diy ÄãµÄpe Íê½áƪ
ÉÏÁ½ÆªÎҽ̸ø´ó¼ÒÈçºÎdiy pe£¬ÓÉÓÚÖÖÖÖÔÒò£¬¶¼ÊÇûÓÐ̫ʵ¼ÊµÄÀý×Ó¡£½ñÌìÎҾͽ²ÊöÒ»¸öʵ¼ÊµÄÀý×Ó¡£
ÎÒÏë¿´Ñ©ÂÛ̳µÄÈËûÓв»ÓÃw32asmµÄ°É£¬Õâ¸öʵÓõŤ¾ß´ó¼Ò¶¼°®Ëü¡£µ«ÊÇw32asmÒ²ÓÐЩ²»ÍêÉƵĵط½¡£
Ê×ÏÈËü²»Ö§³Ö¹öÂÖÊó±êµÄ¹ö¶¯£¨µ±È»ÊÇÔÚÄãûÓÐÓø¨ÖúÊó±êÈí¼þµÄÇé¿öÏ£©£¬È»ºóÊDz»Ö§³ÖÎļþµÄÍÏ·Å
Äã´ò¿ªw32asmºóÍϸöÎļþ½øÈ¥£¬Êó±êÊǸö½ûÖ¹ÍϷŵÄͼ±ê¡£ÏëʵÏÖÕâЩ¹¦ÄÜô£¬ÄǾʹøÉÏÄãµÄÀÏ»¢Ç¯£¨trw£©
£¬°âÊÖ£¨hiew£©ÎÒÃdzö·¢ÐÞÀí»ú´²£¨w32asm£¬ÎÒÐÞÀíµÄw32asmÊÇkiller
Ð޸ĹýµÄw32asm10£¬ÔÎļþÓÃpecompackѹËõ¹ý£¬
×Ô¼ºÍÑ¿ÇÐ޸ģ©£¬£¨ÉùÃ÷£ºÎÒµÄϵͳÊÇ98£¬2000ÏÂÎÒûÓвâÊÔ¡£¿´ÍêÎÒÕâƪÎÄÕµÄÓÐÐËȤµÄÈË£¬¿ÉÒÔÔÚ2000ÏÂÊÔÊÔ£©
ºÃ£¬ÎÒÃÇÏÈ×öµÚÒ»¸ö¹¦ÄܰɼÓÈëÊó±ê¹öÂÖ¹¦ÄÜ£¨ÕâʱºòÎÒµÄÏë·¨ÊǼÙÈçÎÒÓÐw32asmµÄÔ´³ÌÐòµÄ»°¶àºÃ°¡£¬Ã»ÓУ¿ÄÇÖ»Óдӷ´±àÒëµÄpeÎļþ¸É»îÁË£¬
¸Ð¾õÏñÔÚÐÞÀïúÆø¹ÜµÀ©Æø£©
µÚÒ»²½£º·ÖÎöÎÊÌ⣨ÿ¸ödiyÕ߶¼Ó¦¸ÃÑø³ÉÕâ¸öÏ°¹ß£¬²»ÒªÉÏÀ´¾Íbpx ¶ÏµãÂÒÏÂһͨ£©
²»Ö§³Ö¹öÂÖÊÇʲôÔÒòÔì³ÉµÄ£¿
windowsÊǸöÏûϢϵͳ£¬w32asm²»Ö§³Ö¹öÂÖÊÇÒòΪËü½ÓÊܵ½¹öÂÖµÄÏûÏ¢µ«ÊǸù±¾²»´¦ÀíËü£¬
ÎÒÃǵÄÄ¿±ê¾ÍÊÇÕÒµ½w32asm´¦ÀíwindowsÏûÏ¢µÄµØ·½£¬È»ºó¼ÓÈë´¦Àí¹öÂÖÏûÏ¢£¬Èç¹ûÄãÎÊÎÒÔõô´¦Àí¹öÂÖÏûÏ¢£¬ºÜ¼òµ¥£¬
ÎÒÃǰѹöÂÖµÄÏûϢת»¯³É°´¼üµÄÏûÏ¢£¬w32asm²»ÊÇ¿ÉÒÔ°´ÉÏϼüÀ´¹ö¶¯Ã´£¬ÎÒÃǰѹöÂÖµÄÉÏϹö¶¯µÄÏûϢת»¯ÎªÉÏÏ°´¼ü
µÄÏûÏ¢£¬È»ºóÆäËûµÄÊÂÇé½»¸øw32asm×Ô¼ºÈ¥´¦Àí¾Íok£¬ºÃÁËÐÞÀí˼·¶¨ºÃÁË£¬¿ªÊ¼¶¯¹¤
µÚ¶þ²½£ºÕÒµ½win32asm´¦ÀíÏûÏ¢µÄµØ·½
ÔõôÕÒ´¦ÀíÏûÏ¢£¬ÎÒÔÚÉÏһƪÎÄÕÂÒѾ½²¹ýÁË£¬ÕâÀïÎҾͲ»ÔÚÖظ´ÁË¡£
ÕÒµ½´¦ÀíÏûÏ¢µÄµØ·½ÈçÏÂ
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E471(U)
|
:0045261E 8B4604
mov eax, dword ptr [esi+04]£½£½£½¡·¡¾ÕâÀïÊǺ¯Êý²ÎÊýµÄ´«µÝ£¬esi+04¾ÍÊÇmsg µÄunit¡¿
:00452621 3D21010000 cmp
eax, 00000121======>ÕâÀïeax¾ÍÊÇwindowsÏûÏ¢µÄ´úÂë
:00452626 7F41
jg 00452669
:00452628 0F84A30D0000
je 004533D1
:0045262E 3D11010000
cmp eax, 00000111===>¿´¹ýÎÒÉÏƪÎÄÕµÄÈ˾ÍÊìϤÕâ¸ö°É£¬¾ÍÊÇwm_command
:00452633 7F1B
jg 00452650 *´¦ÀíÏûÏ¢µÄµØ·½ºÜ³¤£¬ÒòΪw32asmÓкܶàÏûÏ¢Òª´¦Àí*
:00452635 7463
je 0045269A *ÏÞÓÚƪ·ù£¬ÎÒÖ»Ìù¹Ø¼üµØ·½£¬ÓÐÐËȤµÄÅóÓÑ¿ÉÒÔ×Ô¼º*
:00452637 2DA0000000 sub
eax, 000000A0 *·´»ã±àÔÎļþ¹Û²ì
*
:0045263C 0F84530D0000
je 00453395
*
*
:00452642 83E860
sub eax, 00000060
:00452645 0F8493000000
je 004526DE
:0045264B E92F120000
jmp 0045387F
ºÃÎÒÃÇ϶ϵãbpx 45261e
ÕâʱºòÄã»á·¢ÏÖ²»¶ÏµÄÖжÏÍ£ÔÚÕâ¸öµØ·½£¬ÕâºÜÕý³££¬ÕâÀïÊÇw32asm´¦ÀíÏûÏ¢µÄºËÐIJ¿·Ö£¬Ã¿Ò»¸ö¸øw32asmµÄÏûÏ¢¶¼¾¹ýÕâÀï¹ýÂË¡£
Ƶ·±µÄwindowsÏûÏ¢µ±È»¾Í»áƵ·±µÄÖжÏÁË£º£©¡£Õâ¸öûÓйØϵ£¬Ã¿´ÎÖжÏÎÒÃǾÍf5£¬È»ºóÔÚ°´f5µÄʱºòµÄ¼ä¸ô¾Í¹ö¶¯Êó±êµÄ¹öÂÖ£¬¿´¿´
¹öÂÖµÄÏûÏ¢ÊǶàÉÙ£¨×¢£ºÕâ¸öÔÚwindows±à³ÌÊÖ²áÀï¿ÉÒԲ鵽wm_mousewhellÏûÏ¢µÄ´úÂëÊÇ20A£¬ÎÒÕâÑùÀ´µÄÄ¿µÄÊÇÒòΪÎÒ²»ÖªµÀÆäwaramµÄ
×Ó²ÎÊý£¬Ò²¾ÍÊÇÈçºÎÅжϹöÂÖÏòÉϹö¶¯ºÍÏòϹö¶¯µÄ×Ó²ÎÊýÊÇÈçºÎ¶¨ÒåµÄ£¬¶øÇÒÊÖÍ·ÉÏûÓÐÀàËƵĹöÂÖ³ÌÐò£¬ÎÒÖ»ÓÐ×Ô¼º²âÊÔÁË£¬Õâ¸ö·½·¨
ÊDZȽϱ¿ÁËÒ»µã£¬µ«ÊÇÎÒÃÇÏëÈ˼ҹù¾¸¶¼ÊÇ´óÖÇÈôÓÞ£¬°²Î¿Ò»ÏÂ×Ô¼º£©£¬µ±¿´µ½esi£«04µÄֵΪ20aµÄʱºòÎÒÃÇd
esi£«08£¨Ò»°ã×Ó²ÎÁ¿¶¼ÊÇÕâ¸ö
