- UID
- 15419
注册时间2006-6-11
阅读权限10
最后登录1970-1-1
周游历练
该用户从未签到
|
双击请插入加密狗来到...
004CCEAF . E8 707CF3FF CALL CR1.00404B24
004CCEB4 . 68 84D04C00 PUSH CR1.004CD084 ; ASCII ".trt"
004CCEB9 . B9 54D04C00 MOV ECX,CR1.004CD054 ; ASCII ".btn"
004CCEBE . 8B15 84515300 MOV EDX,DWORD PTR DS:[535184]
004CCEC4 . A1 50525300 MOV EAX,DWORD PTR DS:[535250]
004CCEC9 . E8 3AF4FFFF CALL CR1.004CC308
004CCECE . 55 PUSH EBP ; /Arg1
004CCECF . E8 10FBFFFF CALL CR1.004CC9E4 ; \CR1.004CC9E4
004CCED4 . 59 POP ECX
004CCED5 . C605 3C525300>MOV BYTE PTR DS:[53523C],0
004CCEDC . B1 01 MOV CL,1
004CCEDE . B2 01 MOV DL,1
004CCEE0 . A1 105B4B00 MOV EAX,DWORD PTR DS:[4B5B10]
004CCEE5 . E8 DA99F5FF CALL CR1.004268C4
004CCEEA . A3 34615200 MOV DWORD PTR DS:[526134],EAX
004CCEEF . 33D2 XOR EDX,EDX
004CCEF1 . A1 34615200 MOV EAX,DWORD PTR DS:[526134]
004CCEF6 . E8 059CF5FF CALL CR1.00426B00
004CCEFB . 55 PUSH EBP ; /Arg1
004CCEFC . E8 E3FAFFFF CALL CR1.004CC9E4 ; \CR1.004CC9E4
004CCF01 . 59 POP ECX
004CCF02 . 33C0 XOR EAX,EAX
004CCF04 . 55 PUSH EBP
004CCF05 . 68 64CF4C00 PUSH CR1.004CCF64
004CCF0A . 64:FF30 PUSH DWORD PTR FS:[EAX]
004CCF0D . 64:8920 MOV DWORD PTR FS:[EAX],ESP
004CCF10 . E8 FBF6FEFF CALL CR1.004BC610 CALL进去看看
004CCF15 . 84C0 TEST AL,AL
004CCF17 . 75 41 JNZ SHORT CR1.004CCF5A
004CCF19 . 6A 10 PUSH 10
004CCF1B . 8D95 DCFEFFFF LEA EDX,DWORD PTR SS:[EBP-124]
004CCF21 . A1 7C7A5200 MOV EAX,DWORD PTR DS:[527A7C]
004CCF26 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
004CCF28 . E8 97C9F9FF CALL CR1.004698C4
004CCF2D . 8B85 DCFEFFFF MOV EAX,DWORD PTR SS:[EBP-124]
004CCF33 . E8 987DF3FF CALL CR1.00404CD0
004CCF38 . 8BC8 MOV ECX,EAX
004CCF3A . BA C0D04C00 MOV EDX,CR1.004CD0C0 请插入加密狗
004CCF3F . A1 7C7A5200 MOV EAX,DWORD PTR DS:[527A7C]
004CCF44 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
004CCF46 . E8 51CFF9FF CALL CR1.00469E9C
004CCF4B . E8 3C77F3FF CALL CR1.0040468C
004CCF50 . 33C0 XOR EAX,EAX
004CCF52 . 5A POP EDX
004CCF53 . 59 POP ECX
004CCF54 . 59 POP ECX
004CCF55 . 64:8910 MOV DWORD PTR FS:[EAX],EDX
004CCF58 . EB 33 JMP SHORT CR1.004CCF8D
004CCF5A > 33C0 XOR EAX,EAX
004CCF5C . 5A POP EDX
004CCF10 . E8 FBF6FEFF CALL CR1.004BC610 CALL进去看看
以下进来看到的内容
004BC610 /$ 53 PUSH EBX
004BC611 |. 56 PUSH ESI
004BC612 |. 81C4 D0F9FFFF ADD ESP,-630
004BC618 |. C60424 01 MOV BYTE PTR SS:[ESP],0 这里改为1就可以为有狗运行,但运行到程序里面后功能无反应
004BC61C |. 68 54C74B00 PUSH CR1.004BC754 ; /ResourceType = "dogfile"
004BC621 |. 68 5CC74B00 PUSH CR1.004BC75C ; |ResourceName = "rsakey"
004BC626 |. A1 18875200 MOV EAX,DWORD PTR DS:[528718] ; |
004BC62B |. 50 PUSH EAX ; |hModule => NULL
004BC62C |. E8 A7ABF4FF CALL <JMP.&kernel32.FindResourceA> ; \FindResourceA
004BC631 |. 8BD8 MOV EBX,EAX
004BC633 |. 53 PUSH EBX ; /hResource
004BC634 |. A1 18875200 MOV EAX,DWORD PTR DS:[528718] ; |
004BC639 |. 50 PUSH EAX ; |hModule => NULL
004BC63A |. E8 C9ADF4FF CALL <JMP.&kernel32.SizeofResource> ; \SizeofResource
004BC63F |. 8BF0 MOV ESI,EAX
004BC641 |. 53 PUSH EBX ; /hResource
004BC642 |. A1 18875200 MOV EAX,DWORD PTR DS:[528718] ; |
004BC647 |. 50 PUSH EAX ; |hModule => NULL
004BC648 |. E8 2BADF4FF CALL <JMP.&kernel32.LoadResource> ; \LoadResource
