菜鸟求助,谁看的懂这几个37EXE加壳文件
E:\游戏\SANGO7\dbghelp.dll& & & & ::& & & & Microsoft Visual C++ 5.0
E:\游戏\SANGO7\SANGO7.BIN& & & & ::& & & & UPX 0.89.6 - 1.02 / 1.05 - 1.24 -& Markus & Laszlo
E:\游戏\SANGO7\SG7.dll& & & & ::& & & & Microsoft Visual C++ v7.1 DLL
E:\游戏\SANGO7\SG7.exe& & & & ::& & & & UPX 0.89.6 - 1.02 / 1.05 - 1.24 -& Markus & Laszlo [Overlay]
E:\游戏\SANGO7\unins000.exe& & & & ::& & & & Borland Delphi 2.0 [Overlay]
我什么都看不懂是用peit扫出来的,后面好象是些壳
据说好象用什么PE去掉他们
谁来看看啊~!
这是脱壳后EXE的文件,我先放上来等汇编的高手来修改!
[ 本帖最后由 清清风风 于
13:31 编辑 ]
(63.99 KB)
我找了个解壳软件upxsheel
大概把壳解掉了SG7.exe文件变成7.63M了?
后面不知道怎么改了
武秀才 校尉
回复 #2 清清风风 的帖子
坐等现成的！哪怕是消息也好！！
我只玩单机游戏
游戏网站：http://221.130.201.41/luntan/index.php
/forum/index.php
我好象成功进EXE文件了,不过里面都是些该死的代码看不懂啊
先放上段代码大家研究研究
反汇编文件: E:\游戏\SANGO7\SG7.exe
Code Offset = , Code Size = 00064A00
Data Offset = , Data Size = 00002A00
Number of Objects = 0004 (dec), Imagebase = h
& &Object01: .text& & RVA:
Size: 00064A00 Flags:
& &Object02: .rdata& &RVA:
Offset: 00064E00 Size:
& &Object03: .data& & RVA:
Size: 00002A00 Flags: C0000040
& &Object04: .rsrc& & RVA:
Offset: 00075A00 Size: 00002A00 Flags:
+++++++++++++++++++&&菜单信息 +++++++++++++++++++++++++
Number of Menus =& & 1 (decimal)
MenuID_00A6
& && &Context1 {Popup}
& && && &&&,俓-[P]&&[ID=00A7h]
& && && && &{Popup}
& && && && && && && &[ID=00A8h]
+++++++++++++++++ 对话框信息 ++++++++++++++++++++++++++
Number of Dialogs =& & 1 (decimal)
Name: DialogID_03E8, # of Controls=000, Caption:&?&, ClassName:&&
+++++++++++++++++++ 输入函数 ++++++++++++++++++++++++++++
Number of Imported Modules =& &13 (decimal)
& &Import Module 001: KERNEL32.DLL
& &Import Module 002: ADVAPI32.dll
& &Import Module 003: COMCTL32.dll
& &Import Module 004: comdlg32.dll
& &Import Module 005: GDI32.dll
& &Import Module 006: MPR.dll
& &Import Module 007: ole32.dll
& &Import Module 008: OLEAUT32.dll
& &Import Module 009: SHELL32.dll
& &Import Module 010: USER32.dll
& &Import Module 011: VERSION.dll
& &Import Module 012: WINMM.dll
& &Import Module 013: WSOCK32.dll
+++++++++++++++++++ 输入函数表 ++++++++++++++++++++++++++
& &Import Module 001: KERNEL32.DLL
Addr:0007231E hint(0000) Name: CopyFileW
Addr:0007232A hint(0000) Name: GetLastError
Addr: hint(0000) Name: CreateDirectoryW
Addr:0007234A hint(0000) Name: RemoveDirectoryW
Addr:0007235C hint(0000) Name: TerminateProcess
Addr:0007236E hint(0000) Name: WaitForSingleObject
Addr: hint(0000) Name: SetSystemPowerState
Addr:0007239A hint(0000) Name: SetFileTime
Addr: hint(0000) Name: FindResourceW
Addr: hint(0000) Name: GetFileAttributesW
Addr:000723CC hint(0000) Name: LoadResource
Addr:000723DA hint(0000) Name: FindFirstFileW
Addr:000723EA hint(0000) Name: LockResource
Addr: hint(0000) Name: FindClose
Addr: hint(0000) Name: SizeofResource
Addr: hint(0000) Name: EnumResourceNamesW
Addr: hint(0000) Name: DeleteFileW