λÖã¬windows ÏûÏ¢±¾Éí¾ÍÊÇÕâô¶¨ÒåµÄ£©£¬±È½ÏÏòÉϹö¶¯ºÍÏòϹö¶¯esi£«08µØÖ·ÓÐʲô²»Í¬£¬ÎÒÕâÀï¿´µ½µÄÊǵ±ÏòÉϹö¶¯µÄʱºòesi£«0aÊÇ7800
µ±ÏòϹö¶¯µÄʱºòesi£«0aÊÇ88ff£¬ÎҾͳõ²½È·¶¨ÏòÉϹö¶¯ºÍÏòϹö¶¯µÄÅжÏÁË¡£ÖªµÀÁ˹öÂֵĹö¶¯£¬ÎÒÃÇ»¹Òª²âÊÔһϰ´¼üµÄ×Ó²ÎÊý£¬°´¼üµÄÏûÏ¢
ÊÇwm_keydown 100,wm_keyup 101,wm_char 102ÕâÀïw32asmÖ»´¦Àíwm_keydownµÄÏûÏ¢£¨¿´w32asmÏûÏ¢´¦ÀíµÄµØ·½£¬ÎÒûÓÐÌù³öÀ´£¬ÓÐÐËȤ¿ÉÒÔ×Ô¼º·´
±àÒë×Ô¼ºÍù45264BÏÂÃæ¿´£©£¬ºÃ¼ÈȻֻ´¦Àíwm_keydownµÄÏûÏ¢£¬ÎÒÃÇ»¹ÊÇÀÏ°ì·¨£¬f5¼ÓÉÏÔÚ¼ä¸ôµÄʱºò°´ÏÂÏòÉÏ£¬Ïòϵݴ¼ü£¬È»ºó¹Û²ìesi£«08µÄµØÖ·
µÄ×Ó²ÎÁ¿£¬ÎÒÕâÀïµ±°´ÏòÉϼüesi£«08ÊÇ26£¬Ïòϼüesi£«08ÊÇ28£¬ºÃÏÖÔÚÎÒÃÇÖªµÀÁËËùÓÐÒªÖªµÀµÄ¶«Î÷ÁË£¬¿ªÊ¼ÓðâÊÖÈ¥ÐÞÀí»ú´²°É
Ê×ÏÈÕÒµ½ÔÚ³ÌÐòÀï¿Õ³öÀ´µÄµØ·½
°ÑÔÀ´µÄ
:00452621 3D21010000
cmp eax, 00000121
¸ÄΪ
00452621: E90ACD0500
jmp .0004AF330 £½£½¡·Ìøµ½ÎÒÃÇ×Ô¼ºµÄÏûÏ¢´¦Àí²¹¶¡ÉÏ
|
×Ô¼ºµÄÏûÏ¢´¦Àí²¹¶¡£º
004AF330: 3D0A020000
cmp eax,00000020A ;"
£½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊǹöÂÖ
"
004AF335: 7415
je .0004AF34C
----- (1)£½£½ÊǵĻ°×ªµ½¹öÂÖ´¦Àí
004AF337: 3D33020000
cmp eax,000000233 ;"
3"£½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊÇÍÏ·ÅÎļþ£¨Õâ¸öÊDz¹¶¡µÚ¶þ¸ö¹¦ÄÜÓõģ¬ÔÚÏÂÃæÓвûÊö£©
004AF33C: 7400
je
.0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
004AF33E: 90
nop£½£½£½£½£½¡·¿Õ³öÕâô¶ànopÊÇÒòΪÎÒŵÈһϲ¹¶¡ je .0004AF33EÒÔºó»á±ä³É³¤ÌøתËùÒÔÔ¤ÁôÕâЩ×Ö½Ú
004AF33F: 90
nop
004AF340: 90
nop
004AF341: 90
nop
004AF342: 3D21010000
cmp eax,000000121 ;" !"£½£½¡·»Ö¸´Ô³ÌÐò¶¯×÷
004AF347: E9DA32FAFF
jmp .000452626 ----- (3)£½£½¡·Ìø»ØÔ³ÌÐòµØ·½
004AF34C: 668B460A
mov ax,[esi][0A]£½£½¡·È¡³ö¹öÂÖµÄ×Ó²ÎÊý
004AF350: 663DFF00
cmp
ax,000FF ;" ÿ"£½£½¡·±È½ÏÊÇÏòÉϹö»¹ÊÇÏòϹö
004AF354: 720A
jb
.0004AF360 ----- (4)
004AF356: B828000000
mov
eax,000000028 ;" ("£½£½¡·ÏòϹö¶¯£¬¸Ä¶¯ÏûÏ¢×Ó²ÎÊýΪ°´¼üÏÂ
004AF35B: 894608
mov
[esi][08],eax
004AF35E: EB08
jmps .0004AF368
----- (5)
004AF360: B826000000
mov eax,000000026 ;" &"£½£½¡·ÏòÉϹö¶¯£¬¸Ä¶¯ÏûÏ¢×Ó²ÎÊýΪ°´¼üÉÏ
004AF365: 894608
mov [esi][08],eax
004AF368: B800010000
mov
eax,000000100 ;" "£½£½¡·¸Ä¶¯ÏûϢΪ°´¼üÏûÏ¢
004AF36D: 894604
mov
[esi][04],eax
004AF370: EBD0
jmps .0004AF342
----- (6)£½£½¡·Ìø»ØÔ³ÌÐò
ºÃµ½ÏÖÔÚΪֹ£¬ÎÒÃDzâÊÔ¿´¿´£¬¹þ¹þ£¬¹ûÈ»¹ö¶¯ÁË£¬³É¹¦£¡Ê²Ã´£¿Äã˵¹ö¶¯µÄÌ«Âý£¡£©¡ò£©¡ò¡ù£¤£©¡ù£©£¨¡ò£¬Èç¹ûÏÓÂýµÄ»°£¬×Ô¼º°Ñ°´¼üÏûÏ¢×Ó²ÎÊý¸Ä³Épgdn¡£ºÍpgupÒ»´Î¹ö¶¯Ò»Ò³£¬¿ìÁË°É¡£Ê²Ã´£¿Äã˵Äܲ»Äܲ»ÒªÕâô¿ì£¬Ò»´Î¹ö¶¯3ÐУ¬»òÕß5ÐУ¬×îºÃ¼Ó¸ö¶¨Òå´°¿ÚÏë¹ö¶¯¼¸Ðоͼ¸ÐУ¿ÎÒÒªÔε¹ÁË£¬
´ó¸ç£¬ÎÒÊǸĶ¯peÎļþ£¬²»ÊǸÄÔ´³ÌÐò¡£Èç¹ûÄãÏëÕâÑùµÄ»°£¬ÎÒ¸æËßÄã˼·£¬Äã×Ô¼º×ö.Ê×ÏÈ×Ô¼ºÔÚw32asmµÄmenuÀïÃæ¼Ó¸ö¶¨Òå¹öÂÖ¹ö¶¯µÄ×ÓÑ¡ÏÎҵĵڶþƪ
ÎÄÕÂÓÐ˵Ôõô×öµÄ£¬È»ºó¼ÓÈëµã»÷Õâ¸ö×ÓÑ¡ÏîµÄÏûÏ¢´¦Àí£¬Èõã»÷Õâ¸ö×ÓÑ¡ÏîµÄʱºòµ¯³öÒ»¸ödialog£¬¿ÉÒÔÓÃCreateDialogµÄapiº¯Êý£¬µ±È»ÄãµÄÏÈ×öºÃÕâ¸ödialogµÄ×ÊÔ´£¬È»ºó¼ÓÈëÕâ¸ödialogµÄµÄÏûÏ¢º¯Êý£¬ÔÚdialogÀïÃæ×ö¸öeditµÄ¿Ø¼þºÍÒ»¸öbutton¿Ø¼þµ±µã»÷buttonµÄʱºò¾Í°ÑeditÀïÃæµÄÊýÖµ±£´æµ½Ò»¸öµØÖ·
