[求助]大难题，希望高人出手-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] [求助]大难题，希望高人出手 0.00雪花

发表于: 2009-6-3 14:56 3842

[旧帖] [求助]大难题，希望高人出手 0.00雪花

xyzfxg

2009-6-3 14:56

3842

本人汇编基础差，刚开始学习破解。近来，正在破解一个程序。开始想用字符串查找关键字，但该软件没有明显的提示，没有办法只能借助API来试验。下面说下我的操作步骤：
一是安装程序，对exe查壳，是Microsoft Visual C++ 6.0，无壳
二是od打开程序，F9运行，出现登陆窗口，随便填写用户名和密码，这时我没有按确定按钮
三是在反汇编窗口按ctrl+n，来到输入窗口，查到getwindowtextA，按右键查找输入函数参考，一共有11项，全部下断，然后转到程序的登入窗口，点确定按钮，程序被截断。经查找，是API函数截断的共有2处，地址分别为006fd587和006fdb77，所以我确定这两处应该是关键call或者是关键call所在位置附近的代码。
四是转到od的反汇编窗口查看两处代码。你猜怎么着，大部分代码的意思我看不明白，傻眼了，哈哈！！分析了半天不得头绪，无法判断下步该怎么办。
  特来求助，希望有高人飘过，出个思路，指点一下，应该如何操作来发现关键call啊！下面是两处的截图，希望高人费神：
006FD587  |.  FF15 F8E67300 CALL DWORD PTR DS:[<&USER32.GetWindowTex>; \GetWindowTextA（第一个断点）
006FD58D  |.  3BC6       CMP EAX,ESI
006FD58F    75 14       JNZ SHORT dzh2.006FD5A5
006FD591  |.  FF75 0C    PUSH DWORD PTR SS:[EBP+C]             ; /String2
006FD594  |.  8D85 00FFFFFF LEA EAX,DWORD PTR SS:[EBP-100]          ; |
006FD59A  |.  50          PUSH EAX                               ; |String1
006FD59B  |.  FF15 D0E37300 CALL DWORD PTR DS:[<&KERNEL32.lstrcmpA>] ; \lstrcmpA
006FD5A1  |.  85C0       TEST EAX,EAX
006FD5A3  |.  74 0C       JE SHORT dzh2.006FD5B1
006FD5A5  |>  FF75 0C    PUSH DWORD PTR SS:[EBP+C]             ; /Text
006FD5A8  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
006FD5AB  |.  FF15 A4E67300 CALL DWORD PTR DS:[<&USER32.SetWindowTex>; \SetWindowTextA
006FD5B1  |>  5E          POP ESI
006FD5B2  |.  C9          LEAVE
006FD5B3  \.  C2 0800    RETN 8
006FD5B6  /$  56          PUSH ESI
006FD5B7  |.  8B7424 08    MOV ESI,DWORD PTR SS:[ESP+8]
006FD5BB  |.  8B06       MOV EAX,DWORD PTR DS:[ESI]
006FD5BD  |.  85C0       TEST EAX,EAX
006FD5BF  |.  74 0A       JE SHORT dzh2.006FD5CB
006FD5C1  |.  50          PUSH EAX                               ; /hObject
006FD5C2  |.  FF15 28E27300 CALL DWORD PTR DS:[<&GDI32.DeleteObject>>; \DeleteObject
006FD5C8  |.  8326 00    AND DWORD PTR DS:[ESI],0
006FD5CB  |>  5E          POP ESI
006FD5CC  \.  C2 0400    RETN 4
006FD5CF  /$  53          PUSH EBX
006FD5D0  |.  56          PUSH ESI
006FD5D1  |.  57          PUSH EDI
006FD5D2  |.  FF15 70E87300 CALL DWORD PTR DS:[<&USER32.GetFocus>] ; [GetFocus
006FD5D8  |.  8BF0       MOV ESI,EAX
006FD5DA  |.  85F6       TEST ESI,ESI
006FD5DC  |.  74 62       JE SHORT dzh2.006FD640
006FD5DE  |.  8B7C24 10    MOV EDI,DWORD PTR SS:[ESP+10]
006FD5E2  |.  3BF7       CMP ESI,EDI
006FD5E4  |.  74 5A       JE SHORT dzh2.006FD640
006FD5E6  |.  6A 03       PUSH 3                                  ; /Arg2 = 00000003
006FD5E8  |.  56          PUSH ESI                               ; |Arg1
006FD5E9  |.  E8 86FEFFFF CALL dzh2.006FD474                      ; \dzh2.006FD474
006FD5EE  |.  8B1D 44E87300 MOV EBX,DWORD PTR DS:[<&USER32.GetParent>;  USER32.GetParent
006FD5F4  |.  85C0       TEST EAX,EAX
006FD5F6  |.  75 15       JNZ SHORT dzh2.006FD60D
006FD5F8  |.  56          PUSH ESI                               ; /hWnd
006FD5F9  |.  FFD3       CALL EBX                               ; \GetParent
006FD5FB  |.  8BF0       MOV ESI,EAX
006FD5FD  |.  3BF7       CMP ESI,EDI
006FD5FF  |.  74 3F       JE SHORT dzh2.006FD640
006FD601  |.  6A 02       PUSH 2                                  ; /Arg2 = 00000002
006FD603  |.  56          PUSH ESI                               ; |Arg1
006FD604  |.  E8 6BFEFFFF CALL dzh2.006FD474                      ; \dzh2.006FD474
006FD609  |.  85C0       TEST EAX,EAX
006FD60B  |.  74 33       JE SHORT dzh2.006FD640
006FD60D  |>  85FF       TEST EDI,EDI
006FD60F  |.  74 1F       JE SHORT dzh2.006FD630
006FD611  |.  6A F0       PUSH -10                               ; /Index = GWL_STYLE