Addr: hint(0000) Name: FindNextFileW
Addr: hint(0000) Name: lstrcmpiW
Addr: hint(0000) Name: MoveFileW
Addr:0007245E hint(0000) Name: OutputDebugStringW
Addr: hint(0000) Name: GetLocalTime
Addr: hint(0000) Name: MultiByteToWideChar
Addr: hint(0000) Name: WideCharToMultiByte
Addr:000724AC hint(0000) Name: GetModuleHandleA
Addr:000724BE hint(0000) Name: CompareStringW
Addr:000724CE hint(0000) Name: InterlockedIncrement
Addr: hint(0000) Name: InterlockedDecrement
Addr:000724FA hint(0000) Name: GetTempPathW
Addr: hint(0000) Name: GetTempFileNameW
Addr:0007251A hint(0000) Name: FormatMessageW
Addr:0007252A hint(0000) Name: GetExitCodeProcess
Addr:0007253E hint(0000) Name: DeviceIoControl
Addr: hint(0000) Name: GetPrivateProfileStringW
Addr:0007256A hint(0000) Name: WritePrivateProfileStringW
Addr: hint(0000) Name: GetPrivateProfileSectionW
Addr: hint(0000) Name: WritePrivateProfileSectionW
Addr: hint(0000) Name: SetFileAttributesW
Addr: hint(0000) Name: GetPrivateProfileSectionNamesW
Addr: hint(0000) Name: GetShortPathNameW
Addr: hint(0000) Name: FileTimeToLocalFileTime
Addr: hint(0000) Name: FileTimeToSystemTime
Addr: hint(0000) Name: SystemTimeToFileTime
Addr:0007264E hint(0000) Name: LocalFileTimeToFileTime
Addr: hint(0000) Name: GetDriveTypeW
Addr: hint(0000) Name: SetErrorMode
Addr: hint(0000) Name: GetDiskFreeSpaceW
Addr:0007269A hint(0000) Name: GetVolumeInformationW
Addr: hint(0000) Name: SetVolumeLabelW
Addr: hint(0000) Name: CreateFileW
Addr: hint(0000) Name: GlobalLock
Addr:000726DE hint(0000) Name: GlobalUnlock
Addr:000726EC hint(0000) Name: GlobalAlloc
Addr:000726FA hint(0000) Name: SetProcessWorkingSetSize
Addr: hint(0000) Name: GlobalMemoryStatus
Addr: hint(0000) Name: Beep
Addr:0007272E hint(0000) Name: GetFileSize
Addr:0007273C hint(0000) Name: GetEnvironmentVariableW
Addr: hint(0000) Name: SetEnvironmentVariableW
Addr: hint(0000) Name: GetCurrentProcessId
Addr: hint(0000) Name: GetComputerNameW
Addr: hint(0000) Name: GetWindowsDirectoryW
Addr:000727AE hint(0000) Name: GetSystemDirectoryW
Addr: hint(0000) Name: GetProcessIoCounters
Addr:000727DA hint(0000) Name: CreatePipe
Addr: hint(0000) Name: DuplicateHandle
Addr: hint(0000) Name: GetStdHandle
Addr: hint(0000) Name: CreateProcessW
Addr: hint(0000) Name: SetPriorityClass
Addr: hint(0000) Name: LoadLibraryW
Addr: hint(0000) Name: WriteFile
Addr: hint(0000) Name: GetFileType
Addr: hint(0000) Name: PeekNamedPipe
Addr: hint(0000) Name: SetLastError
Addr:0007286E hint(0000) Name: LoadLibraryExW
Addr:0007287E hint(0000) Name: GlobalFindAtomW
Addr: hint(0000) Name: ResumeThread
Addr:0007289E hint(0000) Name: GetSystemTimeAsFileTime
Addr: hint(0000) Name: CreateThread
Addr: hint(0000) Name: ExitThread
Addr: hint(0000) Name: HeapFree
Addr:000728DC hint(0000) Name: HeapAlloc