£¬È»ºóÄãµÄ¹öÂÖÅжϵĵط½¶ÁÈëÕâ¸öµØÖ·µÄÖµ£¬¸ù¾ÝÕâ¸öÖµÅжÏÓÃsendmessageº¯ÊýÏòw32asm·¢ËͶàÉÙ¸ö°´¼üÏûÏ¢£¬1¾Í·¢1¸ö£¬50¾Í·¢50¸ö£¬ÕâÑùÄãÀÖÒâ¹ö¶¯¶àÉÙÐоͶàÉÙÐУ¬»¹¿ÉÒÔ×Ô¶¨Ò壺£©¡£ÎÒÊǺÜÀÛ£¬²»×öÁË£¬ÄǸö´ó¸ç²»ÂúÒâÎÒ×öµÄ¾Í×Ô¼º¾Í×öÒ»¸öÏë¹ö¶¯¼¸Ðоͼ¸Ðеİɣ¬¼ÇµÃ×öºÃÁË·¢Ò»¸ö¸øÎÒÓÃÓþÍÐÐÁË!ºÃÁË
µ½ÏÖÔÚΪֹÎÒÃǵĹöÂÖ°æÒѾ×öºÃÁË¡£ÐÝÏ¢Ò»ÏÂÑÛ¾¦£¬ÎÒÃÇÒª¿ªÊ¼´ó¶¯¸É¸ê£¬¿ªÊ¼×öÍÏ·Å°æÁË£¨Èç¹ûÊdzõѧÕ߾Ͳ»ÒªÍùÏ¿´ÁË£¬½²ÊöµÄרҵ±È½Ï¶à£©
ÏÖÔÚ¼ÌÐøÎÒÃǵÄdiyÖ®ÂÃ
´ò¿ªw32asmÊÔÊÔÍÏ·ÅÒ»¸öÎļþ£¬ºÇºÇ£¬Êó±êÊǽûÖ¹ÍϷŵÄͼ±ê£¬Ö¤Ã÷ÊÇw32asmÊǸù±¾²»Ö§³ÖÍÏ·Å£¬Ëµ°×ÁËÒ²¾ÍÊDz»´¦ÀíÍϷŵÄÏûÏ¢¡£
ºÃ£¬¼ÈÈ»ÎÒÃÇÒªÊÇÕâ¸öw32asmÖ§³ÖÍÏ·Å£¬Ê×ÏÈÎÒÃÇÏÈÁ˽âÒ»ÏÂÍϷŵÄ֪ʶ£¬windowsÊǸöͼÐνçÃæϵͳ£¬¸÷ÖÖ¸÷ÑùµÄ³ÌÐò¶¼ÊÇ»ùÓÚͼÐνçÃæµÄ£¬
Õâ¸ö½çÃæÊÇÎÒÃÇÒ²¿ÉÒÔ³ÆΪ´°¿Ú£¬´°¿ÚºÜ¶àÊôÐÔ£¬±ÈÈç´ó¼Ò¶¼Á˽âµÄenablewindow¾ÍÊÇÉèÖô°¿ÚµÄÊôÐԵģ¬²»¹ýÕâ¸öº¯ÊýÊÇÉèÖô°¿ÚÊÇ·ñ¿ÉÓõÄ
ÊôÐÔ¡£ÏÖÔÚÎÒÃÇÐèÒªµÄÊÇ´°¿ÚÊÇ·ñ½ÓÊÜÍϷŵÄÊôÐÔ£¬ÎÒ¸æËß´ó¼Ò£¬Õâ¸öº¯Êý¾ÍÊÇDragAcceptFiles£¬ËüÊÇshell32.dllµÄº¯Êý£¬ÓëÍÏ·ÅÓйصĺ¯Êý»¹ÓÐDragFinishºÍDragQueryFile£¬ÎÒÃÇÒª²¹¶¡Ò²¾ÍÒªÓõ½Õâ¸öÈý¸öº¯Êý£¬
Ê×ÏÈÎÒÃÇ¿´¿´DragAcceptFilesÕâ¸öº¯ÊýÊÇÉèÖô°¿ÚÊÇ·ñÄܽÓÊÜÍϷŵÄÏûÏ¢£¬Ò²¾ÍÊÇwindowsÊÇ·ñ·¢ËÍWM_DROPFILESÏûÏ¢¸øÕâ¸ö´°¿Ú¡£Ê¹Óõķ½·¨ÊÇapiÊÖ²áÉϲ鵽Ϊ£º
VOID DragAcceptFiles(
HWND hWnd, //
handle to the registering window ×¢²á´°¿ÚµÄhwnd
BOOL fAccept
// acceptance option ÊÇ·ñ½ÓÊÜÍϷŵÄÏûÏ¢
);
ÖªµÀÁËDragAcceptFilesµÄÓ÷¨ºó.ÎÒµÄ˼·ÊÇ°Ñw32asmµÄËùÓеĴ°¿Ú¶¼¼ÓÉÏÒ»¸ö
invoke DragAcceptFiles,hwnd,TRUE
µ±È»Õâ¸öÊÇÔÚ»ã±àÀïʵÏÖ£¬µ«ÊÇÔÚÒѾÁ¬½ÓºÃµÄpeÎļþÀïÈçºÎʵÏÖ
invoke DragAcceptFiles,hDlg,TRUEÄØ£¿
Òª´ïµ½Õâ¸öÄ¿µÄ
µÚÒ»£ºÊ×ÏÈÎÒÃÇÐèÒªpeÎļþµÄimport±í£¨×¢£ºÈç¹û²»¶®import±íµÄ¿ÉÒÔ×Ô¼ºÏÈѧϰһÏÂpeÎļþµÄ¸ñʽ£¬²»ÄÑ£¬Ö»ÊÇÓе㷳¶øÒÑ£©ÓÐDragAcceptFilesÕâ¸öÒýÈ뺯Êý
µÚ¶þ£ºÈ»ºó¾ÍÊÇÎÒÃÇÐèÒªÔÚpeÎļþÖеĵ½´°¿ÚµÄhwnd
´ïµ½ÒÔÉÏÌõ¼þÒÔºó
Ö»ÒªÔÚpe¿Õ°×¿Õ¼äÓÃÒÔÏ´úÂë¾Í¿ÉʵÏÖ
push
1
push hwnd
call DragAcceptFiles
ÎÒÃÇÏÖÔÚÏÈÀ´´ïµ½µÚÒ»¸öÌõ¼þ
ÄóöÎÒÍѿǵÄw32asm(×¢£ºÎÒ×Ô¼ºÍѿǵÄÓÐÁ½¸ö°æ±¾£¬µÚÒ»¸öÊÇÔÚÈë¿ÚµãdumpÍêÈ«µÄpe£¬È»ºóÊÖ¶¯ÐÞ¸´import£¬Õâ¸ö°æ±¾ºÜÒź¶£¬Ö»ÄÜÔÚ98ÏÂÔËÐУ¬²»ÄÜÔÚ2000ÏÂÔËÐУ¬ÔÒòÊÇÐèÒªÐÞ²¹µÄimportÌ«¶à¿ÉÄÜÓÐÒÅ©£¬»òÕßÎÒÒ²²»ÖªµÀ£¬µÚ¶þ¸ö°æ±¾£¬ÊÇÇéÀÇ´ó¸çÔÚÈë¿ÚµãÓÃtrw2000µÄpedumpÃüÁîdump³öÀ´°æ±¾£¬Õâ¸ö°æ±¾ÄÜ¿çƽ̨£¬µ«ÊÇÒ²Òź¶£¬ÓÃpe±à¼Æ÷¿´²»µ½ÈκεÄimport±í£©
ΪÁËÄÜ¿çƽ̨£¬ÎÒ¾ö¶¨Óõڶþ¸ö°æ±¾¿ªÊ¼¸ÄÔ죬ÓÉÓÚûÓÐÈκεÄimport±í£¬ÎÒÃǸù±¾²»ÖªµÀÊÇ·ñ°üº¬ÓÐDragAcceptFilesÕâ¸öº¯Êý£¬ÓÃstud_pe´ò¿ª×Ô¼º×öµÄµÚÒ»¸ö°æ±¾£¨Ò²¾ÍÊÇÐÞ¸´ÁËimport±íµÄÄǸö°æ±¾£©£¬µã»÷function°´Å¥£¬¹Û²ìimportµÄº¯ÊýÐÅÏ¢·¢ÏÖÆ亯ÊýÓÐkernell32¡¢gdi32.dll
µÈ£¬Ã»Óаüº¬shell32.dll£¬Ò²¾ÍÊÇ˵£¬²»¿ÉÄÜÓÐDragAcceptFilesÕâ¸öÎÒÃÇÐèÒªµÄº¯ÊýÁË£¬Ã»Óк¯Êý£¬ÎÒÃÇÓÖÏëÓã¬ÄǾÍÖ»ÓÐ×Ô¼ºÊÖ¶¯¹¹ÔìÁË£¬Èý¸öÏà¹ØµÄº¯Êý¹¹ÔìÆðÀ´£¬»¹ÊDZȽÏÈÝÒ׵ģ¬²»¹ýÎÒ»¹Êǽ̴ó¼ÒÔõôʹÓÃlordpe¹¹Ôì°É£¨ÓÃstud_peºÍpeeditor¶¼²î²»¶à£¬ÊÖ¶¯Ò²ÐУ¬Èç¹ûÀ´¸ö¶þÈýÊ®¸öº¯ÊýµÄ»°£¬ÎÒ¿´ÊÖ¶¯µÄ¿É¾Í³Ô¿÷ÁË£©
