这个外挂是个网络验证的,验证成功后就显示加入辅助按钮
用OD载入,下硬件执行断点he EnableWindow 点开启按钮,中断后F8走
77D29849 > 8BFF mov edi, edi
77D2984B 55 push ebp
77D2984C 8BEC mov ebp, esp
77D2984E 6A 60 push 60
77D29850 FF75 0C push dword ptr [ebp+C]
77D29853 FF75 08 push dword ptr [ebp+8]
77D29856 E8 DAFFFFFF call 77D29835
77D2985B 5D pop ebp
77D2985C C2 0800 retn 8 返回到022003F0
022003F0 /EB 0E jmp short 02200400
022003F2 |8B10 mov edx, dword ptr [eax]
022003F4 |FF7424 04 push dword ptr [esp+4]
022003F8 |8BC8 mov ecx, eax
022003FA |FF92 A8000000 call dword ptr [edx+A8]
02200400 \C2 0400 retn 4 返回到021A87C2
021A87C2 /E9 F0040000 jmp 021A8CB7
021A8CB7 8D4C24 38 lea ecx, dword ptr [esp+38]
021A8CBB C78424 90000000>mov dword ptr [esp+90], -1
021A8CC6 C74424 38 182C2>mov dword ptr [esp+38], 02212C18
021A8CCE E8 6D0DFDFF call 02179A40
021A8CD3 8B8C24 88000000 mov ecx, dword ptr [esp+88]
021A8CDA 5F pop edi
021A8CDB 5E pop esi
021A8CDC 5D pop ebp
021A8CDD 5B pop ebx
021A8CDE 64:890D 0000000>mov dword ptr fs:[0], ecx
021A8CE5 81C4 84000000 add esp, 84
021A8CEB C2 1800 retn 18 返回到0217960B
0217960B 5D pop ebp ; 0012F41C
0217960C C3 retn
下面所有的call 0043736D就是显示和隐藏按钮的代码了,到底是哪个call显示加入辅助按钮就要靠高手指教了。
004274F5 55 push ebp
004274F6 8BEC mov ebp, esp
004274F8 81EC 14000000 sub esp, 14
004274FE 68 1D994000 push 0040991D ; ASCII "\jlkm.ini"
00427503 FF35 800C7802 push dword ptr [2780C80]
00427509 B9 02000000 mov ecx, 2
0042750E E8 5052FFFF call 0041C763
00427513 83C4 08 add esp, 8
00427516 8945 FC mov dword ptr [ebp-4], eax
00427519 6A FF push -1
0042751B 6A 08 push 8
0042751D 68 24000116 push 16010024
00427522 68 01000152 push 52010001
00427527 E8 3BFE0000 call 00437367
0042752C 83C4 10 add esp, 10
0042752F 8945 F8 mov dword ptr [ebp-8], eax
00427532 68 04000080 push 80000004
00427537 6A 00 push 0
00427539 8B45 F8 mov eax, dword ptr [ebp-8]
0042753C 85C0 test eax, eax
0042753E 75 05 jnz short 00427545
00427540 B8 EF964000 mov eax, 004096EF
00427545 50 push eax
00427546 68 04000080 push 80000004
0042754B 6A 00 push 0
0042754D 68 359D4000 push 00409D35 ; ASCII "kh"
00427552 68 04000080 push 80000004
00427557 6A 00 push 0
00427559 68 19994000 push 00409919
0042755E 68 04000080 push 80000004
00427563 6A 00 push 0
00427565 8B45 FC mov eax, dword ptr [ebp-4]
00427568 85C0 test eax, eax
0042756A 75 05 jnz short 00427571
0042756C B8 EF964000 mov eax, 004096EF
00427571 50 push eax
00427572 68 04000000 push 4
00427577 BB CC080000 mov ebx, 8CC
0042757C E8 C8FD0000 call 00437349
00427581 83C4 34 add esp, 34
00427584 8B5D FC mov ebx, dword ptr [ebp-4]
00427587 85DB test ebx, ebx