004BC64D |. 8BD8 MOV EBX,EAX
004BC64F |. 53 PUSH EBX ; /hResource
004BC650 |. E8 3BADF4FF CALL <JMP.&kernel32.LockResource> ; \LockResource
004BC655 |. 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10]
004BC659 |. 8BCE MOV ECX,ESI
004BC65B |. 92 XCHG EAX,EDX
004BC65C |. E8 0FB6F4FF CALL CR1.00407C70
004BC661 |. 53 PUSH EBX ; /hResource
004BC662 |. E8 89ABF4FF CALL <JMP.&kernel32.FreeResource> ; \FreeResource
004BC667 |. C74424 0C 000>MOV DWORD PTR SS:[ESP+C],400
004BC66F |. E8 64ACF4FF CALL <JMP.&kernel32.GetTickCount> ; [GetTickCount
004BC674 |. 8B15 AC7D5200 MOV EDX,DWORD PTR DS:[527DAC] ; CR1.00523008
004BC67A |. 8902 MOV DWORD PTR DS:[EDX],EAX
004BC67C |. BE 20000000 MOV ESI,20
004BC681 |. 8D9C24 100100>LEA EBX,DWORD PTR SS:[ESP+110]
004BC688 |> B8 FF000000 /MOV EAX,0FF
004BC68D |. E8 126BF4FF |CALL CR1.004031A4
004BC692 |. 8803 |MOV BYTE PTR DS:[EBX],AL
004BC694 |. 43 |INC EBX
004BC695 |. 4E |DEC ESI
004BC696 |.^ 75 F0 \JNZ SHORT CR1.004BC688
004BC698 |. 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C]
004BC69C |. 50 PUSH EAX
004BC69D |. 6A 20 PUSH 20
004BC69F |. 8D8424 180100>LEA EAX,DWORD PTR SS:[ESP+118]
004BC6A6 |. 50 PUSH EAX
004BC6A7 |. 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10]
004BC6AB |. 50 PUSH EAX
004BC6AC |. 8D8424 400100>LEA EAX,DWORD PTR SS:[ESP+140]
004BC6B3 |. 50 PUSH EAX
004BC6B4 |. E8 33FAFFFF CALL <JMP.&crypt.RSAPublicEncrypt>
004BC6B9 |. 85C0 TEST EAX,EAX
004BC6BB |. 0F85 87000000 JNZ CR1.004BC748
004BC6C1 |. 8D8424 300500>LEA EAX,DWORD PTR SS:[ESP+530]
004BC6C8 |. 50 PUSH EAX
004BC6C9 |. 68 FF000000 PUSH 0FF
004BC6CE |. 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10]
004BC6D2 |. 50 PUSH EAX
004BC6D3 |. 8D8424 3C0100>LEA EAX,DWORD PTR SS:[ESP+13C]
004BC6DA |. 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
004BC6DE |. BA FF030000 MOV EDX,3FF
004BC6E3 |. E8 50FAFFFF CALL CR1.004BC138
004BC6E8 |. 84C0 TEST AL,AL
004BC6EA |. 74 5C JE SHORT CR1.004BC748
004BC6EC |. B9 24615200 MOV ECX,CR1.00526124
004BC6F1 |. BA 20000000 MOV EDX,20
004BC6F6 |. B0 20 MOV AL,20
004BC6F8 |. E8 C387F4FF CALL CR1.00404EC0
004BC6FD |. B9 28615200 MOV ECX,CR1.00526128
004BC702 |. BA 20000000 MOV EDX,20
004BC707 |. B0 20 MOV AL,20
004BC709 |. E8 B287F4FF CALL CR1.00404EC0
004BC70E |. B8 24615200 MOV EAX,CR1.00526124
004BC713 |. E8 1086F4FF CALL CR1.00404D28
004BC718 |. 8D9424 100100>LEA EDX,DWORD PTR SS:[ESP+110]
004BC71F |. B9 20000000 MOV ECX,20
004BC724 |. E8 47B5F4FF CALL CR1.00407C70
004BC729 |. B8 28615200 MOV EAX,CR1.00526128
004BC72E |. E8 F585F4FF CALL CR1.00404D28
004BC733 |. 8D9424 100100>LEA EDX,DWORD PTR SS:[ESP+110]
004BC73A |. B9 20000000 MOV ECX,20
004BC73F |. E8 2CB5F4FF CALL CR1.00407C70
004BC744 |. C60424 01 MOV BYTE PTR SS:[ESP],1
004BC748 |> 8A0424 MOV AL,BYTE PTR SS:[ESP]
004BC74B |. 81C4 30060000 ADD ESP,630
004BC751 |. 5E POP ESI
004BC752 |. 5B POP EBX
004BC753 \. C3 RETN
004BC754 . 64 6F 67 66 6>ASCII "dogfile",0
004BC75C . 72 73 61 6B 6>ASCII "rsakey",0
004BC763 00 DB 00
004BC618 |. C60424 01 MOV BYTE PTR SS:[ESP],0 这里改为1就可以为有狗运行,但运行到程序里面后功能无反应
不知那里还要修改..望大侠门指点一下~~~~~~~ |
|