好友
阅读权限20
听众
最后登录1970-1-1
|
楼主|
cshow
发表于 2008-9-15 03:26
第二次循环:
0042CB96> /8B95 40FDFFFF mov edx,dword ptr ss:[ebp-2C0] ;//第二次循环的开始
0042CB9C. |3955 DC cmp dword ptr ss:[ebp-24],edx
0042CB9F. |7F 7C jg short 123.0042CC1D
0042CBA1. |C745 90 01000>mov dword ptr ss:[ebp-70],1;//每次去一位进行运算
0042CBA8. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CBAF. |8B45 C4 mov eax,dword ptr ss:[ebp-3C];//上次运算结果放在EAX里
0042CBB2. |50push eax ;//压栈
0042CBB3. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CBB6. |51push ecx
0042CBB7. |8B55 DC mov edx,dword ptr ss:[ebp-24]
0042CBBA. |52push edx
0042CBBB. |8B45 C0 mov eax,dword ptr ss:[ebp-40];//第一次循环后的结果给EAX
0042CBBE. |50push eax
0042CBBF. |FFD3call ebx ;//这里是计算去第一次计算结果的第几位
0042CBC1. |8BD0mov edx,eax
0042CBC3. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CBC6. |FFD6call esi
0042CBC8. |50push eax ; /Arg1
0042CBC9. |FF15 3C104000 call dword ptr ds:[<&msvbvm60.rtcAns>; \rtcAnsiValueBstr
0042CBCF. |50push eax
0042CBD0. |FF15 04104000 call dword ptr ds:[<&msvbvm60.__vbaS>;//和F(x)的算法一样
0042CBD6. |8BD0mov edx,eax
0042CBD8. |8D4D B8 lea ecx,dword ptr ss:[ebp-48]
0042CBDB. |FFD6call esi
0042CBDD. |50push eax ; |Arg1
0042CBDE. |FF15 4C104000 call dword ptr ds:[<&msvbvm60.__vbaS>; \__vbaStrCat
0042CBE4. |8BD0mov edx,eax
0042CBE6. |8D4D C4 lea ecx,dword ptr ss:[ebp-3C]
0042CBE9. |FFD6call esi
0042CBEB. |8D4D B8 lea ecx,dword ptr ss:[ebp-48]
0042CBEE. |51push ecx
0042CBEF. |8D55 BC lea edx,dword ptr ss:[ebp-44]
0042CBF2. |52push edx
0042CBF3. |6A 02 push 2
0042CBF5. |FF15 A4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStrList
0042CBFB. |83C4 0C add esp,0C
0042CBFE. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CC01. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042CC07. |B8 01000000 mov eax,1
0042CC0C. |0345 DC add eax,dword ptr ss:[ebp-24]
0042CC0F. |0F80 82190000 jo 123.0042E597
0042CC15. |8945 DC mov dword ptr ss:[ebp-24],eax
0042CC18.^\E9 79FFFFFF jmp 123.0042CB96
0042CC1D>8B45 C4 mov eax,dword ptr ss:[ebp-3C]
跟进0042CBD0 这个CALL
73470344 msv>/$55push ebp
73470345 |.8BECmov ebp,esp
73470347 |.51push ecx
73470348 |.8D45 FC lea eax,dword ptr ss:[ebp-4]
7347034B |.50push eax
7347034C |.6A 00 push 0
7347034E |.E8 F961F2FF call msvbvm60.7339654C
73470353 |.50push eax
73470354 |.FF75 08 push dword ptr ss:[ebp+8]
73470357 |.FF15 BC1A3973 call dword ptr ds:[<&OLEAUT32.#109>] ;F7跟进
7347035D |.85C0test eax,eax
7347035F |.7D 0C jge short msvbvm60.7347036D
73470361 |.50push eax
73470362 |.E8 8DB9FEFF call msvbvm60.7345BCF4
73470367 |.50push eax
73470368 |.E8 19DDFEFF call msvbvm60.7345E086
7347036D |>8B45 FC mov eax,dword ptr ss:[ebp-4]
73470370 |.C9leave
73470371 \.C2 0400 retn 4
再跟进73470357
7710DD36 OLE> $8BFFmov edi,edi
7710DD38.55push ebp
7710DD39.8BECmov ebp,esp
7710DD3B.83EC 54 sub esp,54
7710DD3E.A1 04101777 mov eax,dword ptr ds:[77171004]
7710DD43.56push esi
7710DD44.8B75 10 mov esi,dword ptr ss:[ebp+10]
7710DD47.F7C6 00000010 test esi,10000000
7710DD4D.8945 FC mov dword ptr ss:[ebp-4],eax
7710DD50.57push edi
7710DD51.8B7D 14 mov edi,dword ptr ss:[ebp+14]
7710DD54.8D45 AC lea eax,dword ptr ss:[ebp-54]
7710DD57.0F85 D15A0100 jnz OLEAUT32.7712382E