Addr: hint(0000) Name: ExitProcess
Addr: hint(0000) Name: GetACP
Addr:000728FE hint(0000) Name: GetOEMCP
Addr: hint(0000) Name: IsValidCodePage
Addr:0007291A hint(0000) Name: TlsGetValue
Addr: hint(0000) Name: TlsAlloc
Addr: hint(0000) Name: TlsSetValue
Addr: hint(0000) Name: TlsFree
Addr:0007294A hint(0000) Name: UnhandledExceptionFilter
Addr: hint(0000) Name: SetUnhandledExceptionFilter
Addr: hint(0000) Name: RaiseException
Addr: hint(0000) Name: GetModuleFileNameA
Addr: hint(0000) Name: DeleteCriticalSection
Addr:000729BE hint(0000) Name: InitializeCriticalSection
Addr:000729DA hint(0000) Name: HeapSize
Addr: hint(0000) Name: VirtualFree
Addr: hint(0000) Name: VirtualAlloc
Addr:00072A00 hint(0000) Name: HeapReAlloc
Addr:00072A0E hint(0000) Name: HeapDestroy
Addr:00072A1C hint(0000) Name: HeapCreate
Addr:00072A28 hint(0000) Name: SetFilePointer
Addr:00072A38 hint(0000) Name: ReadFile
Addr:00072A42 hint(0000) Name: ReadProcessMemory
Addr:00072A56 hint(0000) Name: WriteProcessMemory
Addr:00072A6A hint(0000) Name: MapViewOfFile
Addr:00072A7A hint(0000) Name: CreateFileMappingW
Addr:00072A8E hint(0000) Name: OpenProcess
Addr:00072A9C hint(0000) Name: UnmapViewOfFile
Addr:00072AAE hint(0000) Name: CloseHandle
Addr:00072ABC hint(0000) Name: QueryPerformanceFrequency
Addr:00072AD8 hint(0000) Name: QueryPerformanceCounter
Addr:00072AF2 hint(0000) Name: GetModuleHandleW
Addr:00072B04 hint(0000) Name: GetSystemInfo
Addr:00072B14 hint(0000) Name: GetCurrentProcess
Addr:00072B28 hint(0000) Name: GetVersionExW
Addr:00072B38 hint(0000) Name: GetCurrentThreadId
Addr:00072B4C hint(0000) Name: Sleep
Addr:00072B54 hint(0000) Name: GetProcAddress
Addr:00072B64 hint(0000) Name: LoadLibraryA
Addr:00072B72 hint(0000) Name: RtlUnwind
Addr:00072B7E hint(0000) Name: GetConsoleCP
Addr:00072B8C hint(0000) Name: GetConsoleMode
Addr:00072B9C hint(0000) Name: FreeLibrary
Addr:00072BAA hint(0000) Name: GetModuleFileNameW
Addr:00072BBE hint(0000) Name: GetFullPathNameW
Addr:00072BD0 hint(0000) Name: SetCurrentDirectoryW
Addr:00072BE6 hint(0000) Name: GetCurrentDirectoryW
Addr:00072BFC hint(0000) Name: EnterCriticalSection
Addr:00072C12 hint(0000) Name: LeaveCriticalSection
Addr:00072C28 hint(0000) Name: GetVersionExA
Addr:00072C38 hint(0000) Name: GetProcessHeap
Addr:00072C48 hint(0000) Name: GetStartupInfoW
Addr:00072C5A hint(0000) Name: SetHandleCount
Addr:00072C6A hint(0000) Name: GetStartupInfoA
Addr:00072C7C hint(0000) Name: SetStdHandle
Addr:00072C8A hint(0000) Name: GetCPInfo
Addr:00072C96 hint(0000) Name: FlushFileBuffers
Addr:00072CA8 hint(0000) Name: LCMapStringA
Addr:00072CB6 hint(0000) Name: LCMapStringW
Addr:00072CC4 hint(0000) Name: GetTimeZoneInformation
Addr:00072CDC hint(0000) Name: FreeEnvironmentStringsA
Addr:00072CF6 hint(0000) Name: GetEnvironmentStrings
