¸Õ¿ªÊ¼Ñ§Ï°ÆÆ½â£¬ÕâÊÇÊ×´ÎÆÆ½âµÄ¹ý³Ì¼Ç¼£¬Ï£Íû¶Ô¸Õ¿ªÊ¼µÄÅóÓÑÄÜÓÐËù°ïÖú¡£
²Ù×÷ϵͳ£ºwin98
ÆÆ½â¶ÔÏó£ºÈÕÓïÀÏʦV1.0
Èí¼þ½éÉÜ£º¸ÃÈí¼þΪÈÕÓï½ÌѧÈí¼þ£¬¹²24¿Î£¬Î´×¢²á°æ±¾Ö»ÄÜѧϰµÚÒ»¿ÎµÄÄÚÈÝ¡£°²×°¸ÃÈí¼þºó£¬ÓÐÒ»¸ö¶ÀÁ¢µÄexe³ÌÐò£¬Ãû³Æ"×¢²áÈÕÓïÀÏʦ.exe"¡£
1¡¢peid²é¿Ç->ÎÞ¿Ç£¬±à³ÌÓïÑÔvb5/6¡£
2¡¢¶¯Ì¬ÕÒ×¢²áÂ룺
TRW2000¼ÓÔØ"×¢²áÈÕÓïÀÏʦ.exe"£¬×¢²á½çÃæÉÏÓÐÁ½¸öedit¿ò£¬ÉÏÃæÒ»¸öÒѾ×Ô¶¯ÌîдÁË"F78EE074"(Ó²ÅÌÐòºÅ)¡£ÔÚÏÂÃæµÄedit¿òÌîд¼ÙÂë"12345678"£¬^Nµ÷³öTRW϶ϵã __vbastrcomp£¬F5·µ»ØÓ¦ÓóÌÐòµã×¢²á°´Å¥£¬TRWÀ¹Ï£¬pmoduleÖÁ³ÌÐòÁì¿Õ£¬ºÜÐÒÔË£¬×¢²áÂë"A17EZPIH"´æ·ÅÔڼĴæÆ÷EAXÖС£
3¡¢¾²Ì¬±©ÆÆ£º
¢Å¡¢Ê¹ÓÃw32dasm¼ÓÔØ"×¢²áÈÕÓïÀÏʦ.exe"£¬ÔÚ´®Ê½²Î¿¼Àï¶¼ÊÇÂÒÂ룬ÎÒ²»ÖªµÀÓÐʲô·½·¨¿ÉÒÔÏÔʾ³öÂÒÂ룬ÎÒµ±Ê±µÄ¿¼ÂÇÊÇÕâЩÂÒÂëÓëÓÐÒâÒåµÄ×Ö·û´®ÔÚ×Ö½ÚÊýÉÏÊÇ·ñÓжÔÓ¦¹ØÏµ£¬ÂÒÂëÖеÄ"èlŒQx.Ncknx!"ÊÇÓë"×¢²áÂë²»ÕýÈ·!"ÔÚ×Ö´®³¤¶ÈÉÏΨһ¿ÉÒÔ¶ÔÓ¦µÄ£¬·´»ã±àµÄ´úÂëÏÔʾ405A33´¦µ÷ÓÃÁË"èlŒQx.Ncknx!"£¬ÏòÉϲéÕÒÕâ¸ö¼Ù¶¨µÄ"×¢²áʧ°ÜÄ£¿é"ÊÇÓÉ40593D´¦µÄÌø×ª¶øÀ´¡£½«40593D´¦µÄ´úÂë"je 00405A03"¸øNOPµô¾Í¿ÉÒÔÁË¡£
¢Æ¡¢Ê¹ÓÃODÒ²¿ÉÒÔʵÏÖÉÏÊö¹ý³Ì£º
Ç°ÃæÖØ¸´µÄ¹ý³ÌÊ¡ÂÔ
Ïà¹Ø´úÂë¶Î£º
00405919 . FF15 88104000 call [<&MSVBVM60.__vbaStrCmp>] ; MSVBVM60.__vbaStrCmp //ºÜÊìϤµÄ×Ö´®±È½Ï
......
0040593D . /0F84 C0000000 je 00405A03 //¹Ø¼üÌø×ª
//²»Ìø×ª£º
00405943 . 8B0F mov ecx, [edi]
......
004059AD . C785 3CFDFFFF>mov dword ptr [ebp-2C4], 00401F84
²é¿´ÄÚ´æ401F84´¦
ÂÒÂ룺èlŒQbŸR,.÷‹sQí•.0åeí‹€^0TÍ‘°e/T¨R!
¶ÔÓ¦£º×¢²á³É¹¦,Çë¹Ø±Õ¡¶ÈÕÓïÀÏʦ¡·ºóÖØÐÂÆô¶¯! //³¤¶È²»Ò»ÖÂÊÇÓÉÓÚ¶ººÅ´¦Ê¹ÓÃÁË¿í×Ö·û
//Ìø×ª£º
00405A03 > \8B35 24114000 mov esi, [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
......