006FD613  |.  57          PUSH EDI                               ; |hWnd
006FD614  |.  FF15 9CE87300 CALL DWORD PTR DS:[<&USER32.GetWindowLon>; \GetWindowLongA
006FD61A  |.  A9 00000040 TEST EAX,40000000
006FD61F  |.  74 0F       JE SHORT dzh2.006FD630
006FD621  |.  57          PUSH EDI
006FD622  |.  FFD3       CALL EBX
006FD624  |.  8BF8       MOV EDI,EAX
006FD626  |.  FF15 58E77300 CALL DWORD PTR DS:[<&USER32.GetDesktopWi>; [GetDesktopWindow
006FD62C  |.  3BF8       CMP EDI,EAX
006FD62E  |.  74 10       JE SHORT dzh2.006FD640
006FD630  |>  6A 00       PUSH 0                                  ; /lParam = 0
006FD632  |.  6A 00       PUSH 0                                  ; |wParam = 0
006FD634  |.  68 4F010000 PUSH 14F                               ; |Message = CB_SHOWDROPDOWN
006FD639  |.  56          PUSH ESI                               ; |hWnd
006FD63A  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FD640  |>  5F          POP EDI
006FD641  |.  5E          POP ESI
006FD642  |.  5B          POP EBX
006FD643  \.  C2 0400    RETN 4
006FD646  /$  57          PUSH EDI
006FD647  |.  8B7C24 08    MOV EDI,DWORD PTR SS:[ESP+8]
006FD64B  |.  85FF       TEST EDI,EDI
006FD64D  |.  74 29       JE SHORT dzh2.006FD678
006FD64F  |.  57          PUSH EDI                               ; /hMem
006FD650  |.  FF15 38E37300 CALL DWORD PTR DS:[<&KERNEL32.GlobalFlag>; \GlobalFlags
006FD656  |.  25 FF000000 AND EAX,0FF
006FD65B  |.  8BC8       MOV ECX,EAX
006FD65D  |.  48          DEC EAX
006FD65E  |.  85C9       TEST ECX,ECX
006FD660  |.  74 0F       JE SHORT dzh2.006FD671
006FD662  |.  56          PUSH ESI
006FD663  |.  8D70 01    LEA ESI,DWORD PTR DS:[EAX+1]
006FD666  |>  57          /PUSH EDI                               ; /hMem
006FD667  |.  FF15 8CE47300 |CALL DWORD PTR DS:[<&KERNEL32.GlobalUnl>; \GlobalUnlock
006FD66D  |.  4E          |DEC ESI
006FD66E  |.^ 75 F6       \JNZ SHORT dzh2.006FD666
006FD670  |.  5E          POP ESI
006FD671  |>  57          PUSH EDI                               ; /hMem
006FD672  |.  FF15 90E47300 CALL DWORD PTR DS:[<&KERNEL32.GlobalFree>; \GlobalFree
006FD678  |>  5F          POP EDI
006FD679  \.  C2 0400    RETN 4
006FD67C .  56          PUSH ESI
006FD67D .  E8 BDEF0000 CALL dzh2.0070C63F
006FD682 .  8BF0       MOV ESI,EAX
006FD684 .  85F6       TEST ESI,ESI
006FD686 .  74 3D       JE SHORT dzh2.006FD6C5
006FD688 .  8B46 0C    MOV EAX,DWORD PTR DS:[ESI+C]
006FD68B .  85C0       TEST EAX,EAX
006FD68D .  74 36       JE SHORT dzh2.006FD6C5
006FD68F .  50          PUSH EAX
006FD690 .  E8 429CFDFF CALL dzh2.006D72D7
006FD695 .  59          POP ECX
006FD696 .  8B4C24 08    MOV ECX,DWORD PTR SS:[ESP+8]
006FD69A .  8D51 04    LEA EDX,DWORD PTR DS:[ECX+4]
006FD69D .  3BC2       CMP EAX,EDX
006FD69F .  77 0F       JA SHORT dzh2.006FD6B0
006FD6A1 .  FF76 0C    PUSH DWORD PTR DS:[ESI+C]
006FD6A4 .  E8 BB64FDFF CALL dzh2.006D3B64
006FD6A9 .  8366 0C 00 AND DWORD PTR DS:[ESI+C],0
006FD6AD .  59          POP ECX
006FD6AE .  EB 10       JMP SHORT dzh2.006FD6C0
006FD6B0 >  2BC1       SUB EAX,ECX
006FD6B2 .  83E8 04    SUB EAX,4
006FD6B5 .  50          PUSH EAX
006FD6B6 .  FF76 0C    PUSH DWORD PTR DS:[ESI+C]
006FD6B9 .  E8 B59AFDFF CALL dzh2.006D7173
006FD6BE .  59          POP ECX
006FD6BF .  59          POP ECX

第二个断点：
006FDB77  |.  FF15 F8E67300 CALL DWORD PTR DS:[<&USER32.GetWindowTex>; \GetWindowTextA
006FDB7D  |.  8B4D 10    MOV ECX,DWORD PTR SS:[EBP+10]
006FDB80  |.  6A FF       PUSH -1
006FDB82  |.  E8 5478FFFF CALL dzh2.006F53DB
006FDB87  |.  EB 0B       JMP SHORT dzh2.006FDB94
006FDB89  |>  8B45 10    MOV EAX,DWORD PTR SS:[EBP+10]
006FDB8C  |.  FF30       PUSH DWORD PTR DS:[EAX]                ; /Arg2
