<<Ò»·ÖÖÓ²âÊÔ>>Èí¼þÊDzâÊÔCPU£¬ÄÚ´æ¡¢´ÅÅÌ¡¢DirectµÈϵͳÐÔÄÜ.ÊǾӼÒ×°»úÖ®Á¼Æ·.
ËüÊÇÓÉVisual C++±àÒëµÄ.¸Ã³ÌÐòÔÚ´¦ÀíËã·¨·½ÃæÔÚ×öÁ˸öСÊÖ½Å(ÒÔÇ°ÂÛ̳ÓзÖÎö¹ýÀàËƵÄÊÖ½Å),¾ÍÊÇ°ÑËã·¨´¦Àí³ÌÐò×¢²á³ÉÏûÏ¢´¦Àí¾ä±ú,ÏûÏ¢ID¶¨ÒåΪ1403,ÔÙͨ¹ýSendMessageµÈÏûÏ¢´¦ÀíAPIµ÷ÓÃÏûÏ¢»Øµ÷º¯Êý¶ø½øÐÐËã·¨¼ÆËã.
»¹ÓÐÒ»µãµã£º×¢²áËã·¨³É¹¦Óë·ñ»¹ÓڸöÔÏóµÄÒ»¸öʵÀý³ÉÔ±bool±äÁ¿[ecx+1A0]ÓÐÔ¼¶¨£º1)µ±bool [ecx+1A0]=0 ×¢²á´íÎó.2)µ±bool [ecx+1A0]=1×¢²á³É¹¦.
Èç¹û˳Àû³É¹¦µÄ»°,³ÌÐò°Ñ×¢²áÐÅÏ¢·Åµ½Ò»¸öinfºó׺µÄÃûµÄÎļþÖÐ.ÿһ´ÎÆô¶¯³ÌÐòµÄʱºò¶¼ºË¶Ô×¢²áÐÅÏ¢.¼ûC# SDK²¹¶¡Ô´´úÂë.¸ÃË㷨ȫ¾Ö±äÁ¿Ì«¶àÁË,ʱ¼äÓÖ²»¶à,Ö±½ÓÀ´¸ö²¹¶¡Ê¡Ê±ÓÖÊ¡Á¦,ÓÖ²»·ÏÄÔϸ°û:=).
----qiweixue
¸½¼þÏÂÔØ
½øÈëMFCÏûÏ¢»Øµ÷º¯ÊýÌåBOOL CWnd::OnWndMsg(UINT message, WPARAM wParam, LPARAM lParam, LRESULT* pResult)
0042A2B0 /$ B8 B0AA4300 mov eax, 0043AAB0 ---ÐÂSEHÁ´´¦Àí¾ä±ú
0042A2B5 |. E8 9EE6FEFF call 00418958----------->¹¹Ô캯ÊýSEH»úÖÆ
0042A2BA |. 83EC 54 sub esp, 54
0042A2BD |. 8365 F0 00 and dword ptr [ebp-10], 0
0042A2C1 |. 53 push ebx
0042A2C2 |. 8B5D 08 mov ebx, [ebp+8]
0042A2C5 |. 56 push esi
0042A2C6 |. 57 push edi
0042A2C7 |. 81FB 11010000 cmp ebx, 111 ---->±È½Ï´¦ÀíWM_COMMANDÏûÏ¢
0042A2CD |. 8BF9 mov edi, ecx
0042A2CF |. 75 18 jnz short 0042A2E9
0042A2D1 |. FF75 10 push dword ptr [ebp+10]
0042A2D4 |. 8B07 mov eax, [edi]
0042A2D6 |. FF75 0C push dword ptr [ebp+C]
0042A2D9 |. FF50 78 call [eax+78]----------------->½øÈëOnCommand(wParam, lParam)
0042A2DC |. 85C0 test eax, eax
0042A2DE |. 0F84 55010000 je 0042A439
0042A2E4 |. E9 1D040000 jmp 0042A706
0042A2E9 |> 83FB 4E cmp ebx, 4E------->---->±È½Ï´¦ÀíWM_NOTIFYÏûÏ¢
0042A2EC |. 75 28 jnz short 0042A316
0042A2EE |. 8B45 10 mov eax, [ebp+10]
0042A2F1 |. 8338 00 cmp dword ptr [eax], 0
0042A2F4 |. 0F84 3F010000 je 0042A439
.
.
.
.......
Ö±½ÓÀ´µ½Ê¼þ´¦Àí¾ä±úµØÖ·£º
00414319 /. 55 push ebp
0041431A |. 8BEC mov ebp, esp
0041431C |. 81EC 10010000 sub esp, 110
00414322 |. 898D F0FEFFFF mov [ebp-110], ecx ----> ecxΪCDialog¶ÔÏóÖ¸Õë
00414328 |. 6A 20 push 20
0041432A |. 68 C8424500 push 004542C8 ---->004542C8±£´æ×¢²áÓÍÏäµÄÈ«¾Ö±äÁ¿
0041432F |. 8B8D F0FEFFFF mov ecx, [ebp-110]
00414335 |. 81C1 14010000 add ecx, 114-->Õâ¶ùÓеãÒâ˼:ecx+114ÊÇÔÚ¶¨Î»CDialog¶ÔÏóÈÝÆ÷ÖеÄ×ӿؼþ¶ÔÏó!Õâ¸öecx+114ÕýÊǿؼþEDITµÄ¶ÔÏóµÄÖ¸Õë¡£
0041433B |. E8 477C0100 call 0042BF87---->Õâ¸öº¯ÊýÊÇCWnd::GetWindowText(String buffer,int Count),Ìø½øÈë¿´¿´,
...
0042BF8E |. FF7424 08 push dword ptr [esp+8] --->Count=20h¸ö×Ö·û
0042BF92 |. FF7424 08 push dword ptr [esp+8] --->Buffer=004542C8±£´æ×¢²áÓÍÏäµÄÈ«¾Ö±äÁ¿
0042BF96 |. FF71 1C push dword ptr [ecx+1C] ------->[ecx]¶ÔÏóÊǿؼþEditÀà,[ecx+1C]ÊÇEditµÄ¾ä±úhWnd
0042BF99 |. FF15 F4C34300 call [<&USER32.GetWindowTextA>] ---->GetWindowTextA(hWnd,Buffer,Count)
0042BF9F |. EB 12 jmp short 0042BFB3----º¯Êý·µ»Ø...
¼ÌÐø...
00414340 |. A3 DC5F4500 mov [455FDC], eax--->[455FDC]È«²¿±äÁ¿±£´æ×¢²áÂëµÄ×Ö½ÚÊýÁ¿
00414345 |. 6A 20 push 20
00414347 |. 68 A83A4500 push 00453AA8
0041434C |. 8B8D F0FEFFFF mov ecx, [ebp-110]
00414352 |. 81C1 D8000000 add ecx, 0D8---------->×¢Òâ:³ÌÐòÓÖÔÚ¶¨Î»CDialogÀàµÄ×ӿؼþ¶ÔÏó,[ecx+0D8]ͬÑùÒ²ÊÇCEdit¶ÔÏó,Ö»²»¹ýËü´æ·ÅµÄÊÇÓû§ÊäÈëÃÜÂë,ÉÏÒ»¸öÊÇ´æ·ÅµÄÊäÈë×¢²á±àÂë
00414358 |. E8 2A7C0100 call 0042BF87------Õâ¸öº¯ÊýÒ²ÊÇCWnd::GetWindowText(String buffer,int Count),ÔÚÉϱ߸ø³öÁ˺¯ÊýÌå¡£
0041435D |. 8945 F8 mov [ebp-8], eax
00414360 |. 837D F8 18 cmp dword ptr [ebp-8], 18--->ÃÜÂëÒª´óÓÚ0x18¸ö×Ö·û,²»È»over²»´¦Àí
00414364 |. 75 09 jnz short 0041436F--->game over
00414366 |. 833D DC5F4500>cmp dword ptr [455FDC], 4----->ÊäÈë×¢²áÂïÐèÒª´óÓÚ4¸ö×Ö·û.
0041436D |. 7D 30 jge short 0041439F--->game over
0041436F |> 68 A08C4400 push 00448CA0 ---->Õâ¸ö±äÁ¿±£´æunicode×Ö·û´®£º"ÊäÈë´íÎó" ×¢Òâ¶ø²»ÊDZ¨¸æ×¢²á±à´íÎó,²»ÊǹؼüÌø.
00414374 |. E8 EBD5FFFF call 00411964 ------->Ò»¹²ÓÐÈý´¦µ÷Óô˴¦Àíº¯Êý,±È½Ï¹Ø¼ü.
00414379 |. 83C4 04 add esp, 4---->CÔ¼¶¨µ÷Óú¯Êý,µ÷ÓÃÕßÇåÀíÕ».
¼ÌÐø...
Óû§ÊäÈëÓÊÏäºÅÂ븴ÖÆ0x40·Ý±£´æÔÚÈ«¾Ö±äÁ¿£º[00453AC8]
Óû§ÊäÈëµÄ¼Ù×¢²áºÅ¸´ÖÆ0x40·Ý±£´æÔÚÈ«¾Ö±äÁ¿£º[004526A0]
·ÖÎö³öÀ´µÄ¹Ø¼ü¶ÔÏó£º
[ecx]=00475588--->CDialogÀà¶ÔÏó
[ecx+1C] m_hWnd = 003B01B8
ÐéÄâ±íÖ¸ÕëºÍ³ÉÔ±º¯ÊýÈçÏ£º
00475588 D0 D7 43 00 01 00 00 00 00 00 00 00 00 00 00 00 Ð×C............
00475598 00 00 00 00 01 00 00 00 00 00 00 00 B8 01 3B 00 ...........?;.
004755A8 00 00 00 00 00 00 00 00 4F E5 D3 77 00 00 00 00 ........OåÓw....
004755B8 00 00 00 00 00 00 00 00 00 00 00 00 64 00 00 00 ............d...
004755C8 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d...............
004755D8 00 00 00 00 00 00 00 00 00 00 00 00 28 00 00 00 ............(...
004755E8 80 00 00 00 00 00 40 00 64 00 00 00 00 00 00 00 €.....@.d.......
004755F8 00 00 00 00 3B C6 42 00 88 55 47 00 3A 5B 43 00 ....;ÆB.ˆUG.:[C.
00475608 00 00 00 00 C4 94 44 00 00 00 00 00 3F 00 00 00 ....ĔD.....?...
00475618 00 00 00 00 6B 10 00 00 84 11 00 00 ....k..?..Ðö
[ecx+114]=0047569C --->CDialogÀàÈÝÆ÷ÖÐ×ÓCUserTextEditÓÃÀ´±£´æ×¢²áÓÊÏäÐÅÏ¢
[ecx+1C] m_hWnd = 002F01E6
ÐéÄâ±íÖ¸ÕëºÍ³ÉÔ±º¯ÊýÈçÏ£º
0047569C 5C F8 43 00 01 00 00 00 00 00 00 00 00 00 00 00 \øC............
004756AC 00 00 00 00 01 00 00 00 00 00 00 00 E6 01 2F 00 ...........?/.
004756BC 00 00 00 00 00 00 00 00 C4 B3 D3 77 00 00 00 00 ........ijÓw....
004756CC 00 00 00 00 00 00 00 00 00 00 00 00 ............
[ecx+0D8]=00475660 --->DialogÀàÈÝÆ÷ÖÐ×ÓCPassWordEditÀàÓÃÀ´±£´æ×¢²áÂëÐÅÏ¢
[ecx+1c]m_hWnd = 00030220
ÐéÄâ±íÖ¸ÕëºÍ³ÉÔ±º¯ÊýÈçÏ£º
00475660 5C F8 43 00 01 00 00 00 00 00 00 00 00 00 00 00 \øC............
00475670 00 00 00 00 01 00 00 00 00 00 00 00 20 02 03 00 ........... .
00475680 00 00 00 00 00 00 00 00 C4 B3 D3 77 00 00 00 00 ........ijÓw....
00475690 00 00 00 00 00 00 00 00 00 00 00 00 ............
µ½ÕâÀïºÜÓÐÒâ˼,Õâ¸ö³ÌÐò°ÑËã·¨´¦Àí³ÌÐò×¢²á³ÉÏûÏ¢´¦Àíº¯ÊýÁË,
00414412 >|> \6A 00 push 0 ------------>lparam
00414414 |. 6A 00 push 0 --->wparam
00414416 |. 68 03140000 push 1403 ------message
0041441B |. 8B8D F0FEFFFF mov ecx, [ebp-110] ---------->ÖØÒª¶ÔÏó´Ë¶ÔÏóecxÖ¸ÏòCDialogÀà¶ÔÏó,CDialogÀà´¦ÀíËã·¨ÏûÏ¢¾ä±ú
00414421 |. E8 BA0B0000 call 00414FE0 ------->CWnd::SendMessage(message,wparam,lparam) Ö÷½ÇµÇ³¡ÁË...½øÈ¥¿´¿´,ÔÚÏÂÎÄ...
00414426 |. 8B85 F0FEFFFF mov eax, [ebp-110]---->CDialog¶ÔÏóÖ¸Õë.
0041442C |. 83B8 A0010000>cmp dword ptr [eax+1A0], 0 ---¹Ø¼ü±È½ÏÓÃCDialogÀà¶ÔÏóÔ¼¶¨µÄboolʵÀý±äÁ¿.µ±Îª0,×¢²á´íÎó,Ϊ1×¢²áÕýÈ·£¡Õâ¸ö×Ö¶ÎÊÇÔڻص÷º¯ÊýÖи³ÖµµÄ£¡
00414433 |. 0F84 DB000000 je <loc_414514>
ÉϱߵÄCWnd::SendMessage(message,wparam,lparam)µ÷ÓÃWin32 API SendMessageA
00414FE0 >/$ 55 push ebp
00414FE1 |. 8BEC mov ebp, esp
00414FE3 |. 51 push ecx
00414FE4 |. 894D FC mov [ebp-4], ecx----------->CDialogÀà¶ÔÏóÖ¸Õë
00414FE7 |. 8B45 10 mov eax, [ebp+10]--->lparam=0
00414FEA |. 50 push eax
00414FEB |. 8B4D 0C mov ecx, [ebp+C] ----->wparam=0
00414FEE |. 51 push ecx
00414FEF |. 8B55 08 mov edx, [ebp+8] ------>message=00001403
00414FF2 |. 52 push edx
00414FF3 |. 8B45 FC mov eax, [ebp-4]--->¾Ö²¿±äÁ¿[ebp-4]°ÑCDialog¶ÔÏóÖ¸Õë¸øeax
00414FF6 |. 8B48 1C mov ecx, [eax+1C] ------->[eax+1C]ΪCDialog¶ÔÏó³ÉÔ±m_hWnd
00414FF9 |. 51 push ecx
00414FFA |. FF15 50C54300 call [<&USER32.SendMessageA>]--->SendMessage(m_hWnd,message,wparam,lparam)
00415000 |. 8BE5 mov esp, ebp
00415002 |. 5D pop ebp
00415003 \. C2 0C00 retn 0C
ÔÚÉϱ߳ÌÐòSendMessage(m_hWnd,message,wparam,lparam)Ö±½Ó½øÈëCDialog¶ÔÏóÖÐ,µ÷ÓÃ×¢²áµÄÏûÏ¢Ëã·¨´¦Àí¾ä±ú,Ëü»áÖ±½ÓCall,¶ø²»ÊǷŵ½ÏûÏ¢¶ÓÁÐÖеȴý.
ÕâÀïÎÒ°ÑCDialogÀàµÄ»Øµ÷º¯ÊýÖ±½ÓÌù³öÀ´£º
00413C80 /. 55 push ebp
00413C81 |. 8BEC mov ebp, esp
00413C83 |. 51 push ecx
00413C84 |. 894D FC mov [ebp-4], ecx
00413C87 |. 817D 08 01140>cmp dword ptr [ebp+8], 1401
00413C8E |. 75 1E jnz short 00413CAE
00413C90 |. 68 A08B4400 push 00448BA0 ; /Arg1 = 00448BA0 ASCII "AboutDlg: --------- Get WM_ABOUTSURFACELOST!"
00413C95 |. E8 66DDFFFF call 00411A00 ; \zwtest.00411A00
00413C9A |. 83C4 04 add esp, 4
00413C9D |. 68 88554700 push 00475588
00413CA2 |. B9 F05B4700 mov ecx, 00475BF0
00413CA7 |. E8 A62C0200 call 00436952
00413CAC |. EB 17 jmp short 00413CC5
00413CAE |> 817D 08 03140>cmp dword ptr [ebp+8], 1403------->ÎÒÃÇÐèÒªµÄÏûÏ¢handleµ½À´ÁË...
