好友
阅读权限10
听众
最后登录1970-1-1
|
Kris
发表于 2011-9-13 12:37
本帖最后由 Kris 于 2011-9-13 12:38 编辑
004011CA 55 push ebp 这里是时钟检测的，这个检测通过了又会有一个时钟来检测其它位上的密码
004011CB 8BEC mov ebp,esp
004011CD 81EC 20000000 sub esp,0x20
004011D3 6A FF push -0x1
004011D5 6A 08 push 0x8
004011D7 68 0E000116 push 0x1601000E
004011DC 68 01000152 push 0x52010001
004011E1 E8 24050000 call x.0040170A
004011E6 83C4 10 add esp,0x10
004011E9 8945 FC mov dword ptr ss:[ebp-0x4],eax
004011EC 68 01030080 push 0x80000301
004011F1 6A 00 push 0x0
004011F3 68 02000000 push 0x2
004011F8 68 04000080 push 0x80000004
004011FD 6A 00 push 0x0
004011FF 8B45 FC mov eax,dword ptr ss:[ebp-0x4]
00401202 85C0 test eax,eax
00401204 75 05 jnz Xx.0040120B
00401206 B8 539E4600 mov eax,x.00469E53
0040120B 50 push eax
0040120C 68 02000000 push 0x2
00401211 BB 50184000 mov ebx,x.00401850
00401216 E8 DD040000 call x.004016F8
0040121B 83C4 1C add esp,0x1C
0040121E 8945 F8 mov dword ptr ss:[ebp-0x8],eax
00401221 8B5D FC mov ebx,dword ptr ss:[ebp-0x4]
00401224 85DB test ebx,ebx
00401226 74 09 je Xx.00401231
00401228 53 push ebx
00401229 E8 D6040000 call x.00401704
0040122E 83C4 04 add esp,0x4
00401231 68 04000080 push 0x80000004
00401236 6A 00 push 0x0
00401238 8B45 F8 mov eax,dword ptr ss:[ebp-0x8]
0040123B 85C0 test eax,eax
0040123D 75 05 jnz Xx.00401244
0040123F B8 539E4600 mov eax,x.00469E53
00401244 50 push eax
00401245 68 01000000 push 0x1
0040124A BB 401A4000 mov ebx,x.00401A40
0040124F E8 A4040000 call x.004016F8
00401254 83C4 10 add esp,0x10
00401257 8945 F4 mov dword ptr ss:[ebp-0xC],eax
0040125A 8B5D F8 mov ebx,dword ptr ss:[ebp-0x8]
0040125D 85DB test ebx,ebx
0040125F 74 09 je Xx.0040126A
00401261 53 push ebx
00401262 E8 9D040000 call x.00401704
00401267 83C4 04 add esp,0x4
0040126A DB45 F4 fild dword ptr ss:[ebp-0xC] ; 密码前2位装入ST0
0040126D DD5D EC fstp qword ptr ss:[ebp-0x14]
00401270 DD45 EC fld qword ptr ss:[ebp-0x14]
00401273 DC05 549E4600 fadd qword ptr ds:[0x469E54] ; +54
00401279 DD5D E4 fstp qword ptr ss:[ebp-0x1C]
0040127C DD45 E4 fld qword ptr ss:[ebp-0x1C]
0040127F DC25 5C9E4600 fsub qword ptr ds:[0x469E5C] ; -99
00401285 D9E4 ftst
00401287 DFE0 fstsw ax
00401289 F6C4 01 test ah,0x1
0040128C 74 02 je Xx.00401290
0040128E D9E0 fchs ; 如果负数就改正数，就是绝对值
00401290 DC1D 649E4600 fcomp qword ptr ds:[0x469E64] ; 比较,如果这个时ST0=0,既密码前2位到小数+54-99=0
00401296 DFE0 fstsw ax ; 那么关键跳就不跳
00401298 F6C4 41 test ah,0x41
0040129B 0F84 3F000000 je x.004012E0 ; 关键跳
004012A1 6A 00 push 0x0
004012A3 68 00000000 push 0x0
004012A8 6A FF push -0x1
004012AA 6A 08 push 0x8
004012AC 68 1D000116 push 0x1601001D
004012B1 68 01000152 push 0x52010001
004012B6 E8 43040000 call x.004016FE
004012BB 83C4 18 add esp,0x18
004012BE 6A 00 push 0x0
004012C0 68 02000000 push 0x2
004012C5 6A FF push -0x1
004012C7 6A 08 push 0x8
004012C9 68 2F000116 push 0x1601002F
004012CE 68 01000152 push 0x52010001
004012D3 E8 26040000 call x.004016FE
004012D8 83C4 18 add esp,0x18
004012DB E9 00000000 jmp x.004012E0
004012E0 8BE5 mov esp,ebp
004012E2 5D pop ebp
004012E3 C3 retn
|密码前2位到小数+54-99|的绝对值≤0,绝对值不为负数，
既：
密码前2位到小数+54-99=0,
密码前2位到小数=0+99-54
密码前2位到小数=45
通过前面后，程序另一时钟继续验证其他密码
密码后2位=52
004014EB 50 push eax
004014EC FF75 F8 push dword ptr ss:[ebp-0x8]
004014EF E8 10FBFFFF call x.00401004
密码345位到十六进制后，取倒数1个字节=9Eh(158)
00401613 50 push eax
00401614 68 01000000 push 0x1
00401619 BB 40194000 mov ebx,x.00401940
0040161E E8 D5000000 call x.004016F8
00401623 83C4 10 add esp,0x10
00401626 68 01010080 push 0x80000101
0040162B 6A 00 push 0x0
0040162D 50 push eax
0040162E 68 01000000 push 0x1
00401633 BB 401A4000 mov ebx,x.00401A40
00401638 E8 BB000000 call x.004016F8
0040163D 83C4 10 add esp,0x10
00401640 8945 F4 mov dword ptr ss:[ebp-0xC],eax
00401643 817D F4 9E00000>cmp dword ptr ss:[ebp-0xC],0x9E
0040164A 0F85 55000000 jnz x.004016A5
连起来密码=4515852
由于检测其余密码的时钟只会检测一次，如果不对，就不再检测了，所以，必须在一瞬间把密码输入进去，So,就必须要复制密码后粘贴了，
|
|
发表于 2011-9-12 21:50
|
发表于 2011-9-14 06:57