006FDB8E  |.  56          PUSH ESI                               ; |Arg1
006FDB8F  |.  E8 CAF9FFFF CALL dzh2.006FD55E                      ; \dzh2.006FD55E
006FDB94  |>  5F          POP EDI
006FDB95  |.  5E          POP ESI
006FDB96  |.  5D          POP EBP
006FDB97  \.  C2 0C00    RETN 0C
006FDB9A  /$  56          PUSH ESI
006FDB9B  |.  8B7424 08    MOV ESI,DWORD PTR SS:[ESP+8]
006FDB9F  |.  57          PUSH EDI
006FDBA0  |.  8BCE       MOV ECX,ESI
006FDBA2  |.  FF7424 10    PUSH DWORD PTR SS:[ESP+10]             ; /Arg1
006FDBA6  |.  E8 C6FDFFFF CALL dzh2.006FD971                      ; \dzh2.006FD971
006FDBAB  |.  33FF       XOR EDI,EDI
006FDBAD  |.  393E       CMP DWORD PTR DS:[ESI],EDI
006FDBAF  |.  74 16       JE SHORT dzh2.006FDBC7
006FDBB1  |.  57          PUSH EDI                               ; /lParam => 0
006FDBB2  |.  57          PUSH EDI                               ; |wParam => 0
006FDBB3  |.  68 F0000000 PUSH 0F0                               ; |Message = BM_GETCHECK
006FDBB8  |.  50          PUSH EAX                               ; |hWnd
006FDBB9  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FDBBF  |.  8B4C24 14    MOV ECX,DWORD PTR SS:[ESP+14]
006FDBC3  |.  8901       MOV DWORD PTR DS:[ECX],EAX
006FDBC5  |.  EB 20       JMP SHORT dzh2.006FDBE7
006FDBC7  |>  8B4C24 14    MOV ECX,DWORD PTR SS:[ESP+14]
006FDBCB  |.  8B11       MOV EDX,DWORD PTR DS:[ECX]
006FDBCD  |.  3BD7       CMP EDX,EDI
006FDBCF  |.  7C 05       JL SHORT dzh2.006FDBD6
006FDBD1  |.  83FA 02    CMP EDX,2
006FDBD4  |.  7E 02       JLE SHORT dzh2.006FDBD8
006FDBD6  |>  8939       MOV DWORD PTR DS:[ECX],EDI
006FDBD8  |>  57          PUSH EDI                               ; /lParam
006FDBD9  |.  FF31       PUSH DWORD PTR DS:[ECX]                ; |wParam
006FDBDB  |.  68 F1000000 PUSH 0F1                               ; |Message = BM_SETCHECK
006FDBE0  |.  50          PUSH EAX                               ; |hWnd
006FDBE1  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FDBE7  |>  5F          POP EDI
006FDBE8  |.  5E          POP ESI
006FDBE9  \.  C2 0C00    RETN 0C
006FDBEC  /$  53          PUSH EBX
006FDBED  |.  55          PUSH EBP
006FDBEE  |.  56          PUSH ESI
006FDBEF  |.  57          PUSH EDI
006FDBF0  |.  8B7C24 14    MOV EDI,DWORD PTR SS:[ESP+14]
006FDBF4  |.  FF7424 18    PUSH DWORD PTR SS:[ESP+18]             ; /Arg1
006FDBF8  |.  8BCF       MOV ECX,EDI                            ; |
006FDBFA  |.  E8 72FDFFFF CALL dzh2.006FD971                      ; \dzh2.006FD971
006FDBFF  |.  33ED       XOR EBP,EBP
006FDC01  |.  8BF0       MOV ESI,EAX
006FDC03  |.  392F       CMP DWORD PTR DS:[EDI],EBP
006FDC05  |.  74 07       JE SHORT dzh2.006FDC0E
006FDC07  |.  8B4424 1C    MOV EAX,DWORD PTR SS:[ESP+1C]
006FDC0B  |.  8308 FF    OR DWORD PTR DS:[EAX],FFFFFFFF
006FDC0E  |>  8B3D C0E87300 MOV EDI,DWORD PTR DS:[<&USER32.SendMessa>;  USER32.SendMessageA
006FDC14  |.  33DB       XOR EBX,EBX
006FDC16  |>  55          /PUSH EBP
006FDC17  |.  55          |PUSH EBP
006FDC18  |.  68 87000000 |PUSH 87
006FDC1D  |.  56          |PUSH ESI
006FDC1E  |.  FFD7       |CALL EDI
006FDC20  |.  A8 40       |TEST AL,40
006FDC22  |.  74 33       |JE SHORT dzh2.006FDC57
006FDC24  |.  8B4424 14    |MOV EAX,DWORD PTR SS:[ESP+14]
006FDC28  |.  55          |PUSH EBP
006FDC29  |.  3928       |CMP DWORD PTR DS:[EAX],EBP
006FDC2B  |.  74 15       |JE SHORT dzh2.006FDC42
006FDC2D  |.  55          |PUSH EBP
006FDC2E  |.  68 F0000000 |PUSH 0F0
006FDC33  |.  56          |PUSH ESI
006FDC34  |.  FFD7       |CALL EDI
006FDC36  |.  85C0       |TEST EAX,EAX
006FDC38  |.  74 1C       |JE SHORT dzh2.006FDC56
006FDC3A  |.  8B4424 1C    |MOV EAX,DWORD PTR SS:[ESP+1C]
006FDC3E  |.  8918       |MOV DWORD PTR DS:[EAX],EBX
006FDC40  |.  EB 14       |JMP SHORT dzh2.006FDC56
006FDC42  |>  8B4C24 20    |MOV ECX,DWORD PTR SS:[ESP+20]
006FDC46  |.  33C0       |XOR EAX,EAX
006FDC48  |.  3B19       |CMP EBX,DWORD PTR DS:[ECX]
006FDC4A  |.  0F94C0       |SETE AL
006FDC4D  |.  50          |PUSH EAX
006FDC4E  |.  68 F1000000 |PUSH 0F1
006FDC53  |.  56          |PUSH ESI
006FDC54  |.  FFD7       |CALL EDI
006FDC56  |>  43          |INC EBX
006FDC57  |>  6A 02       |PUSH 2                               ; /Relation = GW_HWNDNEXT
006FDC59  |.  56          |PUSH ESI                               ; |hWnd
006FDC5A  |.  FF15 00E87300 |CALL DWORD PTR DS:[<&USER32.GetWindow>] ; \GetWindow
006FDC60  |.  8BF0       |MOV ESI,EAX
006FDC62  |.  3BF5       |CMP ESI,EBP
006FDC64  |.  74 10       |JE SHORT dzh2.006FDC76
006FDC66  |.  6A F0       |PUSH -10                               ; /Index = GWL_STYLE
006FDC68  |.  56          |PUSH ESI                               ; |hWnd
006FDC69  |.  FF15 9CE87300 |CALL DWORD PTR DS:[<&USER32.GetWindowLo>; \GetWindowLongA
006FDC6F  |.  A9 00000200 |TEST EAX,20000
006FDC74  |.^ 74 A0       \JE SHORT dzh2.006FDC16
006FDC76  |>  5F          POP EDI
006FDC77  |.  5E          POP ESI
006FDC78  |.  5D          POP EBP
006FDC79  |.  5B          POP EBX
006FDC7A  \.  C2 0C00    RETN 0C
006FDC7D  /$  55          PUSH EBP
006FDC7E  |.  8BEC       MOV EBP,ESP
006FDC80  |.  56          PUSH ESI
006FDC81  |.  8B75 08    MOV ESI,DWORD PTR SS:[EBP+8]
006FDC84  |.  57          PUSH EDI
006FDC85  |.  8BCE       MOV ECX,ESI
006FDC87  |.  FF75 0C    PUSH DWORD PTR SS:[EBP+C]             ; /Arg1
006FDC8A  |.  E8 E2FCFFFF CALL dzh2.006FD971                      ; \dzh2.006FD971
006FDC8F  |.  833E 00    CMP DWORD PTR DS:[ESI],0
006FDC92  |.  8BF8       MOV EDI,EAX
006FDC94  |.  74 40       JE SHORT dzh2.006FDCD6
006FDC96  |.  57          PUSH EDI                               ; /hWnd
006FDC97  |.  FF15 50E67300 CALL DWORD PTR DS:[<&USER32.GetWindowTex>; \GetWindowTextLengthA
006FDC9D  |.  85C0       TEST EAX,EAX
006FDC9F  |.  7E 0F       JLE SHORT dzh2.006FDCB0
006FDCA1  |.  8D48 01    LEA ECX,DWORD PTR DS:[EAX+1]
006FDCA4  |.  51          PUSH ECX
006FDCA5  |.  8B4D 10    MOV ECX,DWORD PTR SS:[EBP+10]
006FDCA8  |.  50          PUSH EAX
006FDCA9  |.  E8 5577FFFF CALL dzh2.006F5403
006FDCAE  |.  EB 12       JMP SHORT dzh2.006FDCC2
006FDCB0  |>  8B4D 10    MOV ECX,DWORD PTR SS:[EBP+10]
006FDCB3  |.  68 00010000 PUSH 100
006FDCB8  |.  68 FF000000 PUSH 0FF
006FDCBD  |.  E8 CA76FFFF CALL dzh2.006F538C
006FDCC2  |>  50          PUSH EAX                               ; |Buffer
006FDCC3  |.  57          PUSH EDI                               ; |hWnd
006FDCC4  |.  FF15 F8E67300 CALL DWORD PTR DS:[<&USER32.GetWindowTex>; \GetWindowTextA
006FDCCA  |.  8B4D 10    MOV ECX,DWORD PTR SS:[EBP+10]
006FDCCD  |.  6A FF       PUSH -1
006FDCCF  |.  E8 0777FFFF CALL dzh2.006F53DB
006FDCD4  |.  EB 20       JMP SHORT dzh2.006FDCF6
006FDCD6  |>  8B75 10    MOV ESI,DWORD PTR SS:[EBP+10]
006FDCD9  |.  FF36       PUSH DWORD PTR DS:[ESI]                ; /lParam
006FDCDB  |.  6A FF       PUSH -1                               ; |wParam = FFFFFFFF
006FDCDD  |.  68 4D010000 PUSH 14D                               ; |Message = CB_SELECTSTRING
006FDCE2  |.  57          PUSH EDI                               ; |hWnd
006FDCE3  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FDCE9  |.  83F8 FF    CMP EAX,-1
006FDCEC  |.  75 08       JNZ SHORT dzh2.006FDCF6
006FDCEE  |.  FF36       PUSH DWORD PTR DS:[ESI]                ; /Arg2
006FDCF0  |.  57          PUSH EDI                               ; |Arg1
006FDCF1  |.  E8 68F8FFFF CALL dzh2.006FD55E                      ; \dzh2.006FD55E
006FDCF6  |>  5F          POP EDI
006FDCF7  |.  5E          POP ESI
006FDCF8  |.  5D          POP EBP
006FDCF9  \.  C2 0C00    RETN 0C
006FDCFC  /$  56          PUSH ESI
006FDCFD  |.  8B7424 08    MOV ESI,DWORD PTR SS:[ESP+8]
006FDD01  |.  FF7424 0C    PUSH DWORD PTR SS:[ESP+C]             ; /Arg1
006FDD05  |.  8BCE       MOV ECX,ESI                            ; |
006FDD07  |.  E8 65FCFFFF CALL dzh2.006FD971                      ; \dzh2.006FD971
006FDD0C  |.  33C9       XOR ECX,ECX
006FDD0E  |.  390E       CMP DWORD PTR DS:[ESI],ECX
006FDD10  |.  5E          POP ESI
006FDD11  |.  51          PUSH ECX                               ; /lParam => 0
006FDD12  |.  74 15       JE SHORT dzh2.006FDD29                ; |
006FDD14  |.  51          PUSH ECX                               ; |wParam => 0
006FDD15  |.  68 47010000 PUSH 147                               ; |Message = CB_GETCURSEL
006FDD1A  |.  50          PUSH EAX                               ; |hWnd
006FDD1B  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FDD21  |.  8B4C24 0C    MOV ECX,DWORD PTR SS:[ESP+C]
006FDD25  |.  8901       MOV DWORD PTR DS:[ECX],EAX
006FDD27  |.  EB 12       JMP SHORT dzh2.006FDD3B
006FDD29  |>  8B4C24 10    MOV ECX,DWORD PTR SS:[ESP+10]          ; |
006FDD2D  |.  FF31       PUSH DWORD PTR DS:[ECX]                ; |wParam
006FDD2F  |.  68 4E010000 PUSH 14E                               ; |Message = CB_SETCURSEL
006FDD34  |.  50          PUSH EAX                               ; |hWnd
006FDD35  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FDD3B  \>  C2 0C00    RETN 0C
006FDD3E  /$  B8 BCB47300 MOV EAX,dzh2.0073B4BC
006FDD43  |.  E8 242EFDFF CALL dzh2.006D0B6C
006FDD48  |.  83EC 40    SUB ESP,40
006FDD4B  |.  57          PUSH EDI
006FDD4C  |.  8B7D 08    MOV EDI,DWORD PTR SS:[EBP+8]
006FDD4F  |.  833F 00    CMP DWORD PTR DS:[EDI],0
006FDD52  |.  74 6E       JE SHORT dzh2.006FDDC2
006FDD54  |.  56          PUSH ESI
006FDD55  |.  8B35 3CE87300 MOV ESI,DWORD PTR DS:[<&USER32.wsprintfA>;  USER32.wsprintfA
006FDD5B  |.  FF75 0C    PUSH DWORD PTR SS:[EBP+C]
006FDD5E  |.  8D45 B4    LEA EAX,DWORD PTR SS:[EBP-4C]
006FDD61  |.  FF75 14    PUSH DWORD PTR SS:[EBP+14]             ; |Format
006FDD64  |.  50          PUSH EAX                               ; |s
006FDD65  |.  FFD6       CALL ESI                               ; \wsprintfA
006FDD67  |.  83C4 0C    ADD ESP,0C
006FDD6A  |.  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]
006FDD6D  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]
006FDD70  |.  FF75 14    PUSH DWORD PTR SS:[EBP+14]
006FDD73  |.  50          PUSH EAX
006FDD74  |.  FFD6       CALL ESI
006FDD76  |.  A1 7CBB7E00 MOV EAX,DWORD PTR DS:[7EBB7C]
006FDD7B  |.  83C4 0C    ADD ESP,0C
006FDD7E  |.  8945 08    MOV DWORD PTR SS:[EBP+8],EAX
006FDD81  |.  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]
006FDD84  |.  8365 FC 00 AND DWORD PTR SS:[EBP-4],0
006FDD88  |.  50          PUSH EAX
006FDD89  |.  8D45 B4    LEA EAX,DWORD PTR SS:[EBP-4C]
006FDD8C  |.  50          PUSH EAX
006FDD8D  |.  8D45 08    LEA EAX,DWORD PTR SS:[EBP+8]
006FDD90  |.  FF75 18    PUSH DWORD PTR SS:[EBP+18]
006FDD93  |.  50          PUSH EAX
006FDD94  |.  E8 170A0000 CALL dzh2.006FE7B0
006FDD99  |.  FF75 18    PUSH DWORD PTR SS:[EBP+18]             ; /Arg3
006FDD9C  |.  6A 30       PUSH 30                               ; |Arg2 = 00000030
006FDD9E  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |Arg1
006FDDA1  |.  E8 64020000 CALL dzh2.006FE00A                      ; \dzh2.006FE00A
006FDDA6  |.  8D4D 08    LEA ECX,DWORD PTR SS:[EBP+8]
006FDDA9  |.  E8 3971FFFF CALL dzh2.006F4EE7
006FDDAE  |.  8BCF       MOV ECX,EDI
