能力值:
( LV4,RANK:50 )
|
-
-
4 楼
调试的时候发现一输入注册码就自动跳走了。不知道咋回事。后来跟了一下。。发现了这里
0040299B . FF35 80524200 push dword ptr [<&KERNEL32.ExitProces>; kernel32.ExitProcess
004029A1 . A1 84524200 mov eax, dword ptr [<&KERNEL32.Outpu>
004029A6 . FFE0 jmp eax
004029A8 > E8 53F2FFFF call 00401C00
004029AD . 8B4D 08 mov ecx, dword ptr [ebp+8]
004029B0 . 3B48 1C cmp ecx, dword ptr [eax+1C]
004029B3 E9 89000000 jnz 00402A41 ;改为jmp
004029B9 > C745 FC 00000>mov dword ptr [ebp-4], 0
004029C0 . E8 3BF2FFFF call 00401C00
004029C5 . 8945 D4 mov dword ptr [ebp-2C], eax
004029C8 . 8B55 D4 mov edx, dword ptr [ebp-2C]
004029CB . 8B02 mov eax, dword ptr [edx]
004029CD . 8B4D D4 mov ecx, dword ptr [ebp-2C]
004029D0 . FF50 4C call dword ptr [eax+4C]
004029D3 . C745 FC FFFFF>mov dword ptr [ebp-4], -1
004029DA . EB 47 jmp short 00402A23
修改了跳转后可以正常跟踪,但是搞了半天没搞懂,。。。真晕。。。
0041CF5A |. 83C5 30 add ebp, 30
0041CF5D |> 397C24 18 /cmp dword ptr [esp+18], edi
0041CF61 |. 74 76 |je short 0041CFD9
0041CF63 |. 57 |push edi ; /RemoveMsg
0041CF64 |. 57 |push edi ; |MsgFilterMax
0041CF65 |. 57 |push edi ; |MsgFilterMin
0041CF66 |. 57 |push edi ; |hWnd
0041CF67 |. 55 |push ebp ; |pMsg
0041CF68 |. FF15 E0534200 |call dword ptr [<&USER32.PeekMessage>; \PeekMessageA
0041CF6E |. 85C0 |test eax, eax
0041CF70 |. 75 67 |jnz short 0041CFD9
0041CF72 |. 397C24 10 |cmp dword ptr [esp+10], edi
0041CF76 |. 74 12 |je short 0041CF8A
0041CF78 |. 6A 01 |push 1
0041CF7A |. 8BCE |mov ecx, esi
0041CF7C |. E8 F6060000 |call 0041D677
0041CF81 |. FF76 1C |push dword ptr [esi+1C]
0041CF84 |. FFD3 |call ebx
0041CF86 |. 897C24 10 |mov dword ptr [esp+10], edi
0041CF8A |> F64424 24 01 |test byte ptr [esp+24], 1
0041CF8F |. 75 1F |jnz short 0041CFB0
0041CF91 |. 397C24 1C |cmp dword ptr [esp+1C], edi
0041CF95 |. 74 19 |je short 0041CFB0
0041CF97 |. 397C24 14 |cmp dword ptr [esp+14], edi
0041CF9B |. 75 13 |jnz short 0041CFB0
0041CF9D |. FF76 1C |push dword ptr [esi+1C] ; /lParam
0041CFA0 |. 57 |push edi ; |wParam
0041CFA1 |. 68 21010000 |push 121 ; |Message = WM_ENTERIDLE
0041CFA6 |. FF7424 28 |push dword ptr [esp+28] ; |hWnd
0041CFAA |. FF15 F8534200 |call dword ptr [<&USER32.SendMessage>; \SendMessageA
0041CFB0 |> F64424 24 02 |test byte ptr [esp+24], 2
0041CFB5 |. 75 1C |jnz short 0041CFD3
0041CFB7 |. 8B4424 14 |mov eax, dword ptr [esp+14]
0041CFBB |. FF4424 14 |inc dword ptr [esp+14]
0041CFBF |. 50 |push eax ; /lParam
0041CFC0 |. 57 |push edi ; |wParam
0041CFC1 |. 68 6A030000 |push 36A ; |Message = MSG(36A)
0041CFC6 |. FF76 1C |push dword ptr [esi+1C] ; |hWnd
0041CFC9 |. FF15 F8534200 |call dword ptr [<&USER32.SendMessage>; \SendMessageA
0041CFCF |. 85C0 |test eax, eax
0041CFD1 |.^ 75 8A |jnz short 0041CF5D
0041CFD3 |> 897C24 18 |mov dword ptr [esp+18], edi
0041CFD7 |.^ EB 84 |jmp short 0041CF5D
0041CFD9 |> E8 72C1FFFF |/call 00419150
0041CFDE |. 8B10 ||mov edx, dword ptr [eax]
0041CFE0 |. 8BC8 ||mov ecx, eax
0041CFE2 |. FF52 5C ||call dword ptr [edx+5C]
0041CFE5 |. 85C0 ||test eax, eax