7710DD5D.50push eax
7710DD5E.0FBF45 08 movsx eax,word ptr ss:[ebp+8];当前的字符ASCII给EAX
7710DD62.50push eax
7710DD63.E8 1D000000 call OLEAUT32.7710DD85 ;F7跟进
7710DD68.57push edi
7710DD69.8D45 AC lea eax,dword ptr ss:[ebp-54]
7710DD6C.50push eax
7710DD6D.E8 B6C7FEFF call OLEAUT32.770FA528
7710DD72>8B4D FC mov ecx,dword ptr ss:[ebp-4]
7710DD75.5Fpop edi
7710DD76.5Epop esi
7710DD77.E8 8137FEFF call OLEAUT32.770F14FD
7710DD7C.C9leave
7710DD7D.C2 1000 retn 10
再跟进7710DD63来到
7710DD85$8BFFmov edi,edi
7710DD87.55push ebp
7710DD88.8BECmov ebp,esp
7710DD8A.837D 08 00cmp dword ptr ss:[ebp+8],0
7710DD8E.0F8C 9A980100 jl OLEAUT32.7712762E
7710DD94.6A 00 push 0
7710DD96>FF75 0C push dword ptr ss:[ebp+C]
7710DD99.FF75 08 push dword ptr ss:[ebp+8]
7710DD9C.E8 BAC7FEFF call OLEAUT32.770FA55B ;F7跟进
7710DDA1.8B45 0C mov eax,dword ptr ss:[ebp+C]
7710DDA4.5Dpop ebp
7710DDA5.C2 0800 retn 8
跟进7710DD9C 第二次循环的关键算法
770FA55B$8BFFmov edi,edi
770FA55D.55push ebp
770FA55E.8BECmov ebp,esp
770FA560.837D 10 00cmp dword ptr ss:[ebp+10],0
770FA564.8B4D 0C mov ecx,dword ptr ss:[ebp+C]
770FA567.0F85 B1D00200 jnz OLEAUT32.7712761E
770FA56D>56push esi
770FA56E.8BF1mov esi,ecx
770FA570.53push ebx
770FA571>8B45 08 mov eax,dword ptr ss:[ebp+8]
770FA574.33D2xor edx,edx
770FA576.6A 0A push 0A
770FA578.5Bpop ebx;EBP=OA
770FA579.F7F3div ebx;EAX对EBX求余余数在EDX
770FA57B.83C2 30 add edx,30 ;余数+30
770FA57E.66:8911 mov word ptr ds:[ecx],dx ;给[ECX]
770FA581.41inc ecx
770FA582.41inc ecx
770FA583.85C0test eax,eax
770FA585.8945 08 mov dword ptr ss:[ebp+8],eax
770FA588.^ 77 E7 ja short OLEAUT32.770FA571
770FA58A.66:8321 00and word ptr ds:[ecx],0;[ECX]与0
770FA58E.49dec ecx
770FA58F.49dec ecx
770FA590.5Bpop ebx;下面把计算结果位置互换
770FA591>66:8B16 mov dx,word ptr ds:[esi] ;第一次计算结果给DX
770FA594.66:8B01 mov ax,word ptr ds:[ecx] ;第二次计算结果给ax
770FA597.66:8911 mov word ptr ds:[ecx],dx ;在入栈
770FA59A.49dec ecx
770FA59B.66:8906 mov word ptr ds:[esi],ax ;在入栈
770FA59E.49dec ecx;存
770FA59F.46inc esi
770FA5A0.46inc esi
770FA5A1.3BF1cmp esi,ecx;比较ECX和ESI是否相等相等循环
770FA5A3.^ 72 EC jb short OLEAUT32.770FA591
770FA5A5.5Epop esi
770FA5A6.5Dpop ebp
770FA5A7.C2 0C00 retn 0C
这里其实就是第一循环里面的第一次算法~~那个F(x)
第一次的算法:
(ASCII+2)对A求余+30ASCII码是第一次运算结果的每一个字符的
上次的运算结果进行相同的运算
第二次运算结果:79527 05349 52535 14851 53515 65151 52505 35753 49526 55353 52534 94853 49505 34949 50495 04949 51494 94850 54515 54854
53544 84948 53495 04949 4955
长度:7C
-----------------------------------------------------------------------------------------------------------
第三次循环:(这个重点算法 后面有很多算法都是和这个一样)
0042CC34> /8B8D 38FDFFFF mov ecx,dword ptr ss:[ebp-2C8] ;第三次循环开始~~
0042CC3A. |8B45 DC mov eax,dword ptr ss:[ebp-24]
0042CC3D. |3BC1cmp eax,ecx
0042CC3F. |7F 64 jg short 123.0042CCA5
0042CC41. |C745 90 05000>mov dword ptr ss:[ebp-70],5
0042CC48. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CC4F. |8D55 88 lea edx,dword ptr ss:[ebp-78]
0042CC52. |52push edx
0042CC53. |50push eax
0042CC54. |8B4D C4 mov ecx,dword ptr ss:[ebp-3C]
0042CC57. |51push ecx
0042CC58. |FFD3call ebx
0042CC5A. |8BD0mov edx,eax
0042CC5C. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CC5F. |FFD6call esi
0042CC61. |50push eax
