>
004381FC . 8BF8 mov edi,eax
004381FE . 3BFB cmp edi,ebx
00438200 . 0F85 84000000 jnz kingdaom.0043828A
00438206 . 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
0043820A . E8 E3750200 call <jmp.&MFC42.#540_CString::CString>
0043820F . 68 ECB94700 push kingdaom.0047B9EC
[quote]
源文件地址:http://yuejuan.ys168.com/
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
- [讨论]两个很详细的黑鹰高级破解视频教程 2839
- [求助]根据此断点能否写出注册机? 2096
- [求助]询问一个注册思路 2789
看原图
赞赏
雪币:
留言: