不知道是不是有人发过了-软件逆向-看雪-安全社区|安全招聘|kanxue.com

不知道是不是有人发过了

发表于: 2004-5-15 18:24 6805

不知道是不是有人发过了

东南破佛

2004-5-15 18:24

6805

英语口语对话王 2004 B0402

www.coolboo.com

UPX 加壳,反调试
使用ProDump脱壳,unpack功能
Delphi作品
首先去掉反跟踪

初步跟踪发现在 005359F5 CALL 0044EC70 处退出

继续跟进,发现在如下处退出:

00447E1E /74 0F          JE SHORT DUMP.00447E2F
00447E20 |E8 03B6FBFF    CALL DUMP.00403428------------->带过则退出

跟进----------->

0040342B FF52 E4       CALL DWORD PTR DS:[EDX-1C] DUMP.00447E38--->带过则退出

跟进----------->

00447E43 /75 0A          JNZ SHORT DUMP.00447E4F
00447E45 |8BC6          MOV EAX,ESI
00447E47 |8B10          MOV EDX,DWORD PTR DS:[EAX]
00447E49 |FF92 C0000000 CALL DWORD PTR DS:[EDX+C0] DUMP.0044811C--->带过则退出
00447E4F \F686 CC020000 2>TEST BYTE PTR DS:[ESI+2CC],20
00447E56 74 12          JE SHORT DUMP.00447E6A
00447E58 8BC6          MOV EAX,ESI
00447E5A 66:BB B6FF    MOV BX,0FFB6
00447E5E E8 09B4FBFF    CALL DUMP.0040326C
00447E63 80A6 CC020000 D>AND BYTE PTR DS:[ESI+2CC],0DF
00447E6A 5E             POP ESI
00447E6B 5B             POP EBX
00447E6C C3             RETN

跟进---------->

00448131 /74 41          JE SHORT DUMP.00448174
00448133 |33C0          XOR EAX,EAX
00448135 |55             PUSH EBP
00448136 |68 5D814400    PUSH DUMP.0044815D
0044813B |64:FF30       PUSH DWORD PTR FS:[EAX]
0044813E |64:8920       MOV DWORD PTR FS:[EAX],ESP
00448141 |8B5D FC       MOV EBX,DWORD PTR SS:[EBP-4]
00448144 |8B55 FC       MOV EDX,DWORD PTR SS:[EBP-4]
00448147 |8B83 BC020000 MOV EAX,DWORD PTR DS:[EBX+2BC]
0044814D |FF93 B8020000 CALL DWORD PTR DS:[EBX+2B8] DUMP.0051D880------->带过则退出
00448153 |33C0          XOR EAX,EAX
00448155 |5A             POP EDX
00448156 |59             POP ECX
00448157 |59             POP ECX
00448158 |64:8910       MOV DWORD PTR FS:[EAX],EDX
0044815B |EB 17          JMP SHORT DUMP.00448174
0044815D  ^|E9 DAB3FBFF    JMP DUMP.0040353C
00448162 |8B55 FC       MOV EDX,DWORD PTR SS:[EBP-4]
00448165 |A1 D4B75300    MOV EAX,DWORD PTR DS:[53B7D4]
0044816A |E8 496C0000    CALL DUMP.0044EDB8
0044816F |E8 24B7FBFF    CALL DUMP.00403898
00448174 \8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
00448177 F680 CC020000 0>TEST BYTE PTR DS:[EAX+2CC],2
0044817E 74 0A          JE SHORT DUMP.0044818A
00448180 B2 01          MOV DL,1
00448182 8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
00448185 E8 EA080000    CALL DUMP.00448A74
0044818A 5F             POP EDI
0044818B 5E             POP ESI
0044818C 5B             POP EBX
0044818D 59             POP ECX
0044818E 5D             POP EBP
0044818F C3             RETN

跟进--------------->

0051D880  /.  55          PUSH EBP
0051D881  |.  8BEC       MOV EBP,ESP
0051D883  |.  6A 00       PUSH 0
0051D885  |.  6A 00       PUSH 0
0051D887  |.  6A 00       PUSH 0
0051D889  |.  53          PUSH EBX
0051D88A  |.  56          PUSH ESI
0051D88B  |.  57          PUSH EDI
0051D88C  |.  8BD8       MOV EBX,EAX
0051D88E  |.  BF 00EB5300 MOV EDI,DUMP.0053EB00
0051D893  |.  33C0       XOR EAX,EAX
0051D895  |.  55          PUSH EBP
0051D896  |.  68 20DD5100 PUSH DUMP.0051DD20
0051D89B  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
0051D89E  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
0051D8A1  |.  6A 00       PUSH 0                                  ; /lParam = 0---------------->这个在搞鬼[0x11CEA1]
0051D8A3  |.  68 A8BC5100 PUSH DUMP.0051BCA8                      ; |Callback = DUMP.0051BCA8
0051D8A8  |.  E8 179BEEFF CALL <JMP.&USER32.EnumWindows>          ; \EnumWindows
0051D8AD  |.  8D55 F8    LEA EDX,DWORD PTR SS:[EBP-8]
0051D8B0  |.  A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C]
0051D8B5  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
0051D8B7  |.  E8 FC18F3FF CALL DUMP.0044F1B8
0051D8BC  |.  8B45 F8    MOV EAX,DWORD PTR SS:[EBP-8]
0051D8BF  |.  8D55 FC    LEA EDX,DWORD PTR SS:[EBP-4]
0051D8C2  |.  E8 FDB8EEFF CALL DUMP.004091C4
0051D8C7  |.  8B55 FC    MOV EDX,DWORD PTR SS:[EBP-4]
0051D8CA  |.  8D83 F8020000 LEA EAX,DWORD PTR DS:[EBX+2F8]
0051D8D0  |.  E8 D764EEFF CALL DUMP.00403DAC
0051D8D5  |.  C683 1C030000>MOV BYTE PTR DS:[EBX+31C],1
0051D8DC  |.  8BCB       MOV ECX,EBX
0051D8DE  |.  B2 01       MOV DL,1
0051D8E0  |.  A1 E0534200 MOV EAX,DWORD PTR DS:[4253E0]
0051D8E5  |.  E8 9EABF0FF CALL DUMP.00428488
0051D8EA  |.  8BF0       MOV ESI,EAX
0051D8EC  |.  89B3 10030000 MOV DWORD PTR DS:[EBX+310],ESI
0051D8F2  |.  8B17       MOV EDX,DWORD PTR DS:[EDI]
0051D8F4  |.  8BC6       MOV EAX,ESI
0051D8F6  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051D8F8  |.  FF51 60    CALL DWORD PTR DS:[ECX+60]
0051D8FB  |.  8B83 D0020000 MOV EAX,DWORD PTR DS:[EBX+2D0]
0051D901  |.  8B50 30    MOV EDX,DWORD PTR DS:[EAX+30]
0051D904  |.  8BC6       MOV EAX,ESI
0051D906  |.  E8 9927F1FF CALL DUMP.004300A4
0051D90B  |.  8B83 D0020000 MOV EAX,DWORD PTR DS:[EBX+2D0]
0051D911  |.  8B50 34    MOV EDX,DWORD PTR DS:[EAX+34]
0051D914  |.  8BC6       MOV EAX,ESI
0051D916  |.  E8 A927F1FF CALL DUMP.004300C4
0051D91B  |.  B2 01       MOV DL,1
0051D91D  |.  8BC6       MOV EAX,ESI
0051D91F  |.  E8 782EF1FF CALL DUMP.0043079C
0051D924  |.  8B15 E4A05300 MOV EDX,DWORD PTR DS:[53A0E4]
0051D92A  |.  8B92 6C020000 MOV EDX,DWORD PTR DS:[EDX+26C]
0051D930  |.  8BC6       MOV EAX,ESI
0051D932  |.  E8 7D2FF1FF CALL DUMP.004308B4
0051D937  |.  33C0       XOR EAX,EAX
0051D939  |.  8946 0C    MOV DWORD PTR DS:[ESI+C],EAX
0051D93C  |.  B2 01       MOV DL,1
0051D93E  |.  8BC6       MOV EAX,ESI
0051D940  |.  E8 7FAFF0FF CALL DUMP.004288C4
0051D945  |.  8BCB       MOV ECX,EBX
0051D947  |.  B2 01       MOV DL,1
0051D949  |.  A1 E0534200 MOV EAX,DWORD PTR DS:[4253E0]
0051D94E  |.  E8 35ABF0FF CALL DUMP.00428488
0051D953  |.  8BF0       MOV ESI,EAX
0051D955  |.  89B3 14030000 MOV DWORD PTR DS:[EBX+314],ESI
0051D95B  |.  8B17       MOV EDX,DWORD PTR DS:[EDI]
0051D95D  |.  8BC6       MOV EAX,ESI
0051D95F  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051D961  |.  FF51 60    CALL DWORD PTR DS:[ECX+60]
0051D964  |.  8B83 D4020000 MOV EAX,DWORD PTR DS:[EBX+2D4]
0051D96A  |.  8B50 30    MOV EDX,DWORD PTR DS:[EAX+30]
0051D96D  |.  8BC6       MOV EAX,ESI
0051D96F  |.  E8 3027F1FF CALL DUMP.004300A4
0051D974  |.  8B83 D4020000 MOV EAX,DWORD PTR DS:[EBX+2D4]
0051D97A  |.  8B50 34    MOV EDX,DWORD PTR DS:[EAX+34]
0051D97D  |.  8BC6       MOV EAX,ESI
0051D97F  |.  E8 4027F1FF CALL DUMP.004300C4
0051D984  |.  8B46 58    MOV EAX,DWORD PTR DS:[ESI+58]
0051D987  |.  BA 0000A000 MOV EDX,0A00000
0051D98C  |.  E8 FBD3EFFF CALL DUMP.0041AD8C
0051D991  |.  B2 01       MOV DL,1
0051D993  |.  8BC6       MOV EAX,ESI
0051D995  |.  E8 022EF1FF CALL DUMP.0043079C
0051D99A  |.  8B15 E4A05300 MOV EDX,DWORD PTR DS:[53A0E4]
0051D9A0  |.  8B92 70020000 MOV EDX,DWORD PTR DS:[EDX+270]
0051D9A6  |.  8BC6       MOV EAX,ESI
0051D9A8  |.  E8 072FF1FF CALL DUMP.004308B4
0051D9AD  |.  33C0       XOR EAX,EAX
0051D9AF  |.  8946 0C    MOV DWORD PTR DS:[ESI+C],EAX
0051D9B2  |.  B2 01       MOV DL,1
0051D9B4  |.  8BC6       MOV EAX,ESI
0051D9B6  |.  E8 09AFF0FF CALL DUMP.004288C4
0051D9BB  |.  8BCB       MOV ECX,EBX
0051D9BD  |.  B2 01       MOV DL,1
0051D9BF  |.  A1 28825100 MOV EAX,DWORD PTR DS:[518228]
0051D9C4  |.  E8 FBABFFFF CALL DUMP.005185C4
0051D9C9  |.  8BF0       MOV ESI,EAX
0051D9CB  |.  89B3 0C030000 MOV DWORD PTR DS:[EBX+30C],ESI
0051D9D1  |.  8B17       MOV EDX,DWORD PTR DS:[EDI]
0051D9D3  |.  8BC6       MOV EAX,ESI
0051D9D5  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051D9D7  |.  FF51 60    CALL DWORD PTR DS:[ECX+60]
0051D9DA  |.  8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
0051D9E0  |.  8B50 30    MOV EDX,DWORD PTR DS:[EAX+30]
0051D9E3  |.  8BC6       MOV EAX,ESI
0051D9E5  |.  E8 BA26F1FF CALL DUMP.004300A4
0051D9EA  |.  8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
0051D9F0  |.  8B50 34    MOV EDX,DWORD PTR DS:[EAX+34]
0051D9F3  |.  8BC6       MOV EAX,ESI
0051D9F5  |.  E8 CA26F1FF CALL DUMP.004300C4
0051D9FA  |.  8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
0051DA00  |.  8B50 3C    MOV EDX,DWORD PTR DS:[EAX+3C]
0051DA03  |.  8BC6       MOV EAX,ESI
0051DA05  |.  E8 FE26F1FF CALL DUMP.00430108
0051DA0A  |.  8B83 D8020000 MOV EAX,DWORD PTR DS:[EBX+2D8]
0051DA10  |.  8B50 38    MOV EDX,DWORD PTR DS:[EAX+38]
0051DA13  |.  8BC6       MOV EAX,ESI
0051DA15  |.  E8 CE26F1FF CALL DUMP.004300E8
0051DA1A  |.  B2 01       MOV DL,1
0051DA1C  |.  8BC6       MOV EAX,ESI
0051DA1E  |.  E8 792DF1FF CALL DUMP.0043079C
0051DA23  |.  B2 01       MOV DL,1
0051DA25  |.  8BC6       MOV EAX,ESI
0051DA27  |.  E8 8CB2FFFF CALL DUMP.00518CB8
0051DA2C  |.  BA FFFFFF00 MOV EDX,0FFFFFF
0051DA31  |.  8BC6       MOV EAX,ESI
0051DA33  |.  E8 60B0FFFF CALL DUMP.00518A98
0051DA38  |.  BA FF800000 MOV EDX,80FF
0051DA3D  |.  8BC6       MOV EAX,ESI
0051DA3F  |.  E8 68B0FFFF CALL DUMP.00518AAC
0051DA44  |.  BA FFFF0000 MOV EDX,0FFFF
0051DA49  |.  8BC6       MOV EAX,ESI
0051DA4B  |.  E8 90B0FFFF CALL DUMP.00518AE0
0051DA50  |.  BA 14000000 MOV EDX,14
0051DA55  |.  8BC6       MOV EAX,ESI
0051DA57  |.  E8 50B1FFFF CALL DUMP.00518BAC
0051DA5C  |.  BA 01000000 MOV EDX,1
0051DA61  |.  8BC6       MOV EAX,ESI
0051DA63  |.  E8 18B1FFFF CALL DUMP.00518B80
0051DA68  |.  B2 01       MOV DL,1
0051DA6A  |.  8BC6       MOV EAX,ESI
0051DA6C  |.  E8 2B2DF1FF CALL DUMP.0043079C
0051DA71  |.  8BCB       MOV ECX,EBX
0051DA73  |.  B2 01       MOV DL,1
0051DA75  |.  A1 4C024A00 MOV EAX,DWORD PTR DS:[4A024C]
0051DA7A  |.  E8 95B5F8FF CALL DUMP.004A9014
0051DA7F  |.  8BF0       MOV ESI,EAX
0051DA81  |.  89B3 FC020000 MOV DWORD PTR DS:[EBX+2FC],ESI
0051DA87  |.  8B17       MOV EDX,DWORD PTR DS:[EDI]
0051DA89  |.  8BC6       MOV EAX,ESI
0051DA8B  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DA8D  |.  FF51 60    CALL DWORD PTR DS:[ECX+60]
0051DA90  |.  8B83 DC020000 MOV EAX,DWORD PTR DS:[EBX+2DC]
0051DA96  |.  8B50 30    MOV EDX,DWORD PTR DS:[EAX+30]
0051DA99  |.  8BC6       MOV EAX,ESI
0051DA9B  |.  E8 0426F1FF CALL DUMP.004300A4
0051DAA0  |.  8B83 DC020000 MOV EAX,DWORD PTR DS:[EBX+2DC]
0051DAA6  |.  8B50 34    MOV EDX,DWORD PTR DS:[EAX+34]
0051DAA9  |.  8BC6       MOV EAX,ESI
0051DAAB  |.  E8 1426F1FF CALL DUMP.004300C4
0051DAB0  |.  8B83 DC020000 MOV EAX,DWORD PTR DS:[EBX+2DC]
0051DAB6  |.  8B50 3C    MOV EDX,DWORD PTR DS:[EAX+3C]
0051DAB9  |.  8BC6       MOV EAX,ESI
0051DABB  |.  E8 4826F1FF CALL DUMP.00430108
0051DAC0  |.  8B83 DC020000 MOV EAX,DWORD PTR DS:[EBX+2DC]
0051DAC6  |.  8B50 38    MOV EDX,DWORD PTR DS:[EAX+38]
0051DAC9  |.  8BC6       MOV EAX,ESI
0051DACB  |.  E8 1826F1FF CALL DUMP.004300E8
0051DAD0  |.  8B15 E4A05300 MOV EDX,DWORD PTR DS:[53A0E4]
0051DAD6  |.  8B92 74020000 MOV EDX,DWORD PTR DS:[EDX+274]
0051DADC  |.  8BC6       MOV EAX,ESI
0051DADE  |.  E8 D12DF1FF CALL DUMP.004308B4
0051DAE3  |.  B2 01       MOV DL,1
0051DAE5  |.  8BC6       MOV EAX,ESI
0051DAE7  |.  E8 B02CF1FF CALL DUMP.0043079C
0051DAEC  |.  B2 01       MOV DL,1
0051DAEE  |.  8BC6       MOV EAX,ESI
0051DAF0  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DAF2  |.  FF51 5C    CALL DWORD PTR DS:[ECX+5C]
0051DAF5  |.  33C0       XOR EAX,EAX
0051DAF7  |.  8986 E8020000 MOV DWORD PTR DS:[ESI+2E8],EAX
0051DAFD  |.  8986 EC020000 MOV DWORD PTR DS:[ESI+2EC],EAX
0051DB03  |.  8B93 EC020000 MOV EDX,DWORD PTR DS:[EBX+2EC]
0051DB09  |.  8BC6       MOV EAX,ESI
0051DB0B  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]             ;  DUMP.0051B954
0051DB0D  |.  FF91 C0000000 CALL DWORD PTR DS:[ECX+C0]
0051DB13  |.  6A 00       PUSH 0                                  ; /lParam = 0---------------->这个在搞鬼[0x11D113]
0051DB15  |.  68 A8BC5100 PUSH DUMP.0051BCA8                      ; |Callback = DUMP.0051BCA8
0051DB1A  |.  E8 A598EEFF CALL <JMP.&USER32.EnumWindows>          ; \EnumWindows
0051DB1F  |.  8BCB       MOV ECX,EBX
0051DB21  |.  B2 01       MOV DL,1
0051DB23  |.  A1 4C024A00 MOV EAX,DWORD PTR DS:[4A024C]
0051DB28  |.  E8 E7B4F8FF CALL DUMP.004A9014
0051DB2D  |.  8BF0       MOV ESI,EAX
0051DB2F  |.  89B3 00030000 MOV DWORD PTR DS:[EBX+300],ESI
0051DB35  |.  8B17       MOV EDX,DWORD PTR DS:[EDI]
0051DB37  |.  8BC6       MOV EAX,ESI
0051DB39  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DB3B  |.  FF51 60    CALL DWORD PTR DS:[ECX+60]
0051DB3E  |.  8B83 E0020000 MOV EAX,DWORD PTR DS:[EBX+2E0]
0051DB44  |.  8B50 30    MOV EDX,DWORD PTR DS:[EAX+30]
0051DB47  |.  8BC6       MOV EAX,ESI
0051DB49  |.  E8 5625F1FF CALL DUMP.004300A4
0051DB4E  |.  8B83 E0020000 MOV EAX,DWORD PTR DS:[EBX+2E0]
0051DB54  |.  8B50 34    MOV EDX,DWORD PTR DS:[EAX+34]
0051DB57  |.  8BC6       MOV EAX,ESI
0051DB59  |.  E8 6625F1FF CALL DUMP.004300C4
0051DB5E  |.  8B83 E0020000 MOV EAX,DWORD PTR DS:[EBX+2E0]
0051DB64  |.  8B50 3C    MOV EDX,DWORD PTR DS:[EAX+3C]
0051DB67  |.  8BC6       MOV EAX,ESI
0051DB69  |.  E8 9A25F1FF CALL DUMP.00430108
0051DB6E  |.  8B83 E0020000 MOV EAX,DWORD PTR DS:[EBX+2E0]
0051DB74  |.  8B50 38    MOV EDX,DWORD PTR DS:[EAX+38]
0051DB77  |.  8BC6       MOV EAX,ESI
0051DB79  |.  E8 6A25F1FF CALL DUMP.004300E8
0051DB7E  |.  8B15 E4A05300 MOV EDX,DWORD PTR DS:[53A0E4]
0051DB84  |.  8B92 78020000 MOV EDX,DWORD PTR DS:[EDX+278]
0051DB8A  |.  8BC6       MOV EAX,ESI
0051DB8C  |.  E8 232DF1FF CALL DUMP.004308B4
0051DB91  |.  33D2       XOR EDX,EDX
0051DB93  |.  8BC6       MOV EAX,ESI
0051DB95  |.  E8 022CF1FF CALL DUMP.0043079C
0051DB9A  |.  33D2       XOR EDX,EDX
0051DB9C  |.  8BC6       MOV EAX,ESI
0051DB9E  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DBA0  |.  FF51 5C    CALL DWORD PTR DS:[ECX+5C]
0051DBA3  |.  33C0       XOR EAX,EAX
0051DBA5  |.  8986 E8020000 MOV DWORD PTR DS:[ESI+2E8],EAX
0051DBAB  |.  8986 EC020000 MOV DWORD PTR DS:[ESI+2EC],EAX
0051DBB1  |.  8B93 EC020000 MOV EDX,DWORD PTR DS:[EBX+2EC]
0051DBB7  |.  8BC6       MOV EAX,ESI
0051DBB9  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DBBB  |.  FF91 C0000000 CALL DWORD PTR DS:[ECX+C0]
0051DBC1  |.  B2 01       MOV DL,1
0051DBC3  |.  8BC6       MOV EAX,ESI
0051DBC5  |.  E8 2A90F1FF CALL DUMP.00436BF4
0051DBCA  |.  33D2       XOR EDX,EDX
0051DBCC  |.  8BC6       MOV EAX,ESI
0051DBCE  |.  E8 0990F1FF CALL DUMP.00436BDC
0051DBD3  |.  8BCB       MOV ECX,EBX
0051DBD5  |.  B2 01       MOV DL,1
0051DBD7  |.  A1 4C024A00 MOV EAX,DWORD PTR DS:[4A024C]
0051DBDC  |.  E8 33B4F8FF CALL DUMP.004A9014
0051DBE1  |.  8BF0       MOV ESI,EAX
0051DBE3  |.  89B3 04030000 MOV DWORD PTR DS:[EBX+304],ESI
0051DBE9  |.  8B17       MOV EDX,DWORD PTR DS:[EDI]
0051DBEB  |.  8BC6       MOV EAX,ESI
0051DBED  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DBEF  |.  FF51 60    CALL DWORD PTR DS:[ECX+60]
0051DBF2  |.  8B83 E4020000 MOV EAX,DWORD PTR DS:[EBX+2E4]
0051DBF8  |.  8B50 30    MOV EDX,DWORD PTR DS:[EAX+30]
0051DBFB  |.  8BC6       MOV EAX,ESI
0051DBFD  |.  E8 A224F1FF CALL DUMP.004300A4
0051DC02  |.  8B83 E4020000 MOV EAX,DWORD PTR DS:[EBX+2E4]
0051DC08  |.  8B50 34    MOV EDX,DWORD PTR DS:[EAX+34]
0051DC0B  |.  8BC6       MOV EAX,ESI
0051DC0D  |.  E8 B224F1FF CALL DUMP.004300C4
0051DC12  |.  8B83 E4020000 MOV EAX,DWORD PTR DS:[EBX+2E4]
0051DC18  |.  8B50 3C    MOV EDX,DWORD PTR DS:[EAX+3C]
0051DC1B  |.  8BC6       MOV EAX,ESI
0051DC1D  |.  E8 E624F1FF CALL DUMP.00430108
0051DC22  |.  8B83 E4020000 MOV EAX,DWORD PTR DS:[EBX+2E4]
0051DC28  |.  8B50 38    MOV EDX,DWORD PTR DS:[EAX+38]
0051DC2B  |.  8BC6       MOV EAX,ESI
0051DC2D  |.  E8 B624F1FF CALL DUMP.004300E8
0051DC32  |.  8B15 E4A05300 MOV EDX,DWORD PTR DS:[53A0E4]
0051DC38  |.  8B92 7C020000 MOV EDX,DWORD PTR DS:[EDX+27C]
0051DC3E  |.  8BC6       MOV EAX,ESI
0051DC40  |.  E8 6F2CF1FF CALL DUMP.004308B4
0051DC45  |.  B2 01       MOV DL,1
0051DC47  |.  8BC6       MOV EAX,ESI
0051DC49  |.  E8 4E2BF1FF CALL DUMP.0043079C
0051DC4E  |.  B2 01       MOV DL,1
0051DC50  |.  8BC6       MOV EAX,ESI
0051DC52  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DC54  |.  FF51 5C    CALL DWORD PTR DS:[ECX+5C]
0051DC57  |.  899E EC020000 MOV DWORD PTR DS:[ESI+2EC],EBX
0051DC5D  |.  C786 E8020000>MOV DWORD PTR DS:[ESI+2E8],DUMP.0051CFA8
0051DC67  |.  8B93 EC020000 MOV EDX,DWORD PTR DS:[EBX+2EC]
0051DC6D  |.  8BC6       MOV EAX,ESI
0051DC6F  |.  8B08       MOV ECX,DWORD PTR DS:[EAX]
0051DC71  |.  FF91 C0000000 CALL DWORD PTR DS:[ECX+C0]
0051DC77  |.  B2 01       MOV DL,1
0051DC79  |.  8BC6       MOV EAX,ESI
0051DC7B  |.  E8 748FF1FF CALL DUMP.00436BF4
0051DC80  |.  66:BA 0100 MOV DX,1
0051DC84  |.  8BC6       MOV EAX,ESI
0051DC86  |.  E8 518FF1FF CALL DUMP.00436BDC
0051DC8B  |.  8B93 08030000 MOV EDX,DWORD PTR DS:[EBX+308]
0051DC91  |.  8B83 0C030000 MOV EAX,DWORD PTR DS:[EBX+30C]
0051DC97  |.  E8 60AFFFFF CALL DUMP.00518BFC
0051DC9C  |.  8B07       MOV EAX,DWORD PTR DS:[EDI]
0051DC9E  |.  8998 7C020000 MOV DWORD PTR DS:[EAX+27C],EBX
0051DCA4  |.  C780 78020000>MOV DWORD PTR DS:[EAX+278],DUMP.0051D5E4
0051DCAE  |.  33D2       XOR EDX,EDX
0051DCB0  |.  8B07       MOV EAX,DWORD PTR DS:[EDI]
0051DCB2  |.  E8 4999F2FF CALL DUMP.00447600
0051DCB7  |.  33D2       XOR EDX,EDX
0051DCB9  |.  8B07       MOV EAX,DWORD PTR DS:[EDI]
0051DCBB  |.  E8 8429F1FF CALL DUMP.00430644
0051DCC0  |.  33D2       XOR EDX,EDX
0051DCC2  |.  8B07       MOV EAX,DWORD PTR DS:[EDI]
0051DCC4  |.  E8 FF2CF1FF CALL DUMP.004309C8
0051DCC9  |.  8B15 64A05300 MOV EDX,DWORD PTR DS:[53A064]
0051DCCF  |.  8B12       MOV EDX,DWORD PTR DS:[EDX]
0051DCD1  |.  8B07       MOV EAX,DWORD PTR DS:[EDI]
0051DCD3  |.  E8 DC2BF1FF CALL DUMP.004308B4
0051DCD8  |.  8D55 F4    LEA EDX,DWORD PTR SS:[EBP-C]
0051DCDB  |.  8B07       MOV EAX,DWORD PTR DS:[EDI]
0051DCDD  |.  E8 A22BF1FF CALL DUMP.00430884
0051DCE2  |.  8B55 F4    MOV EDX,DWORD PTR SS:[EBP-C]
0051DCE5  |.  A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C]
0051DCEA  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
0051DCEC  |.  E8 6B0BF3FF CALL DUMP.0044E85C
0051DCF1  |.  6A 00       PUSH 0                                  ; /lParam = 0---------------->这个在搞鬼[0x11D2F1]
0051DCF3  |.  68 A8BC5100 PUSH DUMP.0051BCA8                      ; |Callback = DUMP.0051BCA8
0051DCF8  |.  E8 C796EEFF CALL <JMP.&USER32.EnumWindows>          ; \EnumWindows
0051DCFD  |.  33C0       XOR EAX,EAX
0051DCFF  |.  5A          POP EDX
0051DD00  |.  59          POP ECX
0051DD01  |.  59          POP ECX
0051DD02  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
0051DD05  |.  68 27DD5100 PUSH DUMP.0051DD27
0051DD0A  |>  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
0051DD0D  |.  E8 4660EEFF CALL DUMP.00403D58
0051DD12  |.  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
0051DD15  |.  BA 02000000 MOV EDX,2
0051DD1A  |.  E8 5D60EEFF CALL DUMP.00403D7C
0051DD1F  \.  C3          RETN
0051DD20 .- E9 CB5AEEFF JMP DUMP.004037F0
0051DD25 .^ EB E3       JMP SHORT DUMP.0051DD0A
0051DD27 .  5F          POP EDI
0051DD28 .  5E          POP ESI
0051DD29 .  5B          POP EBX
0051DD2A .  8BE5       MOV ESP,EBP
0051DD2C .  5D          POP EBP
0051DD2D .  C3          RETN

所以让这个软件在OD下被我们乖乖的调试的办法就是把上面三个相同的函数调用统统都NOP

==================================================================================================================

总结一下这样找反跟踪的代码效率实在是太低,而且一个不小心就有可能要重新开始找了,各位老大有什么好办法还请不吝赐教。

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)

收藏・2

免费・6

支持

最新回复 (12)
东南破佛雪币： 387 活跃值： (216) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 57 粉丝 1 关注私信	东南破佛 1 2 楼出现NAG后根据堆栈一步一步往上找找到如下代码: 0053471A . 8B00 MOV EAX,DWORD PTR DS:[EAX] 0053471C . E8 CFA5F1FF CALL DUMP14.0044ECF0------------------------->带过这个则出现NAG 00534721 . E8 72DFFFFF CALL DUMP14.00532698 00534726 . E9 DE1C0000 JMP DUMP14.00536409 0053472B > 33C0 XOR EAX,EAX 0053472D . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] ; DUMP14.0053E7A8 省略 00534975 . 33D2 XOR EDX,EDX 00534977 . 8990 E8020000 MOV DWORD PTR DS:[EAX+2E8],EDX 0053497D . 8990 EC020000 MOV DWORD PTR DS:[EAX+2EC],EDX 00534983 . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00534988 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 0053498A . E8 61A3F1FF CALL DUMP14.0044ECF0----------------------->带过这个出现NAG 0053498F . E8 04DDFFFF CALL DUMP14.00532698 00534994 . E9 701A0000 JMP DUMP14.00536409 00534999 > A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 省略 00534CFC . B9 75670000 MOV ECX,6775 00534D01 . A1 5CEB5300 MOV EAX,DWORD PTR DS:[53EB5C] 00534D06 . E8 ADDCFFFF CALL DUMP14.005329B8 00534D0B . E9 B7100000 JMP DUMP14.00535DC7----------------------> 00534D10 > E8 9BD9FFFF CALL DUMP14.005326B0------------------------>这里来自534288 00534D15 . 803D 80EB5300>CMP BYTE PTR DS:[53EB80],1 00534D1C . 74 43 JE SHORT DUMP14.00534D61 00534D1E . 803D 81EB5300>CMP BYTE PTR DS:[53EB81],1 00534D25 . 74 3A JE SHORT DUMP14.00534D61 00534D27 . 803D 82EB5300>CMP BYTE PTR DS:[53EB82],1 00534D2E . 74 31 JE SHORT DUMP14.00534D61 00534D30 . 803D 83EB5300>CMP BYTE PTR DS:[53EB83],1 00534D37 . 74 28 JE SHORT DUMP14.00534D61 00534D39 . 803D 84EB5300>CMP BYTE PTR DS:[53EB84],1 00534D40 . 74 1F JE SHORT DUMP14.00534D61 00534D42 . 803D 85EB5300>CMP BYTE PTR DS:[53EB85],1 00534D49 . 74 16 JE SHORT DUMP14.00534D61 00534D4B . 803D 86EB5300>CMP BYTE PTR DS:[53EB86],1 00534D52 . 74 0D JE SHORT DUMP14.00534D61 00534D54 . 803D 87EB5300>CMP BYTE PTR DS:[53EB87],1 00534D5B . 0F85 52010000 JNZ DUMP14.00534EB3 00534D61 > A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 省略 00534E9D . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00534EA2 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00534EA4 . E8 479EF1FF CALL DUMP14.0044ECF0--------------------------->带过这个则出现NAG 00534EA9 . E8 EAD7FFFF CALL DUMP14.00532698 00534EAE . E9 56150000 JMP DUMP14.00536409 00534EB3 > A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 00534EB8 . 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30] 00534EBB . 83C0 18 ADD EAX,18 00534EBE . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534EC4 . 8B52 74 MOV EDX,DWORD PTR DS:[EDX+74] 00534EC7 . E8 E0EEECFF CALL DUMP14.00403DAC 00534ECC . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534ED2 . 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 00534ED5 . B9 01000000 MOV ECX,1 00534EDA . A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 00534EDF . E8 14FDF2FF CALL DUMP14.00464BF8 00534EE4 . A3 58EB5300 MOV DWORD PTR DS:[53EB58],EAX-------------->关键数值◎◎◎◎◎ 00534EE9 . 68 5A2C0000 PUSH 2C5A 00534EEE . 8D85 48FEFFFF LEA EAX,DWORD PTR SS:[EBP-1B8] 00534EF4 . 50 PUSH EAX 00534EF5 . B9 BE570000 MOV ECX,57BE 00534EFA . BA 680A0000 MOV EDX,0A68 00534EFF . B8 F0645300 MOV EAX,DUMP14.005364F0 ; ASCII ";O" 00534F04 . E8 FB1FFCFF CALL DUMP14.004F6F04 00534F09 . 8B85 48FEFFFF MOV EAX,DWORD PTR SS:[EBP-1B8] 00534F0F . E8 283FEDFF CALL DUMP14.00408E3C 00534F14 . 3B05 58EB5300 CMP EAX,DWORD PTR DS:[53EB58] 00534F1A . 7D 30 JGE SHORT DUMP14.00534F4C 00534F1C . 68 5A2C0000 PUSH 2C5A 00534F21 . 8D85 44FEFFFF LEA EAX,DWORD PTR SS:[EBP-1BC] 00534F27 . 50 PUSH EAX 00534F28 . B9 BE570000 MOV ECX,57BE 00534F2D . BA 680A0000 MOV EDX,0A68 00534F32 . B8 F0645300 MOV EAX,DUMP14.005364F0 ; ASCII ";O" 00534F37 . E8 C81FFCFF CALL DUMP14.004F6F04 00534F3C . 8B85 44FEFFFF MOV EAX,DWORD PTR SS:[EBP-1BC] 00534F42 . E8 F53EEDFF CALL DUMP14.00408E3C 00534F47 . A3 58EB5300 MOV DWORD PTR DS:[53EB58],EAX-------------->关键数值◎◎◎◎◎ 00534F4C > FF05 58EB5300 INC DWORD PTR DS:[53EB58] 00534F52 . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534F58 . 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 00534F5B . 8B0D 58EB5300 MOV ECX,DWORD PTR DS:[53EB58] 00534F61 . A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 00534F66 . E8 49FEF2FF CALL DUMP14.00464DB4 00534F6B . 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] 00534F71 . 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 00534F74 . 8D85 40FEFFFF LEA EAX,DWORD PTR SS:[EBP-1C0] 00534F7A . 8B15 5CEB5300 MOV EDX,DWORD PTR DS:[53EB5C] 00534F80 . E8 9FF0ECFF CALL DUMP14.00404024 00534F85 . 8B85 40FEFFFF MOV EAX,DWORD PTR SS:[EBP-1C0] 00534F8B . E8 3840EDFF CALL DUMP14.00408FC8 00534F90 . 84C0 TEST AL,AL 00534F92 . 74 66 JE SHORT DUMP14.00534FFA 00534F94 . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534F9A . 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 00534F9D . B9 75670000 MOV ECX,6775 00534FA2 . A1 5CEB5300 MOV EAX,DWORD PTR DS:[53EB5C] 00534FA7 . E8 10DBFFFF CALL DUMP14.00532ABC 00534FAC . FF05 54EB5300 INC DWORD PTR DS:[53EB54] 00534FB2 . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534FB8 . 8B52 2C MOV EDX,DWORD PTR DS:[EDX+2C] 00534FBB . B9 3C540000 MOV ECX,543C 00534FC0 . A1 60EB5300 MOV EAX,DWORD PTR DS:[53EB60] 00534FC5 . E8 EED9FFFF CALL DUMP14.005329B8 00534FCA . 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] 00534FD0 . 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 00534FD3 . 8D85 3CFEFFFF LEA EAX,DWORD PTR SS:[EBP-1C4] 00534FD9 . 8B15 5CEB5300 MOV EDX,DWORD PTR DS:[53EB5C] 00534FDF . E8 40F0ECFF CALL DUMP14.00404024 00534FE4 . 8B85 3CFEFFFF MOV EAX,DWORD PTR SS:[EBP-1C4] 00534FEA . E8 ADF1ECFF CALL DUMP14.0040419C 00534FEF . 50 PUSH EAX ; /FileName = "" 00534FF0 . E8 171DEDFF CALL <JMP.&KERNEL32.DeleteFileA> ; \DeleteFileA 00534FF5 . E9 CD0D0000 JMP DUMP14.00535DC7 00534FFA > 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] 省略 00535969 . E8 2EE8ECFF CALL DUMP14.0040419C 0053596E . 50 PUSH EAX ; /FileName = "" 0053596F . E8 9813EDFF CALL <JMP.&KERNEL32.DeleteFileA> ; \DeleteFileA 00535974 . E9 4E040000 JMP DUMP14.00535DC7 00535979 > 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] ; DUMP14.0053E7A8 省略 00535B0D . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00535B12 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535B14 . E8 D791F1FF CALL DUMP14.0044ECF0------------------------->带过这个则出现NAG 00535B19 . E8 7ACBFFFF CALL DUMP14.00532698 00535B1E . E9 E6080000 JMP DUMP14.00536409 00535B23 > A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 省略 00535C64 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535C66 . E8 8590F1FF CALL DUMP14.0044ECF0-------------------------->带过这个则出现NAG 00535C6B . E8 28CAFFFF CALL DUMP14.00532698 00535C70 . E9 94070000 JMP DUMP14.00536409 00535C75 > A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 省略 00535D9B . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535D9D . 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300] 00535DA3 . 33D2 XOR EDX,EDX 00535DA5 . 8990 E8020000 MOV DWORD PTR DS:[EAX+2E8],EDX 00535DAB . 8990 EC020000 MOV DWORD PTR DS:[EAX+2EC],EDX 00535DB1 . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00535DB6 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535DB8 . E8 338FF1FF CALL DUMP14.0044ECF0------------------------->带过这个出现NAG 00535DBD . E8 D6C8FFFF CALL DUMP14.00532698 00535DC2 . E9 42060000 JMP DUMP14.00536409 00535DC7 > 833D 54EB5300>CMP DWORD PTR DS:[53EB54],0------------------>跳到这里可以避免上面从 00534288 处跳 00534D5B 处跳到 00534EB3 然后根据内存 0053EB58 处的数字值执行某一个DeleteFileA 函数(?)，随后跳转到 00535DC7 内存 0053EB54 处保存使用次数 00532ABC 处CALL修改 53EB54 （532BE7） 00534EDF 和 00534F47 处CALL返回的EAX值最终存放到 53EB58 对比软件超过使用次数前后的流程可以对软件改造如下： 00534F90 . 84C0 TEST AL,AL-------------------------------[134590] 00534F92 74 66 JE SHORT DUMP14.00534FFA----------------->这里不跳走则执行最初的一个DeleteFileA 00534F94 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] ; DUMP14.0053E7A8 00534F9A 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 00534F9D B9 75670000 MOV ECX,6775 00534FA2 A1 5CEB5300 MOV EAX,DWORD PTR DS:[53EB5C] 00534FA7 E8 10DBFFFF CALL DUMP14.00532ABC －－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－改造后代码如下: 00534F90 C705 58EB5300 01000000 MOV DWORD PTR DS:[53EB58],1 00534F9A C705 54EB5300 01000000 MOV DWORD PTR DS:[53EB54],1 00534FA4 E9 1E0E0000 JMP DUMP14.00535DC7 00534FA9 90 NOP 00534FAA 90 NOP 00534FAB 90 NOP 更改之后,运行正常,使用次数永远是1 ====================================================== 后记: 这个软件除了这个使用次数限制外还有使用时间限制(每次使用时间为1小时),使用功能限制,但是我的水平太低了,这个去反跟踪和使用次数限制比较简单一点,正好适合我们才鸟练习.其他的留给其他老大做吧 2004-5-15 18:36 0
luckynt 雪币： 221 活跃值： (100) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 36 粉丝 0 关注私信	luckynt 3 楼先顶一下``````` 慢慢看 2004-5-15 18:42 0
MengLong 雪币： 279 活跃值： (435) 能力值： ( LV9，RANK：250 ) 在线值：发帖 14 回帖 125 粉丝 2 关注私信	MengLong 6 4 楼先收藏 2004-5-16 14:04 0
无名和尚雪币： 272 活跃值： (340) 能力值： ( LV4，RANK：50 ) 在线值：发帖 11 回帖 111 粉丝 1 关注私信	无名和尚 1 5 楼一般这种neg都有一个timer控件控制,我想这一个小时的时间限制也应该是由timer控件控制的.让我找找不行,脱壳脱不干净.资源编辑不了,用freeres也不行 2004-5-16 15:06 0
iamocean 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 42 粉丝 0 关注私信	iamocean 6 楼虽然现在看不大明白，但偶相信偶的水平会慢慢提高的！！ 2004-5-16 22:56 0
狗剩雪币： 124 活跃值： (107) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 119 粉丝 2 关注私信	狗剩 1 7 楼你直接用Prodump就可以脱了掉没隐藏Prodump标题直接脱掉了么？呵呵，看看你系统help目录文件被删了几个;) 2004-5-17 03:05 0
aqtata 雪币： 319 活跃值： (1091) 能力值： ( LV7，RANK：100 ) 在线值：发帖 76 回帖 358 粉丝 2 关注私信	aqtata 2 8 楼最初由狗剩发布你直接用Prodump就可以脱了掉没隐藏Prodump标题直接脱掉了么？呵呵，看看你系统help目录文件被删了几个;) 说话都有高手的味道！！大哥能说一说怎么隐藏标题么,插件还是什么?? 2004-5-17 14:58 0
狗剩雪币： 124 活跃值： (107) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 119 粉丝 2 关注私信	狗剩 1 9 楼最初由 aqtata 发布说话都有高手的味道！！大哥能说一说怎么隐藏标题么,插件还是什么?? 哪里是啥高手呀，我前些天也在跟踪这个软件啦。。。至于隐藏标题，龙[D.4s]写了一款cool隐藏窗口标题的工具。很不错的说：） http://shjianye.51.net/window.rar 2004-5-17 19:28 0
东南破佛雪币： 387 活跃值： (216) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 57 粉丝 1 关注私信	东南破佛 1 10 楼有声有色2004 B0224 这个软件给我们的是试用版的程序,有20次限制正式版需要作者发给我们…… 去掉限制吧 UPX加壳（做了手脚的），用GUW32最好了是Delphi的作品用OD载入过程中直接退出不会别的办法，只能用笨办法了。在出现第一个提示时按回车，然后快速按F12，让程序暂停然后利用下断点 bp EnumWindows，可以找到类似与英语口语对话王2004中的代码每次只能中断到下面的一个 005B12D4 005B12CD 6A 00 PUSH 0----------------------------------->[0x1B06CD] 005B12CF 68 08D35A00 PUSH VP.005AD308 005B12D4 E8 4B60E5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005A7341 6A 00 PUSH 0----------------------------------->[0x1A6741] 005A7343 68 74595A00 PUSH VP1.005A5974 005A7348 E8 D7FFE5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005A75B3 6A 00 PUSH 0----------------------------------->[0x1A69B3] 005A75B5 68 74595A00 PUSH VP1.005A5974 005A75BA E8 65FDE5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005A7792 6A 00 PUSH 0----------------------------------->[0x1A6B92] 005A7794 68 74595A00 PUSH VP1.005A5974 005A7799 E8 86FBE5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005BFEE0 6A 00 PUSH 0----------------------------------->[0x1BF2E0] 005BFEE2 68 60DF5B00 PUSH VP.005BDF60 005BFEE7 E8 3874E4FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里上面这些断点都修改之后就可以调试了 ========================================================================================== 005C1C19 A1 90C75C00 MOV EAX,DWORD PTR DS:[5CC790] 005C1C1E 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30] 005C1C21 83C0 18 ADD EAX,18 005C1C24 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1C2A 8B52 74 MOV EDX,DWORD PTR DS:[EDX+74] 005C1C2D E8 DA21E4FF CALL VP2.00403E0C 005C1C32 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1C38 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 005C1C3B B9 01000000 MOV ECX,1 005C1C40 A1 90C75C00 MOV EAX,DWORD PTR DS:[5CC790] 005C1C45 E8 EA34EAFF CALL VP2.00465134 005C1C4A A3 98C75C00 MOV DWORD PTR DS:[5CC798],EAX------------>EAX=0x14已经使用的次数 005C1C4F 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],13------------->比较 005C1C56 7E 0A JLE SHORT VP2.005C1C62 005C1C58 C705 98C75C00 1>MOV DWORD PTR DS:[5CC798],13 005C1C62 FF05 98C75C00 INC DWORD PTR DS:[5CC798] 005C1C68 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1C6E 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 005C1C71 8B0D 98C75C00 MOV ECX,DWORD PTR DS:[5CC798] 005C1C77 A1 90C75C00 MOV EAX,DWORD PTR DS:[5CC790] 005C1C7C E8 6F36EAFF CALL VP2.004652F0 005C1C81 8B0D CC775C00 MOV ECX,DWORD PTR DS:[5C77CC] 005C1C87 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 005C1C8A 8D85 58FEFFFF LEA EAX,DWORD PTR SS:[EBP-1A8] 005C1C90 8B15 9CC75C00 MOV EDX,DWORD PTR DS:[5CC79C] 005C1C96 E8 E923E4FF CALL VP2.00404084 005C1C9B 8B85 58FEFFFF MOV EAX,DWORD PTR SS:[EBP-1A8] 005C1CA1 E8 6673E4FF CALL VP2.0040900C 005C1CA6 84C0 TEST AL,AL-------------------------->这里更改 005C1CA8 74 66 JE SHORT VP2.005C1D10 005C1CAA 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1CB0 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 005C1CB3 B9 75670000 MOV ECX,6775 005C1CB8 A1 9CC75C00 MOV EAX,DWORD PTR DS:[5CC79C] 005C1CBD E8 CAD9FFFF CALL VP2.005BF68C 005C1CC2 FF05 94C75C00 INC DWORD PTR DS:[5CC794] 005C1CC8 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1CCE 8B52 2C MOV EDX,DWORD PTR DS:[EDX+2C] 005C1CD1 B9 3C540000 MOV ECX,543C 005C1CD6 A1 A0C75C00 MOV EAX,DWORD PTR DS:[5CC7A0] 005C1CDB E8 A8D8FFFF CALL VP2.005BF588 005C1CE0 8B0D CC775C00 MOV ECX,DWORD PTR DS:[5C77CC] 005C1CE6 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 005C1CE9 8D85 54FEFFFF LEA EAX,DWORD PTR SS:[EBP-1AC] 005C1CEF 8B15 9CC75C00 MOV EDX,DWORD PTR DS:[5CC79C] 005C1CF5 E8 8A23E4FF CALL VP2.00404084 005C1CFA 8B85 54FEFFFF MOV EAX,DWORD PTR SS:[EBP-1AC] 005C1D00 E8 F724E4FF CALL VP2.004041FC 005C1D05 50 PUSH EAX 005C1D06 E8 414FE4FF CALL <JMP.&KERNEL32.DeleteFileA> 005C1D0B E9 CD0D0000 JMP VP2.005C2ADD------------------------>重要地址 ------------------------------------------------------------------------------------- 005C2ADD 833D 94C75C00 0>CMP DWORD PTR DS:[5CC794],0------------>内存关键地址 005C2AE4 74 1F JE SHORT VP1.005C2B05 005C2AE6 833D 94C75C00 1>CMP DWORD PTR DS:[5CC794],14 005C2AED 74 16 JE SHORT VP1.005C2B05 005C2AEF 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],14----------->内存关键地址 005C2AF6 74 0D JE SHORT VP1.005C2B05 005C2AF8 833D 98C75C00 0>CMP DWORD PTR DS:[5CC798],0 005C2AFF 0F85 52010000 JNZ VP1.005C2C57 ------------------------------------------------------------------------------------- 005C2C57 833D 94C75C00 0>CMP DWORD PTR DS:[5CC794],0 005C2C5E 74 1F JE SHORT VP1.005C2C7F 005C2C60 833D 94C75C00 1>CMP DWORD PTR DS:[5CC794],14------------>内存关键地址 005C2C67 74 16 JE SHORT VP1.005C2C7F 005C2C69 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],14------------>内存关键地址 005C2C70 74 0D JE SHORT VP1.005C2C7F 005C2C72 833D 98C75C00 0>CMP DWORD PTR DS:[5CC798],0 005C2C79 0F85 52010000 JNZ VP1.005C2DD1 ------------------------------------------------------------------------------------- 005C2DD1 833D 94C75C00 0>CMP DWORD PTR DS:[5CC794],0 005C2DD8 74 1F JE SHORT VP1.005C2DF9 005C2DDA 833D 94C75C00 1>CMP DWORD PTR DS:[5CC794],14------------>内存关键地址 005C2DE1 74 16 JE SHORT VP1.005C2DF9 005C2DE3 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],14------------>内存关键地址 005C2DEA 74 0D JE SHORT VP1.005C2DF9 005C2DEC 833D 98C75C00 0>CMP DWORD PTR DS:[5CC798],0 005C2DF3 0F85 52010000 JNZ VP1.005C2F4B ------------------------------------------------------------------------------------- 005C2F4B A1 68795C00 MOV EAX,DWORD PTR DS:[5C7968] 005C2F50 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F52 E8 19BDE8FF CALL VP1.0044EC70 005C2F57 8B0D EC7A5C00 MOV ECX,DWORD PTR DS:[5C7AEC] 005C2F5D A1 68795C00 MOV EAX,DWORD PTR DS:[5C7968] 005C2F62 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F64 8B15 24995A00 MOV EDX,DWORD PTR DS:[5A9924] 005C2F6A E8 19BDE8FF CALL VP1.0044EC88 005C2F6F A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2F74 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F76 8B15 94C75C00 MOV EDX,DWORD PTR DS:[5CC794] 005C2F7C 8990 440D0000 MOV DWORD PTR DS:[EAX+D44],EDX 005C2F82 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2F87 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F89 8B15 98C75C00 MOV EDX,DWORD PTR DS:[5CC798] 005C2F8F 8990 480D0000 MOV DWORD PTR DS:[EAX+D48],EDX 005C2F95 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2F9A 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F9C C680 4C0D0000 0>MOV BYTE PTR DS:[EAX+D4C],0 005C2FA3 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2FA8 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FAA C680 380D0000 0>MOV BYTE PTR DS:[EAX+D38],0 005C2FB1 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2FB6 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FB8 C680 4D0D0000 0>MOV BYTE PTR DS:[EAX+D4D],0 005C2FBF A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2FC4 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FC6 8B15 EC7A5C00 MOV EDX,DWORD PTR DS:[5C7AEC] 005C2FCC 8B12 MOV EDX,DWORD PTR DS:[EDX] 005C2FCE 8982 B4020000 MOV DWORD PTR DS:[EDX+2B4],EAX 005C2FD4 C782 B0020000 6>MOV DWORD PTR DS:[EDX+2B0],VP1.005AE964 005C2FDE A1 68795C00 MOV EAX,DWORD PTR DS:[5C7968] 005C2FE3 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FE5 E8 1EBDE8FF CALL VP1.0044ED08---------------------------->这个CALL呼叫启动对话框 005C2FEA E8 79C2FFFF CALL VP1.005BF268 根据上面跟踪到的内存关键地址，更改以下代码： 005C1CA6 84C0 TEST AL,AL----------------------->[0x1C10A6] 005C1CA8 74 66 JE SHORT VP1.005C1D10 005C1CAA 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1CB0 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 005C1CB3 B9 75670000 MOV ECX,6775 005C1CB8 A1 9CC75C00 MOV EAX,DWORD PTR DS:[5CC79C] 005C1CBD E8 CAD9FFFF CALL VP1.005BF68C 更改为以下代码： 005C1CA6 C705 94C75C00 01000000 MOV DWORD PTR DS:[5CC794],1 005C1CB0 C705 98C75C00 01000000 MOV DWORD PTR DS:[5CC798],1 005C1CBA E9 1E0E0000 JMP VP1.005C2ADD 005C1CBF 90 NOP 005C1CC0 90 NOP 005C1CC1 90 NOP 从版本上看这个软件应该在英语口语对话王2004 B0402之后，但是总体感觉这个软件的难度要大于英语口语对话王 2004-5-21 18:48 0
sungy 雪币： 547 活跃值： (2200) 能力值： ( LV7，RANK：100 ) 在线值：发帖 146 回帖 665 粉丝 31 关注私信	sungy 1 11 楼继续努力了！ 2004-7-8 17:36 0
wofan[OCN] 雪币： 2943 活跃值： (1788) 能力值： ( LV9，RANK：850 ) 在线值：发帖 55 回帖 808 粉丝 8 关注私信	wofan[OCN] 21 12 楼精采！真的， 2004-8-2 22:09 0
sungy 雪币： 547 活跃值： (2200) 能力值： ( LV7，RANK：100 ) 在线值：发帖 146 回帖 665 粉丝 31 关注私信	sungy 1 13 楼这东西会让wasm32等自动结束 2004-8-6 15:08 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

东南破佛

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (12)
东南破佛雪币： 387 活跃值： (216) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 57 粉丝 1 关注私信	东南破佛 1 2 楼出现NAG后根据堆栈一步一步往上找找到如下代码: 0053471A . 8B00 MOV EAX,DWORD PTR DS:[EAX] 0053471C . E8 CFA5F1FF CALL DUMP14.0044ECF0------------------------->带过这个则出现NAG 00534721 . E8 72DFFFFF CALL DUMP14.00532698 00534726 . E9 DE1C0000 JMP DUMP14.00536409 0053472B > 33C0 XOR EAX,EAX 0053472D . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] ; DUMP14.0053E7A8 省略 00534975 . 33D2 XOR EDX,EDX 00534977 . 8990 E8020000 MOV DWORD PTR DS:[EAX+2E8],EDX 0053497D . 8990 EC020000 MOV DWORD PTR DS:[EAX+2EC],EDX 00534983 . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00534988 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 0053498A . E8 61A3F1FF CALL DUMP14.0044ECF0----------------------->带过这个出现NAG 0053498F . E8 04DDFFFF CALL DUMP14.00532698 00534994 . E9 701A0000 JMP DUMP14.00536409 00534999 > A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 省略 00534CFC . B9 75670000 MOV ECX,6775 00534D01 . A1 5CEB5300 MOV EAX,DWORD PTR DS:[53EB5C] 00534D06 . E8 ADDCFFFF CALL DUMP14.005329B8 00534D0B . E9 B7100000 JMP DUMP14.00535DC7----------------------> 00534D10 > E8 9BD9FFFF CALL DUMP14.005326B0------------------------>这里来自534288 00534D15 . 803D 80EB5300>CMP BYTE PTR DS:[53EB80],1 00534D1C . 74 43 JE SHORT DUMP14.00534D61 00534D1E . 803D 81EB5300>CMP BYTE PTR DS:[53EB81],1 00534D25 . 74 3A JE SHORT DUMP14.00534D61 00534D27 . 803D 82EB5300>CMP BYTE PTR DS:[53EB82],1 00534D2E . 74 31 JE SHORT DUMP14.00534D61 00534D30 . 803D 83EB5300>CMP BYTE PTR DS:[53EB83],1 00534D37 . 74 28 JE SHORT DUMP14.00534D61 00534D39 . 803D 84EB5300>CMP BYTE PTR DS:[53EB84],1 00534D40 . 74 1F JE SHORT DUMP14.00534D61 00534D42 . 803D 85EB5300>CMP BYTE PTR DS:[53EB85],1 00534D49 . 74 16 JE SHORT DUMP14.00534D61 00534D4B . 803D 86EB5300>CMP BYTE PTR DS:[53EB86],1 00534D52 . 74 0D JE SHORT DUMP14.00534D61 00534D54 . 803D 87EB5300>CMP BYTE PTR DS:[53EB87],1 00534D5B . 0F85 52010000 JNZ DUMP14.00534EB3 00534D61 > A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 省略 00534E9D . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00534EA2 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00534EA4 . E8 479EF1FF CALL DUMP14.0044ECF0--------------------------->带过这个则出现NAG 00534EA9 . E8 EAD7FFFF CALL DUMP14.00532698 00534EAE . E9 56150000 JMP DUMP14.00536409 00534EB3 > A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 00534EB8 . 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30] 00534EBB . 83C0 18 ADD EAX,18 00534EBE . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534EC4 . 8B52 74 MOV EDX,DWORD PTR DS:[EDX+74] 00534EC7 . E8 E0EEECFF CALL DUMP14.00403DAC 00534ECC . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534ED2 . 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 00534ED5 . B9 01000000 MOV ECX,1 00534EDA . A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 00534EDF . E8 14FDF2FF CALL DUMP14.00464BF8 00534EE4 . A3 58EB5300 MOV DWORD PTR DS:[53EB58],EAX-------------->关键数值◎◎◎◎◎ 00534EE9 . 68 5A2C0000 PUSH 2C5A 00534EEE . 8D85 48FEFFFF LEA EAX,DWORD PTR SS:[EBP-1B8] 00534EF4 . 50 PUSH EAX 00534EF5 . B9 BE570000 MOV ECX,57BE 00534EFA . BA 680A0000 MOV EDX,0A68 00534EFF . B8 F0645300 MOV EAX,DUMP14.005364F0 ; ASCII ";O" 00534F04 . E8 FB1FFCFF CALL DUMP14.004F6F04 00534F09 . 8B85 48FEFFFF MOV EAX,DWORD PTR SS:[EBP-1B8] 00534F0F . E8 283FEDFF CALL DUMP14.00408E3C 00534F14 . 3B05 58EB5300 CMP EAX,DWORD PTR DS:[53EB58] 00534F1A . 7D 30 JGE SHORT DUMP14.00534F4C 00534F1C . 68 5A2C0000 PUSH 2C5A 00534F21 . 8D85 44FEFFFF LEA EAX,DWORD PTR SS:[EBP-1BC] 00534F27 . 50 PUSH EAX 00534F28 . B9 BE570000 MOV ECX,57BE 00534F2D . BA 680A0000 MOV EDX,0A68 00534F32 . B8 F0645300 MOV EAX,DUMP14.005364F0 ; ASCII ";O" 00534F37 . E8 C81FFCFF CALL DUMP14.004F6F04 00534F3C . 8B85 44FEFFFF MOV EAX,DWORD PTR SS:[EBP-1BC] 00534F42 . E8 F53EEDFF CALL DUMP14.00408E3C 00534F47 . A3 58EB5300 MOV DWORD PTR DS:[53EB58],EAX-------------->关键数值◎◎◎◎◎ 00534F4C > FF05 58EB5300 INC DWORD PTR DS:[53EB58] 00534F52 . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534F58 . 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 00534F5B . 8B0D 58EB5300 MOV ECX,DWORD PTR DS:[53EB58] 00534F61 . A1 50EB5300 MOV EAX,DWORD PTR DS:[53EB50] 00534F66 . E8 49FEF2FF CALL DUMP14.00464DB4 00534F6B . 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] 00534F71 . 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 00534F74 . 8D85 40FEFFFF LEA EAX,DWORD PTR SS:[EBP-1C0] 00534F7A . 8B15 5CEB5300 MOV EDX,DWORD PTR DS:[53EB5C] 00534F80 . E8 9FF0ECFF CALL DUMP14.00404024 00534F85 . 8B85 40FEFFFF MOV EAX,DWORD PTR SS:[EBP-1C0] 00534F8B . E8 3840EDFF CALL DUMP14.00408FC8 00534F90 . 84C0 TEST AL,AL 00534F92 . 74 66 JE SHORT DUMP14.00534FFA 00534F94 . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534F9A . 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 00534F9D . B9 75670000 MOV ECX,6775 00534FA2 . A1 5CEB5300 MOV EAX,DWORD PTR DS:[53EB5C] 00534FA7 . E8 10DBFFFF CALL DUMP14.00532ABC 00534FAC . FF05 54EB5300 INC DWORD PTR DS:[53EB54] 00534FB2 . 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] 00534FB8 . 8B52 2C MOV EDX,DWORD PTR DS:[EDX+2C] 00534FBB . B9 3C540000 MOV ECX,543C 00534FC0 . A1 60EB5300 MOV EAX,DWORD PTR DS:[53EB60] 00534FC5 . E8 EED9FFFF CALL DUMP14.005329B8 00534FCA . 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] 00534FD0 . 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 00534FD3 . 8D85 3CFEFFFF LEA EAX,DWORD PTR SS:[EBP-1C4] 00534FD9 . 8B15 5CEB5300 MOV EDX,DWORD PTR DS:[53EB5C] 00534FDF . E8 40F0ECFF CALL DUMP14.00404024 00534FE4 . 8B85 3CFEFFFF MOV EAX,DWORD PTR SS:[EBP-1C4] 00534FEA . E8 ADF1ECFF CALL DUMP14.0040419C 00534FEF . 50 PUSH EAX ; /FileName = "" 00534FF0 . E8 171DEDFF CALL <JMP.&KERNEL32.DeleteFileA> ; \DeleteFileA 00534FF5 . E9 CD0D0000 JMP DUMP14.00535DC7 00534FFA > 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] 省略 00535969 . E8 2EE8ECFF CALL DUMP14.0040419C 0053596E . 50 PUSH EAX ; /FileName = "" 0053596F . E8 9813EDFF CALL <JMP.&KERNEL32.DeleteFileA> ; \DeleteFileA 00535974 . E9 4E040000 JMP DUMP14.00535DC7 00535979 > 8B0D 6C9E5300 MOV ECX,DWORD PTR DS:[539E6C] ; DUMP14.0053E7A8 省略 00535B0D . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00535B12 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535B14 . E8 D791F1FF CALL DUMP14.0044ECF0------------------------->带过这个则出现NAG 00535B19 . E8 7ACBFFFF CALL DUMP14.00532698 00535B1E . E9 E6080000 JMP DUMP14.00536409 00535B23 > A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 省略 00535C64 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535C66 . E8 8590F1FF CALL DUMP14.0044ECF0-------------------------->带过这个则出现NAG 00535C6B . E8 28CAFFFF CALL DUMP14.00532698 00535C70 . E9 94070000 JMP DUMP14.00536409 00535C75 > A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 省略 00535D9B . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535D9D . 8B80 00030000 MOV EAX,DWORD PTR DS:[EAX+300] 00535DA3 . 33D2 XOR EDX,EDX 00535DA5 . 8990 E8020000 MOV DWORD PTR DS:[EAX+2E8],EDX 00535DAB . 8990 EC020000 MOV DWORD PTR DS:[EAX+2EC],EDX 00535DB1 . A1 9C9F5300 MOV EAX,DWORD PTR DS:[539F9C] 00535DB6 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 00535DB8 . E8 338FF1FF CALL DUMP14.0044ECF0------------------------->带过这个出现NAG 00535DBD . E8 D6C8FFFF CALL DUMP14.00532698 00535DC2 . E9 42060000 JMP DUMP14.00536409 00535DC7 > 833D 54EB5300>CMP DWORD PTR DS:[53EB54],0------------------>跳到这里可以避免上面从 00534288 处跳 00534D5B 处跳到 00534EB3 然后根据内存 0053EB58 处的数字值执行某一个DeleteFileA 函数(?)，随后跳转到 00535DC7 内存 0053EB54 处保存使用次数 00532ABC 处CALL修改 53EB54 （532BE7） 00534EDF 和 00534F47 处CALL返回的EAX值最终存放到 53EB58 对比软件超过使用次数前后的流程可以对软件改造如下： 00534F90 . 84C0 TEST AL,AL-------------------------------[134590] 00534F92 74 66 JE SHORT DUMP14.00534FFA----------------->这里不跳走则执行最初的一个DeleteFileA 00534F94 8B15 6C9E5300 MOV EDX,DWORD PTR DS:[539E6C] ; DUMP14.0053E7A8 00534F9A 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 00534F9D B9 75670000 MOV ECX,6775 00534FA2 A1 5CEB5300 MOV EAX,DWORD PTR DS:[53EB5C] 00534FA7 E8 10DBFFFF CALL DUMP14.00532ABC －－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－改造后代码如下: 00534F90 C705 58EB5300 01000000 MOV DWORD PTR DS:[53EB58],1 00534F9A C705 54EB5300 01000000 MOV DWORD PTR DS:[53EB54],1 00534FA4 E9 1E0E0000 JMP DUMP14.00535DC7 00534FA9 90 NOP 00534FAA 90 NOP 00534FAB 90 NOP 更改之后,运行正常,使用次数永远是1 ====================================================== 后记: 这个软件除了这个使用次数限制外还有使用时间限制(每次使用时间为1小时),使用功能限制,但是我的水平太低了,这个去反跟踪和使用次数限制比较简单一点,正好适合我们才鸟练习.其他的留给其他老大做吧 2004-5-15 18:36 0
luckynt 雪币： 221 活跃值： (100) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 36 粉丝 0 关注私信	luckynt 3 楼先顶一下``````` 慢慢看 2004-5-15 18:42 0
MengLong 雪币： 279 活跃值： (435) 能力值： ( LV9，RANK：250 ) 在线值：发帖 14 回帖 125 粉丝 2 关注私信	MengLong 6 4 楼先收藏 2004-5-16 14:04 0
无名和尚雪币： 272 活跃值： (340) 能力值： ( LV4，RANK：50 ) 在线值：发帖 11 回帖 111 粉丝 1 关注私信	无名和尚 1 5 楼一般这种neg都有一个timer控件控制,我想这一个小时的时间限制也应该是由timer控件控制的.让我找找不行,脱壳脱不干净.资源编辑不了,用freeres也不行 2004-5-16 15:06 0
iamocean 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 42 粉丝 0 关注私信	iamocean 6 楼虽然现在看不大明白，但偶相信偶的水平会慢慢提高的！！ 2004-5-16 22:56 0
狗剩雪币： 124 活跃值： (107) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 119 粉丝 2 关注私信	狗剩 1 7 楼你直接用Prodump就可以脱了掉没隐藏Prodump标题直接脱掉了么？呵呵，看看你系统help目录文件被删了几个;) 2004-5-17 03:05 0
aqtata 雪币： 319 活跃值： (1091) 能力值： ( LV7，RANK：100 ) 在线值：发帖 76 回帖 358 粉丝 2 关注私信	aqtata 2 8 楼最初由狗剩发布你直接用Prodump就可以脱了掉没隐藏Prodump标题直接脱掉了么？呵呵，看看你系统help目录文件被删了几个;) 说话都有高手的味道！！大哥能说一说怎么隐藏标题么,插件还是什么?? 2004-5-17 14:58 0
狗剩雪币： 124 活跃值： (107) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 119 粉丝 2 关注私信	狗剩 1 9 楼最初由 aqtata 发布说话都有高手的味道！！大哥能说一说怎么隐藏标题么,插件还是什么?? 哪里是啥高手呀，我前些天也在跟踪这个软件啦。。。至于隐藏标题，龙[D.4s]写了一款cool隐藏窗口标题的工具。很不错的说：） http://shjianye.51.net/window.rar 2004-5-17 19:28 0
东南破佛雪币： 387 活跃值： (216) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 57 粉丝 1 关注私信	东南破佛 1 10 楼有声有色2004 B0224 这个软件给我们的是试用版的程序,有20次限制正式版需要作者发给我们…… 去掉限制吧 UPX加壳（做了手脚的），用GUW32最好了是Delphi的作品用OD载入过程中直接退出不会别的办法，只能用笨办法了。在出现第一个提示时按回车，然后快速按F12，让程序暂停然后利用下断点 bp EnumWindows，可以找到类似与英语口语对话王2004中的代码每次只能中断到下面的一个 005B12D4 005B12CD 6A 00 PUSH 0----------------------------------->[0x1B06CD] 005B12CF 68 08D35A00 PUSH VP.005AD308 005B12D4 E8 4B60E5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005A7341 6A 00 PUSH 0----------------------------------->[0x1A6741] 005A7343 68 74595A00 PUSH VP1.005A5974 005A7348 E8 D7FFE5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005A75B3 6A 00 PUSH 0----------------------------------->[0x1A69B3] 005A75B5 68 74595A00 PUSH VP1.005A5974 005A75BA E8 65FDE5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005A7792 6A 00 PUSH 0----------------------------------->[0x1A6B92] 005A7794 68 74595A00 PUSH VP1.005A5974 005A7799 E8 86FBE5FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里 005BFEE0 6A 00 PUSH 0----------------------------------->[0x1BF2E0] 005BFEE2 68 60DF5B00 PUSH VP.005BDF60 005BFEE7 E8 3874E4FF CALL <JMP.&USER32.EnumWindows>----------->NOP到这里上面这些断点都修改之后就可以调试了 ========================================================================================== 005C1C19 A1 90C75C00 MOV EAX,DWORD PTR DS:[5CC790] 005C1C1E 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30] 005C1C21 83C0 18 ADD EAX,18 005C1C24 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1C2A 8B52 74 MOV EDX,DWORD PTR DS:[EDX+74] 005C1C2D E8 DA21E4FF CALL VP2.00403E0C 005C1C32 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1C38 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 005C1C3B B9 01000000 MOV ECX,1 005C1C40 A1 90C75C00 MOV EAX,DWORD PTR DS:[5CC790] 005C1C45 E8 EA34EAFF CALL VP2.00465134 005C1C4A A3 98C75C00 MOV DWORD PTR DS:[5CC798],EAX------------>EAX=0x14已经使用的次数 005C1C4F 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],13------------->比较 005C1C56 7E 0A JLE SHORT VP2.005C1C62 005C1C58 C705 98C75C00 1>MOV DWORD PTR DS:[5CC798],13 005C1C62 FF05 98C75C00 INC DWORD PTR DS:[5CC798] 005C1C68 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1C6E 8B52 20 MOV EDX,DWORD PTR DS:[EDX+20] 005C1C71 8B0D 98C75C00 MOV ECX,DWORD PTR DS:[5CC798] 005C1C77 A1 90C75C00 MOV EAX,DWORD PTR DS:[5CC790] 005C1C7C E8 6F36EAFF CALL VP2.004652F0 005C1C81 8B0D CC775C00 MOV ECX,DWORD PTR DS:[5C77CC] 005C1C87 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 005C1C8A 8D85 58FEFFFF LEA EAX,DWORD PTR SS:[EBP-1A8] 005C1C90 8B15 9CC75C00 MOV EDX,DWORD PTR DS:[5CC79C] 005C1C96 E8 E923E4FF CALL VP2.00404084 005C1C9B 8B85 58FEFFFF MOV EAX,DWORD PTR SS:[EBP-1A8] 005C1CA1 E8 6673E4FF CALL VP2.0040900C 005C1CA6 84C0 TEST AL,AL-------------------------->这里更改 005C1CA8 74 66 JE SHORT VP2.005C1D10 005C1CAA 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1CB0 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 005C1CB3 B9 75670000 MOV ECX,6775 005C1CB8 A1 9CC75C00 MOV EAX,DWORD PTR DS:[5CC79C] 005C1CBD E8 CAD9FFFF CALL VP2.005BF68C 005C1CC2 FF05 94C75C00 INC DWORD PTR DS:[5CC794] 005C1CC8 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1CCE 8B52 2C MOV EDX,DWORD PTR DS:[EDX+2C] 005C1CD1 B9 3C540000 MOV ECX,543C 005C1CD6 A1 A0C75C00 MOV EAX,DWORD PTR DS:[5CC7A0] 005C1CDB E8 A8D8FFFF CALL VP2.005BF588 005C1CE0 8B0D CC775C00 MOV ECX,DWORD PTR DS:[5C77CC] 005C1CE6 8B49 28 MOV ECX,DWORD PTR DS:[ECX+28] 005C1CE9 8D85 54FEFFFF LEA EAX,DWORD PTR SS:[EBP-1AC] 005C1CEF 8B15 9CC75C00 MOV EDX,DWORD PTR DS:[5CC79C] 005C1CF5 E8 8A23E4FF CALL VP2.00404084 005C1CFA 8B85 54FEFFFF MOV EAX,DWORD PTR SS:[EBP-1AC] 005C1D00 E8 F724E4FF CALL VP2.004041FC 005C1D05 50 PUSH EAX 005C1D06 E8 414FE4FF CALL <JMP.&KERNEL32.DeleteFileA> 005C1D0B E9 CD0D0000 JMP VP2.005C2ADD------------------------>重要地址 ------------------------------------------------------------------------------------- 005C2ADD 833D 94C75C00 0>CMP DWORD PTR DS:[5CC794],0------------>内存关键地址 005C2AE4 74 1F JE SHORT VP1.005C2B05 005C2AE6 833D 94C75C00 1>CMP DWORD PTR DS:[5CC794],14 005C2AED 74 16 JE SHORT VP1.005C2B05 005C2AEF 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],14----------->内存关键地址 005C2AF6 74 0D JE SHORT VP1.005C2B05 005C2AF8 833D 98C75C00 0>CMP DWORD PTR DS:[5CC798],0 005C2AFF 0F85 52010000 JNZ VP1.005C2C57 ------------------------------------------------------------------------------------- 005C2C57 833D 94C75C00 0>CMP DWORD PTR DS:[5CC794],0 005C2C5E 74 1F JE SHORT VP1.005C2C7F 005C2C60 833D 94C75C00 1>CMP DWORD PTR DS:[5CC794],14------------>内存关键地址 005C2C67 74 16 JE SHORT VP1.005C2C7F 005C2C69 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],14------------>内存关键地址 005C2C70 74 0D JE SHORT VP1.005C2C7F 005C2C72 833D 98C75C00 0>CMP DWORD PTR DS:[5CC798],0 005C2C79 0F85 52010000 JNZ VP1.005C2DD1 ------------------------------------------------------------------------------------- 005C2DD1 833D 94C75C00 0>CMP DWORD PTR DS:[5CC794],0 005C2DD8 74 1F JE SHORT VP1.005C2DF9 005C2DDA 833D 94C75C00 1>CMP DWORD PTR DS:[5CC794],14------------>内存关键地址 005C2DE1 74 16 JE SHORT VP1.005C2DF9 005C2DE3 833D 98C75C00 1>CMP DWORD PTR DS:[5CC798],14------------>内存关键地址 005C2DEA 74 0D JE SHORT VP1.005C2DF9 005C2DEC 833D 98C75C00 0>CMP DWORD PTR DS:[5CC798],0 005C2DF3 0F85 52010000 JNZ VP1.005C2F4B ------------------------------------------------------------------------------------- 005C2F4B A1 68795C00 MOV EAX,DWORD PTR DS:[5C7968] 005C2F50 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F52 E8 19BDE8FF CALL VP1.0044EC70 005C2F57 8B0D EC7A5C00 MOV ECX,DWORD PTR DS:[5C7AEC] 005C2F5D A1 68795C00 MOV EAX,DWORD PTR DS:[5C7968] 005C2F62 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F64 8B15 24995A00 MOV EDX,DWORD PTR DS:[5A9924] 005C2F6A E8 19BDE8FF CALL VP1.0044EC88 005C2F6F A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2F74 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F76 8B15 94C75C00 MOV EDX,DWORD PTR DS:[5CC794] 005C2F7C 8990 440D0000 MOV DWORD PTR DS:[EAX+D44],EDX 005C2F82 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2F87 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F89 8B15 98C75C00 MOV EDX,DWORD PTR DS:[5CC798] 005C2F8F 8990 480D0000 MOV DWORD PTR DS:[EAX+D48],EDX 005C2F95 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2F9A 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2F9C C680 4C0D0000 0>MOV BYTE PTR DS:[EAX+D4C],0 005C2FA3 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2FA8 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FAA C680 380D0000 0>MOV BYTE PTR DS:[EAX+D38],0 005C2FB1 A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2FB6 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FB8 C680 4D0D0000 0>MOV BYTE PTR DS:[EAX+D4D],0 005C2FBF A1 EC7A5C00 MOV EAX,DWORD PTR DS:[5C7AEC] 005C2FC4 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FC6 8B15 EC7A5C00 MOV EDX,DWORD PTR DS:[5C7AEC] 005C2FCC 8B12 MOV EDX,DWORD PTR DS:[EDX] 005C2FCE 8982 B4020000 MOV DWORD PTR DS:[EDX+2B4],EAX 005C2FD4 C782 B0020000 6>MOV DWORD PTR DS:[EDX+2B0],VP1.005AE964 005C2FDE A1 68795C00 MOV EAX,DWORD PTR DS:[5C7968] 005C2FE3 8B00 MOV EAX,DWORD PTR DS:[EAX] 005C2FE5 E8 1EBDE8FF CALL VP1.0044ED08---------------------------->这个CALL呼叫启动对话框 005C2FEA E8 79C2FFFF CALL VP1.005BF268 根据上面跟踪到的内存关键地址，更改以下代码： 005C1CA6 84C0 TEST AL,AL----------------------->[0x1C10A6] 005C1CA8 74 66 JE SHORT VP1.005C1D10 005C1CAA 8B15 CC775C00 MOV EDX,DWORD PTR DS:[5C77CC] 005C1CB0 8B52 28 MOV EDX,DWORD PTR DS:[EDX+28] 005C1CB3 B9 75670000 MOV ECX,6775 005C1CB8 A1 9CC75C00 MOV EAX,DWORD PTR DS:[5CC79C] 005C1CBD E8 CAD9FFFF CALL VP1.005BF68C 更改为以下代码： 005C1CA6 C705 94C75C00 01000000 MOV DWORD PTR DS:[5CC794],1 005C1CB0 C705 98C75C00 01000000 MOV DWORD PTR DS:[5CC798],1 005C1CBA E9 1E0E0000 JMP VP1.005C2ADD 005C1CBF 90 NOP 005C1CC0 90 NOP 005C1CC1 90 NOP 从版本上看这个软件应该在英语口语对话王2004 B0402之后，但是总体感觉这个软件的难度要大于英语口语对话王 2004-5-21 18:48 0
sungy 雪币： 547 活跃值： (2200) 能力值： ( LV7，RANK：100 ) 在线值：发帖 146 回帖 665 粉丝 31 关注私信	sungy 1 11 楼继续努力了！ 2004-7-8 17:36 0
wofan[OCN] 雪币： 2943 活跃值： (1788) 能力值： ( LV9，RANK：850 ) 在线值：发帖 55 回帖 808 粉丝 8 关注私信	wofan[OCN] 21 12 楼精采！真的， 2004-8-2 22:09 0
sungy 雪币： 547 活跃值： (2200) 能力值： ( LV7，RANK：100 ) 在线值：发帖 146 回帖 665 粉丝 31 关注私信	sungy 1 13 楼这东西会让wasm32等自动结束 2004-8-6 15:08 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复