|
016F:0048E146 XOR EAX,EAX
016F:0048E148 MOV AX,[0049317C]
016F:0048E14E TEST AL,01
016F:0048E150 JNZ NEAR 0048E1D5
016F:0048E156 CMP DWORD [00493174],BYTE +00
016F:0048E15D JZ NEAR 0048E198 应该跳转
016F:0048E163 MOVSX EAX,WORD [00496AB1]
016F:0048E16A TEST EAX,EAX
016F:0048E16C JL NEAR 0048E198
016F:0048E172 MOVSX EAX,WORD [00496AB1]
016F:0048E179 SHL EAX,02
016F:0048E17C LEA EAX,[EAX+EAX*2]
016F:0048E17F LEA EAX,[EAX+EAX*4]
016F:0048E182 MOV ECX,[00496D3C]
016F:0048E188 XOR EDX,EDX
016F:0048E18A MOV DX,[EAX+ECX+28]
016F:0048E18F TEST DL,08
016F:0048E192 JNZ NEAR 0048E1C4
016F:0048E198 CMP DWORD [00493174],BYTE +00
016F:0048E19F JZ NEAR 0048E1D5 应该跳转
016F:0048E1A5 MOVSX EAX,WORD [00496AB1]
016F:0048E1AC TEST EAX,EAX
016F:0048E1AE JNL NEAR 0048E1D5
016F:0048E1B4 XOR EAX,EAX
016F:0048E1B6 MOV AX,[00496D44]
016F:0048E1BC TEST AL,08
016F:0048E1BE JZ NEAR 0048E1D5
016F:0048E1C4 XOR EAX,EAX
016F:0048E1C6 MOV AX,[0049317C]
016F:0048E1CC OR EAX,BYTE +01
016F:0048E1CF MOV [0049317C],AX
016F:0048E1D5 XOR EAX,EAX
016F:0048E1D7 MOV AX,[0049317C]
016F:0048E1DD TEST EAX,EAX
016F:0048E1DF JZ NEAR 0048E2B7 应该跳转
016F:0048E1E5 CMP DWORD [EBP-50],BYTE +01
016F:0048E1E9 JNZ NEAR 0048E2B7
016F:0048E1EF XOR EAX,EAX
016F:0048E1F1 MOV AX,[004931B8]
016F:0048E1F7 TEST EAX,EAX
016F:0048E1F9 JZ NEAR 0048E2B7
016F:0048E1FF LEA EAX,[EBP-64]
016F:0048E202 PUSH EAX
016F:0048E203 MOV EDX,00496C70
016F:0048E208 LEA ECX,[00496AA1]
016F:0048E20E CALL 00491B50
016F:0048E213 MOV ECX,00496A40
016F:0048E218 ADD ECX,BYTE +61
016F:0048E21B MOV EDX,[EAX]
016F:0048E21D MOV [ECX],EDX
016F:0048E21F MOV EDX,[EAX+04]
016F:0048E222 MOV [ECX+04],EDX
016F:0048E225 MOV EDX,[EAX+08]
016F:0048E228 MOV [ECX+08],EDX
016F:0048E22B MOV EAX,[EAX+0C]
016F:0048E22E MOV [ECX+0C],EAX
016F:0048E231 CALL 00490640
016F:0048E236 TEST EAX,EAX
016F:0048E238 JNZ NEAR 0048E24D
016F:0048E23E MOV EDX,004932D4
016F:0048E243 MOV ECX,004932B8
016F:0048E248 CALL 00491600
016F:0048E24D MOV EDX,00496B40
016F:0048E252 LEA ECX,[00496AA1]
016F:0048E258 CALL 00490BC0
016F:0048E25D MOV ECX,[EBP+10]
016F:0048E260 CALL 00491100
016F:0048E265 TEST EAX,EAX
016F:0048E267 JZ NEAR 0048E295
016F:0048E26D CALL 00491080
016F:0048E272 MOV [EBP-50],EAX
016F:0048E275 PUSH BYTE +00
