该程序是个绿色版，只有一个exe和三个DLL：
C:\CAD\CADe_SIMU.exe
C:\CAD\MFC42D.DLL
C:\CAD\MFCO42D.DLL
C:\CAD\MSVCRTD.DLL
用ollydbg调试，输入函数只是显示：
006AE05C .idata 输入 MFC42D.#1019
006AE164 .idata 输入 MFC42D.#1033
之类的，没法其知道是在哪里确定的窗口样式。
下断CreateWindowExa，回溯
5F42D4F5 >/$ 55 push ebp
5F42D4F6 |. 8BEC mov ebp, esp
5F42D4F8 |. 83EC 38 sub esp, 38
5F42D4FB |. 53 push ebx
5F42D4FC |. 56 push esi
5F42D4FD |. 57 push edi
5F42D4FE |. 894D C8 mov dword ptr [ebp-38], ecx
5F42D501 |. 8B45 08 mov eax, dword ptr [ebp+8]
5F42D504 |. 8945 F8 mov dword ptr [ebp-8], eax
5F42D507 |. 8B4D 0C mov ecx, dword ptr [ebp+C]
5F42D50A |. 894D F4 mov dword ptr [ebp-C], ecx
5F42D50D |. 8B55 10 mov edx, dword ptr [ebp+10]
5F42D510 |. 8955 F0 mov dword ptr [ebp-10], edx
5F42D513 |. 8B45 14 mov eax, dword ptr [ebp+14]
5F42D516 |. 8945 EC mov dword ptr [ebp-14], eax
5F42D519 |. 8B4D 18 mov ecx, dword ptr [ebp+18]
5F42D51C |. 894D E8 mov dword ptr [ebp-18], ecx
5F42D51F |. 8B55 1C mov edx, dword ptr [ebp+1C]
5F42D522 |. 8955 E4 mov dword ptr [ebp-1C], edx
5F42D525 |. 8B45 20 mov eax, dword ptr [ebp+20]
5F42D528 |. 8945 E0 mov dword ptr [ebp-20], eax
5F42D52B |. 8B4D 24 mov ecx, dword ptr [ebp+24]
5F42D52E |. 894D DC mov dword ptr [ebp-24], ecx
5F42D531 |. 8B55 28 mov edx, dword ptr [ebp+28]
5F42D534 |. 8955 D8 mov dword ptr [ebp-28], edx
5F42D537 |. 8B45 2C mov eax, dword ptr [ebp+2C]
5F42D53A |. 8945 D4 mov dword ptr [ebp-2C], eax
5F42D53D |. E8 1BDB0400 call #1096
5F42D542 |. 8945 D0 mov dword ptr [ebp-30], eax
5F42D545 |. 8B4D 30 mov ecx, dword ptr [ebp+30]
5F42D548 |. 894D CC mov dword ptr [ebp-34], ecx
5F42D54B |. 8D55 CC lea edx, dword ptr [ebp-34]
5F42D54E |. 52 push edx
5F42D54F |. 8B45 C8 mov eax, dword ptr [ebp-38]
5F42D552 |. 8B10 mov edx, dword ptr [eax]
5F42D554 |. 8B4D C8 mov ecx, dword ptr [ebp-38]
5F42D557 |. FF52 64 call dword ptr [edx+64]
5F42D55A |. 85C0 test eax, eax
5F42D55C |. 75 15 jnz short 5F42D573
5F42D55E |. 8B45 C8 mov eax, dword ptr [ebp-38]
5F42D561 |. 8B10 mov edx, dword ptr [eax]
5F42D563 |. 8B4D C8 mov ecx, dword ptr [ebp-38]
5F42D566 |. FF92 AC000000 call dword ptr [edx+AC]
5F42D56C |. 33C0 xor eax, eax
5F42D56E |. E9 A7000000 jmp 5F42D61A
5F42D573 |> 8B45 C8 mov eax, dword ptr [ebp-38]
5F42D576 |. 50 push eax ; /Arg1
5F42D577 |. E8 FAFDFFFF call #1113 ; \#1113
5F42D57C |. 8B4D CC mov ecx, dword ptr [ebp-34]
5F42D57F |. 51 push ecx ; /lParam
5F42D580 |. 8B55 D0 mov edx, dword ptr [ebp-30] ; |
5F42D583 |. 52 push edx ; |hInst
5F42D584 |. 8B45 D4 mov eax, dword ptr [ebp-2C] ; |
5F42D587 |. 50 push eax ; |hMenu
5F42D588 |. 8B4D D8 mov ecx, dword ptr [ebp-28] ; |
5F42D58B |. 51 push ecx ; |hParent
5F42D58C |. 8B55 DC mov edx, dword ptr [ebp-24] ; |
5F42D58F |. 52 push edx ; |Height
5F42D590 |. 8B45 E0 mov eax, dword ptr [ebp-20] ; |
5F42D593 |. 50 push eax ; |Width
5F42D594 |. 8B4D E4 mov ecx, dword ptr [ebp-1C] ; |
5F42D597 |. 51 push ecx ; |Y
5F42D598 |. 8B55 E8 mov edx, dword ptr [ebp-18] ; |
5F42D59B |. 52 push edx ; |X
5F42D59C |. 8B45 EC mov eax, dword ptr [ebp-14] ; |
5F42D59F |. 50 push eax ; |Style
5F42D5A0 |. 8B4D F0 mov ecx, dword ptr [ebp-10] ; |
5F42D5A3 |. 51 push ecx ; |WindowName
5F42D5A4 |. 8B55 F4 mov edx, dword ptr [ebp-C] ; |
5F42D5A7 |. 52 push edx ; |Class
5F42D5A8 |. 8B45 F8 mov eax, dword ptr [ebp-8] ; |
5F42D5AB |. 50 push eax ; |ExtStyle
5F42D5AC |. FF15 F4B84A5F call dword ptr [<&USER32.CreateWindow>; \CreateWindowExA
不知道是不是在
5F42D59C |. 8B45 EC mov eax, dword ptr [ebp-14] ; |
5F42D59F |. 50 push eax ; |Style
确定style的值，这时候是
eax=00CF8000
MFC42D.#1658+0AA
但是最后形成的窗口样式值却是：54CFC000
不知道最后在哪里改变了？
[课程]FART 脱壳王！加量不加价！FART作者讲授！