¹¹Ô캯Êýƪ£º
ÓÃlordpe´ò¿ªµÚ¶þ¸öÍÑ¿Ç°æ±¾£¬µã»÷directories°´Å¥£¬È»ºóµã»÷importtabl°´Å¥£¬Ö»ÄÜ¿´µ½Ò»¸ökernell32.dll£¬ÔÚÉÏÃæµã»÷ÓÒ¼ü£¬Ñ¡Ôñ
add import£¬µ¯³ö´°¿Ú£¬ÔÚdllÌîÈëSHELL32.dll£¬apiÌîÈëDragAcceptFilesµã»÷ÄǸö¼ÓºÅµÄ°´Å¥¿´µ½DragAcceptFilesÒѾÌí¼Ó½øÈ¥ÁËÈ»ºóÓÃÕâ¸ö·½·¨Ìí¼ÓDragFinishºÍDragQueryFileº¯ÊýÌí¼ÓÍê³Éºóµã»÷ok£¬¿´µ½import±í¶àÁËÒ»¸öshell32µÄdllÁË°É£¬ÀïÃæÓÐÎÒÃÇÌí¼ÓµÄÈý¸öº¯Êý,¼ÇÏÂÕâ¸öÈý¸öº¯ÊýµÄthunkrvaÖµ£¨ÒÔºóÒªÓõ½£©£¬ÎÒÕâÀïÈçÏÂ:
ThunkRva ThunkOffset ThunkValue
Hint ApiName
0015803B 0015803B
0015800C 0000 DragAcceptFiles
0015803F 0015803F 0015801E 0000
DragQueryFile
00158043 00158043 0015802E
0000 DragFinish
ÆäʵÄãÒ²¿ÉÒÔ×Ô¼ºÓÃwinhex¹¹ÔìÕâ¸öÈý¸öº¯Êý£¬²»ÄÑ£¬¿´¿´Ïà¹ØµÄpe¸ñʽÎĵµ¾ÍÄÜ×öµ½£¬×Ô¼º¹¹ÔìµÄÓиöºÃ´¦¾ÍÊǽṹ±È½Ï·ÖÃ÷£¬¿´ÆðÀ´±È½ÏÊæ·þ£¬Èí¼þ¹¹ÔìµÄÊÇÖØж¨Î»¹ýimportËùÒÔÓеã»ìÂÒ£¬²»¹ýÄãÏë͵ÀÁ¾ÍÓÃÈí¼þ¹¹Ôì°É£¬Õâ¸ö·½±ã
¹¹ÔìÍêÁ˺¯Êý,ÎÒÃǵĸøËüÒ»¸öfirshthunk£¬·ñÔòÔÚ³ÌÐòÀïÃæÔõôcallÄÇÀïÄØ£¿ÕâÀï¾ÍÓõ½ÁËthunkrvaµÄÖµÁË£¬ÏÖÔÚ¹¤¾ß»»³ÉÁËhiew,ÓÃhiew´ò¿ªÍѿǺóµÄw32asmÎÒÃÇÀ´µ½004AF29C
ÈçÏ£º
004AF29C: FF25244B4D00
jmp d,[004D4B24]
004AF2A2: FF252C4B4D00
jmp
d,[004D4B2C]
004AF2A8: FF25304B4D00
jmp d,[004D4B30]
004AF2AE: FF25344B4D00
jmp
d,[004D4B34]==>ÕâЩjmp¶¼ÊǶ¨Î»apiº¯ÊýµÄ£¬Ã¿¸öjmp´ú±í³ÌÐòÒªÓõ½apiº¯ÊýµØÖ·
004AF2B4: 0000
add
[eax],al *************************************************************
004AF2B6: 0000
add [eax],al *ÄãÎÊ£¬ÔõôÕÒµ½Õâ¸öµØ·½µÄ£¬ºÜ¼òµ¥£¬Ëæ±ãϸö³ÌÐòÒªÓõ½µÄapiº¯*
004AF2B8: 0000
add [eax],al *Êý£¬¿´¿´ÆäcallµÄÊÇÄǸöµØÖ·£¬¾ÍÄÜÕÒµ½Õâ¸öµØ·½
*
004AF2BA: 0000
add
[eax],al *************************************************************
ÎÒÃÇÏÖÔÚ¾ÍÒª¼ÓÈëDragAcceptFiles¡¢DragQueryFile¡¢DragFinishÈý¸öº¯ÊýµÄjmp£¬
jmpµ½ÄÇÀï,Æäʵ¾ÍÊÇjmpÄǸöThunkRva+imagebaseµÄÖµ,imagebaseÖµÊÇ4000000
ËùÒÔÎÒÃÇÒªÔÚ004AF2B4´¦ÌîÈ룺
004AF2B4£ºjmp d,[0055803B] *55803b=15803B(ThunkRva)+4000000(imagebase)ÒÔÏÂÒ»Ñù¼ÆËã
jmp d,[0055803f]
jmp d,[00558043]
ÌíÍêºóÈçÏ£º
004AF29C: FF25244B4D00
jmp d,[004D4B24]
004AF2A2:
FF252C4B4D00 jmp
d,[004D4B2C]
004AF2A8: FF25304B4D00
jmp d,[004D4B30]
004AF2AE: FF25344B4D00
jmp d,[004D4B34]
004AF2B4: FF253B805500
jmp
DragAcceptFiles ;SHELL32.dl==>¿´µ½ÎÒÃǹ¹ÔìµÄº¯ÊýÁËô£¬ÕæÊÇhappy°¡
004AF2BA: FF253F805500
jmp
DragQueryFile ;SHELL32.dll
004AF2C0: FF2543805500
jmp DragFinish ;SHELL32.dll
004AF2C6: 0000
add [eax],al
004AF2C8: 0000
add
[eax],al
ÏÖÔÚ¼ÇÏÂ004AF2B4¡¢004AF2BA¡¢004AF2C0ÕâÈý¸öÖµ.ÒÔºócall 004AF2B4¾ÍÊÇcall
DragAcceptFilesÁË£¬µ÷ÓÃDragQueryFile Ò²¾ÍÊÇcall 004AF2BAÁË£¬ÒÔ´ËÀàÍÆ
º¯Êý¹¹ÔìÍê³ÉµÚÒ»¸öÌõ¼þÒ²¾ÍÂú×ãÁË£¬¿ªÊ¼ÎÒÃǵڶþ¸öÌõ¼þhwndµÄÑ°ÕÒ°É
Ñ°ÕÒhwnd´ò²¹¶¡Æª£º
ÈçºÎÕÒµ½hwndÖµÄØ£¬¶Ôwindows±à³ÌÊìϤµÄÈË(Äã²»ÊìϤ¾ÍÂýÂýѧ£¬×ÜÓÐÒ»Ìì»áÊìϤµÄ£©ÖªµÀGetWindowRectº¯ÊýÒ²ÐèÒªÒ»¸öhwndÖµ£¬ÎÒÃǽػñ