016F:0048E277 PUSH BYTE +00
016F:0048E279 PUSH BYTE +10
016F:0048E27B MOV EAX,[00496C80]
016F:0048E280 PUSH EAX
016F:0048E281 CALL `USER32!SendMessageA`
016F:0048E287 MOV WORD [004931B8],00
016F:0048E290 JMP 0048E2B7
016F:0048E295 MOV DWORD [EBP-50],00
016F:0048E29C MOV WORD [004931B8],00
016F:0048E2A5 PUSH BYTE +00
016F:0048E2A7 PUSH BYTE +00
016F:0048E2A9 PUSH BYTE +10
016F:0048E2AB MOV EAX,[00496C80]
016F:0048E2B0 PUSH EAX
016F:0048E2B1 CALL `USER32!SendMessageA`
016F:0048E2B7 LEA EDX,[EBP-4C]
016F:0048E2BA LEA ECX,[EBP-54]
016F:0048E2BD CALL 0048E3D0
016F:0048E2C2 MOV [EBP-48],EAX
016F:0048E2C5 PUSH BYTE +00
016F:0048E2C7 PUSH BYTE +00
016F:0048E2C9 PUSH BYTE +10
016F:0048E2CB MOV EAX,[00496C80]
016F:0048E2D0 PUSH EAX
016F:0048E2D1 CALL `USER32!SendMessageA`
016F:0048E2D7 CMP DWORD [00493180],BYTE +02
016F:0048E2DE JZ NEAR 0048E32C 要改
016F:0048E2E4 CMP DWORD [EBP-50],BYTE +01
016F:0048E2E8 JNZ NEAR 0048E32C 要改
016F:0048E2EE XOR EAX,EAX
016F:0048E2F0 MOV AX,[004931B8]
016F:0048E2F6 TEST EAX,EAX
016F:0048E2F8 JZ NEAR 0048E32C 要改
016F:0048E2FE MOV EAX,[EBP+08]
016F:0048E301 PUSH EAX
016F:0048E302 PUSH DWORD 004931A8
016F:0048E307 CALL `USER32!UnregisterClassA`
016F:0048E30D XOR EAX,EAX
016F:0048E30F MOV AX,[004931BC]
016F:0048E315 TEST EAX,EAX
016F:0048E317 JZ NEAR 0048E32C 要改
016F:0048E31D MOV EAX,[EBP-4C]
016F:0048E320 PUSH EAX
016F:0048E321 LEA EDX,[EBP-54]
016F:0048E324 MOV ECX,[EBP-48]
016F:0048E327 CALL 0048E360 好了，就是它，但此过程中又有跳转，见下面子程序5，要改
016F:0048E32C CMP DWORD [EBP-54],BYTE +00
016F:0048E330 JZ NEAR 0048E33E
016F:0048E336 MOV ECX,[EBP-54]
016F:0048E339 CALL 004915F0
016F:0048E33E MOV EAX,[EBP-50]
016F:0048E341 PUSH EAX
016F:0048E342 CALL `KERNEL32!ExitProcess`
016F:0048E348 MOV EAX,[EBP-50]
016F:0048E34B JMP 0048E350
016F:0048E350 POP EDI
016F:0048E351 POP ESI
016F:0048E352 POP EBX
016F:0048E353 LEAVE
016F:0048E354 RET 10
子程序3：若上次退出前输入的注册码正确，此处不显示注册码对话框，否则要显示
016F:00490CC0 TEST BYTE [00496D33],80
016F:00490CC7 PUSH ESI
016F:00490CC8 PUSH EDI
016F:00490CC9 MOV ESI,ECX
016F:00490CCB JZ NEAR 00490D7A
016F:00490CD1 CMP WORD [004931B8],BYTE +00
016F:00490CD9 JNZ 00490CE4
016F:00490CDB CMP BYTE [00496AB3],02
016F:00490CE2 JNZ 00490D15 跳转
016F:00490CE4 CMP WORD [00496AB1],BYTE +00
016F:00490CEC JL 00490D0B
