|
|
小猪猪登场 这个圆梦FZ之前一直被TMTT X***(Bi~~) 由于后来加VM后 TMTT就被圆梦给(Bi~~) 了 为了解决这一困惑 还论坛Q宠大乐斗用户的使用权，写个分析逆向过程，给论坛逆向不了这个FZ的人一些思路 即便发出去后这个FZ可能以后就再也逆向不了了
首先上图
大家可以看到 点击VIP 即粗体的功能后 他就会告诉你 不能用滴 要掏出你滴小钱包才能给你用滴 我们就要逆向这个
先把他拖入我们万恶的欧弟的身体里，对他进行凌辱
载入可以看到满满的都是邪恶 VM神马太恶心了 重口味的说
OK 首先不管他 我们先整理思路 首先呢 他是点击功能后出现的提示 而且弹出的是信息框 那么我们就有几个思路PJ了
1.易语言按钮事件 FF55FC5F5E
2.信息框API bp MessageBoxA
按钮事件呢 思路好点的就可以知道 断下跟进去满满又是邪恶 所以就直接先搁置1了 先下API断点吧
在命令栏输入 bp MessageBoxA 或者是 Ctrl+G 跳转到 MessageBoxA 然后F2断点
记得先F9运行后再下断点 否则VMP壳会检测滴
然后我们在FZ里点击VIP功能 成功断下
然后再堆栈窗口 右键 反汇编窗口跟随
堆栈里有很多返回 我们一个一个在反汇编查看 会发现很多返回都在虚拟机里 我们不管他 继续向下找 直到找到.....
跟出来以后发现并不是按钮事件的末端 而是一个子程序的调用 下面还有个call 那当然是要进去一探究竟
- 00403A1B 55 push ebp
- 00403A1C 8BEC mov ebp,esp
- 00403A1E 81EC 04000000 sub esp,0x4
- 00403A24 833D D802C200 0>cmp dword ptr ds:[0xC202D8],0x0 //判断全局变量是否为0
- 00403A2B 0F85 53040000 jnz Q宠大乐?00403E84 //如果等于0则不跳转
- 00403A31 6A 00 push 0x0 //以下代码都是对选择框的禁止=真
- 00403A33 68 00000000 push 0x0
- 00403A38 6A FF push -0x1
- 00403A3A 6A 12 push 0x12
- 00403A3C 68 81000216 push 0x16020081
- 00403A41 68 03000152 push 0x52010003
- 00403A46 E8 888A1D00 call Q宠大乐?005DC4D3
- 00403A4B 83C4 18 add esp,0x18
- 00403A4E 6A 00 push 0x0
- 00403A50 68 00000000 push 0x0
- 00403A55 6A FF push -0x1
- 00403A57 6A 12 push 0x12
- 00403A59 68 FBFE0116 push 0x1601FEFB
- 00403A5E 68 03000152 push 0x52010003
- 00403A63 E8 6B8A1D00 call Q宠大乐?005DC4D3
- 00403A68 83C4 18 add esp,0x18
- 00403A6B 6A 00 push 0x0
- 00403A6D 68 00000000 push 0x0
- 00403A72 6A FF push -0x1
- 00403A74 6A 12 push 0x12
- 00403A76 68 62F80116 push 0x1601F862
- 00403A7B 68 03000152 push 0x52010003
- 00403A80 E8 4E8A1D00 call Q宠大乐?005DC4D3
- 00403A85 83C4 18 add esp,0x18
- 00403A88 6A 00 push 0x0
- 00403A8A 68 00000000 push 0x0
- 00403A8F 6A FF push -0x1
- 00403A91 6A 12 push 0x12
- 00403A93 68 61F80116 push 0x1601F861
- 00403A98 68 03000152 push 0x52010003
- 00403A9D E8 318A1D00 call Q宠大乐?005DC4D3
- 00403AA2 83C4 18 add esp,0x18
- 00403AA5 6A 00 push 0x0
- 00403AA7 68 00000000 push 0x0
- 00403AAC 6A FF push -0x1
- 00403AAE 6A 12 push 0x12
- 00403AB0 68 63F80116 push 0x1601F863
- 00403AB5 68 03000152 push 0x52010003
- 00403ABA E8 148A1D00 call Q宠大乐?005DC4D3
- 00403ABF 83C4 18 add esp,0x18
- 00403AC2 6A 00 push 0x0
- 00403AC4 68 00000000 push 0x0
- 00403AC9 6A FF push -0x1
- 00403ACB 6A 12 push 0x12
- 00403ACD 68 6EF80116 push 0x1601F86E
- 00403AD2 68 03000152 push 0x52010003
- 00403AD7 E8 F7891D00 call Q宠大乐?005DC4D3