getwindowsrectº¯Êý£¬±£´æÕâ¸öhwnd£¬ÔÙʹÓÃÕâ¸öhwndÀ´DragAcceptFiles ²»¾Íok£¬ºÃÈ·¶¨Ë¼Â·£¬´ò¿ªtrwÈ»ºóbpx
getwindowsrect
Æô¶¯w32asm·¢ÏÖÆäÔÚÕâÀïµ÷ÓÃgetwindowsrect£º
0167:00492941 52
PUSH EDX=========>Õâ¸öÊÇÒ»¸örectµÄstructµÄpoint£¬Ò²¾ÍÊÇÒ»¸ö¾ØÕó½á¹¹µÄÖ¸Õë
0167:00492942 FF700C PUSH
DWORD [EAX+0C]===>ÕâÀï¾ÍÊÇÎÒÃÇÐèÒªµÄhwnd
0167:00492945 E810C90100
CALL `USER32!GetWindowRect===>µ÷ÓÃÕâ¸öº¯ÊýÁËÒ²¾ÍÊÇcall
.0004AF25A
0167:0049294A EB1B JMP
SHORT 00492967
0167:0049294C
8B582C MOV EBX,[EAX+2C]
³ÌÐòÆô¶¯µ÷ÓÃÁ˺ܶà´ÎGetWindowRectº¯Êý£¬Ã¿´Îhwnd¶¼²»Í¬£¬ÕâÊÇÒòΪw32asm´°¿Ú·ÖΪºÃ¼¸¸ö£¬edit´°¿Ú£¬menu´°¿Ú£¬toolbar£¬×´Ì¬À¸µÈµÈ
ÎÒÃDz»¹ÜËü£¬°Ñÿ¸ö´°¿ÚµÄDragAcceptFiles Öµ¶¼ÉèÖÃΪture¾ÍÐÐÁË£¬¹ÜËüÓжàÉÙ¸öÄØ£¬ÓжàÉÙ¸ö£¬¾Íture¶àÉÙ¸ö£¬¸ö¸ö¶¼ÄܽÓÊÜÍÏ·Å£¬ÏëÍù
ÄÇÀïÍϾÍÍùÄÇÀïÍÏ
°ÑÕâ¾ä£º
0167:00492945 E810C90100 CALL
`USER32!GetWindowRect
¸ÄΪ£º
00492945: E996C90100
jmp .0004AF2E0
-----ÕâÀïÊÇÎÒÃÇ×Ô¼ºµÄ²¹¶¡³ÌÐòÁË
×Ô¼º²¹¶¡µÄµØ·½£º
004AF2E0: 58
pop
eax££££¡·È¡³öѹÈë¶ÑÕ»µÄhwnd
004AF2E1: A3C6F24A00
mov [004AF2C6],eax£££¡·±£´æµ½Ò»¸öµØÖ·£¬ÎÒÑ¡ÔñµÄÊÇ004AF2C6
004AF2E6: 50
push eax£££¡·Ñ¹hwndÈë¶ÑÕ»
004AF2E7: E86EFFFFFF
call .0004AF25A -----¡· CALL `USER32!GetWindowRect
004AF2EC: 6A01
push 001£½£½£½´«µÝture
004AF2EE:
FF35C6F24A00 push
d,[004AF2C6]£½£½¡·´«µÝhwnd
004AF2F4: E8BBFFFFFF
call
DragAcceptFiles ;SHELL32.dll£½£½£½¡·Ò²¾ÍÊÇcall 004AF2B4ÎÒÃÇÔÚÉÏÃæ¹¹ÔìµÄµØ·½
004AF2F9: E96936FEFF
jmp
.000492967 -----¡·»Øµ½³ÌÐòÔÀ´µÄµØ·½
ÏÖÔÚ´ò¿ª²¹¶¡ÍêµÄ³ÌÐò£¬ÍϸöÎļþÊÔÊÔ£¬ÊDz»ÊÇͼ±êÒѾ±äÁË£¬Äã˵£¬±äÊDZäÁË,ÔõôûÓз´Ó¦°¡£¬»¹Ã»ÓмÓÈëʼþÔõô»áÓз´Ó¦£¿ÕæÊǵģ¬Â·Òª
Ò»²½Ò»²½µÄ×ß¡£²»ÒªÌ«¼±
ÏÖÔÚ¿ªÊ¼ÎÒÃǼÓÈëʼþµÄ¹ý³ÌÁË£¬Ê×ÏÈÕÒµ½½ÓÊÜÏûÏ¢µÄµØ·½£¬¼ÓÈëÅжÏÍÏ·ÅÏûÏ¢µÄ´úÂ룬ÉÏÃæÒѾ˵¹ýÁËÔÚ
:0045261E 8B4604
mov eax, dword ptr [esi+04]£½£½£½¡·¡¾ÕâÀïÊǺ¯Êý²ÎÊýµÄ´«µÝ£¬esi+04¾ÍÊÇmsg µÄunit¡¿
:00452621 3D21010000
cmp eax, 00000121======>ÕâÀïeax¾ÍÊÇwindowsÏûÏ¢µÄ´úÂë
¶øÇÒ
:00452621 3D21010000
cmp eax, 00000121
ÒѾ¸ÄΪ£º
00452621: E90ACD0500
jmp .0004AF330
Ò²¾ÍÊÇÏûÏ¢´¦ÀíÒѾÔÚÎÒÃÇ×Ô¼ºµÄ²¹¶¡µØ·½ÁË
004AF330: 3D0A020000
cmp eax,00000020A
;" £½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊǹöÂÖ
"
004AF335: 7415
je
.0004AF34C ----- (1)£½£½ÊǵĻ°×ªµ½¹öÂÖ´¦Àí
004AF337: 3D33020000
cmp
eax,000000233 ;" 3"£½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊÇÍÏ·ÅÎļþ
004AF33C: 7400
je
.0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
ºÃÏÖÔÚÎÒÃÇ¿ÉÒÔ°Ñ004AF33C:
7400
je .0004AF33Eתµ½ÎÒÃÇ×Ô¼ºÍÏ·Å´¦ÀíµÄµØ·½ÁË
ÏÖÔÚ³ÌÐòÒ²ÄÜÅжÏÍÏ·ÅÏûÏ¢£¬ÎÒÃǾÍÐèÒª¸ù¾ÝÕâ¸öÏûÏ¢×öÏà¹ØµÄ¶¯×÷ÁË£¬Ò²¾ÍÊÇÐèÒª×ö´ò¿ªÕâ¸öÍÏ·ÅÎļþ²¢ÇÒ·´»ã±àËü¡£
ѧϰµ½ÕâÀ´ó¼ÒÊDz»ÊÇÒѾ±È½ÏÓÐ˼·ÁË£¬Ê×ÏÈÎÒÃDZØÐëµÃµ½ÍÏ·ÅÎļþµÄÎļþÃû£¬Õâ¾ÍÐèÒªDragQueryFile º¯ÊýÁË
The DragQueryFile
function retrieves the filenames of dropped files.