006FDDB0  |.  E8 EBFBFFFF CALL dzh2.006FD9A0
006FDDB5  |.  834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
006FDDB9  |.  8D4D 08    LEA ECX,DWORD PTR SS:[EBP+8]
006FDDBC  |.  E8 9B71FFFF CALL dzh2.006F4F5C
006FDDC1  |.  5E          POP ESI
006FDDC2  |>  8B4D F4    MOV ECX,DWORD PTR SS:[EBP-C]
006FDDC5  |.  5F          POP EDI
006FDDC6  |.  64:890D 00000>MOV DWORD PTR FS:[0],ECX
006FDDCD  |.  C9          LEAVE
006FDDCE  \.  C2 1400    RETN 14
006FDDD1  /$  55          PUSH EBP
006FDDD2  |.  8BEC       MOV EBP,ESP
006FDDD4  |.  8B45 0C    MOV EAX,DWORD PTR SS:[EBP+C]
006FDDD7  |.  3B45 10    CMP EAX,DWORD PTR SS:[EBP+10]
006FDDDA  |.  7C 05       JL SHORT dzh2.006FDDE1
006FDDDC  |.  3B45 14    CMP EAX,DWORD PTR SS:[EBP+14]
006FDDDF  |.  7E 18       JLE SHORT dzh2.006FDDF9
006FDDE1  |>  68 12F10000 PUSH 0F112
006FDDE6  |.  68 B47E7600 PUSH dzh2.00767EB4
006FDDEB  |.  FF75 14    PUSH DWORD PTR SS:[EBP+14]
006FDDEE  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]
006FDDF1  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]
006FDDF4  |.  E8 45FFFFFF CALL dzh2.006FDD3E
006FDDF9  |>  5D          POP EBP
006FDDFA  \.  C2 1000    RETN 10
006FDDFD  /$  B8 D0B47300 MOV EAX,dzh2.0073B4D0
006FDE02  |.  E8 652DFDFF CALL dzh2.006D0B6C
006FDE07  |.  83EC 20    SUB ESP,20
006FDE0A  |.  56          PUSH ESI
006FDE0B  |.  57          PUSH EDI
006FDE0C  |.  8B7D 08    MOV EDI,DWORD PTR SS:[EBP+8]
006FDE0F  |.  33F6       XOR ESI,ESI
006FDE11  |.  3937       CMP DWORD PTR DS:[EDI],ESI
006FDE13  |.  74 68       JE SHORT dzh2.006FDE7D
006FDE15  |.  8B45 0C    MOV EAX,DWORD PTR SS:[EBP+C]
006FDE18  |.  8B00       MOV EAX,DWORD PTR DS:[EAX]
006FDE1A  |.  8B40 F8    MOV EAX,DWORD PTR DS:[EAX-8]
006FDE1D  |.  3B45 10    CMP EAX,DWORD PTR SS:[EBP+10]
006FDE20  |.  7E 5B       JLE SHORT dzh2.006FDE7D
006FDE22  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]             ; /<%d>
006FDE25  |.  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]          ; |
006FDE28  |.  68 B8067B00 PUSH dzh2.007B06B8                      ; |Format = "%d"
006FDE2D  |.  50          PUSH EAX                               ; |s
006FDE2E  |.  FF15 3CE87300 CALL DWORD PTR DS:[<&USER32.wsprintfA>]  ; \wsprintfA
006FDE34  |.  A1 7CBB7E00 MOV EAX,DWORD PTR DS:[7EBB7C]
006FDE39  |.  83C4 0C    ADD ESP,0C
006FDE3C  |.  8945 10    MOV DWORD PTR SS:[EBP+10],EAX
006FDE3F  |.  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]
006FDE42  |.  8975 FC    MOV DWORD PTR SS:[EBP-4],ESI
006FDE45  |.  50          PUSH EAX
006FDE46  |.  BE 14F10000 MOV ESI,0F114
006FDE4B  |.  8D45 10    LEA EAX,DWORD PTR SS:[EBP+10]
006FDE4E  |.  56          PUSH ESI
006FDE4F  |.  50          PUSH EAX
006FDE50  |.  E8 44090000 CALL dzh2.006FE799
006FDE55  |.  56          PUSH ESI                               ; /Arg3
006FDE56  |.  6A 30       PUSH 30                               ; |Arg2 = 00000030
006FDE58  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]             ; |Arg1
006FDE5B  |.  E8 AA010000 CALL dzh2.006FE00A                      ; \dzh2.006FE00A
006FDE60  |.  8D4D 10    LEA ECX,DWORD PTR SS:[EBP+10]
006FDE63  |.  E8 7F70FFFF CALL dzh2.006F4EE7
006FDE68  |.  8BCF       MOV ECX,EDI
006FDE6A  |.  E8 31FBFFFF CALL dzh2.006FD9A0
006FDE6F  |.  834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
006FDE73  |.  8D4D 10    LEA ECX,DWORD PTR SS:[EBP+10]
006FDE76  |.  E8 E170FFFF CALL dzh2.006F4F5C
006FDE7B  |.  EB 1C       JMP SHORT dzh2.006FDE99
006FDE7D  |>  8B47 08    MOV EAX,DWORD PTR DS:[EDI+8]
006FDE80  |.  3BC6       CMP EAX,ESI
006FDE82  |.  74 15       JE SHORT dzh2.006FDE99
006FDE84  |.  3977 0C    CMP DWORD PTR DS:[EDI+C],ESI
006FDE87  |.  74 10       JE SHORT dzh2.006FDE99