- 00403ADC 83C4 18 add esp,0x18
- 00403ADF 6A 00 push 0x0
- 00403AE1 68 00000000 push 0x0
- 00403AE6 6A FF push -0x1
- 00403AE8 6A 12 push 0x12
- 00403AEA 68 7CF80116 push 0x1601F87C
- 00403AEF 68 03000152 push 0x52010003
- 00403AF4 E8 DA891D00 call Q宠大乐?005DC4D3
- 00403AF9 83C4 18 add esp,0x18
- 00403AFC 6A 00 push 0x0
- 00403AFE 68 00000000 push 0x0
- 00403B03 6A FF push -0x1
- 00403B05 6A 12 push 0x12
- 00403B07 68 7EF80116 push 0x1601F87E
- 00403B0C 68 03000152 push 0x52010003
- 00403B11 E8 BD891D00 call Q宠大乐?005DC4D3
- 00403B16 83C4 18 add esp,0x18
- 00403B19 6A 00 push 0x0
- 00403B1B 68 00000000 push 0x0
- 00403B20 6A FF push -0x1
- 00403B22 6A 12 push 0x12
- 00403B24 68 86F80116 push 0x1601F886
- 00403B29 68 03000152 push 0x52010003
- 00403B2E E8 A0891D00 call Q宠大乐?005DC4D3
- 00403B33 83C4 18 add esp,0x18
- 00403B36 6A 00 push 0x0
- 00403B38 68 00000000 push 0x0
- 00403B3D 6A FF push -0x1
- 00403B3F 6A 12 push 0x12
- 00403B41 68 22F80116 push 0x1601F822
- 00403B46 68 03000152 push 0x52010003
- 00403B4B E8 83891D00 call Q宠大乐?005DC4D3
- 00403B50 83C4 18 add esp,0x18
- 00403B53 6A 00 push 0x0
- 00403B55 68 00000000 push 0x0
- 00403B5A 6A FF push -0x1
- 00403B5C 6A 12 push 0x12
- 00403B5E 68 83F80116 push 0x1601F883
- 00403B63 68 03000152 push 0x52010003
- 00403B68 E8 66891D00 call Q宠大乐?005DC4D3
- 00403B6D 83C4 18 add esp,0x18
- 00403B70 6A 00 push 0x0
- 00403B72 68 01000000 push 0x1
- 00403B77 6A FF push -0x1
- 00403B79 6A 05 push 0x5
- 00403B7B 68 DC040216 push 0x160204DC
- 00403B80 68 03000152 push 0x52010003
- 00403B85 E8 49891D00 call Q宠大乐?005DC4D3
- 00403B8A 83C4 18 add esp,0x18
- 00403B8D 6A 00 push 0x0
- 00403B8F 68 00000000 push 0x0
- 00403B94 6A FF push -0x1
- 00403B96 6A 12 push 0x12
- 00403B98 68 6AF80116 push 0x1601F86A
- 00403B9D 68 03000152 push 0x52010003
- 00403BA2 E8 2C891D00 call Q宠大乐?005DC4D3
- 00403BA7 83C4 18 add esp,0x18
- 00403BAA 6A 00 push 0x0
- 00403BAC 68 00000000 push 0x0
- 00403BB1 6A FF push -0x1
- 00403BB3 6A 12 push 0x12
- 00403BB5 68 66F80116 push 0x1601F866
- 00403BBA 68 03000152 push 0x52010003
- 00403BBF E8 0F891D00 call Q宠大乐?005DC4D3
- 00403BC4 83C4 18 add esp,0x18
- 00403BC7 6A 00 push 0x0
- 00403BC9 68 00000000 push 0x0
- 00403BCE 6A FF push -0x1
- 00403BD0 6A 12 push 0x12
- 00403BD2 68 67F80116 push 0x1601F867
- 00403BD7 68 03000152 push 0x52010003
- 00403BDC E8 F2881D00 call Q宠大乐?005DC4D3
- 00403BE1 83C4 18 add esp,0x18
- 00403BE4 6A 00 push 0x0
- 00403BE6 68 00000000 push 0x0
- 00403BEB 6A FF push -0x1
- 00403BED 6A 12 push 0x12
- 00403BEF 68 68F80116 push 0x1601F868
- 00403BF4 68 03000152 push 0x52010003
- 00403BF9 E8 D5881D00 call Q宠大乐?005DC4D3
- 00403BFE 83C4 18 add esp,0x18
- 00403C01 6A 00 push 0x0
- 00403C03 68 00000000 push 0x0
- 00403C08 6A FF push -0x1
- 00403C0A 6A 12 push 0x12
- 00403C0C 68 75F80116 push 0x1601F875
- 00403C11 68 03000152 push 0x52010003
- 00403C16 E8 B8881D00 call Q宠大乐?005DC4D3
- 00403C1B 83C4 18 add esp,0x18
- 00403C1E 6A 00 push 0x0
- 00403C20 68 00000000 push 0x0
- 00403C25 6A FF push -0x1
- 00403C27 6A 12 push 0x12
- 00403C29 68 69F80116 push 0x1601F869
- 00403C2E 68 03000152 push 0x52010003
- 00403C33 E8 9B881D00 call Q宠大乐?005DC4D3
- 00403C38 83C4 18 add esp,0x18
- 00403C3B 6A 00 push 0x0
- 00403C3D 68 00000000 push 0x0
- 00403C42 6A FF push -0x1
- 00403C44 6A 12 push 0x12
- 00403C46 68 6FF80116 push 0x1601F86F
- 00403C4B 68 03000152 push 0x52010003
- 00403C50 E8 7E881D00 call Q宠大乐?005DC4D3
- 00403C55 83C4 18 add esp,0x18
- 00403C58 6A 00 push 0x0
- 00403C5A 68 00000000 push 0x0
- 00403C5F 6A FF push -0x1
- 00403C61 6A 12 push 0x12
- 00403C63 68 6BF80116 push 0x1601F86B
- 00403C68 68 03000152 push 0x52010003
- 00403C6D E8 61881D00 call Q宠大乐?005DC4D3
- 00403C72 83C4 18 add esp,0x18
- 00403C75 6A 00 push 0x0
- 00403C77 68 00000000 push 0x0
- 00403C7C 6A FF push -0x1
- 00403C7E 6A 12 push 0x12
- 00403C80 68 7AF80116 push 0x1601F87A
- 00403C85 68 03000152 push 0x52010003
- 00403C8A E8 44881D00 call Q宠大乐?005DC4D3
- 00403C8F 83C4 18 add esp,0x18
- 00403C92 6A 00 push 0x0
- 00403C94 68 00000000 push 0x0
- 00403C99 6A FF push -0x1
- 00403C9B 6A 12 push 0x12
- 00403C9D 68 76F80116 push 0x1601F876
- 00403CA2 68 03000152 push 0x52010003
- 00403CA7 E8 27881D00 call Q宠大乐?005DC4D3
- 00403CAC 83C4 18 add esp,0x18
- 00403CAF 6A 00 push 0x0
- 00403CB1 68 00000000 push 0x0
- 00403CB6 6A FF push -0x1
- 00403CB8 6A 12 push 0x12
- 00403CBA 68 74F80116 push 0x1601F874
- 00403CBF 68 03000152 push 0x52010003
- 00403CC4 E8 0A881D00 call Q宠大乐?005DC4D3
- 00403CC9 83C4 18 add esp,0x18
- 00403CCC 6A 00 push 0x0
- 00403CCE 68 00000000 push 0x0
- 00403CD3 6A FF push -0x1
- 00403CD5 6A 12 push 0x12
- 00403CD7 68 73F80116 push 0x1601F873
- 00403CDC 68 03000152 push 0x52010003
- 00403CE1 E8 ED871D00 call Q宠大乐?005DC4D3
- 00403CE6 83C4 18 add esp,0x18
- 00403CE9 6A 00 push 0x0
- 00403CEB 68 00000000 push 0x0
- 00403CF0 6A FF push -0x1