0042CC62. |FF15 8C114000 call dword ptr ds:[<&msvbvm60.__vbaR>;msvbvm60.__vbaR8Str
0042CC68. |FF15 E4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;第二次运算结果的每五个字符十六进制给EAX
0042CC6E. |8945 E0 mov dword ptr ss:[ebp-20],eax
0042CC71. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CC74. |FF15 24124000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStr
0042CC7A. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CC7D. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042CC83. |8B55 C8 mov edx,dword ptr ss:[ebp-38];16进制相加
0042CC86. |0355 E0 add edx,dword ptr ss:[ebp-20];第一次和用户名的位数相加
0042CC89. |0F80 08190000 jo 123.0042E597
0042CC8F. |8955 C8 mov dword ptr ss:[ebp-38],edx
0042CC92. |B8 05000000 mov eax,5
0042CC97. |0345 DC add eax,dword ptr ss:[ebp-24]
0042CC9A. |0F80 F7180000 jo 123.0042E597
0042CCA0. |8945 DC mov dword ptr ss:[ebp-24],eax
0042CCA3.^\EB 8F jmp short 123.0042CC34
0042CCA5>8B45 C0 mov eax,dword ptr ss:[ebp-40]
0042CC68.FF15 E4114000call dword ptr ds:[<&msvbvm60.__vbaF>;第二次运算结果的每五个字符十六进制给EAX
0042CC83.8B55 C8mov edx,dword ptr ss:[ebp-38];16进制相加
0042CC86.0355 E0add edx,dword ptr ss:[ebp-20];第一次和用户名的位数相加
79527--136A7
第一次和用户名的位数(我这里是D)相加,保存在edx(=136B4)
05349--14E5
52535--CD37
14851--3A03
53515--D10B
65151--FE7F
52505--CD19
35753--8BA9
49526--C176
55353--D839
52534--CD36
94853--17285
49505--C161
34949--8885
50495--C53F
04949--1355
51494--C926
94850--17282
54515--D4F3
54854--D646
53544--D128
84948--14BD4
53495--D0F7
04949--1355
4955--135B
最后:EDX=127287
结果:7952705349525351485153515651515250535753495265535352534948534950534949504950494951494948505451554854
长度:3D
-------------------------------------------------------------------------------------------------------------
第四次循环:(这次是对第一次循环的结果进行的运算)0042CCBC> /8B8D 30FDFFFF mov ecx,dword ptr ss:[ebp-2D0]
0042CCC2. |394D DC cmp dword ptr ss:[ebp-24],ecx
0042CCC5. |6A 01 push 1
0042CCC7. |0F8F 82000000 jg 123.0042CD4F
0042CCCD. |FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
0042CCD3. |C745 90 01000>mov dword ptr ss:[ebp-70],1
0042CCDA. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CCE1. |8B55 C4 mov edx,dword ptr ss:[ebp-3C]
0042CCE4. |52push edx
0042CCE5. |8D45 88 lea eax,dword ptr ss:[ebp-78]
0042CCE8. |50push eax
0042CCE9. |8B4D DC mov ecx,dword ptr ss:[ebp-24]
0042CCEC. |51push ecx
0042CCED. |8B55 C0 mov edx,dword ptr ss:[ebp-40];第一次循环的结果
0042CCF0. |52push edx
0042CCF1. |FFD3call ebx ;每一位的ASCII
0042CCF3. |8BD0mov edx,eax
0042CCF5. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CCF8. |FFD6call esi
0042CCFA. |50push eax ; /Arg1
0042CCFB. |FF15 3C104000 call dword ptr ds:[<&msvbvm60.rtcAns>; \提取ASCII
0042CD01. |50push eax
0042CD02. |FF15 04104000 call dword ptr ds:[<&msvbvm60.__vbaS>;进行F(x)的算法
0042CD08. |8BD0mov edx,eax
0042CD0A. |8D4D B8 lea ecx,dword ptr ss:[ebp-48]
0042CD0D. |FFD6call esi
0042CD0F. |50push eax ; |Arg1
0042CD10. |FF15 4C104000 call dword ptr ds:[<&msvbvm60.__vbaS>; \连接到第二次循环运算结果的后面
0042CD16. |8BD0mov edx,eax;跟进去才可以看见 出来就看不见了
0042CD18. |8D4D C4 lea ecx,dword ptr ss:[ebp-3C]
0042CD1B. |FFD6call esi
0042CD1D. |8D45 B8 lea eax,dword ptr ss:[ebp-48]
0042CD20. |50push eax
0042CD21. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CD24. |51push ecx