Addr:00072D0E hint(0000) Name: FreeEnvironmentStringsW
Addr:00072D28 hint(0000) Name: GetEnvironmentStringsW
Addr:00072D40 hint(0000) Name: GetCommandLineA
Addr:00072D52 hint(0000) Name: GetCommandLineW
Addr:00072D64 hint(0000) Name: GetTickCount
Addr:00072D72 hint(0000) Name: GetStringTypeA
Addr:00072D82 hint(0000) Name: GetStringTypeW
Addr:00072D92 hint(0000) Name: GetLocaleInfoA
Addr:00072DA2 hint(0000) Name: WriteConsoleA
Addr:00072DB2 hint(0000) Name: GetConsoleOutputCP
Addr:00072DC6 hint(0000) Name: WriteConsoleW
Addr:00072DD6 hint(0000) Name: CreateFileA
Addr:00072DE4 hint(0000) Name: SetEndOfFile
Addr:00072DF2 hint(0000) Name: CompareStringA
Addr:00072E02 hint(0000) Name: GlobalFree
Addr:00072E0E hint(0000) Name: SetEnvironmentVariableA
& &Import Module 002: ADVAPI32.dll
Addr:00072E28 hint(0000) Name: RegEnumValueW
Addr:00072E38 hint(0000) Name: RegDeleteValueW
Addr:00072E4A hint(0000) Name: RegDeleteKeyW
Addr:00072E5A hint(0000) Name: RegSetValueExW
Addr:00072E6A hint(0000) Name: RegCreateKeyExW
Addr:00072E7C hint(0000) Name: GetUserNameW
Addr:00072E8A hint(0000) Name: RegConnectRegistryW
Addr:00072EA0 hint(0000) Name: RegEnumKeyExW
Addr:00072EB0 hint(0000) Name: AdjustTokenPrivileges
Addr:00072EC8 hint(0000) Name: LookupPrivilegeValueW
Addr:00072EE0 hint(0000) Name: OpenProcessToken
Addr:00072EF2 hint(0000) Name: CloseServiceHandle
Addr:00072F06 hint(0000) Name: UnlockServiceDatabase
Addr:00072F1E hint(0000) Name: LockServiceDatabase
Addr:00072F34 hint(0000) Name: OpenSCManagerW
Addr:00072F44 hint(0000) Name: RegCloseKey
Addr:00072F52 hint(0000) Name: RegQueryValueExW
Addr:00072F64 hint(0000) Name: RegOpenKeyExW
& &Import Module 003: COMCTL32.dll
Addr:00072F74 hint(0000) Name: ImageList_BeginDrag
Addr:00072F8A hint(0000) Name: ImageList_SetDragCursorImage
Addr:00072FA8 hint(0000) Name: ImageList_EndDrag
Addr:00072FBC hint(0000) Name: ImageList_DragLeave
Addr:00072FD2 hint(0000) Name: ImageList_DragMove
Addr:00072FE6 hint(0000) Name: ImageList_DragEnter
Addr:00072FFC hint(0000) Name: ImageList_Destroy
Addr: hint(0000) Name: ImageList_ReplaceIcon
Addr: hint(0000) Name: ImageList_Create
Addr:0007303A hint(0000) Name: InitCommonControlsEx
Addr: hint(0000) Name: ImageList_Remove
& &Import Module 004: comdlg32.dll
Addr: hint(0000) Name: GetSaveFileNameW
Addr: hint(0000) Name: GetOpenFileNameW
& &Import Module 005: GDI32.dll
Addr: hint(0000) Name: ExtCreatePen
Addr: hint(0000) Name: StrokeAndFillPath
Addr: hint(0000) Name: StrokePath
Addr: hint(0000) Name: EndPath
Addr:000730BE hint(0000) Name: SetPixel
Addr: hint(0000) Name: CloseFigure
Addr: hint(0000) Name: SetBkColor
Addr: hint(0000) Name: CreatePen
Addr:000730EE hint(0000) Name: CreateSolidBrush
Addr: hint(0000) Name: SetTextColor
Addr:0007310E hint(0000) Name: GetObjectW
Addr:0007311A hint(0000) Name: PolyBezierTo
Addr: hint(0000) Name: SetViewportOrgEx
Addr:0007313A hint(0000) Name: Rectangle
Addr: hint(0000) Name: BeginPath
Addr: hint(0000) Name: PolyDraw
Addr:0007315C hint(0000) Name: Ellipse
Addr: hint(0000) Name: MoveToEx
Addr: hint(0000) Name: AngleArc
Addr:0007317A hint(0000) Name: LineTo
Addr: hint(0000) Name: SetBkMode
Addr:0007318E hint(0000) Name: RoundRect
Addr:0007319A hint(0000) Name: CreateCompatibleBitmap
Addr: hint(0000) Name: GetPixel
Addr:000731BC hint(0000) Name: DeleteDC
Addr: hint(0000) Name: GetDIBits
Addr: hint(0000) Name: BitBlt
Addr:000731DA hint(0000) Name: SelectObject
Addr: hint(0000) Name: CreateDIBSection
Addr:000731FA hint(0000) Name: CreateCompatibleDC
Addr:0007320E hint(0000) Name: CreateFontW
Addr:0007321C hint(0000) Name: GetDeviceCaps
Addr:0007322C hint(0000) Name: GetTextFaceW
Addr:0007323A hint(0000) Name: GetStockObject
Addr:0007324A hint(0000) Name: CreateDCW
Addr: hint(0000) Name: GetTextExtentPoint32W
Addr:0007326E hint(0000) Name: DeleteObject
& &Import Module 006: MPR.dll
Addr:0007327C hint(0000) Name: WNetUseConnectionW
Addr: hint(0000) Name: WNetGetConnectionW
Addr: hint(0000) Name: WNetAddConnection2W
Addr:000732BA hint(0000) Name: WNetCancelConnection2W
& &Import Module 007: ole32.dll
Addr: hint(0000) Name: OleSetMenuDescriptor
Addr: hint(0000) Name: MkParseDisplayName
Addr:000732FC hint(0000) Name: OleSetContainedObject
Addr: hint(0000) Name: CoCreateInstance
Addr: hint(0000) Name: CoInitialize
Addr: hint(0000) Name: CoUninitialize
Addr: hint(0000) Name: CreateStreamOnHGlobal
Addr:0007335C hint(0000) Name: CoInitializeSecurity
Addr: hint(0000) Name: CoCreateInstanceEx
Addr: hint(0000) Name: CoSetProxyBlanket
Addr:0007339A hint(0000) Name: StringFromCLSID
Addr:000733AC hint(0000) Name: OleUninitialize
Addr:000733BE hint(0000) Name: CoTaskMemAlloc
Addr:000733CE hint(0000) Name: CoTaskMemFree
Addr:000733DE hint(0000) Name: IIDFromString
Addr:000733EE hint(0000) Name: StringFromIID
Addr:000733FE hint(0000) Name: CLSIDFromString
Addr: hint(0000) Name: OleInitialize
Addr: hint(0000) Name: CreateBindCtx
Addr: hint(0000) Name: CLSIDFromProgID
& &Import Module 008: OLEAUT32.dll
Addr: hint(00A2) Name: CLSIDFromProgID
Addr: hint(0026) Name: CLSIDFromProgID
Addr: hint(0027) Name: CLSIDFromProgID
Addr: hint(0025) Name: CLSIDFromProgID
Addr: hint(0029) Name: CLSIDFromProgID
Addr: hint(0002) Name: CLSIDFromProgID
Addr: hint(01A2) Name: CLSIDFromProgID
Addr: hint(0018) Name: CLSIDFromProgID
Addr: hint(0017) Name: CLSIDFromProgID
Addr: hint(00D8) Name: CLSIDFromProgID
Addr: hint(00B9) Name: CLSIDFromProgID
Addr: hint(0008) Name: CLSIDFromProgID
Addr: hint(0009) Name: CLSIDFromProgID
Addr:8000000A hint(000A) Name: CLSIDFromProgID
Addr: hint(0023) Name: CLSIDFromProgID
& &Import Module 009: SHELL32.dll
Addr: hint(0000) Name: DragQueryPoint
Addr: hint(0000) Name: ShellExecuteExW
Addr: hint(0000) Name: DragQueryFileW
Addr: hint(0000) Name: SHBrowseForFolderW
Addr: hint(0000) Name: SHGetPathFromIDListW
Addr:0007349E hint(0000) Name: SHGetDesktopFolder
Addr: hint(0000) Name: SHGetMalloc
Addr: hint(0000) Name: SHFileOperationW
Addr: hint(0000) Name: ExtractIconExW
Addr: hint(0000) Name: Shell_NotifyIconW
Addr: hint(0000) Name: ShellExecuteW
Addr: hint(0000) Name: DragFinish
& &Import Module 010: USER32.dll
武秀才 校尉
回复 #5 清清风风 的帖子
这些MS都是媒体平台的联接！！！！
在往后面的看看！
我只玩单机游戏
游戏网站：http://221.130.201.41/luntan/index.php
/forum/index.php
太长了只能放一小段上来,先看看吧
+++++++++++++++++++++++++ 汇编代码列表+++++++++++++++++++
//************************ 代码开始 .text ***************
Program Entry Point = 0045372D (E:\游戏\SANGO7\SG7.exe File Offset:000B852D)
:E8A74800& && && && &&&mov ecx,
:ADD20000& && && && &&&call
:C0& && && && && && &&&xor eax, eax
:0040100C A3F8854700& && && && &&&mov dword ptr [], eax
:F4854700& && && && &&&mov dword ptr [], eax
:E0854700& && && && &&&mov dword ptr [], eax
:0040101B A3DC854700& && && && &&&mov dword ptr [004785DC], eax
:D8854700& && && && &&&mov dword ptr [], eax
:F0854700& && && && &&&mov dword ptr [], eax
:0040102A A3EC854700& && && && &&&mov dword ptr [004785EC], eax
:0040102F A3E8854700& && && && &&&mov dword ptr [], eax
:E4854700& && && && &&&mov dword ptr [], eax
:BE854700& && && && &&&mov byte ptr [004785BE], al
:0040103E A2FEA94800& && && && &&&mov byte ptr [0048A9FE], al
:E4A74800& && && && &&&mov byte ptr [], al
:C0854700& && && && &&&mov byte ptr [], al
:0040104D A2BD854700& && && && &&&mov byte ptr [004785BD], al
:BC854700& && && && &&&mov byte ptr [004785BC], al
:BB854700& && && && &&&mov byte ptr [004785BB], al
:0040105C A2BA854700& && && && &&&mov byte ptr [004785BA], al
:B9854700& && && && &&&mov byte ptr [], al
:B8854700& && && && &&&mov byte ptr [], al
:0040106B A3D4A74800& && && && &&&mov dword ptr [], eax
:5E0A0& & mov dword ptr [],
:0040107A C605BF& && && & mov byte ptr [004785BF], 01
:D0A74800& && && && &&&mov eax,
:& && && && && && && & ret
* Referenced by a CALL at Address:
|:004019FA& &
:& && && && && && && & push ebp
:BEC& && && && && && &&&mov ebp, esp
:EC& && && && &sub esp,
:& && && && && && && & push edi
:D85E4FDFFFF& && && && &lea eax, dword ptr [ebp+FFFFFDE4]
:& && && && && && && & push eax
: BF& && && && &&&mov edi,
:& && && && && && && & push edi
:0040109E C645FE00& && && && && & mov [ebp-02], 00
: C645FF00& && && && && & mov [ebp-01], 00
* Reference To: KERNEL32.GetCurrentDirectoryW, Ord:0000h
& && && && && && && && && && && & |
: FF& && && && &Call dword ptr []
:004010AC FF7508& && && && && && &push [ebp+08]
:004010AF E& && && && &&&call
: E8D5D10000& && && && &&&call 0040E28E
: 85C0& && && && && && &&&test eax, eax
:004010BB 7419& && && && && && &&&je
:004010BD 6A10& && && && && && &&&push
:004010BF & && && && &&&push 0046AD86
: & && && && &&&push 0046AD88
: 6A00& && && && && && &&&push
* Reference To: USER32.MessageBoxA, Ord:0000h
& && && && && && && && && && && & |
:004010CB FF& && && && &Call dword ptr []
: E9DA010000& && && && &&&jmp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010BB(C)
: 833DE0A7480000& && && & cmp dword ptr [],
:004010DD 53& && && && && && && & push ebx
:004010DE 56& && && && && && && & push esi
:004010DF BBF4A74800& && && && &&&mov ebx,
: 7520& && && && && && &&&jne
: 6AFF& && && && && && &&&push FFFFFFFF
: FF35E8A74800& && && && &push dword ptr []
:004010EE BE98C84800& && && && &&&mov esi,
: 6A01& && && && && && &&&push
: E8CE530000& && && && &&&call
:004010FA A0BC854700& && && && &&&mov al, byte ptr [004785BC]
:004010FF A29AC84800& && && && &&&mov byte ptr [0048C89A], al
: EB4E& && && && && && &&&jmp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:D45FE& && && && && && &lea eax, dword ptr [ebp-02]
:& && && && && && && & push eax
:E0A74800& && && && &&&push
:BF3& && && && && && &&&mov esi, ebx
:8C84800& && && && &&&mov eax,
:75A0000& && && && &&&call 00406B22
:C0& && && && && && &&&test al, al
:0F& && && && && && &&&jne 0040112E
:0040111F C705D000& & mov dword ptr [],
:3010000& && && && &&&jmp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040111D(C)
:0040112E A098C84800& && && && &&&mov al, byte ptr []
:E4A74800& && && && &&&mov byte ptr [], al
:9C84800& && && && &&&mov al, byte ptr []
:DCA74800& && && && &&&push 0048A7DC
:5FF& && && && && && &mov byte ptr [ebp-01], al
:D85D8FBFFFF& && && && &lea eax, dword ptr [ebp+FFFFFBD8]
:& && && && && && && & push eax
:& && && && && && && & push edi
:& && && && && && && & push ebx
* Reference To: KERNEL32.GetFullPathNameW, Ord:0000h
& && && && && && && && && && && & |
:0040114E FF150C634600& && && && &Call dword ptr [0046630C]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
: FF35E0A74800& && && && &push dword ptr []
:& && && && && && && & push ebx
:0040115B E86B810100& && && && &&&call 004192CB
:C0& && && && && && &&&test eax, eax
:6& && && && && && &&&je 0040118A
: BF98C84800& && && && &&&mov edi,
:6550000& && && && &&&call
:D85E4FDFFFF& && && && &lea eax, dword ptr [ebp+FFFFFDE4]
:& && && && && && && & push eax
* Reference To: KERNEL32.SetCurrentDirectoryW, Ord:0000h
& && && && && && && && && && && & |
: FF& && && && &Call dword ptr []
:0040117B C705D000& & mov dword ptr [],
:4010000& && && && &&&jmp 004012AE
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:7DFF01& && && && && & cmp byte ptr [ebp-01], 01
:F85A8000000& && && && &jne 0040123C
:DB5A7480001& && && & cmp byte ptr [], 01
:F859B000000& && && && &jne 0040123C
: E8D2C70000& && && && &&&call
: 84C0& && && && && && &&&test al, al