- 00403CF2 6A 12 push 0x12
- 00403CF4 68 70F80116 push 0x1601F870
- 00403CF9 68 03000152 push 0x52010003
- 00403CFE E8 D0871D00 call Q宠大乐?005DC4D3
- 00403D03 83C4 18 add esp,0x18
- 00403D06 6A 00 push 0x0
- 00403D08 68 00000000 push 0x0
- 00403D0D 6A FF push -0x1
- 00403D0F 6A 12 push 0x12
- 00403D11 68 7BF80116 push 0x1601F87B
- 00403D16 68 03000152 push 0x52010003
- 00403D1B E8 B3871D00 call Q宠大乐?005DC4D3
- 00403D20 83C4 18 add esp,0x18
- 00403D23 6A 00 push 0x0
- 00403D25 68 00000000 push 0x0
- 00403D2A 6A FF push -0x1
- 00403D2C 6A 12 push 0x12
- 00403D2E 68 72F80116 push 0x1601F872
- 00403D33 68 03000152 push 0x52010003
- 00403D38 E8 96871D00 call Q宠大乐?005DC4D3
- 00403D3D 83C4 18 add esp,0x18
- 00403D40 6A 00 push 0x0
- 00403D42 68 00000000 push 0x0
- 00403D47 6A FF push -0x1
- 00403D49 6A 12 push 0x12
- 00403D4B 68 91F80116 push 0x1601F891
- 00403D50 68 03000152 push 0x52010003
- 00403D55 E8 79871D00 call Q宠大乐?005DC4D3
- 00403D5A 83C4 18 add esp,0x18
- 00403D5D 6A 00 push 0x0
- 00403D5F 68 00000000 push 0x0
- 00403D64 6A FF push -0x1
- 00403D66 6A 12 push 0x12
- 00403D68 68 8DF80116 push 0x1601F88D
- 00403D6D 68 03000152 push 0x52010003
- 00403D72 E8 5C871D00 call Q宠大乐?005DC4D3
- 00403D77 83C4 18 add esp,0x18
- 00403D7A 6A 00 push 0x0
- 00403D7C 68 00000000 push 0x0
- 00403D81 6A FF push -0x1
- 00403D83 6A 12 push 0x12
- 00403D85 68 85F80116 push 0x1601F885
- 00403D8A 68 03000152 push 0x52010003
- 00403D8F E8 3F871D00 call Q宠大乐?005DC4D3
- 00403D94 83C4 18 add esp,0x18
- 00403D97 6A 00 push 0x0
- 00403D99 68 00000000 push 0x0
- 00403D9E 6A FF push -0x1
- 00403DA0 6A 12 push 0x12
- 00403DA2 68 84F80116 push 0x1601F884
- 00403DA7 68 03000152 push 0x52010003
- 00403DAC E8 22871D00 call Q宠大乐?005DC4D3
- 00403DB1 83C4 18 add esp,0x18
- 00403DB4 6A 00 push 0x0
- 00403DB6 68 00000000 push 0x0
- 00403DBB 6A FF push -0x1
- 00403DBD 6A 12 push 0x12
- 00403DBF 68 6CF80116 push 0x1601F86C
- 00403DC4 68 03000152 push 0x52010003
- 00403DC9 E8 05871D00 call Q宠大乐?005DC4D3
- 00403DCE 83C4 18 add esp,0x18
- 00403DD1 6A 00 push 0x0
- 00403DD3 68 00000000 push 0x0
- 00403DD8 6A FF push -0x1
- 00403DDA 6A 12 push 0x12
- 00403DDC 68 82F80116 push 0x1601F882
- 00403DE1 68 03000152 push 0x52010003
- 00403DE6 E8 E8861D00 call Q宠大乐?005DC4D3
- 00403DEB 83C4 18 add esp,0x18
- 00403DEE 6A 00 push 0x0
- 00403DF0 68 00000000 push 0x0
- 00403DF5 6A FF push -0x1
- 00403DF7 6A 12 push 0x12
- 00403DF9 68 84F80116 push 0x1601F884