0041CFE7 |. 74 65 ||je short 0041D04E
0041CFE9 |. 397C24 10 ||cmp dword ptr [esp+10], edi
0041CFED |. 74 23 ||je short 0041D012
0041CFEF |. 8B45 04 ||mov eax, dword ptr [ebp+4]
0041CFF2 |. 3D 18010000 ||cmp eax, 118
0041CFF7 |. 74 07 ||je short 0041D000
0041CFF9 |. 3D 04010000 ||cmp eax, 104
0041CFFE |. 75 12 ||jnz short 0041D012
0041D000 |> 6A 01 ||push 1
0041D002 |. 8BCE ||mov ecx, esi
0041D004 |. E8 6E060000 ||call 0041D677
0041D009 |. FF76 1C ||push dword ptr [esi+1C]
0041D00C |. FFD3 ||call ebx
0041D00E |. 897C24 10 ||mov dword ptr [esp+10], edi
0041D012 |> 8B06 ||mov eax, dword ptr [esi]
0041D014 |. 8BCE ||mov ecx, esi
0041D016 |. FF50 70 ||call dword ptr [eax+70]
0041D019 |. 85C0 ||test eax, eax
0041D01B |. 74 3C ||je short 0041D059
0041D01D |. E8 2EC1FFFF ||call 00419150
0041D022 |. 8B10 ||mov edx, dword ptr [eax]
0041D024 |. 55 ||push ebp
0041D025 |. 8BC8 ||mov ecx, eax
0041D027 |. FF52 64 ||call dword ptr [edx+64]
0041D02A |. 85C0 ||test eax, eax
0041D02C |. 74 0C ||je short 0041D03A
0041D02E |. C74424 18 010>||mov dword ptr [esp+18], 1
0041D036 |. 897C24 14 ||mov dword ptr [esp+14], edi
0041D03A |> 57 ||push edi ; /RemoveMsg
0041D03B |. 57 ||push edi ; |MsgFilterMax
0041D03C |. 57 ||push edi ; |MsgFilterMin
0041D03D |. 57 ||push edi ; |hWnd
0041D03E |. 55 ||push ebp ; |pMsg
0041D03F |. FF15 E0534200 ||call dword ptr [<&USER32.PeekMessag>; \PeekMessageA
0041D045 |. 85C0 ||test eax, eax
0041D047 |.^ 75 90 |\jnz short 0041CFD9
0041D049 |.^ E9 0FFFFFFF \jmp 0041CF5D
下面貌似出现了正确的提示。。。。。。。
00402220 . 64:A1 0000000>mov eax, dword ptr fs:[0]
00402226 . 6A FF push -1
00402228 . 68 E8414200 push 004241E8
0040222D . 50 push eax
0040222E . 64:8925 00000>mov dword ptr fs:[0], esp
00402235 . 83EC 14 sub esp, 14
00402238 . 53 push ebx
00402239 . E8 C2F9FFFF call 00401C00
0040223E . 8B10 mov edx, dword ptr [eax]
00402240 . 8BC8 mov ecx, eax
00402242 . FF52 2C call dword ptr [edx+2C]
00402245 . 84C0 test al, al
00402247 . 0F84 AB000000 je 004022F8
0040224D . 8A4424 07 mov al, byte ptr [esp+7]
00402251 . 55 push ebp
00402252 . 57 push edi
00402253 . 884424 10 mov byte ptr [esp+10], al
00402257 . BF E4E04200 mov edi, 0042E0E4 ; yes, you have done it.\ncongratulations!!
0040225C . 83C9 FF or ecx, FFFFFFFF
0040225F . 33C0 xor eax, eax
00402261 . 33DB xor ebx, ebx
00402263 . F2:AE repne scas byte ptr es:[edi]
00402265 . F7D1 not ecx
00402267 . 49 dec ecx
00402268 . 6A 01 push 1
0040226A . 8BE9 mov ebp, ecx
0040226C . 8D4C24 14 lea ecx, dword ptr [esp+14]
00402270 . 55 push ebp
00402271 . 895C24 1C mov dword ptr [esp+1C], ebx
00402275 . 895C24 20 mov dword ptr [esp+20], ebx
00402279 . 895C24 24 mov dword ptr [esp+24], ebx
0040227D . E8 0EF7FFFF call 00401990
00402282 . 84C0 test al, al
00402284 . 74 26 je short 004022AC
00402286 . 8B7C24 14 mov edi, dword ptr [esp+14]
0040228A . 8BCD mov ecx, ebp
0040228C . 8BD1 mov edx, ecx
0040228E . 56 push esi
0040228F . BE E4E04200 mov esi, 0042E0E4 ; yes, you have done it.\ncongratulations!!