016F:00490CEE MOVSX EAX,WORD [00496AB1]
016F:00490CF5 SHL EAX,02
016F:00490CF8 LEA ECX,[EAX+EAX*2]
016F:00490CFB MOV EAX,[00496D3C]
016F:00490D00 LEA EDX,[ECX+ECX*4]
016F:00490D03 CMP WORD [EDX+EAX+02],BYTE +00
016F:00490D09 JNZ 00490D15
016F:00490D0B CMP WORD [00493160],BYTE +02
016F:00490D13 JNZ 00490D7A
016F:00490D15 XOR EDX,EDX
016F:00490D17 MOV ECX,68
016F:00490D1C MOV ESI,00
016F:00490D21 CALL 00491510
016F:00490D26 MOV EDX,00496B20
016F:00490D2B MOV ECX,EAX
016F:00490D2D MOV [00496CC0],EAX
016F:00490D32 CALL 0048D4E0
016F:00490D37 TEST EAX,EAX
016F:00490D39 JZ 00490D4C 应该跳转
016F:00490D3B MOV EDX,0048D010
016F:00490D40 MOV ECX,00496B20
016F:00490D45 CALL 0048D680 即注册对话框
016F:00490D4A MOV ESI,EAX
016F:00490D4C MOV ECX,00496B20 到此处
016F:00490D51 CALL 0048B200
016F:00490D56 MOV EAX,[00496CC0]
016F:00490D5B MOV EDI,[00497394]
016F:00490D61 PUSH EAX
016F:00490D62 CALL EDI
016F:00490D64 PUSH EAX
016F:00490D65 CALL `KERNEL32!GlobalUnlock`
016F:00490D6B MOV EAX,[00496CC0]
016F:00490D70 PUSH EAX
016F:00490D71 CALL EDI
016F:00490D73 PUSH EAX
016F:00490D74 CALL `KERNEL32!GlobalFree`
016F:00490D7A MOV EAX,ESI
016F:00490D7C POP EDI
016F:00490D7D POP ESI
子程序4：若上次退出前输入的注册码正确，显示注册人和注册名框，否则不显示
016F:00490D80 TEST BYTE [00496D33],40
016F:00490D87 PUSH ESI
016F:00490D88 PUSH EDI
016F:00490D89 MOV ESI,ECX
016F:00490D8B JZ NEAR 00490E86
016F:00490D91 CMP WORD [00496AB1],BYTE +00
016F:00490D99 JL 00490DBC
016F:00490D9B MOVSX EAX,WORD [00496AB1]
016F:00490DA2 SHL EAX,02
016F:00490DA5 LEA ECX,[EAX+EAX*2]
016F:00490DA8 MOV EAX,[00496D3C]
016F:00490DAD LEA EDX,[ECX+ECX*4]
016F:00490DB0 CMP WORD [EDX+EAX+02],BYTE +00
016F:00490DB6 JNZ NEAR 00490E86
016F:00490DBC CMP WORD [004931B8],BYTE +00
016F:00490DC4 JZ 00490DCF
016F:00490DC6 CMP BYTE [00496AB3],02
016F:00490DCD JZ 00490E00
016F:00490DCF TEST BYTE [00496D33],80
016F:00490DD6 JNZ NEAR 00490E86 不跳
016F:00490DDC TEST BYTE [00496D33],10
016F:00490DE3 JZ 00490E00 应该跳转
016F:00490DE5 MOV ECX,01
016F:00490DEA CALL 0048E700 次数用完对话框
016F:00490DEF TEST EAX,EAX
016F:00490DF1 JZ 00490E00
016F:00490DF3 TEST BYTE [00496D33],10
016F:00490DFA JNZ NEAR 00490E86
016F:00490E00 XOR EDX,EDX
016F:00490E02 MOV ECX,6D
016F:00490E07 MOV ESI,00
016F:00490E0C CALL 00491510
016F:00490E11 MOV EDX,00496C90