UINT DragQueryFile(
HDROP hDrop, // handle to structure
for dropped files£½£½£½¡·ÍϷŵÄhdrop
UINT iFile, //
index of file to query£½£½¡·Îª0¾Í¿ÉÒÔÁË
LPTSTR lpszFile, //
buffer for returned filename£½£½¡··ÅÎļþÃûµÄµØÖ·
UINT cch //
size of buffer for filename£½£½¡·bufferµÄ³ß´ç
);
ÎÒÃÇ¿´¿´Õâ¸öº¯ÊýÐèҪʲô²ÎÊý£¬ÏÖÔÚÐèÒªÕҵľÍÊÇhdropÕâ¸öÀàËÆÓÚwindows´°¿ÚµÄhwndÓÃÀ´Î¨Ò»±êʶÍϷŵģ¬Õâ¸öÒ²¾ÍÊÇmsgµÄ×Ó²ÎÊý
:0045261E 8B4604
mov eax, dword ptr [esi+04]£½£½£½¡·¡¾ÕâÀïÊǺ¯Êý²ÎÊýµÄ´«µÝ£¬esi+04¾ÍÊÇmsg µÄunit¡¿
esi+04ÊÇÏûÏ¢unit£¬ÄÇôÕâ¸ö×Ó²ÎÊý¾ÍÔÚesi+08´¦
ºÃÁËÏà¹ØµÄ²ÎÊý¶¼¸ã¶¨ÁË£¬ÏÂÒ»²½¾ÍÊÇ¿´¿´w32asmÔõô´ò¿ªÒ»¸ö¸ù¾ÝÎļþÃû´ò¿ªÎļþµÄ¶¯×÷µÄ£»´ÓÄÇÀïÏÂÊÖÄØ£¿´ÓdisassemblerµÄopen fileÏÂÊÖ£¿Õâ¸ö»áµ¯³öÒ»¸ö¿ò×Ó³öÀ´£¬²»ºÃ£¬ÄǾʹÓrecent
filesÏÂÊÖ£¬rencent files¿ÉÒÔ´ò¿ªÄã×î½ü´ò¿ªµÄÎļþ£¬ºÃÎÒÃÇ¿´¿´ËüÊÇÔõô´ò¿ªµÄ
£¨¸ú×ÙÕâ¸ö¶¯×÷ºÜ¸´ÔÓ£¬ÎÒÒªÏêϸµÄ˵£¬¿ÉÄÜ´òÒ»ÌìµÄ×ÖÒ²´ò²»Í꣬ÎÒ´ò×Öµ½ÏÖÔÚÒѾºÜÀÛÁË£¬´ó¼Ò¾Í½«¾Íһϣ¬ÎÒ½ö½ö½²¸ú×ٵĹؼüµØ·½£©
ÔÚÏûÏ¢Åжϣ¨ÏûÏ¢ÊÇ111 wm_command)µÄµØ·½Ï¶ϵ㣬Ȼºóµã»÷recent filesµÄ°´Å¥£¬·¢ÏÖÆä×Ó²ÎÁ¿Îªbd02È»ºóÓÖµ÷ÓÃ×Ô¼º,ÕâʱºòµÄ×Ó²ÎÁ¿±ä³É
0c5f,µ±Äãµã»÷open fileʱºò·¢ÏÖ×Ó²ÎÁ¿Ò²ÊÇ0c5f£¬¿´À´ÊÇÔÚµã»÷recent filesÎļþµÄʱºò»ápostÒ»¸ö0c5fÏûÏ¢»ØÀ´£¬ÄÇôrencentÀïÃæµÄ×î½ü´ò¿ªµÄÎļþÊÇ´æÔÚÄǸöµØ·½ÄØ£¿¾¹ý¸ú×Ù¿ÉÒÔ·¢ÏÖÊÇ´æÔÚc:\windows\w32dasm8.iniÎļþÀïÃ棬
windowsÓÃÀ´´ò¿ªiniÎļþµÄapiÊÇGetPrivateProfileString£¬ÏÂbpx GetPrivateProfileStringÕâ¸ö¶Ïµã£¬È»ºóµã»÷recent
ÀïÃæµÄ×î½ü´ò¿ªµÄÎļþ³ÌÐòÖжÏÔÚÕâÀ£¨ÎÒÃǾÍÀ´·ÖÎöÕâÀïÊÇʲôÒâ˼£©
|:100411F0
|
:1004310C
55
push ebp
:1004310D 8BEC
mov ebp, esp£½£½£½¡·ÕâÊÇvc±à³Ì´«µÝ²ÎÊýµÄÐÎʽ£¬ÓÃvc¶¼ÊÇÕâÑù£¬ºÍ±àÒëÆ÷ÓйØϵ
:1004310F 53
push ebx£½£½¡·ÕâÀï´«µÝµÄ²ÎÊýÊÇ´°¿ÚµÄhwnd
:10043110 56
push esi
:10043111 8B450C
mov eax, dword ptr [ebp+0C]£½£½¡·ÕâÀïÊÇÏûÏ¢µÄ×Ó²ÎÊý£¬ÕâÀïÊÇ×î½üÎå¸öÎļþµÄid
:10043114 2DBD020000 sub
eax, 000002BD
:10043119 D1E0
shl eax, 1
* Possible StringData Ref from Data
Obj ->"12345"
|
:1004311B BB3B5A0410
mov ebx, 10045A3B
:10043120 03D8
add ebx, eax£½£½£½¡·°Ñeax×öת»»±ä³ÉÁËtable±í£¬¾ÍÖªµÀÊǵã»÷ÁËÄǸöÎļþ£¬[ebx]»á±ä³É1-5Ö®¼ä
* Possible StringData Ref from Data Obj ->"W32dasm8.ini"
|
:10043122 684A5A0410
push 10045A4A==>²ÎÊý£¬ÎļþÃû
:10043127 6880000000
push 00000080==>buffer size
:1004312C
68575A0410 push 10045A57==>¶ÁÈëÄÚÈݵØÖ·Ö¸Õë
* Possible StringData Ref from Data Obj ->"NULL"
|
:10043131 68455A0410
push 10045A45£½£½¡·È±Ê¡×Ö·û´®µÄÖ¸Õë
:10043136 53
push ebx==>key name
* Possible StringData Ref from Data Obj ->"RECENT"
|
:10043137 68345A0410
push 10045A34===>¶ÎÃû
* Reference To: KERNEL32.GetPrivateProfileStringA,
Ord:0125h
|
:1004313C E8AB0B0000
Call 10043CEC==>µÃµ½key nameϵÄÄÚÈÝ
:10043141 A3305A0410 mov dword
ptr [10045A30], eax==>·µ»ØµÄµ½×Ö½Ú
:10043146 68575A0410
push 10045A57
* Possible StringData Ref from Data
Obj ->"NULL"
|
:1004314B 68455A0410
push 10045A45
* Reference
To: KERNEL32.lstrcmpiA, Ord:02D9h
|
:10043150 E8F70B0000 Call
10043D4C==>±È½ÏÉÏÃæÁ½¸ö×Ö·û´®(Õâ¸ö±È½ÏµÄ×÷ÓÃÊÇ¿´ÊDz»ÊÇÒªµ÷Õû×î½ü´ò¿ªµÄÎļþµÄ˳Ðò£©
:10043155 0BC0
or eax, eax
:10043157
745E je 100431B7
:10043159 BF575A0410 mov
edi, 10045A57
:1004315E 8B0D305A0410
mov ecx, dword ptr [10045A30]
:10043164 8BF7
mov esi, edi
:10043166 03F9
add edi, ecx
:10043168
FD
std
:10043169 B05C
mov al, 5C
:1004316B F2
repnz
:1004316C AE
scasb
:1004316D 85C9
test ecx, ecx
:1004316F 741C
je 1004318D
:10043171 83C702
add edi, 00000002
:10043174 C647FF00
mov [edi-01], 00
:10043178 3BFE