0042CD25. |6A 02 push 2
0042CD27. |FF15 A4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStrList
0042CD2D. |83C4 0C add esp,0C
0042CD30. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CD33. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042CD39. |B8 01000000 mov eax,1
0042CD3E. |0345 DC add eax,dword ptr ss:[ebp-24]
0042CD41. |0F80 50180000 jo 123.0042E597
0042CD47. |8945 DC mov dword ptr ss:[ebp-24],eax
0042CD4A.^\E9 6DFFFFFF jmp 123.0042CCBC
0042CD4F>FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
算法:
(ASCII)对A求余+30
第一次循环结果:4F 51 45 30 35 38 33 42 59 51 4A 55 45 105 125 112 121 131 102 637 065 601 051 211 17
4--52
F--70
5--53
1--49
4--52
5--53
.....
2--50
1--49
1--49
1--49
7--55
第二次运算结果:7952705349525351485153515651515250535753495265535352534948534950534949504950494951494948505451554854535448494853495049494955
第四次运算结果:7952705349525351485153515651515250535753495265535352534948534950534949504950494951494948505451554854535448494853495049494955
5270534952535148515351565151525053575349526553535253494853495053494950495049495149494850545155485453544849485349504949495
长度:F6(246)
------------------------------------------------------------------------------------------------------------
第五次循环:(方法和第三次循环一样)
0042CD6F> /3B85 28FDFFFF cmp eax,dword ptr ss:[ebp-2D8] ;第五次开始
0042CD75. |6A 01 push 1
0042CD77. |7F 75 jg short 123.0042CDEE
0042CD79. |FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
0042CD7F. |C745 90 05000>mov dword ptr ss:[ebp-70],5;每循环一次提取五个字符
0042CD86. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CD8D. |8D45 88 lea eax,dword ptr ss:[ebp-78]
0042CD90. |50push eax
0042CD91. |8B4D DC mov ecx,dword ptr ss:[ebp-24]
0042CD94. |51push ecx
0042CD95. |8B55 C4 mov edx,dword ptr ss:[ebp-3C]
0042CD98. |52push edx
0042CD99. |FFD3call ebx ;提取第四次循环结果的前五个字符
0042CD9B. |8BD0mov edx,eax
0042CD9D. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CDA0. |FFD6call esi
0042CDA2. |50push eax
0042CDA3. |FF15 8C114000 call dword ptr ds:[<&msvbvm60.__vbaR>;msvbvm60.__vbaR8Str
0042CDA9. |FF15 E4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;将这五个字符转换成16进制
0042CDAF. |8945 E0 mov dword ptr ss:[ebp-20],eax
0042CDB2. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CDB5. |FF15 24124000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStr
0042CDBB. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CDBE. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042CDC4. |6A 01 push 1
0042CDC6. |FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
0042CDCC. |8B45 C8 mov eax,dword ptr ss:[ebp-38];[EBP-38]->EAX
0042CDCF. |0345 E0 add eax,dword ptr ss:[ebp-20];[EBP-38]+16进制->EAX
0042CDD2. |0F80 BF170000 jo 123.0042E597
0042CDD8. |8945 C8 mov dword ptr ss:[ebp-38],eax;结果给[EBP-38]
0042CDDB. |B8 05000000 mov eax,5;下面是控制下次循环的
0042CDE0. |0345 DC add eax,dword ptr ss:[ebp-24]
0042CDE3. |0F80 AE170000 jo 123.0042E597
0042CDE9. |8945 DC mov dword ptr ss:[ebp-24],eax
0042CDEC.^\EB 81 jmp short 123.0042CD6F
0042CDEE>FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
第一次和第三次循环后保存的结果相加,接着继续累加,只是保存在EAX
79527--136A7
05349--CD37
52535--3A03
...........