016F:00490E16 MOV ECX,EAX
016F:00490E18 MOV [00496D1C],EAX
016F:00490E1D CALL 0048D4E0
016F:00490E22 TEST EAX,EAX
016F:00490E24 JZ 00490E37
016F:00490E26 MOV EDX,0048D6C0
016F:00490E2B MOV ECX,00496C90
016F:00490E30 CALL 0048D680 注册正确框,正确的注册名和注册码
016F:00490E35 MOV ESI,EAX
016F:00490E37 MOV ECX,00496C90
016F:00490E3C CALL 0048B200
016F:00490E41 MOV EAX,[00496D1C]
016F:00490E46 MOV EDI,[00497394]
016F:00490E4C PUSH EAX
016F:00490E4D CALL EDI
016F:00490E4F PUSH EAX
016F:00490E50 CALL `KERNEL32!GlobalUnlock`
016F:00490E56 MOV EAX,[00496D1C]
016F:00490E5B PUSH EAX
016F:00490E5C CALL EDI
016F:00490E5E PUSH EAX
016F:00490E5F CALL `KERNEL32!GlobalFree`
016F:00490E65 TEST BYTE [00496D33],10
016F:00490E6C JNZ 00490E86
016F:00490E6E PUSH BYTE +00
016F:00490E70 MOV EAX,[00496C80]
016F:00490E75 PUSH DWORD 8000
016F:00490E7A PUSH DWORD 0111
016F:00490E7F PUSH EAX
016F:00490E80 CALL `USER32!SendMessageA`
016F:00490E86 MOV EAX,ESI
016F:00490E88 POP EDI
016F:00490E89 POP ESI
ret
子程序5：进入正确的万能五笔程序，但进入前要判断一下。
016F:0048E360 PUSH ESI
016F:0048E361 PUSH EDI
016F:0048E362 MOV ESI,EDX
016F:0048E364 MOV EDI,[ESP+0C]
016F:0048E368 MOV EDX,[ECX+02]
016F:0048E36B XOR EDX,[ECX+06]
016F:0048E36E XOR EDX,[ECX+0A]
016F:0048E371 ADD EDI,EDX
016F:0048E373 XOR EDX,EDX
016F:0048E375 MOV EAX,[ECX+06]
016F:0048E378 INC EDX
016F:0048E379 XOR [EDI+EDX*4-04],EAX
016F:0048E37D INC EDX
016F:0048E37E MOV EAX,[ECX+0A]
016F:0048E381 XOR [EDI+EDX*4-04],EAX
016F:0048E385 CMP EDX,BYTE +14
016F:0048E388 JL 0048E375
016F:0048E38A MOV ECX,[ESI]
016F:0048E38C CALL 004915F0
016F:0048E391 MOV DWORD [ESI],00
016F:0048E397 CMP WORD [004931B8],BYTE +00
016F:0048E39F JZ 0048E3AD 要改
016F:0048E3A1 CMP WORD [004931C0],BYTE +00
016F:0048E3A9 JZ 0048E3AD
016F:0048E3AB CALL EDI 就是它，正确的程序在此处，TNND,找死我了
016F:0048E3AD PUSH BYTE +00
016F:0048E3AF PUSH DWORD 00493328
016F:0048E3B4 PUSH DWORD 00493318
016F:0048E3B9 PUSH BYTE +00
016F:0048E3BB CALL `USER32!MessageBoxA`
016F:0048E3C1 POP EDI
016F:0048E3C2 POP ESI
016F:0048E3C3 RET 04
好，总结以下，其实就是不断的判断障碍，
注册对话框在 48e07b call的子程序中。
正确的程序代码藏在 48e3ab call的子程序中。
知道了这一点（也是最困难的一点），就容易对症下药了。
其中要更改的地方有：
490d39
48e086 改为nop
48e2de
48e2e8
48e2f8
48e39f
48e3a9
当然不一定非得如此，只要能跳到48e3ab,其他的跳转应该也行。 |
|
设为首页
加入收藏
总编信箱
投稿或申请专栏请先 [登 陆]