00405A33 . C785 2CFDFFFF>mov dword ptr [ebp-2D4], 00401FB4
²é¿´ÄÚ´æ401FB4´¦
ÂÒÂ룺èlŒQx.Ncknx!
¶ÔÓ¦£º×¢²áÂë²»ÕýÈ·!
°Ñ40593D¿ªÊ¼µÄ0F84 C0000000 ¸Ä³É9090 90909090 (¼´NOP) ÆÆ½â°æ¾ÍÍê³ÉÁË¡£
4¡¢ÄÚ´æ×¢²á»ú£º
ÓÐÁËODºÜÇåÎúµÄ·ÖÎö£¬ÖÆ×÷ÄÚ´æ×¢²á»úÓ¦¸ÃûÓÐÄѶÈÁË¡£
ʹÓÃkeymake->ÆäËû->ÄÚ´æ×¢²á»ú¡£
ÖжϵØÖ·ÁÐ±í²¿·Ö
ÖжϵØÖ·:405919
ÖжϴÎÊý:1
µÚÒ»×Ö½Ú:FF
Ö¸Á¶È:10
×¢²áÂ벿·Ö
Äڴ淽ʽ->¼Ä´æÆ÷EAX->¿í×Ö·û´®
ok!Éú³ÉÄÚ´æ×¢²á»ú!
5¡¢¹ØÓÚËã·¨£º
ȷʵ¸ú×Ù×¢²áËã·¨ÊÇ×îºÄʱºÄÁ¦µÄ¹¤×÷£¬µ«Ö»ÒªÏ¸Öºͼá³ÖÊÇ¿ÉÒÔ×öµ½µÄ¡£
¸Ã×¢²áËã·¨½âÊÍÈçÏ£º
µÚÒ»²½£º¼ÆËã³öÒ»¸ö"±äÒìÂë"£¨²»ÖªµÀÓ¦¸ÃÓÃʲô´ÊÀ´ÃüÃû£©£¬±äÒìÂëµÄ¼ÆËã¹ý³ÌΪӲÅÌÐòºÅ×îºóÒ»¸ö×Ö·ûµÄASCII¼õÈ¥µÚÒ»¸ö×Ö·ûµÄASCII£¬Èç¹û½á¹û>=0£¬ÄÇô¸ÃÊý×Ö¾ÍÊDZäÒìÂ룬·ñÔò¾ÍÓÃ×îºóÒ»¸ö×Ö·ûµÄASCII¼õÈ¥µÚÈý¸ö×Ö·ûµÄASCII£¨½á¹ûÖµ¿ÉÒÔΪ¸ºÊý£©¡£
µÚ¶þ²½£º½«Ó²ÅÌÐòºÅµÄÿһλ·Ö±ðÓë±äÒìÊýÈ¡ºÍ¡£
µÚÈý²½£ºµÚ¶þ²½µÄ½á¹û°´Î»Êý·Ö±ð¼ÆË㣬µÚһλ-1£»µÚ¶þλ-2£»µÚÈýλ+3£»µÚËÄλ+4£»µÚÎåλ+25(5µÄƽ·½)£»µÚÁùλ+36(6µÄƽ·½)£»µÚÆßλ+10£»µÚ°Ëλ+11¡£
µÚËIJ½£º°ÑµÚÈý²½µÄ½á¹ûµ±×÷ASCIIÖµ£¬È»ºóת»»Îª¶ÔÓ¦µÄÊý×Ö»òÕß×Öĸ¡£Èç¹ûijλµÄÊýÖµ³¬³ö·¶Î§£¬Ôò°´ÕÕ×Ö´®"nmQR22IH"ÌîÈë¶ÔÓ¦µÄλÖá£
ʾÀý£º
Ó²ÅÌÐòºÅ F 7 8 E E 0 7 4
ASCII 70 55 56 69 69 48 55 52 52-56=-4
µÚ¶þ²½£º 66 51 52 65 65 44 51 48
-1 -2 +3 +4 +25 +36 +10 +11
µÚÈý²½£º 65 49 55 69 90 80 61 59 48¡«57(0¡«9) 65¡«90(A¡«Z)
µÚËIJ½£º A 1 7 E Z P
ºò²¹×Ö´® n m Q R 2 2 I H
×¢²áÂ룺 A 1 7 E Z P I H
µÚÒ»´ÎÆÆ½â£¬µÚÒ»´ÎÐ´ÆÆÎÄ£¬·²Ê¶¼»áÓеÚÒ»´Î£¬½öÒÔ´ËÖºÍÎÒÒ»Ñù¸Õ¿ªÊ¼Æð²½µÄÅóÓÑ£¬Ö»ÊDz»ÖªµÀÎÒ×¾ÁӵıíÊöÊÇ·ñÄܶÔÄãÓÐËù°ïÖú£¿