00427589 74 09 je short 00427594
0042758B 53 push ebx
0042758C E8 ACFD0000 call 0043733D
00427591 83C4 04 add esp, 4
00427594 8B5D F8 mov ebx, dword ptr [ebp-8]
00427597 85DB test ebx, ebx
00427599 74 09 je short 004275A4
0042759B 53 push ebx
0042759C E8 9CFD0000 call 0043733D
004275A1 83C4 04 add esp, 4
004275A4 68 1D994000 push 0040991D ; ASCII "\jlkm.ini"
004275A9 FF35 800C7802 push dword ptr [2780C80]
004275AF B9 02000000 mov ecx, 2
004275B4 E8 AA51FFFF call 0041C763
004275B9 83C4 08 add esp, 8
004275BC 8945 FC mov dword ptr [ebp-4], eax
004275BF 6A FF push -1
004275C1 6A 08 push 8
004275C3 68 27000116 push 16010027
004275C8 68 01000152 push 52010001
004275CD E8 95FD0000 call 00437367
004275D2 83C4 10 add esp, 10
004275D5 8945 F8 mov dword ptr [ebp-8], eax
004275D8 68 04000080 push 80000004
004275DD 6A 00 push 0
004275DF 8B45 F8 mov eax, dword ptr [ebp-8]
004275E2 85C0 test eax, eax
004275E4 75 05 jnz short 004275EB
004275E6 B8 EF964000 mov eax, 004096EF
004275EB 50 push eax
004275EC 68 04000080 push 80000004
004275F1 6A 00 push 0
004275F3 68 389D4000 push 00409D38 ; ASCII "mm"
004275F8 68 04000080 push 80000004
004275FD 6A 00 push 0
004275FF 68 19994000 push 00409919
00427604 68 04000080 push 80000004
00427609 6A 00 push 0
0042760B 8B45 FC mov eax, dword ptr [ebp-4]
0042760E 85C0 test eax, eax
00427610 75 05 jnz short 00427617
00427612 B8 EF964000 mov eax, 004096EF
00427617 50 push eax
00427618 68 04000000 push 4
0042761D BB CC080000 mov ebx, 8CC
00427622 E8 22FD0000 call 00437349
00427627 83C4 34 add esp, 34
0042762A 8B5D FC mov ebx, dword ptr [ebp-4]
0042762D 85DB test ebx, ebx
0042762F 74 09 je short 0042763A
00427631 53 push ebx
00427632 E8 06FD0000 call 0043733D
00427637 83C4 04 add esp, 4
0042763A 8B5D F8 mov ebx, dword ptr [ebp-8]
0042763D 85DB test ebx, ebx
0042763F 74 09 je short 0042764A
00427641 53 push ebx
00427642 E8 F6FC0000 call 0043733D
00427647 83C4 04 add esp, 4
0042764A 6A FF push -1
0042764C 6A 08 push 8
0042764E 68 150A0116 push 16010A15
00427653 68 01000152 push 52010001
00427658 E8 0AFD0000 call 00437367
0042765D 83C4 10 add esp, 10
00427660 8945 F8 mov dword ptr [ebp-8], eax
00427663 837D F8 00 cmp dword ptr [ebp-8], 0
00427667 0F8F 49020000 jg 004278B6
0042766D 6A FF push -1
0042766F 6A 08 push 8
00427671 68 24000116 push 16010024
00427676 68 01000152 push 52010001
0042767B E8 E7FC0000 call 00437367
00427680 83C4 10 add esp, 10
00427683 8945 FC mov dword ptr [ebp-4], eax
00427686 68 EF964000 push 004096EF
0042768B FF75 FC push dword ptr [ebp-4]
