遇到解狗的问题..望高手指教
双击请插入加密狗来到...004CCEAF .E8 707CF3FF CALL CR1.00404B24
004CCEB4 .68 84D04C00 PUSH CR1.004CD084 ;ASCII ".trt"
004CCEB9 .B9 54D04C00 MOV ECX,CR1.004CD054 ;ASCII ".btn"
004CCEBE .8B15 84515300 MOV EDX,DWORD PTR DS:
004CCEC4 .A1 50525300 MOV EAX,DWORD PTR DS:
004CCEC9 .E8 3AF4FFFF CALL CR1.004CC308
004CCECE .55 PUSH EBP ; /Arg1
004CCECF .E8 10FBFFFF CALL CR1.004CC9E4 ; \CR1.004CC9E4
004CCED4 .59 POP ECX
004CCED5 .C605 3C525300>MOV BYTE PTR DS:,0
004CCEDC .B1 01 MOV CL,1
004CCEDE .B2 01 MOV DL,1
004CCEE0 .A1 105B4B00 MOV EAX,DWORD PTR DS:
004CCEE5 .E8 DA99F5FF CALL CR1.004268C4
004CCEEA .A3 34615200 MOV DWORD PTR DS:,EAX
004CCEEF .33D2 XOR EDX,EDX
004CCEF1 .A1 34615200 MOV EAX,DWORD PTR DS:
004CCEF6 .E8 059CF5FF CALL CR1.00426B00
004CCEFB .55 PUSH EBP ; /Arg1
004CCEFC .E8 E3FAFFFF CALL CR1.004CC9E4 ; \CR1.004CC9E4
004CCF01 .59 POP ECX
004CCF02 .33C0 XOR EAX,EAX
004CCF04 .55 PUSH EBP
004CCF05 .68 64CF4C00 PUSH CR1.004CCF64
004CCF0A .64:FF30 PUSH DWORD PTR FS:
004CCF0D .64:8920 MOV DWORD PTR FS:,ESP
004CCF10 .E8 FBF6FEFF CALL CR1.004BC610 CALL进去看看
004CCF15 .84C0 TEST AL,AL
004CCF17 .75 41 JNZ SHORT CR1.004CCF5A
004CCF19 .6A 10 PUSH 10
004CCF1B .8D95 DCFEFFFF LEA EDX,DWORD PTR SS:
004CCF21 .A1 7C7A5200 MOV EAX,DWORD PTR DS:
004CCF26 .8B00 MOV EAX,DWORD PTR DS:
004CCF28 .E8 97C9F9FF CALL CR1.004698C4
004CCF2D .8B85 DCFEFFFF MOV EAX,DWORD PTR SS:
004CCF33 .E8 987DF3FF CALL CR1.00404CD0
004CCF38 .8BC8 MOV ECX,EAX
004CCF3A .BA C0D04C00 MOV EDX,CR1.004CD0C0 请插入加密狗
004CCF3F .A1 7C7A5200 MOV EAX,DWORD PTR DS:
004CCF44 .8B00 MOV EAX,DWORD PTR DS:
004CCF46 .E8 51CFF9FF CALL CR1.00469E9C
004CCF4B .E8 3C77F3FF CALL CR1.0040468C
004CCF50 .33C0 XOR EAX,EAX
004CCF52 .5A POP EDX
004CCF53 .59 POP ECX
004CCF54 .59 POP ECX
004CCF55 .64:8910 MOV DWORD PTR FS:,EDX
004CCF58 .EB 33 JMP SHORT CR1.004CCF8D
004CCF5A >33C0 XOR EAX,EAX
004CCF5C .5A POP EDX
004CCF10 .E8 FBF6FEFF CALL CR1.004BC610 CALL进去看看
以下进来看到的内容
004BC610/$53 PUSH EBX
004BC611|.56 PUSH ESI
004BC612|.81C4 D0F9FFFF ADD ESP,-630
004BC618|.C60424 01 MOV BYTE PTR SS:,0 这里改为1就可以为有狗运行,但运行到程序里面后功能无反应
004BC61C|.68 54C74B00 PUSH CR1.004BC754 ; /ResourceType = "dogfile"
004BC621|.68 5CC74B00 PUSH CR1.004BC75C ; |ResourceName = "rsakey"
004BC626|.A1 18875200 MOV EAX,DWORD PTR DS: ; |
004BC62B|.50 PUSH EAX ; |hModule => NULL
004BC62C|.E8 A7ABF4FF CALL <JMP.&kernel32.FindResourceA> ; \FindResourceA
004BC631|.8BD8 MOV EBX,EAX
004BC633|.53 PUSH EBX ; /hResource
004BC634|.A1 18875200 MOV EAX,DWORD PTR DS: ; |
004BC639|.50 PUSH EAX ; |hModule => NULL
004BC63A|.E8 C9ADF4FF CALL <JMP.&kernel32.SizeofResource> ; \SizeofResource
004BC63F|.8BF0 MOV ESI,EAX
004BC641|.53 PUSH EBX ; /hResource
004BC642|.A1 18875200 MOV EAX,DWORD PTR DS: ; |
004BC647|.50 PUSH EAX ; |hModule => NULL