00413CB5 |. 75 0E jnz short 00413CC5
00413CB7 |. E8 69080000 call 00414525-------->ÕâÊǹؼüËã·¨Call...ÎÒ²»´òËã¸ø³öËã·¨·ÖÎöÁË,Ì«¶àÁË,Ò»»á¸ø¸ö²¹¶¡ºÜʡʱ¼äµÄ.
00413CBC |. 8B4D FC mov ecx, [ebp-4]--->CDialogÀà¶ÔÏóÖ¸Õë
00413CBF |. 8981 A0010000 mov [ecx+1A0], eax----°Ñ½á¹û¸øCDialogÀà³ÉÔ±±äÁ¿[ecx+1A0]±£´æ,[ecx+1A0]Ϊbool±äÁ¿,µ±Îª1µÄʱºò×¢²á³É¹¦,µÈÓÚ0×¢²á´íÎó£¡
00413CC5 |> 8B55 10 mov edx, [ebp+10]--->lparam
00413CC8 |. 52 push edx
00413CC9 |. 8B45 0C mov eax, [ebp+C] ---->wparam
00413CCC |. 50 push eax
00413CCD |. 8B4D 08 mov ecx, [ebp+8] -------->message
00413CD0 |. 51 push ecx
00413CD1 |. 8B4D FC mov ecx, [ebp-4]
00413CD4 |. E8 11600100 call 00429CEA ----->ĬÈÏÏûÏ¢CWnd::DefWindowProc(message,wparam,lparam)
00413CD9 |. 8BE5 mov esp, ebp
00413CDB |. 5D pop ebp
00413CDC \. C2 0C00 retn 0C
=======================================
¸ø³öC#.Net SDK²¹¶¡Ô´´úÂ룺
using System;
using System.Drawing;
using System.ComponentModel;
using System.Windows.Forms;
using System.IO;
namespace Pediy
{
public class PediyForm: System.Windows.Forms.Form
{
private Button button2;
private Label label1;
private Label label2;
private TextBox textBox1;
private TextBox textBox2;
private OpenFileDialog openFileDialog1;
private LinkLabel linkLabel1;
private Button button1;
private string drxpath;
public PediyForm()
{
this.InitializeComponent();
}
private void InitializeComponent()
{
this.button1 = new System.Windows.Forms.Button();
this.button2 = new System.Windows.Forms.Button();
this.label1 = new System.Windows.Forms.Label();
this.label2 = new System.Windows.Forms.Label();
this.textBox1 = new System.Windows.Forms.TextBox();
this.textBox2 = new System.Windows.Forms.TextBox();
this.openFileDialog1 = new System.Windows.Forms.OpenFileDialog();
this.linkLabel1 = new System.Windows.Forms.LinkLabel();
this.SuspendLayout();
this.button1.Location = new System.Drawing.Point(380, 12);
this.button1.Name = "button1";
this.button1.Size = new System.Drawing.Size(69, 23);
this.button1.TabIndex = 0;
this.button1.Text = "´ò¿ª(&O)";
this.button1.UseVisualStyleBackColor = true;
this.button1.Click += new System.EventHandler(this.button1_Click);
this.button2.Location = new System.Drawing.Point(380, 42);
this.button2.Name = "button2";
this.button2.Size = new System.Drawing.Size(69, 23);
this.button2.TabIndex = 1;
this.button2.Text = "È·¶¨(&T)";
this.button2.UseVisualStyleBackColor = true;
this.button2.Click += new System.EventHandler(this.button2_Click);
this.label1.AutoSize = true;
this.label1.Location = new System.Drawing.Point(10, 17);
this.label1.Name = "label1";
this.label1.Size = new System.Drawing.Size(41, 12);
this.label1.TabIndex = 2;
this.label1.Text = "Îļþ£º";
this.label2.AutoSize = true;
this.label2.Location = new System.Drawing.Point(12, 53);
this.label2.Name = "label2";
this.label2.Size = new System.Drawing.Size(65, 12);
this.label2.TabIndex = 3;
this.label2.Text = "״̬>>>>>>";
this.textBox1.Location = new System.Drawing.Point(57, 12);
this.textBox1.Name = "textBox1";
this.textBox1.Size = new System.Drawing.Size(305, 21);