006FDE89  |.  56          PUSH ESI                               ; /lParam
006FDE8A  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]             ; |wParam
006FDE8D  |.  68 C5000000 PUSH 0C5                               ; |Message = EM_LIMITTEXT
006FDE92  |.  50          PUSH EAX                               ; |hWnd
006FDE93  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FDE99  |>  8B4D F4    MOV ECX,DWORD PTR SS:[EBP-C]
006FDE9C  |.  5F          POP EDI
006FDE9D  |.  5E          POP ESI
006FDE9E  |.  64:890D 00000>MOV DWORD PTR FS:[0],ECX
006FDEA5  |.  C9          LEAVE
006FDEA6  \.  C2 0C00    RETN 0C
006FDEA9  /$  56          PUSH ESI
006FDEAA  |.  57          PUSH EDI
006FDEAB  |.  8B7C24 14    MOV EDI,DWORD PTR SS:[ESP+14]
006FDEAF  |.  837F 1C 00 CMP DWORD PTR DS:[EDI+1C],0
006FDEB3  |.  75 3B       JNZ SHORT dzh2.006FDEF0
006FDEB5  |.  8B7424 0C    MOV ESI,DWORD PTR SS:[ESP+C]
006FDEB9  |.  FF7424 10    PUSH DWORD PTR SS:[ESP+10]             ; /Arg1
006FDEBD  |.  8BCE       MOV ECX,ESI                            ; |
006FDEBF  |.  E8 ADFAFFFF CALL dzh2.006FD971                      ; \dzh2.006FD971
006FDEC4  |.  50          PUSH EAX
006FDEC5  |.  8BCF       MOV ECX,EDI
006FDEC7  |.  E8 B162FFFF CALL dzh2.006F417D
006FDECC  |.  85C0       TEST EAX,EAX
006FDECE  |.  75 07       JNZ SHORT dzh2.006FDED7
006FDED0  |.  E8 FEDFFEFF CALL dzh2.006EBED3
006FDED5  |.  EB 19       JMP SHORT dzh2.006FDEF0
006FDED7  |>  FF77 1C    PUSH DWORD PTR DS:[EDI+1C]             ; /hWnd
006FDEDA  |.  8B76 04    MOV ESI,DWORD PTR DS:[ESI+4]          ; |
006FDEDD  |.  FF15 44E87300 CALL DWORD PTR DS:[<&USER32.GetParent>]  ; \GetParent
006FDEE3  |.  3946 1C    CMP DWORD PTR DS:[ESI+1C],EAX
006FDEE6  |.  74 08       JE SHORT dzh2.006FDEF0
006FDEE8  |.  56          PUSH ESI
006FDEE9  |.  8BCF       MOV ECX,EDI
006FDEEB  |.  E8 2E68FFFF CALL dzh2.006F471E
006FDEF0  |>  5F          POP EDI
006FDEF1  |.  5E          POP ESI
006FDEF2  \.  C2 0C00    RETN 0C
006FDEF5  /$  56          PUSH ESI
006FDEF6  |.  E8 ED7EDCFF CALL dzh2.004C5DE8
006FDEFB  |.  8BF0       MOV ESI,EAX
006FDEFD  |.  85F6       TEST ESI,ESI
006FDEFF  |.  74 1E       JE SHORT dzh2.006FDF1F
006FDF01  |.  8B06       MOV EAX,DWORD PTR DS:[ESI]
006FDF03  |.  8BCE       MOV ECX,ESI
006FDF05  |.  FF90 B0000000 CALL DWORD PTR DS:[EAX+B0]
006FDF0B  |.  85C0       TEST EAX,EAX
006FDF0D  |.  74 10       JE SHORT dzh2.006FDF1F
006FDF0F  |.  8B4E 68    MOV ECX,DWORD PTR DS:[ESI+68]
006FDF12  |.  85C9       TEST ECX,ECX
006FDF14  |.  74 09       JE SHORT dzh2.006FDF1F
006FDF16  |.  8B01       MOV EAX,DWORD PTR DS:[ECX]
006FDF18  |.  FF7424 08    PUSH DWORD PTR SS:[ESP+8]
006FDF1C  |.  FF50 64    CALL DWORD PTR DS:[EAX+64]
006FDF1F  |>  5E          POP ESI
006FDF20  \.  C2 0400    RETN 4
006FDF23  /$  55          PUSH EBP
006FDF24  |.  8BEC       MOV EBP,ESP
006FDF26  |.  81EC 14010000 SUB ESP,114
006FDF2C  |.  53          PUSH EBX
006FDF2D  |.  56          PUSH ESI
006FDF2E  |.  57          PUSH EDI
006FDF2F  |.  33DB       XOR EBX,EBX
006FDF31  |.  8BF9       MOV EDI,ECX
006FDF33  |.  53          PUSH EBX
006FDF34  |.  897D F0    MOV DWORD PTR SS:[EBP-10],EDI
006FDF37  |.  E8 B9FFFFFF CALL dzh2.006FDEF5
006FDF3C  |.  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
006FDF3F  |.  50          PUSH EAX
006FDF40  |.  53          PUSH EBX
006FDF41  |.  E8 55010000 CALL dzh2.006FE09B
006FDF46  |.  33F6       XOR ESI,ESI
006FDF48  |.  3BC3       CMP EAX,EBX
006FDF4A  |.  8945 F4    MOV DWORD PTR SS:[EBP-C],EAX
006FDF4D  |.  74 18       JE SHORT dzh2.006FDF67
006FDF4F  |.  53          PUSH EBX                               ; /lParam