0042768E E8 C84FFFFF call 0041C65B
00427693 83C4 08 add esp, 8
00427696 83F8 00 cmp eax, 0
00427699 B8 00000000 mov eax, 0
0042769E 0F95C0 setne al
004276A1 8945 F8 mov dword ptr [ebp-8], eax
004276A4 8B5D FC mov ebx, dword ptr [ebp-4]
004276A7 85DB test ebx, ebx
004276A9 74 09 je short 004276B4
004276AB 53 push ebx
004276AC E8 8CFC0000 call 0043733D
004276B1 83C4 04 add esp, 4
004276B4 837D F8 00 cmp dword ptr [ebp-8], 0
004276B8 0F84 58000000 je 00427716
004276BE 6A FF push -1
004276C0 6A 08 push 8
004276C2 68 27000116 push 16010027
004276C7 68 01000152 push 52010001
004276CC E8 96FC0000 call 00437367
004276D1 83C4 10 add esp, 10
004276D4 8945 F4 mov dword ptr [ebp-C], eax
004276D7 68 EF964000 push 004096EF
004276DC FF75 F4 push dword ptr [ebp-C]
004276DF E8 774FFFFF call 0041C65B
004276E4 83C4 08 add esp, 8
004276E7 83F8 00 cmp eax, 0
004276EA B8 00000000 mov eax, 0
004276EF 0F95C0 setne al
004276F2 8945 F0 mov dword ptr [ebp-10], eax
004276F5 8B5D F4 mov ebx, dword ptr [ebp-C]
004276F8 85DB test ebx, ebx
004276FA 74 09 je short 00427705
004276FC 53 push ebx
004276FD E8 3BFC0000 call 0043733D
00427702 83C4 04 add esp, 4
00427705 837D F0 00 cmp dword ptr [ebp-10], 0
00427709 0F84 07000000 je 00427716
0042770F B8 01000000 mov eax, 1
00427714 EB 02 jmp short 00427718
00427716 33C0 xor eax, eax
00427718 85C0 test eax, eax
0042771A 0F84 22010000 je 00427842
00427720 68 04000080 push 80000004
00427725 6A 00 push 0
00427727 68 DD9A4000 push 00409ADD ; ASCII "banb"
0042772C 68 01000000 push 1
00427731 BB 58050000 mov ebx, 558
00427736 E8 0EFC0000 call 00437349
0042773B 83C4 10 add esp, 10
0042773E 8945 F8 mov dword ptr [ebp-8], eax
00427741 837D F8 01 cmp dword ptr [ebp-8], 1
00427745 0F85 D5000000 jnz 00427820
0042774B 6A FF push -1
0042774D 6A 08 push 8
0042774F 68 24000116 push 16010024
00427754 68 01000152 push 52010001
00427759 E8 09FC0000 call 00437367
0042775E 83C4 10 add esp, 10
00427761 8945 FC mov dword ptr [ebp-4], eax
00427764 6A FF push -1
00427766 6A 08 push 8
00427768 68 27000116 push 16010027
0042776D 68 01000152 push 52010001
00427772 E8 F0FB0000 call 00437367
00427777 83C4 10 add esp, 10
0042777A 8945 F8 mov dword ptr [ebp-8], eax
0042777D 68 439A4000 push 00409A43
00427782 FF35 7C0C7802 push dword ptr [2780C7C]
00427788 68 459A4000 push 00409A45
0042778D FF35 980C7802 push dword ptr [2780C98]
00427793 68 16974000 push 00409716
00427798 FF75 F8 push dword ptr [ebp-8]
0042779B 68 3E974000 push 0040973E
004277A0 FF75 FC push dword ptr [ebp-4]
004277A3 68 EF9A4000 push 00409AEF ; ASCII "开启!"
