lesson504.htm

为所有对破解感兴趣的朋友准备的礼物。希望大家能够喜欢。

          :0040116B 0F85A9000000 　　jne 0040121A -&gt;如果长度不同出错<br>
          :00401171 6860214000　　　 push 00402160<br>
          :00401176 6A08　　　　　　　push 00000008<br>
          :00401178 6A0D　　　　　　 push 0000000D<br>
          :0040117A 6A03　　　　　　 push 00000003<br>
          :0040117C FF7508　　　　　 push [ebp+08] </span> </p>
        <p><span class="p9">----------------------------<br>
          USER32!SendDlgItemMessageA <br>
          :00401197 B9FFFFFFFF　　　 MOV ECX,FFFFFFFF <br>
          :0040119C 41 　　　　　　　INC ECX <br>
          :0040119D 0FBE8160214000 　MOVSX EAX,BYTE PTR [ECX+00402160];将姓名字符赋值eax判断它们是<br>
          :004011A4 83F800　　　　　 CMP EAX,00 ;是否是字符<br>
          :004011A7 7432 　　　　　　JZ 004011DB ;如果都是跳<br>
          :004011A9 BEFFFFFFFF 　　　MOV ESI,FFFFFFFF <br>
          :004011AE 83F841 　　　　　CMP EAX,41 ;eax&lt;41h (A)跳到出错信息处<br>
          :004011B1 7C67 　　　　　　JL 0040121A <br>
          :004011B3 83F87A 　　　　　CMP EAX,7A ;eax&gt;7A (z)跳到出错信息处 <br>
          :004011B6 7762 　　　　　　JA 0040121A <br>
          :004011B8 83F85A 　　　　　CMP EAX,5A ;判断EAX和5A (Z) 大小，<br>
          :004011BB 7C03 　　　　　　JL 004011C0 ;如小于Z则不处理。<br>
          :004011BD 83E820 　　　　　SUB EAX,20 ;否则将姓名字符换成大写字母 <br>
          :004011C0 46 　　　　　　　INC ESI ;ESI+1 <br>
          :004011C1 0FBE9617204000 　MOVSX EDX,BYTE PTR [ESI+00402017];00402017=计算序列号的原始字串 
          <br>
          :004011C8 3BC2 　　　　　　CMP EAX,EDX ;判断当前字符串= edx ？<br>
          :004011CA 75F4 　　　　　　JNZ 004011C0 ;如果不相等则循环 <br>
          :004011CC 0FBE863C204000 　MOVSX EAX,BYTE PTR [ESI+0040203C];eax=将正确字符<br>
          :004011D3 898194214000 　　MOV [ECX+00402194],EAX ;储存字符串在00402194 <br>
          :004011D9 EBC1 　　　　　　JMP 0040119C ;循环<br>
          ----------------------------<br>
          :004011DB FF35AF214000 　　push dword ptr [004021AF] ;序列号个数入栈<br>
          :004011E1 6894214000 　　　push 00402194 ;正确的序列号入栈<br>
          :004011E6 6879214000 　　　push 00402179 ;我们输入的序列号入栈<br>
          :004011EB E854000000 　　　call 00401244 ;三个参数传进去比较。<br>
          :004011F0 83F801 　　　　　cmp eax, 00000001<br>
          :004011F3 0F84DEFEFFFF 　　je 004010D7 -&gt;如eax=1正确<br>
          :004011F9 EB1F 　　　　　　jmp 0040121A -&gt;如 eax&lt;&gt;1出错<br>
          如果eax&lt;&gt;1将出错，因此上面的一个call是关键，有3个参数传给它处理（3个push),处理结果以eax返回。在第2个PUSH过后，下d 
          esp将看到正确的序列号。....</span> </p>
        