48534--BD96
95049--17349
49495--C157
最后累加后的结果:EAX=00368607
长度:F6
------------------------------------------------------------------------------------------------------------
第六次循环:(算法和第三次循环一样)
0042CE0E> /3B85 20FDFFFF cmp eax,dword ptr ss:[ebp-2E0] ;第六次开始
0042CE14. |6A 01 push 1
0042CE16. |7F 75 jg short 123.0042CE8D
0042CE18. |FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
0042CE1E. |C745 90 04000>mov dword ptr ss:[ebp-70],4;取4个字符
0042CE25. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CE2C. |8D55 88 lea edx,dword ptr ss:[ebp-78]
0042CE2F. |52push edx
0042CE30. |8B45 DC mov eax,dword ptr ss:[ebp-24]
0042CE33. |50push eax
0042CE34. |8B4D C4 mov ecx,dword ptr ss:[ebp-3C]
0042CE37. |51push ecx
0042CE38. |FFD3call ebx ;取第二次循环的每四个字符
0042CE3A. |8BD0mov edx,eax
0042CE3C. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CE3F. |FFD6call esi
0042CE41. |50push eax
0042CE42. |FF15 8C114000 call dword ptr ds:[<&msvbvm60.__vbaR>;msvbvm60.__vbaR8Str
0042CE48. |FF15 E4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFpI4
0042CE4E. |8945 E0 mov dword ptr ss:[ebp-20],eax
0042CE51. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CE54. |FF15 24124000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStr
0042CE5A. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CE5D. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042CE63. |6A 01 push 1
0042CE65. |FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
0042CE6B. |8B55 D8 mov edx,dword ptr ss:[ebp-28]
0042CE6E. |0355 E0 add edx,dword ptr ss:[ebp-20]
0042CE71. |0F80 20170000 jo 123.0042E597
0042CE77. |8955 D8 mov dword ptr ss:[ebp-28],edx;从EDX转存到堆栈
0042CE7A. |B8 04000000 mov eax,4
0042CE7F. |0345 DC add eax,dword ptr ss:[ebp-24]
0042CE82. |0F80 0F170000 jo 123.0042E597
0042CE88. |8945 DC mov dword ptr ss:[ebp-24],eax
0042CE8B.^\EB 81 jmp short 123.0042CE0E
0042CE8D>FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
这次只是把取五个字符改成取四个字符而已,把字符全部转换成16进制后累加(不是和前面的结果累加)
7952--1F10
7053--1B8D
4952--1358
5351--14E7
..........
3495--DA7
0494--1EE
9495--2517
最后累加结果:EDX=0004E264
长度:F6
------------------------------------------------------------------------------------------------------------
第七次循环:(算法和第三次循环一样)
0042CEAD> /3B85 18FDFFFF cmp eax,dword ptr ss:[ebp-2E8] ;第七次循环
0042CEB3. |7F 77 jg short 123.0042CF2C
0042CEB5. |6A 01 push 1
0042CEB7. |FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
0042CEBD. |C745 90 03000>mov dword ptr ss:[ebp-70],3;取三个字符
0042CEC4. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CECB. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CECE. |51push ecx
0042CECF. |8B55 DC mov edx,dword ptr ss:[ebp-24]
0042CED2. |52push edx
0042CED3. |8B45 C4 mov eax,dword ptr ss:[ebp-3C]
0042CED6. |50push eax
0042CED7. |FFD3call ebx
0042CED9. |8BD0mov edx,eax
0042CEDB. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CEDE. |FFD6call esi
0042CEE0. |50push eax
0042CEE1. |FF15 8C114000 call dword ptr ds:[<&msvbvm60.__vbaR>;msvbvm60.__vbaR8Str
0042CEE7. |FF15 E4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFpI4
0042CEED. |8945 E0 mov dword ptr ss:[ebp-20],eax
0042CEF0. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CEF3. |FF15 24124000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStr
0042CEF9. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CEFC. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042CF02. |6A 01 push 1
0042CF04. |FF15 84104000 call dword ptr ds:[<&msvbvm60.__vbaO>;msvbvm60.__vbaOnError
0042CF0A. |8B4D D4 mov ecx,dword ptr ss:[ebp-2C]
0042CF0D. |034D E0 add ecx,dword ptr ss:[ebp-20]
0042CF10. |0F80 81160000 jo 123.0042E597
0042CF16. |894D D4 mov dword ptr ss:[ebp-2C],ecx
0042CF19. |B8 03000000 mov eax,3
0042CF1E. |0345 DC add eax,dword ptr ss:[ebp-24]
0042CF21. |0F80 70160000 jo 123.0042E597
0042CF27. |8945 DC mov dword ptr ss:[ebp-24],eax
0042CF2A.^\EB 81 jmp short 123.0042CEAD
0042CF2C>8B55 C4 mov edx,dword ptr ss:[ebp-3C]
这次只是把取五个字符改成取三个字符而已,把字符全部转换成16进制后累加(不是和前面的结果累加)
795--31B
270--10E
534--216
........
504--1F8
949--3B5
495--1EF
最后累加的结果:ECX=A944
长度:F6
--------------------------------------------------------------------------------------------------------------
第八次循环:(算法和第三次一样)
0042CF43> /8B85 10FDFFFF mov eax,dword ptr ss:[ebp-2F0] ;第八次
0042CF49. |3945 DC cmp dword ptr ss:[ebp-24],eax
0042CF4C. |7F 67 jg short 123.0042CFB5
0042CF4E. |C745 90 04000>mov dword ptr ss:[ebp-70],4;取4个
0042CF55. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CF5C. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CF5F. |51push ecx
0042CF60. |8B55 DC mov edx,dword ptr ss:[ebp-24]
0042CF63. |52push edx
0042CF64. |8B45 C4 mov eax,dword ptr ss:[ebp-3C]
0042CF67. |50push eax
0042CF68. |FFD3call ebx
0042CF6A. |8BD0mov edx,eax
0042CF6C. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CF6F. |FFD6call esi
0042CF71. |50push eax
0042CF72. |FF15 8C114000 call dword ptr ds:[<&msvbvm60.__vbaR>;msvbvm60.__vbaR8Str
0042CF78. |FF15 E4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFpI4
0042CF7E. |8945 E0 mov dword ptr ss:[ebp-20],eax
0042CF81. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CF84. |FF15 24124000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStr
0042CF8A. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CF8D. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042CF93. |8B4D D8 mov ecx,dword ptr ss:[ebp-28]
0042CF96. |034D E0 add ecx,dword ptr ss:[ebp-20]
0042CF99. |0F80 F8150000 jo 123.0042E597
0042CF9F. |894D D8 mov dword ptr ss:[ebp-28],ecx
0042CFA2. |B8 04000000 mov eax,4
0042CFA7. |0345 DC add eax,dword ptr ss:[ebp-24]
0042CFAA. |0F80 E7150000 jo 123.0042E597
0042CFB0. |8945 DC mov dword ptr ss:[ebp-24],eax
0042CFB3.^\EB 8E jmp short 123.0042CF43
0042CFB5>8B55 C4 mov edx,dword ptr ss:[ebp-3C]
第一次是和第五次的结果(0004E264)累加
7952--1F10
7053--1B8D
4952--1358
5351--14E7
..........