006FDF50  |.  53          PUSH EBX                               ; |wParam
006FDF51  |.  68 76030000 PUSH 376                               ; |Message = MSG(376)
006FDF56  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]             ; |hWnd
006FDF59  |.  FF15 C0E87300 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \SendMessageA
006FDF5F  |.  3BC3       CMP EAX,EBX
006FDF61  |.  74 04       JE SHORT dzh2.006FDF67
006FDF63  |.  8BF0       MOV ESI,EAX
006FDF65  |.  EB 0A       JMP SHORT dzh2.006FDF71
006FDF67  |>  3BFB       CMP EDI,EBX
006FDF69  |.  74 06       JE SHORT dzh2.006FDF71
006FDF6B  |.  8DB7 9C000000 LEA ESI,DWORD PTR DS:[EDI+9C]
006FDF71  |>  3BF3       CMP ESI,EBX
006FDF73  |.  895D F8    MOV DWORD PTR SS:[EBP-8],EBX
006FDF76  |.  74 13       JE SHORT dzh2.006FDF8B
006FDF78  |.  8B06       MOV EAX,DWORD PTR DS:[ESI]
006FDF7A  |.  8945 F8    MOV DWORD PTR SS:[EBP-8],EAX
006FDF7D  |.  8B45 10    MOV EAX,DWORD PTR SS:[EBP+10]
006FDF80  |.  3BC3       CMP EAX,EBX
006FDF82  |.  74 07       JE SHORT dzh2.006FDF8B
006FDF84  |.  05 00000300 ADD EAX,30000
006FDF89  |.  8906       MOV DWORD PTR DS:[ESI],EAX
006FDF8B  |>  8B5D 0C    MOV EBX,DWORD PTR SS:[EBP+C]
006FDF8E  |.  F6C3 F0    TEST BL,0F0
006FDF91  |.  75 17       JNZ SHORT dzh2.006FDFAA
006FDF93  |.  8BC3       MOV EAX,EBX
006FDF95  |.  83E0 0F    AND EAX,0F
006FDF98  |.  83F8 01    CMP EAX,1

呵呵，啰嗦了这么多，希望大家一起探讨，一起进步。我将按你的思路走下去，直到.........

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・0

免费・0

支持

最新回复 (8)
billstone 雪币： 339 活跃值： (10) 能力值： ( LV9，RANK：260 ) 在线值：发帖 12 回帖 190 粉丝 0 关注私信	billstone 6 2 楼我汗，好长的代码 2009-6-3 15:14 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 3 楼哈哈，这只是截取了一部分。希望给点建议也好啊！！实在没有办法才发帖求教啊，各位大哥大姐不要看看就走啊！！ 2009-6-3 15:49 0
nantz 雪币： 238 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 136 粉丝 0 关注私信	nantz 4 楼地方是对的,可继续跟踪,看看有没有anti. 2009-6-3 15:56 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 5 楼终于高人露面。是不是说他有反跟踪程序啊！我曾经在第一断点处首先清除断点，然后用f8一路按下来，结构发现到了一个位置，出现返回指令后，程序又运回起始行了，这是不是反跟踪啊。另外想请教下，我应该学点什么知识，可以看懂上面的东东啊！！！！！！！！！！ 2009-6-3 16:08 0
nantz 雪币： 238 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 136 粉丝 0 关注私信	nantz 6 楼学点seh ,异常. 2009-6-3 16:18 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 7 楼 seh，异常指什么啊？说明白些可以吗？ 2009-6-3 16:23 0
ucantseeme 雪币： 442 活跃值： (43) 能力值： ( LV2，RANK：10 ) 在线值：发帖 46 回帖 990 粉丝 1 关注私信	ucantseeme 8 楼大智慧2 字数补丁.exe 2009-6-3 18:03 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 9 楼哈哈，看样是高人，可是我还是不太明白，能说清楚点吗？？ 2009-6-3 19:44 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

xyzfxg

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (8)
billstone 雪币： 339 活跃值： (10) 能力值： ( LV9，RANK：260 ) 在线值：发帖 12 回帖 190 粉丝 0 关注私信	billstone 6 2 楼我汗，好长的代码 2009-6-3 15:14 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 3 楼哈哈，这只是截取了一部分。希望给点建议也好啊！！实在没有办法才发帖求教啊，各位大哥大姐不要看看就走啊！！ 2009-6-3 15:49 0
nantz 雪币： 238 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 136 粉丝 0 关注私信	nantz 4 楼地方是对的,可继续跟踪,看看有没有anti. 2009-6-3 15:56 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 5 楼终于高人露面。是不是说他有反跟踪程序啊！我曾经在第一断点处首先清除断点，然后用f8一路按下来，结构发现到了一个位置，出现返回指令后，程序又运回起始行了，这是不是反跟踪啊。另外想请教下，我应该学点什么知识，可以看懂上面的东东啊！！！！！！！！！！ 2009-6-3 16:08 0
nantz 雪币： 238 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 136 粉丝 0 关注私信	nantz 6 楼学点seh ,异常. 2009-6-3 16:18 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 7 楼 seh，异常指什么啊？说明白些可以吗？ 2009-6-3 16:23 0
ucantseeme 雪币： 442 活跃值： (43) 能力值： ( LV2，RANK：10 ) 在线值：发帖 46 回帖 990 粉丝 1 关注私信	ucantseeme 8 楼大智慧2 字数补丁.exe 2009-6-3 18:03 0
xyzfxg 雪币： 25 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 58 粉丝 0 关注私信	xyzfxg 9 楼哈哈，看样是高人，可是我还是不太明白，能说清楚点吗？？ 2009-6-3 19:44 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复