004277A8 B9 09000000 mov ecx, 9
004277AD E8 B14FFFFF call 0041C763
004277B2 83C4 24 add esp, 24
004277B5 8945 F4 mov dword ptr [ebp-C], eax
004277B8 8B5D FC mov ebx, dword ptr [ebp-4]
004277BB 85DB test ebx, ebx
004277BD 74 09 je short 004277C8
004277BF 53 push ebx
004277C0 E8 78FB0000 call 0043733D
004277C5 83C4 04 add esp, 4
004277C8 8B5D F8 mov ebx, dword ptr [ebp-8]
004277CB 85DB test ebx, ebx
004277CD 74 09 je short 004277D8
004277CF 53 push ebx
004277D0 E8 68FB0000 call 0043733D
004277D5 83C4 04 add esp, 4
004277D8 8D45 F4 lea eax, dword ptr [ebp-C]
004277DB 50 push eax
004277DC E8 8071FFFF call 0041E961
004277E1 8945 F0 mov dword ptr [ebp-10], eax
004277E4 8B5D F4 mov ebx, dword ptr [ebp-C]
004277E7 85DB test ebx, ebx
004277E9 74 09 je short 004277F4
004277EB 53 push ebx
004277EC E8 4CFB0000 call 0043733D
004277F1 83C4 04 add esp, 4
004277F4 837D F0 00 cmp dword ptr [ebp-10], 0
004277F8 0F85 1D000000 jnz 0042781B
004277FE 6A 00 push 0
00427800 68 F59A4000 push 00409AF5
00427805 6A FF push -1
00427807 6A 08 push 8
00427809 68 25090116 push 16010925
0042780E 68 01000152 push 52010001
00427813 E8 55FB0000 call 0043736D
00427818 83C4 18 add esp, 18
0042781B E9 1D000000 jmp 0042783D
00427820 6A 00 push 0
00427822 68 45AF4000 push 0040AF45
00427827 6A FF push -1
00427829 6A 08 push 8
0042782B 68 25090116 push 16010925
00427830 68 01000152 push 52010001
00427835 E8 33FB0000 call 0043736D
0042783A 83C4 18 add esp, 18
0042783D E9 1D000000 jmp 0042785F
00427842 6A 00 push 0
00427844 68 5EAF4000 push 0040AF5E
00427849 6A FF push -1
0042784B 6A 08 push 8
0042784D 68 25090116 push 16010925
00427852 68 01000152 push 52010001
00427857 E8 11FB0000 call 0043736D
0042785C 83C4 18 add esp, 18
0042785F 6A 00 push 0
00427861 68 01000000 push 1
00427866 6A FF push -1
00427868 6A 06 push 6
0042786A 68 2C000116 push 1601002C
0042786F 68 01000152 push 52010001
00427874 E8 F4FA0000 call 0043736D
00427879 83C4 18 add esp, 18
0042787C 6A 00 push 0
0042787E 68 01000000 push 1
00427883 6A FF push -1
00427885 6A 06 push 6
00427887 68 2B000116 push 1601002B
0042788C 68 01000152 push 52010001
00427891 E8 D7FA0000 call 0043736D
00427896 83C4 18 add esp, 18
00427899 6A 00 push 0
0042789B 68 88130000 push 1388
004278A0 6A FF push -1
004278A2 6A 08 push 8
004278A4 68 150A0116 push 16010A15
004278A9 68 01000152 push 52010001
004278AE E8 BAFA0000 call 0043736D
004278B3 83C4 18 add esp, 18
004278B6 8BE5 mov esp, ebp
004278B8 5D pop ebp
004278B9 C3 retn
004278BA 55 push ebp
004278BB 8BEC mov ebp, esp
004278BD 81EC 0C000000 sub esp, 0C
004278C3 6A FF push -1
004278C5 6A 12 push 12
004278C7 68 A2110116 push 160111A2
004278CC 68 01000152 push 52010001
004278D1 E8 91FA0000 call 00437367
004278D6 83C4 10 add esp, 10
004278D9 8945 F8 mov dword ptr [ebp-8], eax
004278DC 837D F8 01 cmp dword ptr [ebp-8], 1
004278E0 0F85 1D000000 jnz 00427903
004278E6 6A 00 push 0
004278E8 68 00000000 push 0
004278ED 6A FF push -1
004278EF 6A 12 push 12
004278F1 68 9A150116 push 1601159A
004278F6 68 01000152 push 52010001
004278FB E8 6DFA0000 call 0043736D
00427900 83C4 18 add esp, 18
00427903 8BE5 mov esp, ebp
00427905 5D pop ebp
00427906 C3 retn
[课程]FART 脱壳王!加量不加价!FART作者讲授!