004BC648|.E8 2BADF4FF CALL <JMP.&kernel32.LoadResource> ; \LoadResource
004BC64D|.8BD8 MOV EBX,EAX
004BC64F|.53 PUSH EBX ; /hResource
004BC650|.E8 3BADF4FF CALL <JMP.&kernel32.LockResource> ; \LockResource
004BC655|.8D5424 10 LEA EDX,DWORD PTR SS:
004BC659|.8BCE MOV ECX,ESI
004BC65B|.92 XCHG EAX,EDX
004BC65C|.E8 0FB6F4FF CALL CR1.00407C70
004BC661|.53 PUSH EBX ; /hResource
004BC662|.E8 89ABF4FF CALL <JMP.&kernel32.FreeResource> ; \FreeResource
004BC667|.C74424 0C 000>MOV DWORD PTR SS:,400
004BC66F|.E8 64ACF4FF CALL <JMP.&kernel32.GetTickCount> ; [GetTickCount
004BC674|.8B15 AC7D5200 MOV EDX,DWORD PTR DS: ;CR1.00523008
004BC67A|.8902 MOV DWORD PTR DS:,EAX
004BC67C|.BE 20000000 MOV ESI,20
004BC681|.8D9C24 100100>LEA EBX,DWORD PTR SS:
004BC688|>B8 FF000000 /MOV EAX,0FF
004BC68D|.E8 126BF4FF |CALL CR1.004031A4
004BC692|.8803 |MOV BYTE PTR DS:,AL
004BC694|.43 |INC EBX
004BC695|.4E |DEC ESI
004BC696|.^ 75 F0 \JNZ SHORT CR1.004BC688
004BC698|.8D4424 0C LEA EAX,DWORD PTR SS:
004BC69C|.50 PUSH EAX
004BC69D|.6A 20 PUSH 20
004BC69F|.8D8424 180100>LEA EAX,DWORD PTR SS:
004BC6A6|.50 PUSH EAX
004BC6A7|.8D4424 10 LEA EAX,DWORD PTR SS:
004BC6AB|.50 PUSH EAX
004BC6AC|.8D8424 400100>LEA EAX,DWORD PTR SS:
004BC6B3|.50 PUSH EAX
004BC6B4|.E8 33FAFFFF CALL <JMP.&crypt.RSAPublicEncrypt>
004BC6B9|.85C0 TEST EAX,EAX
004BC6BB|.0F85 87000000 JNZ CR1.004BC748
004BC6C1|.8D8424 300500>LEA EAX,DWORD PTR SS:
004BC6C8|.50 PUSH EAX
004BC6C9|.68 FF000000 PUSH 0FF
004BC6CE|.8D4424 10 LEA EAX,DWORD PTR SS:
004BC6D2|.50 PUSH EAX
004BC6D3|.8D8424 3C0100>LEA EAX,DWORD PTR SS:
004BC6DA|.8B4C24 10 MOV ECX,DWORD PTR SS:
004BC6DE|.BA FF030000 MOV EDX,3FF
004BC6E3|.E8 50FAFFFF CALL CR1.004BC138
004BC6E8|.84C0 TEST AL,AL
004BC6EA|.74 5C JE SHORT CR1.004BC748
004BC6EC|.B9 24615200 MOV ECX,CR1.00526124
004BC6F1|.BA 20000000 MOV EDX,20
004BC6F6|.B0 20 MOV AL,20
004BC6F8|.E8 C387F4FF CALL CR1.00404EC0
004BC6FD|.B9 28615200 MOV ECX,CR1.00526128
004BC702|.BA 20000000 MOV EDX,20
004BC707|.B0 20 MOV AL,20
004BC709|.E8 B287F4FF CALL CR1.00404EC0
004BC70E|.B8 24615200 MOV EAX,CR1.00526124
004BC713|.E8 1086F4FF CALL CR1.00404D28
004BC718|.8D9424 100100>LEA EDX,DWORD PTR SS:
004BC71F|.B9 20000000 MOV ECX,20
004BC724|.E8 47B5F4FF CALL CR1.00407C70
004BC729|.B8 28615200 MOV EAX,CR1.00526128
004BC72E|.E8 F585F4FF CALL CR1.00404D28
004BC733|.8D9424 100100>LEA EDX,DWORD PTR SS:
004BC73A|.B9 20000000 MOV ECX,20
004BC73F|.E8 2CB5F4FF CALL CR1.00407C70
004BC744|.C60424 01 MOV BYTE PTR SS:,1
004BC748|>8A0424 MOV AL,BYTE PTR SS:
004BC74B|.81C4 30060000 ADD ESP,630
004BC751|.5E POP ESI
004BC752|.5B POP EBX
004BC753\.C3 RETN
004BC754 .64 6F 67 66 6>ASCII "dogfile",0
004BC75C .72 73 61 6B 6>ASCII "rsakey",0
004BC763 00 DB 00
004BC618|.C60424 01 MOV BYTE PTR SS:,0 这里改为1就可以为有狗运行,但运行到程序里面后功能无反应
不知那里还要修改..望大侠门指点一下~~~~~~~
页:
[1]