cmp edi, esi
:1004317A
7411 je 1004318D£½£½£½¡·ÕâÒ»¶ÎµÄ×÷ÓÃÊÇ°Ñd:\1\hiew.exe±ä³Éd:\1µÄÐÎʽ£¬ÎªSetCurrentDirectoryA×ö×¼±¸
:1004317C 56
push esi==>esiµÄµØÖ·¾ÍÊÇX:\XXX\µÄÐÎʽÁË
* Reference To: KERNEL32.SetCurrentDirectoryA,
Ord:023Eh£½£½¡·ÉèÖÃÏÖÔڵķ¾¶ÎªX:\XXX\
|
:1004317D
E8A60B0000 Call 10043D28
:10043182 57
push edi
:10043183 68575A0410
push 10045A57
* Reference To: KERNEL32.lstrcpyA, Ord:02DCh
|
:10043188 E8C50B0000
Call 10043D52
* Referenced by a (U)nconditional
or (C)onditional Jump at Addresses:
|:1004316F(C), :1004317A(C)
|
:1004318D 68575A0410 push 10045A57
:10043192 68515E0410 push
10045E51
* Reference To: KERNEL32.lstrcpyA, Ord:02DCh
|
:10043197 E8B60B0000
Call 10043D52£½£½£½¡·ÉÏÃæÒ»¶ÎµÄ×÷ÓÃÊǵ÷Õû×î½üÎļþ´ò¿ªµÄ˳Ðò
:1004319C C605505E041002
mov byte ptr [10045E50], 02£½£½¡·Õâ¸ö¿ÉÊDZê־λŶ£¬Èç¹ûΪÁãµÄ»°£¬ÄǾͻᵯ³öÄǸö´ò¿ªÎļþµÄ´°¿Ú
:100431A3 6A00
push 00000000
* Possible Ref to Menu: MenuID_00CB, Item: "Open
File to Disassemble.."
|
:100431A5
680C5F0000 push 00005F0C
:100431AA 6811010000 push 00000111
:100431AF FF7508
push [ebp+08]==>´°¿ÚµÄhwnd
* Reference To: USER32.PostMessageA, Ord:01DBh
|
:100431B2 E8E70A0000
Call 10043C9E£½£½¡·ÎÒ¹ûȻûÓÐ²Â´í£¬¾ÍÊÇpostÒ»¸öµã»÷open fileÏûÏ¢¸ø×Ô¼º
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10043157(C)
|
:100431B7 5E
pop esi
:100431B8 5B
pop ebx
:100431B9
C9
leave
:100431BA C20800
ret 0008
Õâ¶Î´úÂëÎÒÒѾ·ÖÎöÍê±Ï£¬ÏÖÔÚÎÒÃÇÒª×öµÄÊÂÇé¾ÍÊÇÔڵĵ½DragQueryFile µÄÏûÏ¢ºó£¬×öÒ»ÑùµÄ´¦Àí¶¯×÷£¬È»ºópostÒ»¸öopen
fileÏûÏ¢¸ø×Ô¼º
£¬¾Í´ïµ½Ä¿µÄÁË£¬¹Ø¼üµÄµØ·½ÊÇÈçºÎµÃµ½PostMessageAµÄhwndÄØ£¿Õâ¸öhwndÊÇw32asm muneµÄid£¬windows³ÌÐòÔ±¶¼ÖªµÀsetmenuµÄº¯Êý°É£¬ÎÒÃÇ϶ϵãbpx
setmenu£¬¿´µ½Ô³ÌÐòÊÇÔÚÕâÀïsetmenu
:0049CD86 8BF7
mov esi, edi
:0049CD88 56
push esi£½£½£½¡·¾Éhwnd
:0049CD89 8B0B
mov ecx, dword ptr [ebx]
:0049CD8B FF710C
push [ecx+0C]£½£½¡·ÐÂhwnd
* Reference
To: user32.SetMenu, Ord:0221h
|
:0049CD8E
E865230100 Call 004AF0F8
:0049CD93 85C0
test eax, eax
ÎÒÃÇÒª×öµÄÊÂÇé¾ÍÊDZ£´æÕâ¸öеÄhwnd£¬ÒÔ±äPostMessageAµÄʱºòÓõ½
:0049CD8E
E865230100 Call 004AF0F8
¸ÄΪ£º
0049CD8E: E97D250100
jmp .0004AF310 -----µ½ÎÒÃÇ×Ô¼º±£´æhwndµÄ´úÂë
×Ô¼º±£´æhwndµÄ´úÂ룺
004AF310: 58
pop
eax£½£½¡·È¡³öhwnd
004AF311: A3CAF24A00
mov [004AF2CA],eax£½£½¡·±£´æÔÚ[004AF2CA]£¬ÒÔ±ãÓõ½µÄʱºòÔÚÕâÀïÈ¡»Ø
004AF316: 50
push eax
004AF317:
E8DCFDFFFF call
.0004AF0F8 -----call setmenu
004AF31C: E972DAFEFF
jmp
.00049CD93 -----»Øµ½³ÌÐòÔÀ´µØ·½
004AF321: 0000
add
[eax],al
004AF323: 0000
add [eax],al
004AF325: 0000
add [eax],al
ÏÖÔÚhwndÒ²ÓÐÁË£¬¶øÇÒDragQueryFile»á·µ»Ø´ò¿ªÎļþµÄ×Ö½Ú£¬ÍêÈ«ºÍGetPrivateProfileStringA·µ»ØµÄÒ»Ñù£¬Ò²¾ÍÊÇÔÚÔÀ´GetPrivateProfileStringA´¦¸ÄΪDragQueryFile¾Íok£¬ÄÇôÆäËûµÄPostMessageA¡¢lstrcpyA¡¢SetCurrentDirectoryA¡¢lstrcmpiAµÄcallµ½ÄÇÀïÈ¥ÕÒÄØ£¬Èç¹ûÄÜ¿´µ½import±í¾ÍÖ±½Ó´Óimport±íÕÒ£¬µ«ÊÇÕâ¸öÍÑ¿Ç°æµÄÎÞimport±íÕæÊÇÂé·³£¬Ã»Óа취£¬Ï¶ϵãÒ»¸öÒ»¸ö¿´£¬ÏÈÀ´bpx
postmessagea
Ô³ÌÐòÖжÏÔÚ
:00453402 E85DBD0500
Call 004AF164£½£½¡·Õâ¸ö¾ÍÊÇcall postmessagea
ÆäËû¼¸¸öº¯ÊýÈçÏ£º
postmessagea :00453402 E85DBD0500
Call 004AF164
lstrcpyA
:00451C49 E80CD00500
Call 004AEC5A
SetCurrentDirectoryA :0043E679 E8B8050700
Call 004AEC36
lstrcmpiA
:0043E468 E815070700
Call 004AEB82
ºÃÁËÏÖÔÚÐèÒªµÄº¯ÊýµØÖ·Ò²ÓÐÁË£¬ÎÒÃÇ¿ªÊ¼²¹¶¡
004AF330: 3D0A020000
cmp
eax,00000020A ;" £½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊǹöÂÖ
"
004AF335: 7415
je