  </td>
    </tr>
  </table>
</div>
<div id="KB4Parent" class="parent"> <span class="p9"><a href="#" onClick="expandIt('KB4'); return false"> 
  4、习题四答案</a> </span></div>
<div id="KB4Child" class="child"> <span class="p9">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> 
  <table width="100%" cellspacing="0" align="center">
    <tr bgcolor="#EFEFEF"> 
      <td> 
        <p class="p9">用bpx hmemcpy设断来到此： <br>
          :0040156A&nbsp; 8D4DEC&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          LEA&nbsp; &nbsp; ECX,[EBP-14] <br>
          :0040156D&nbsp; E8DE020000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
          &nbsp; 00401850&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; eax 
          = name的长度n <br>
          :00401572&nbsp; 8945E4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; [EBP-1C],EAX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ebp-1c 
          = eax <br>
          :00401575&nbsp; 837DE405&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; 
          &nbsp; DWORD PTR [EBP-1C],05 ; 检测姓名是否大于5个字符 <br>
          :00401579&nbsp; 7D43&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; JGE&nbsp; &nbsp; 004015BE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; <br>
          ................................. <br>
          :004015BE&nbsp; C745E000000000&nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
          DWORD PTR [EBP-20],00000000 ; ebp-20 = 0 <br>
          :004015C5&nbsp; EB09&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; JMP&nbsp; &nbsp; 004015D0 <br>
          :004015C7&nbsp; 8B55E0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; EDX,[EBP-20]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; edx 
          = ebp-20 (开始记数n) <br>
          :004015CA&nbsp; 83C201&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          ADD&nbsp; &nbsp; EDX,01&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ; edx = edx + 1 <br>
          :004015CD&nbsp; 8955E0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; [EBP-20],EDX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 记数n= 
          edx <br>
          :004015D0&nbsp; 8B45E0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; EAX,[EBP-20]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; eax 
          = 记数n <br>
          :004015D3&nbsp; 3B45E4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          CMP&nbsp; &nbsp; EAX,[EBP-1C]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; is 
          eax &lt; 姓名长度 <br>
          :004015D6&nbsp; 7D42&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; JGE&nbsp; &nbsp; 0040161A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ; 如果大于或等于就跳走 <br>
          :004015D8&nbsp; 8B4DE0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; ECX,[EBP-20]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ecx 
          = 记数n <br>
          :004015DB&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; PUSH&nbsp; &nbsp; ECX <br>
          :004015DC&nbsp; 8D4DEC&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          LEA&nbsp; &nbsp; ECX,[EBP-14] <br>
          :004015DF&nbsp; E81C030000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
          &nbsp; 00401900 <br>
          :004015E4&nbsp; 0FBED0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOVSX&nbsp; EDX,AL&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          ; edx = char[记数n] <br>
          :004015E7&nbsp; 8B45F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; EAX,[EBP-10]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; eax 
          = ebp-10 (将始地址81276345h放入eax) <br>
          :004015EA&nbsp; 03C2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ADD&nbsp; &nbsp; EAX,EDX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; &nbsp; ; eax = eax + edx <br>
          :004015EC&nbsp; 8945F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; [EBP-10],EAX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ebp-10 
          = eax <br>
          :004015EF&nbsp; 8B4DE0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; ECX,[EBP-20]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ecx 
          = 记数n <br>
          :004015F2&nbsp; C1E108&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          SHL&nbsp; &nbsp; ECX,08&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ; ecx = ecx shl 8 <br>
          :004015F5&nbsp; 8B55F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; EDX,[EBP-10]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; edx 
          = ebp-10 <br>
          :004015F8&nbsp; 33D1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; XOR&nbsp; &nbsp; EDX,ECX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; &nbsp; ; edx = edx xor ecx <br>
          :004015FA&nbsp; 8955F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; [EBP-10],EDX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ebp-10 
          = edx <br>
          :004015FD&nbsp; 8B45E0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; EAX,[EBP-20]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; eax 
          = 记数n <br>
          :00401600&nbsp; 83C001&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          ADD&nbsp; &nbsp; EAX,01&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ; eax = eax + 1 <br>
          :00401603&nbsp; 8B4DE4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; ECX,[EBP-1C]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ecx 
          = 姓名长度 <br>
          :00401606&nbsp; 0FAF4DE0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IMUL&nbsp; 
          &nbsp; ECX,[EBP-20]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ecx = ecx * 
          记数n <br>
          :0040160A&nbsp; F7D1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; NOT&nbsp; &nbsp; ECX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; &nbsp; &nbsp; &nbsp; ; not ecx <br>
          :0040160C&nbsp; 0FAFC1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          IMUL&nbsp; &nbsp; EAX,ECX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ; eax = eax * ecx <br>
          :0040160F&nbsp; 8B55F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; EDX,[EBP-10]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; edx 
          = ebp-10 <br>
          :00401612&nbsp; 0FAFD0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          IMUL&nbsp; &nbsp; EDX,EAX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ; edx = edx * eax <br>
          :00401615&nbsp; 8955F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; [EBP-10],EDX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; edp-10 
          = edx <br>
          :00401618&nbsp; EBAD&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; JMP&nbsp; &nbsp; 004015C7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; ; 跳到开始处循环 <br>
          :0040161A&nbsp; 8B45F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          MOV&nbsp; &nbsp; EAX,[EBP-10]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; eax 
          = 正确的序列号(要将这16进制换成10进制） <br>
          ................................. <br>
          :00401640&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; TEST&nbsp; &nbsp; EAX,EAX&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
          &nbsp; &nbsp; ;判断输入序列号正确与否 <br>
          :00401642&nbsp; 0F85FF000000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; &nbsp; 
          00401747 <br>
          以上基本分析出序列号是如何计算的，请新手认真吸取。 </p>
      </td>
    </tr>
  </table>
</div>
<div id="KB5Parent" class="parent"> <span class="p9"><a href="#" onClick="expandIt('KB5'); return false"> 
  </a></span></div>
<span class="p9">
<script language='JavaScript'>
    if (NS4) {
        firstEl = "KB1Parent";
        firstInd = getIndex(firstEl);
        arrange();
    }
</script>
</span> <br>
<br>
<table width="80%" border="1" cellspacing="0" cellpadding="0" align="center" bgcolor="#99CCFF" bordercolorlight="#99CCFF" bordercolordark="#99CCFF">
  <tr> 
    <td width="82%" class="p8" height="2">Copyright @看雪 2000 All rights reserved 
      　　<a href="mailto:[e-mail]">与我联系</a></td>
    <td width="10%" class="p9" height="2"><a href="index.htm" tppabs="http://toye.dihou.org/index.htm">返回<br>
      首页</a></td>
    <td width="8%" class="p8" height="2"><a href="molu.htm" tppabs="http://toye.dihou.org/molu.htm" class="p9">返回<br>
      目录</a></td>
  </tr>
</table>
<p></p>
<p></p>
      </body>
</html>