3495--DA7
0494--1EE
9495--2517
最后累加结果:ECX=0009C4C8
长度:F6
----------------------------------------------------------------------------------------------------------------
第九次循环:(算法和第三次一样)
0042CFCC> /8B85 08FDFFFF mov eax,dword ptr ss:[ebp-2F8] ;第九次循环
0042CFD2. |3945 DC cmp dword ptr ss:[ebp-24],eax
0042CFD5. |7F 67 jg short 123.0042D03E
0042CFD7. |C745 90 03000>mov dword ptr ss:[ebp-70],3
0042CFDE. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042CFE5. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042CFE8. |51push ecx
0042CFE9. |8B55 DC mov edx,dword ptr ss:[ebp-24]
0042CFEC. |52push edx
0042CFED. |8B45 C4 mov eax,dword ptr ss:[ebp-3C]
0042CFF0. |50push eax
0042CFF1. |FFD3call ebx
0042CFF3. |8BD0mov edx,eax
0042CFF5. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042CFF8. |FFD6call esi
0042CFFA. |50push eax
0042CFFB. |FF15 8C114000 call dword ptr ds:[<&msvbvm60.__vbaR>;msvbvm60.__vbaR8Str
0042D001. |FF15 E4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFpI4
0042D007. |8945 E0 mov dword ptr ss:[ebp-20],eax
0042D00A. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042D00D. |FF15 24124000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStr
0042D013. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042D016. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042D01C. |8B4D D4 mov ecx,dword ptr ss:[ebp-2C]
0042D01F. |034D E0 add ecx,dword ptr ss:[ebp-20]
0042D022. |0F80 6F150000 jo 123.0042E597
0042D028. |894D D4 mov dword ptr ss:[ebp-2C],ecx
0042D02B. |B8 03000000 mov eax,3
0042D030. |0345 DC add eax,dword ptr ss:[ebp-24]
0042D033. |0F80 5E150000 jo 123.0042E597
0042D039. |8945 DC mov dword ptr ss:[ebp-24],eax
0042D03C.^\EB 8E jmp short 123.0042CFCC
0042D03E>8B55 C4 mov edx,dword ptr ss:[ebp-3C]
第一次是和第六次的结果(0000A944)累加
795--31B
270--10E
534--216
........
504--1F8
949--3B5
495--1EF
最后累加的结果:ECX=00015288
长度:F6
----------------------------------------------------------------------------------------------------------------
第十次循环:(算法和第三次一样)
0042D055> /8B85 00FDFFFF mov eax,dword ptr ss:[ebp-300] ;第十次循环
0042D05B. |3945 DC cmp dword ptr ss:[ebp-24],eax
0042D05E. |7F 67 jg short 123.0042D0C7
0042D060. |C745 90 01000>mov dword ptr ss:[ebp-70],1;取1个
0042D067. |C745 88 02000>mov dword ptr ss:[ebp-78],2
0042D06E. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042D071. |51push ecx
0042D072. |8B55 DC mov edx,dword ptr ss:[ebp-24]
0042D075. |52push edx
0042D076. |8B45 C4 mov eax,dword ptr ss:[ebp-3C]
0042D079. |50push eax
0042D07A. |FFD3call ebx
0042D07C. |8BD0mov edx,eax
0042D07E. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042D081. |FFD6call esi
0042D083. |50push eax
0042D084. |FF15 8C114000 call dword ptr ds:[<&msvbvm60.__vbaR>;msvbvm60.__vbaR8Str
0042D08A. |FF15 E4114000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFpI4
0042D090. |8945 E0 mov dword ptr ss:[ebp-20],eax
0042D093. |8D4D BC lea ecx,dword ptr ss:[ebp-44]
0042D096. |FF15 24124000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeStr
0042D09C. |8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042D09F. |FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaF>;msvbvm60.__vbaFreeVar
0042D0A5. |8B4D CC mov ecx,dword ptr ss:[ebp-34]
0042D0A8. |034D E0 add ecx,dword ptr ss:[ebp-20]
0042D0AB. |0F80 E6140000 jo 123.0042E597
0042D0B1. |894D CC mov dword ptr ss:[ebp-34],ecx
0042D0B4. |B8 01000000 mov eax,1
0042D0B9. |0345 DC add eax,dword ptr ss:[ebp-24]
0042D0BC. |0F80 D5140000 jo 123.0042E597
0042D0C2. |8945 DC mov dword ptr ss:[ebp-24],eax
0042D0C5.^\EB 8E jmp short 123.0042D055
0042D0C7>8D55 CC lea edx,dword ptr ss:[ebp-34];终于走完了十大循环
每次取一个字符,把字符全部转换成16进制后累加(不是和前面的结果累加)
7--7
9--9
5--5
2--2
7--7
....