.0004AF34C ----- (1)£½£½ÊǵĻ°×ªµ½¹öÂÖ´¦Àí
004AF337: 3D33020000
cmp
eax,000000233 ;" 3"£½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊÇÍÏ·ÅÎļþ
004AF33C: 7400
je
.0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
ÏÈ°Ñ
004AF33C: 7400
je .0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
¸Ä³É£º
004AF33C: 7442
je .0004AF380 -----µ÷µ½´¦ÀíÍϷŵÄ×Ó³ÌÐòÖÐ
´¦ÀíÍϷŵÄ×Ó³ÌÐò£º
*Õâ¶Î³ÌÐò¾ÍÊDzÎÕÕÔÀ´´¦Àí³ÌÐòдµÄ
004AF380: FF7608
push
d,[esi][08]
004AF383: 8F05CEF24A00
pop d,[004AF2CE]==>±£´æÍϷŵÄhDropµ½[004AF2CE]
004AF389: 6800010000
push 000000100 ;" "==>»º³åÇøΪ100ËùÒÔ²»ÒªÍ϶¯Â·¾¶³¤¶È´óÓÚ256µÄÎļþŶ£¬¿ÉÄÜÒª³ö´í
004AF38E: 68575A0410
push 010045A57 ;"ZW"£½£½¡·±£´æÎļþÃû³ÆµÄµØÖ·
004AF393:
6A00
push 000£½£½¡·UINT iFile
004AF395: FF35CEF24A00
push
d,[004AF2CE]£½£½¡·push hDrop
004AF39B: E81AFFFFFF
call DragQueryFile
;SHELL32.dll£½£½¡·µÃµ½Í϶¯µÄÎļþÃû
004AF3A0: A3305A0410
mov [10045A30],eax£½£½¡··µ»ØµÄ×Ö½ÚÊý±£´æ£¬ÒÔ϶¼ÊÇÄ£·ÂÔÀ´³ÌÐòµÄ¶¯×÷£¬ÉÏÃæÒѾÓзÖÎö£¬ÎҾͲ»ÏêϸµÄ˵Ã÷ÁË
004AF3A5: 68575A0410
push 010045A57 ;"ZW"
004AF3AA: 68455A0410
push
010045A45 ;"ZE"
004AF3AF: E8CEF7FFFF
call .0004AEB82 -----
(2)£½£½¡·call lstrcmpiA
004AF3B4: 0BC0
or
eax,eax
004AF3B6: 0F846A32FAFF
je .000452626 ----- (3)£½£½¡·Èç¹ûΪÁã¾ÍÖ±½ÓÍ˳ö£¬Ô¶¯×÷ÊÇÖ±½Óret£¬ÎÒÃǾÍÖ±½Ó·µ»Ø
004AF3BC: 6660
pusha£½£½¡·±£´æËùÓеļĴæÆ÷£¬ÒòΪÏÂÃæÒªÓõ½esiµÈ£¬ËùÒÔÏÖÔÚÏȱ£´æÖ®
004AF3BE: BF575A0410
mov
edi,010045A57 ;"ZW"
004AF3C3: 8B0D305A0410
mov ecx,[10045A30]
004AF3C9: 8BF7
mov esi,edi
004AF3CB: 03F9
add
edi,ecx
004AF3CD: FD
std
004AF3CE: B05C
mov
al,05C ;"\"
004AF3D0: F2AE
repne
scasb
004AF3D2: 85C9
test ecx,ecx
004AF3D4:
741D
je .0004AF3F3 -----
(4)
004AF3D6: 83C702
add edi,002 ;""
004AF3D9:
C647FF00
mov b,[edi][-01],000 ;" "
004AF3DD: 3BFE
cmp
edi,esi
004AF3DF: 7412
je
.0004AF3F3 ----- (1)
004AF3E1: 56
push
esi
004AF3E2: E84FF8FFFF
call .0004AEC36 ----- (2)¾ÍÊÇcall
SetCurrentDirectoryA
004AF3E7: 57
push
edi
004AF3E8: 68575A0410
push 010045A57 ;"ZW"
004AF3ED: 90
nop
004AF3EE: E867F8FFFF
call .0004AEC5A
----- (3)¾ÍÊÇ call lstrcpyA
004AF3F3: 68575A0410
push 010045A57 ;"ZW"
004AF3F8: 68515E0410
push 010045E51 ;"^Q"
004AF3FD: E858F8FFFF
call
.0004AEC5A ----- (4)¾ÍÊÇ call lstrcpyA
004AF402: C605505E041002
mov b,[10045E50],002
;""
004AF409: 6A00
push 000
004AF40B:
680C5F0000 push
000005F0C ;" _
004AF410: 6811010000
push
000000111 ;" "
004AF415: A1CAF24A00
mov eax,[004AF2CA]£½£½¡·Õâ¸ö¾ÍÊÇÎÒÃÇÔÚsetmenu±£´æµÄhwnd
004AF41A: 50
push eax
004AF41B:
E844FDFFFF call
.0004AF164 ----- (5)¾ÍÊÇ call postmessagea
004AF420: FF35CEF24A00
push
d,[004AF2CE]£½£½¡·Õâ¸öÊDZ£´æµÄ hDrop£¬
004AF426: E895FEFFFF
call DragFinish
;SHELL32.dll£½£½¡·ÍÏ·Å´¦ÀíÍêºóÒªÊÍ·ÅhDrop£¬µ÷ÓÃDragFinish
004AF42B: 6661
popa »Ö¸´¶ÑÕ»
004AF42D: E9F431FAFF
jmp .000452626 ----- (7)Ìø»ØÔ´¦ÀíµØ·½
ºÃÁ˵½ÏÖÔÚΪֹÎÒÃÇdiy¼ÓÇ¿°æµÄw32asmÒѾ³öÀ´ÁË£¬´ó¼ÒÏíÊÜÒ»ÏÂÀͶ¯³É¹û°É£¬Èç¹ûÓÐÐËȤµÄ»°£¬»¹¿É¸øw32asm×öºÜ¶à¸ÄÔ죬ʹ֮¸ü¼ÓÊʺÏÓë
ÎÒÃÇ×Ô¼ºµÄ¹¤×÷Ï°¹ß¡£ÎÒÒѾ°Ñ·½·¨ºÍÔÀí¶¼½Ì¸ø´ó¼ÒÁË£¬ÓÐË×ö³ö¸ü¼ÓpowerµÄ°æ±¾£¬¼ÇµÃ¸øÎÒÒ»·ÝŶ£¬
´Ë³ÌÐòÔÚ98ϲâÊԳɹ¦£¬2000ÏÂÎÒÏëÓ¦¸Ã²»»á³É¹¦£¬ÒòΪ2000ϵÄÍϷź¯Êý²»Í¬£¬ÓÐÐËȤµÄÈË¿ÉÒÔÔÚÀïÃæ¼ÓÉÏgetversionº¯ÊýÅжÏÊÇ98»¹ÊÇ2000
Èç¹ûÊÇ2000ÏÂÓÃÁíÍâÒ»Ì׺¯ÊýʵÏÖ¡£ÎÒ×Ô¼ººÜÉÙÔÚ2000ÏÂʹÓÃw32asmËùÒÔÎҾͲ»×öÁË£º£¨£¬¾Íµ±Áô¸ø´ó¼ÒµÄ×÷Òµ°É
ºó¼Ç£ºÐ´µ½ÕâÀïÒѾÊÇÁ½ÊÖ·¢ËᣬϣÍûÕâƬÎÄÕ³ÉΪdiy peµÄ¾µä½Ì³Ì£¬Èç¹û¿´Ñ©³öÒ»±¾diy peµÄÊéÊDz»ÊÇ¿¼ÂÇÑ¡ÉÏÎÒÕâƪÎÄÕ£º£©
ÄãµÄÅóÓÑ£ºpll621
2002.8.24