本帖最后由 空空 于 2009-6-4 22:40 编辑
1# kernel2008
/下断
0046BD24 /. 55 push ebp
0046BD25 |. 8BEC mov ebp, esp
0046BD27 |. B9 08000000 mov ecx, 8
/循环
0046BD2C |> 6A 00 /push 0
0046BD2E |. 6A 00 |push 0
0046BD30 |. 49 |dec ecx
0046BD31 |.^ 75 F9 \jnz short 0046BD2C
0046BD33 |. 51 push ecx
0046BD34 |. 53 push ebx
0046BD35 |. 8BD8 mov ebx, eax
0046BD37 |. 33C0 xor eax, eax
0046BD39 |. 55 push ebp
0046BD3A |. 68 D1BE4600 push 0046BED1
0046BD3F |. 64:FF30 push dword ptr fs:[eax]
0046BD42 |. 64:8920 mov dword ptr fs:[eax], esp
0046BD45 |. 8D55 FC lea edx, dword ptr [ebp-4]
0046BD48 |. 8B83 20030000 mov eax, dword ptr [ebx+320]
/cmp比较 je等于则继续往下走,以下开始检查输入用户名及注册码部分
0046BD4E |. E8 B192FCFF call 00435004
0046BD53 |. 837D FC 00 cmp dword ptr [ebp-4], 0
0046BD57 |. 74 54 je short 0046BDAD
0046BD59 |. 8D55 F8 lea edx, dword ptr [ebp-8]
0046BD5C |. 8B83 10030000 mov eax, dword ptr [ebx+310]
0046BD62 |. E8 9D92FCFF call 00435004
0046BD67 |. 837D F8 00 cmp dword ptr [ebp-8], 0
0046BD6B |. 74 40 je short 0046BDAD
0046BD6D |. 8D55 F4 lea edx, dword ptr [ebp-C]
0046BD70 |. 8B83 14030000 mov eax, dword ptr [ebx+314]
0046BD76 |. E8 8992FCFF call 00435004
0046BD7B |. 837D F4 00 cmp dword ptr [ebp-C], 0
0046BD7F |. 74 2C je short 0046BDAD
0046BD81 |. 8D55 F0 lea edx, dword ptr [ebp-10]
0046BD84 |. 8B83 18030000 mov eax, dword ptr [ebx+318]
0046BD8A |. E8 7592FCFF call 00435004
0046BD8F |. 837D F0 00 cmp dword ptr [ebp-10], 0
0046BD93 |. 74 18 je short 0046BDAD
0046BD95 |. 8D55 EC lea edx, dword ptr [ebp-14]
0046BD98 |. 8B83 1C030000 mov eax, dword ptr [ebx+31C]
0046BD9E |. E8 6192FCFF call 00435004
0046BDA3 |. 837D EC 00 cmp dword ptr [ebp-14], 0
/不等于则提示用户名及其注册码输入有误
0046BDA7 0F85 A4000000 jnz 0046BE51
0046BDAD |> 6A 40 push 40
程序还会往c:\Team.ini这里写进去一个ini文件。
接下来,没思路了,基本上每个CALL都跟进去看了一下。
希望有人能帮忙指点一下 ;) |