9--9
4--4
9--9
4--4
9--9
5--5
最后结果:ECX=00000486
--------------------------------------------------------------------------------------------------------------------
0042D0C7> \8D55 CC lea edx,dword ptr ss:[ebp-34];终于走完了十大循环
0042D0CA.8995 00FEFFFF mov dword ptr ss:[ebp-200],edx ;保存第九次循环结果地址存在[ebp-200]
0042D0D0.C785 F8FDFFFF>mov dword ptr ss:[ebp-208],4003;4003保存在[ebp-208]
0042D0DA.8D85 F8FDFFFF lea eax,dword ptr ss:[ebp-208] ;[ebp-208]的地址给eax
0042D0E0.50push eax
0042D0E1.8D4D 88 lea ecx,dword ptr ss:[ebp-78]
0042D0E4.51push ecx
0042D0E5.8B1D DC114000 mov ebx,dword ptr ds:[<&msvbvm60.rtc>;msvbvm60.rtcVarStrFromVar
0042D0EB.FFD3call ebx ;得到一串注册码字符; <&msvbvm60.rtcVarStrFromVar>
0042D0ED.8D55 88 lea edx,dword ptr ss:[ebp-78]
0042D0F0.52push edx ; /Arg2
0042D0F1.8D85 78FFFFFF lea eax,dword ptr ss:[ebp-88]; |
0042D0F7.50push eax ; |Arg1
0042D0F8.FF15 AC104000 call dword ptr ds:[<&msvbvm60.rtcLef>; \过滤掉空格
用第九次循环得到结果(486)通过第一次的算法:[(ASCII+2)对A求余+30]得到" 1158"(有个空格)
剩下的三个方法一样~~~
用第八次循环得到结果(15288)通过第一次的算法:[(ASCII+2)对A求余+30]得到" 86664")(有个空格) 清空格
用第七次循环得到结果(15288)通过第一次的算法:[(ASCII+2)对A求余+30]得到" 640200")(有个空格) 清空格
用第五次循环得到结果(00368607)通过第一次的算法:[(ASCII+2)对A求余+30]得到" 3573255"(有个空格) 清空格
最后经过__vbaVarCat连接到一起
0042D1A3.C785 C0FDFFFF>mov dword ptr ss:[ebp-240],14
0042D1AD.C785 B8FDFFFF>mov dword ptr ss:[ebp-248],8002
0042D1B7.8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-88]
0042D1BD.51push ecx ; /Arg3
0042D1BE.8D95 58FFFFFF lea edx,dword ptr ss:[ebp-A8]; |
0042D1C4.52push edx ; |Arg2
0042D1C5.8D85 48FFFFFF lea eax,dword ptr ss:[ebp-B8]; |
0042D1CB.50push eax ; |Arg1
0042D1CC.FF15 6C114000 call dword ptr ds:[<&msvbvm60.__vbaV>; \__vbaVarCat
0042D1D2.50push eax ; /Arg3
0042D1D3.8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-D8]; |
0042D1D9.51push ecx ; |Arg2
0042D1DA.8D95 18FFFFFF lea edx,dword ptr ss:[ebp-E8]; |
0042D1E0.52push edx ; |Arg1
0042D1E1.FF15 6C114000 call dword ptr ds:[<&msvbvm60.__vbaV>; \__vbaVarCat
0042D1E7.50push eax ; /Arg3
0042D1E8.8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-108] ; |
0042D1EE.50push eax ; |Arg2
0042D1EF.8D8D E8FEFFFF lea ecx,dword ptr ss:[ebp-118] ; |
0042D1F5.51push ecx ; |Arg1
0042D1F6.FF15 6C114000 call dword ptr ds:[<&msvbvm60.__vbaV>; \__vbaVarCat;//跟进可找到注册码
找注册码的可见我的追码教程
就得到
1158866646402003573255 |
|