00402294 . C1E9 02 shr ecx, 2
00402297 . F3:A5 rep movs dword ptr es:[edi], dword p>
00402299 . 8BCA mov ecx, edx
0040229B . 83E1 03 and ecx, 3
0040229E . F3:A4 rep movs byte ptr es:[edi], byte ptr>
004022A0 . 8B4424 18 mov eax, dword ptr [esp+18]
004022A4 . 896C24 1C mov dword ptr [esp+1C], ebp
004022A8 . 5E pop esi
004022A9 . 881C28 mov byte ptr [eax+ebp], bl
004022AC > 895C24 28 mov dword ptr [esp+28], ebx
004022B0 . E8 4BF9FFFF call 00401C00
004022B5 . 8B10 mov edx, dword ptr [eax]
004022B7 . 8D4C24 10 lea ecx, dword ptr [esp+10]
004022BB . 51 push ecx
004022BC . 8BC8 mov ecx, eax
004022BE . FF52 34 call dword ptr [edx+34]
004022C1 . 8B4424 14 mov eax, dword ptr [esp+14]
004022C5 . 5F pop edi
004022C6 . 3BC3 cmp eax, ebx
004022C8 . 5D pop ebp
004022C9 . 74 2D je short 004022F8
|
能力值:
(RANK:260 )
|
-
-
9 楼
[QUOTE=keheng;654265]调试的时候发现一输入注册码就自动跳走了。不知道咋回事。后来跟了一下。。发现了这里
0040299B . FF35 80524200 push dword ptr [<&KERNEL32.ExitProces>; kernel32.ExitProcess
00...[/QUOTE]
这里其实就是一点小把戏,其实是对执行时间进行判断的。
你后面跟到的消息处理过程的是MFC的代码,没有什么用。
|
能力值:
( LV2,RANK:10 )
|
-
-
15 楼
004029B0 . 3B48 1C CMP ECX,DWORD PTR DS:[EAX+1C]
004029B3 . E9 89000000 JMP CM02.00402A41 ; 把这里改为JMP
004029B8 90 NOP
004029B9 . C745 FC 00000>MOV DWORD PTR SS:[EBP-4],0
004029C0 . E8 3BF2FFFF CALL CM02.00401C00
004029C5 . 8945 D4 MOV DWORD PTR SS:[EBP-2C],EAX
004029C8 . 8B55 D4 MOV EDX,DWORD PTR SS:[EBP-2C]
004029CB . 8B02 MOV EAX,DWORD PTR DS:[EDX]
004029CD . 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C]
004029D0 . FF50 4C CALL DWORD PTR DS:[EAX+4C] ; 似乎这是进去就是异常检验
004029D3 . C745 FC FFFFF>MOV DWORD PTR SS:[EBP-4],-1
004029DA . EB 47 JMP SHORT CM02.00402A23
004029DC . 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
004029DF . 8B11 MOV EDX,DWORD PTR DS:[ECX]
004029E1 . 8B02 MOV EAX,DWORD PTR DS:[EDX]
004029E3 . 8945 D8 MOV DWORD PTR SS:[EBP-28],EAX
004029E6 . 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
004029E9 . 51 PUSH ECX
004029EA . 8B55 D8 MOV EDX,DWORD PTR SS:[EBP-28]
004029ED . 52 PUSH EDX
004029EE . E8 0DF2FFFF CALL CM02.00401C00
004029F3 . 8945 D0 MOV DWORD PTR SS:[EBP-30],EAX
004029F6 . 8B45 D0 MOV EAX,DWORD PTR SS:[EBP-30]
004029F9 . 8B10 MOV EDX,DWORD PTR DS:[EAX]
004029FB . 8B4D D0 MOV ECX,DWORD PTR SS:[EBP-30]
004029FE . FF52 18 CALL DWORD PTR DS:[EDX+18]
00402A01 . C3 RETN
00402A02 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]
00402A05 . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
00402A08 . 50 PUSH EAX
00402A09 . E8 F2F1FFFF CALL CM02.00401C00
00402A0E . 8945 CC MOV DWORD PTR SS:[EBP-34],EAX
00402A11 . 8B4D CC MOV ECX,DWORD PTR SS:[EBP-34]
00402A14 . 8B11 MOV EDX,DWORD PTR DS:[ECX]
00402A16 . 8B4D CC MOV ECX,DWORD PTR SS:[EBP-34]
00402A19 . FF52 28 CALL DWORD PTR DS:[EDX+28]
00402A1C . C745 FC FFFFF>MOV DWORD PTR SS:[EBP-4],-1
00402A23 > E8 D8F1FFFF CALL CM02.00401C00
00402A28 . 8B40 20 MOV EAX,DWORD PTR DS:[EAX+20]
00402A2B . 50 PUSH EAX ; /Timeout
00402A2C . FF15 7C524200 CALL DWORD PTR DS:[<&KERNEL32.Sleep>] ; \Sleep
00402A32 . B9 01000000 MOV ECX,1
00402A37 . 85C9 TEST ECX,ECX
00402A39 . 90 NOP ; 把这里用nop填充
00402A3A . 90 NOP
00402A3B . 90 NOP
00402A3C . 90 NOP
00402A3D . 90 NOP
00402A3E . 90 NOP
00402A3F . EB 35 JMP SHORT CM02.00402A76
00402A41 > 6A 00 PUSH 0
00402A43 . 6A 00 PUSH 0
00402A45 . 6A 11 PUSH 11
这样好像就可以正常调试了!!!
|