难度：简单
算法：简单
使用工具： W32dasm v8.93
ollydbg v1.09b
PEID v0.8
AspackDie v1.4
首先用 PEID v0.8 看是 Aspack2.12 的壳，用 AspackDie v1.4 很快就脱掉壳了。
运行软件，输入相关信息 Name：Nnewell ，Code：4545454545123456789

:004631C6 8BC3 mov eax, ebx
:004631C8 E86F8DFEFF call 0044BF3C
:004631CD 33C9 xor ecx, ecx

* Possible StringData Ref from Code Obj ->"\software\**计费器"

:004631CF BA143B4600 mov edx, 00463B14
:004631D4 8BC3 mov eax, ebx
:004631D6 E8C58DFEFF call 0044BFA0
:004631DB 84C0 test al, al
:004631DD 740F je 004631EE
:004631DF 8D4DF8 lea ecx, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"UserName"

:004631E2 BA343B4600 mov edx, 00463B34
:004631E7 8BC3 mov eax, ebx
:004631E9 E87A8FFEFF call 0044C168

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:004631DD(C)

:004631EE 33C9 xor ecx, ecx

* Possible StringData Ref from Code Obj ->"\software\microsoft\Counter"

:004631F0 BA483B4600 mov edx, 00463B48
:004631F5 8BC3 mov eax, ebx
:004631F7 E8A48DFEFF call 0044BFA0
:004631FC 84C0 test al, al
:004631FE 741C je 0046321C
:00463200 8D4DF0 lea ecx, dword ptr [ebp-10]

* Possible StringData Ref from Code Obj ->"flag"

:00463203 BA6C3B4600 mov edx, 00463B6C
:00463208 8BC3 mov eax, ebx
:0046320A E8598FFEFF call 0044C168
:0046320F 8B55F0 mov edx, dword ptr [ebp-10]
:00463212 B8987F4600 mov eax, 00467F98
:00463217 E8E006FAFF call 004038FC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:004631FE(C)

:0046321C 8BC3 mov eax, ebx
:0046321E E8E98CFEFF call 0044BF0C
:00463223 8BC3 mov eax, ebx
:00463225 E86AFBF9FF call 00402D94
:0046322A 8B45F8 mov eax, dword ptr [ebp-08] <<--eax==Nnewell，取出用户名
:0046322D E8F208FAFF call 00403B24
:00463232 83F804 cmp eax, 00000004 <<--用户名是否大于4位
:00463235 7D0D jge 00463244
:00463237 8D45F8 lea eax, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"guest"

[1] [2] [3] [4] [5] [6] [7] 下一页

上一篇:变速精灵 XP 简体中文版注册分析上

下一篇:P-CODE算法分析----幼儿学语言