- 00403DFE 68 03000152 push 0x52010003
- 00403E03 E8 CB861D00 call Q宠大乐?005DC4D3
- 00403E08 83C4 18 add esp,0x18
- 00403E0B 6A 00 push 0x0
- 00403E0D 68 00000000 push 0x0
- 00403E12 6A FF push -0x1
- 00403E14 6A 12 push 0x12
- 00403E16 68 83F80116 push 0x1601F883
- 00403E1B 68 03000152 push 0x52010003
- 00403E20 E8 AE861D00 call Q宠大乐?005DC4D3
- 00403E25 83C4 18 add esp,0x18
- 00403E28 6A 00 push 0x0
- 00403E2A 68 00000000 push 0x0
- 00403E2F 6A FF push -0x1
- 00403E31 6A 12 push 0x12
- 00403E33 68 64F80116 push 0x1601F864
- 00403E38 68 03000152 push 0x52010003
- 00403E3D E8 91861D00 call Q宠大乐?005DC4D3
- 00403E42 83C4 18 add esp,0x18
- 00403E45 6A 00 push 0x0
- 00403E47 68 00000000 push 0x0
- 00403E4C 6A FF push -0x1
- 00403E4E 6A 12 push 0x12
- 00403E50 68 5FF80116 push 0x1601F85F
- 00403E55 68 03000152 push 0x52010003
- 00403E5A E8 74861D00 call Q宠大乐?005DC4D3
- 00403E5F 83C4 18 add esp,0x18
- 00403E62 6A 00 push 0x0
- 00403E64 68 00000000 push 0x0
- 00403E69 6A FF push -0x1
- 00403E6B 6A 12 push 0x12
- 00403E6D 68 5EF80116 push 0x1601F85E
- 00403E72 68 03000152 push 0x52010003
- 00403E77 E8 57861D00 call Q宠大乐?005DC4D3
- 00403E7C 83C4 18 add esp,0x18
- 00403E7F E9 1D000000 jmp Q宠大乐?00403EA1
- 00403E84 6A 00 push 0x0
- 00403E86 68 00000000 push 0x0
- 00403E8B 6A FF push -0x1
- 00403E8D 6A 05 push 0x5
- 00403E8F 68 DC040216 push 0x160204DC
- 00403E94 68 03000152 push 0x52010003
- 00403E99 E8 35861D00 call Q宠大乐?005DC4D3
- 00403E9E 83C4 18 add esp,0x18
- 00403EA1 8BE5 mov esp,ebp
- 00403EA3 5D pop ebp
- 00403EA4 C3 retn
这里没有被VM掉 经过我对易语言一些了解 发现这里的判断一个全局变量 0xC202D8 的值是不是 0 如果是的话 就禁止所有选择框的点击 如果不是则解禁 这就是关键点了
圆梦就这样被搞了 只要我们 mov dword ptr ds:[0xC202D8],0x1 就可以使用VIP功能了
自从学会逆向版圆梦FZ 粉蘑菇都爱上我了呢
记得加精加热心哦 亲~~
补: 膜拜 Xjun、恒、H; All大大
|
评分
-
| 参与人数 20 | HB +18 |
THX +14 |
收起
理由
|
|
29590
| |
+ 1 |
|
|
24567
| |
+ 1 |
|
|
Jawon
| |
+ 1 |
|
|
一路走来不容易
| + 1 |
|
|
|
Soul1999
| + 1 |
|
|
|
yexing
| |
+ 1 |
|
|
行行行行行行
| |
+ 1 |
|
|
消逝的过去
| |
+ 1 |
|
|
三月十六
| |
+ 1 |
|
|
成丰羽
| + 1 |
|
[吾爱汇编论坛52HB.COM]-感谢楼主热心分享，小小评分不成敬意！ |
|
hackysh
| + 1 |
|
|
|
y_jiping
| |
+ 1 |
|
|
baky1223
| + 2 |
|
|
|
jaunic
| |
+ 1 |
|
|
hnymsh
| |
+ 1 |
|
|
lies
| + 1 |
|
|
|
engliking3
| |
+ 1 |
[快捷评语]--吃水不忘打井人，给个评分懂感恩！ |
|
mtkpp
| + 3 |
+ 1 |
你将受到所有人的崇拜！ |
|
王婆卖瓜
| + 5 |
+ 1 |
转的一手好帖！学习了！ |
|
寂寞、格式化
| + 3 |
+ 1 |
你将受到所有人的崇拜！ |
查看全部评分
|
[复制链接]
|RSS|手机版|小黑屋|帮助|吾爱汇编
( 
京公网安备11011502005403号 , 京ICP备20003498号-6 )|网站地图
窥视卡
雷达卡
