悬赏（一款http连接器，跳不出程序领空）简单逆向

前言：我错了，希望恒大大解除我的访问IP  ，一不小心用了论坛网站做测试了！
悬赏地址：    https://www.52hb.com/thread-33160-1-1.html
楼主说找不到关键字暂停法不能用！我发现可以找到关键字，出个简单的逆向教程
发现我这发帖不能上传图，不知道什么原因，全程文字
————————————开始——————————————————
把软件拖入OD直接运行起来
查找ascll码就发现关键字   “禁止对非私有IP测试!”，双击进去

[Asm] 纯文本查看 复制代码

002063E2    50              push eax
002063E3    E8 49D5FFFF     call httptest.00203931
002063E8    E8 AB520100     call httptest.0021B698
002063ED    E8 462C0100     call httptest.00219038
002063F2    E8 982C0100     call httptest.0021908F
002063F7    8D9D 60FFFFFF   lea ebx,dword ptr ss:[ebp-0xA0]
002063FD    E8 5D510100     call httptest.0021B55F
00206402    8B95 60FFFFFF   mov edx,dword ptr ss:[ebp-0xA0]
00206408    E8 3B510100     call httptest.0021B548
0020640D    B8 01000000     mov eax,0x1
00206412    B9 08000000     mov ecx,0x8
00206417    91              xchg eax,ecx
00206418    E8 56CB0000     call httptest.00212F73
0020641D    BA 94462200     mov edx,httptest.00224694                ; 192.168.
00206422    E8 59520100     call httptest.0021B680
00206427    E8 943B0100     call httptest.00219FC0
0020642C    0F84 09010000   je httptest.0020653B
00206432    8B95 60FFFFFF   mov edx,dword ptr ss:[ebp-0xA0]
00206438    E8 0B510100     call httptest.0021B548
0020643D    B8 01000000     mov eax,0x1
00206442    B9 03000000     mov ecx,0x3
00206447    91              xchg eax,ecx
00206448    E8 26CB0000     call httptest.00212F73
0020644D    BA A4462200     mov edx,httptest.002246A4                ; 10.
00206452    E8 29520100     call httptest.0021B680
00206457    E8 643B0100     call httptest.00219FC0
0020645C    0F84 D9000000   je httptest.0020653B
00206462    8B95 60FFFFFF   mov edx,dword ptr ss:[ebp-0xA0]
00206468    E8 DB500100     call httptest.0021B548
0020646D    B8 01000000     mov eax,0x1
00206472    B9 04000000     mov ecx,0x4
00206477    91              xchg eax,ecx
00206478    E8 F6CA0000     call httptest.00212F73
0020647D    BA B0462200     mov edx,httptest.002246B0                ; 172.
00206482    E8 F9510100     call httptest.0021B680
00206487    E8 343B0100     call httptest.00219FC0
0020648C    0F85 38000000   jnz httptest.002064CA
00206492    8B95 60FFFFFF   mov edx,dword ptr ss:[ebp-0xA0]
00206498    E8 AB500100     call httptest.0021B548
0020649D    B9 05000000     mov ecx,0x5
002064A2    B8 02000000     mov eax,0x2
002064A7    E8 C7CA0000     call httptest.00212F73
002064AC    B8 01000000     mov eax,0x1
002064B1    E8 A5330100     call httptest.0021985B
002064B6    DF7D 94         fistp qword ptr ss:[ebp-0x6C]
002064B9    8B75 94         mov esi,dword ptr ss:[ebp-0x6C]
002064BC    83FE 10         cmp esi,0x10
002064BF    7E 09           jle Xhttptest.002064CA
002064C1    83FE 1F         cmp esi,0x1F
002064C4    0F8C 71000000   jl httptest.0020653B
002064CA    8B95 60FFFFFF   mov edx,dword ptr ss:[ebp-0xA0]
002064D0    E8 73500100     call httptest.0021B548
002064D5    BA BC462200     mov edx,httptest.002246BC                ; 127.0.0.1
002064DA    E8 A1510100     call httptest.0021B680
002064DF    E8 DC3A0100     call httptest.00219FC0
002064E4    0F84 51000000   je httptest.0020653B
002064EA    6A 00           push 0x0
002064EC    6A 00           push 0x0
002064EE    6A 40           push 0x40
002064F0    BA 88462200     mov edx,httptest.00224688                ; 提示
002064F5    E8 86510100     call httptest.0021B680
002064FA    8D5C24 08       lea ebx,dword ptr ss:[esp+0x8]
002064FE    E8 72380100     call httptest.00219D75
00206503    BA CC462200     mov edx,httptest.002246CC                ; 禁止对非私有IP测试!
00206508    E8 73510100     call httptest.0021B680
0020650D    8D5C24 08       lea ebx,dword ptr ss:[esp+0x8]
00206511    E8 5F380100     call httptest.00219D75
00206516    8B05 04362200   mov eax,dword ptr ds:[0x223604]
0020651C    50              push eax
0020651D    FF15 44672200   call dword ptr ds:[<&USER32.MessageBoxA>>; USER32.MessageBoxA

往上找到 002063E2  50   push eax下断 然后直接F8步过 ，第一个CALL需要暂停一下再运行才能到第二个CALL
一直到下面第一个大跳转处  0020642C   /0F84 09010000   je httptest.0020653B    把判断JE修改JMP
也可以不用在Push eax 处下断,直接在判断处下断也行.
修改好了第一处再F8就会到达

[Asm] 纯文本查看 复制代码

0020653B   |8D9D 60FFFFFF   lea ebx,dword ptr ss:[ebp-0xA0]
00206541   |E8 A3540100     call httptest.0021B9E9
00206546   |8BC3            mov eax,ebx
00206548   |50              push eax
00206549   |FF15 30682200   call dword ptr ds:[<&WS2_32.inet_addr>]  ; WS2_32.inet_addr
0020654F   |D96D F0         fldcw word ptr ss:[ebp-0x10]
00206552   |8905 F4392200   mov dword ptr ds:[0x2239F4],eax
00206558   |6A 00           push 0x0
0020655A   |8B05 F4392200   mov eax,dword ptr ds:[0x2239F4]
00206560   |50              push eax
00206561   |FF15 34682200   call dword ptr ds:[<&WS2_32.ntohl>]      ; WS2_32.ntohl
00206567   |D96D F0         fldcw word ptr ss:[ebp-0x10]
0020656A   |8BDC            mov ebx,esp
0020656C   |53              push ebx
0020656D   |8903            mov dword ptr ds:[ebx],eax
0020656F   |E8 C2040000     call httptest.00206A36
00206574   |83C4 04         add esp,0x4
00206577   |F7D0            not eax
00206579   |85C0            test eax,eax
0020657B   |74 05           je Xhttptest.00206582
0020657D   |E9 90040000     jmp httptest.00206A12
00206582   |66:C705 D43A220>mov word ptr ds:[0x223AD4],0x1
0020658B   |BA 38462200     mov edx,httptest.00224638                ; 最小耗时:
00206590   |E8 EB500100     call httptest.0021B680
00206595   |6A 00           push 0x0

一直F8到  0020657B   /74 05           je Xhttptest.00206582 处修改跳转为 jmp 00206582
即可爆破，超级简单的
我测试时习惯用上了论坛网站，然后ping了IP测试软件是否成功，没想到被限制了访问网站
现在我都是用的DL访问网站的，求解救啊 ！

额，貌似能访问论坛了！没限制？？？？

感谢楼主分享

感谢分享！

[吾爱汇编论坛52HB.COM]-很简单实用的教程，谢谢楼主。

不错不错，学习下

楼主辛苦了，谢谢分享!