this.textBox1.TabIndex = 4;
this.textBox2.BackColor = System.Drawing.SystemColors.ControlLight;
this.textBox2.Dock = System.Windows.Forms.DockStyle.Bottom;
this.textBox2.ForeColor = System.Drawing.SystemColors.Highlight;
this.textBox2.Location = new System.Drawing.Point(0, 68);
this.textBox2.Name = "textBox2";
this.textBox2.ReadOnly = true;
this.textBox2.Size = new System.Drawing.Size(461, 21);
this.textBox2.TabIndex = 5;
this.openFileDialog1.ReadOnlyChecked = true;
this.openFileDialog1.Title = "<ÇëÑ¡Ôñ²¹¶¡Îļþ>";
this.linkLabel1.AutoSize = true;
this.linkLabel1.Location = new System.Drawing.Point(298, 47);
this.linkLabel1.Name = "linkLabel1";
this.linkLabel1.Size = new System.Drawing.Size(47, 12);
this.linkLabel1.TabIndex = 6;
this.linkLabel1.TabStop = true;
this.linkLabel1.Text = "¹ØÓÚ(&A)";
this.linkLabel1.LinkClicked += new System.Windows.Forms.LinkLabelLinkClickedEventHandler(this.linkLabel1_LinkClicked);
this.AcceptButton = this.button2;
this.ClientSize = new System.Drawing.Size(461, 89);
this.Controls.Add(this.linkLabel1);
this.Controls.Add(this.textBox2);
this.Controls.Add(this.textBox1);
this.Controls.Add(this.label2);
this.Controls.Add(this.label1);
this.Controls.Add(this.button2);
this.Controls.Add(this.button1);
this.MaximizeBox = false;
this.MinimizeBox = false;
this.Name = "PediyForm";
this.StartPosition = System.Windows.Forms.FormStartPosition.CenterScreen;
this.Text = "www.pediy.com---qiweixue";
this.TopMost = true;
this.Load += new System.EventHandler(this.PediyForm_Load);
this.ResumeLayout(false);
this.PerformLayout();
}
private void button1_Click(object sender, EventArgs e)
{
openFileDialog1.ShowDialog();
textBox1.Text = openFileDialog1.FileName;
}
private void linkLabel1_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
{
MessageBox.Show("http:\\www.pediy.com---qiweixue");
}
private void button2_Click(object sender, EventArgs e)
{
if (textBox1.Text != null)
{
byte[] pebuf1=new Byte[]{117,66};
byte[] pebuf2=new Byte[]{91,82,69,71,73,83,84,69,82,73,78,70,79,93
,13,10,113,105,119,101,105,120,117,101,64,
49,50,54,46,99,111,109,32,113,105,119,101,
105,120,117,101,13,10};
FileStream fs1 = new FileStream(textBox1.Text,FileMode.Open,FileAccess.ReadWrite);
FileInfo fi = new FileInfo(textBox1.Text);
drxpath = fi.DirectoryName;
fs1.Seek(76385, SeekOrigin.Begin);
fs1.Write(pebuf1, 0, pebuf1.Length);
fs1.Close();
FileStream fs2= new FileStream(drxpath + "\\Zwtstetc.inf", FileMode.Append, FileAccess.Write);
fs2.Write(pebuf2, 0, pebuf2.Length);
fs2.Close();
textBox2.Text = "OK,Succeed:=)....[wwww.pediy.com-qiweixue]";
}
}
private void PediyForm_Load(object sender, EventArgs e)
{
textBox2.Text = "PediyForm is running...........";
}
}
public class RunPediyForm
{
[STAThread]
public static void Main()
{
Application.Run(new PediyForm());
}
}
}
==================
Net FrameWork Distributable Package 2.0
Net FrameWork SDK 2.0
Ö±½ÓÓÃCSC.exe Pediy.cs±àÒë¾Íok...
ÓÐÎóÖ®´¦,¶àлָ½Ì
Copyright © 2000 - 2006 PEdiy.com All Rights Reserved.By KanXue Studio