: 0F858E000000& && && && &jne 0040123C
:004011AE 57& && && && && && && & push edi
:004011AF 8D85D8FBFFFF& && && && &lea eax, dword ptr [ebp+FFFFFBD8]
: 50& && && && && && && & push eax
: 6A00& && && && && && &&&push
* Reference To: KERNEL32.GetModuleFileNameW, Ord:0000h
& && && && && && && && && && && & |
: FF& && && && &Call dword ptr []
:004011BE 807DFE00& && && && && & cmp byte ptr [ebp-02], 00
: 7451& && && && && && &&&je
: BFF0AD4600& && && && &&&mov edi, 0046ADF0
: 57& && && && && && && & push edi
:004011CA 8D75F0& && && && && && &lea esi, dword ptr [ebp-10]
:004011CD E811D10000& && && && &&&call
: 53& && && && && && && & push ebx
: 8BC6& && && && && && &&&mov eax, esi
: E804D30000& && && && &&&call 0040E4DE
:004011DA 57& && && && && && && & push edi
:004011DB 8BC6& && && && && && &&&mov eax, esi
:004011DD E8FCD20000& && && && &&&call 0040E4DE
: 6A01& && && && && && &&&push
: 8D85E4FDFFFF& && && && &lea eax, dword ptr [ebp+FFFFFDE4]
:004011EA 50& && && && && && && & push eax
:004011EB FF75F0& && && && && && &push [ebp-10]
:004011EE 8D85D8FBFFFF& && && && &lea eax, dword ptr [ebp+FFFFFBD8]
: 50& && && && && && && & push eax
: 68F4AD4600& && && && &&&push 0046ADF4
* Reference To: USER32.GetForegroundWindow, Ord:0000h
& && && && && && && && && && && & |
:004011FA FF15F4654600& && && && &Call dword ptr []
:& && && && && && && & push eax
* Reference To: SHELL32.ShellExecuteW, Ord:0000h
& && && && && && && && && && && & |
: FF& && && && &Call dword ptr []
: FF75F0& && && && && && &push [ebp-10]
:0040120A E837D10400& && && && &&&call
:& && && && && && && & pop ecx
:2000000& && && && &&&jmp
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:A01& && && && && && &&&push
:D85E4FDFFFF& && && && &lea eax, dword ptr [ebp+FFFFFDE4]
:& && && && && && && & push eax
:0040121E FF7508& && && && && && &push [ebp+08]
:D85D8FBFFFF& && && && &lea eax, dword ptr [ebp+FFFFFBD8]
:& && && && && && && & push eax
:F4AD4600& && && && &&&push 0046ADF4
* Reference To: USER32.GetForegroundWindow, Ord:0000h
& && && && && && && && && && && & |
:0040122D FF15F4654600& && && && &Call dword ptr []
:& && && && && && && & push eax
* Reference To: SHELL32.ShellExecuteW, Ord:0000h
& && && && && && && && && && && & |
: FF& && && && &Call dword ptr []
:0040123A EB5B& && && && && && &&&jmp
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040118E(C), :0040119B(C), :(C)
:0040123C E& && && && &&&call
:2010000& && && && &&&call
:DE4A7480000& && && & cmp byte ptr [], 00
:0A& && && && && && &&&jne
:0040124F BF40B24800& && && && &&&mov edi,
:D68C0000& && && && &&&call 00409F2F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040124D(C)
:A01& && && && && && &&&push
:0040125B B800AA4800& && && && &&&mov eax, 0048AA00
:C8810100& && && && &&&call 0041942D
:DE4A7480000& && && & cmp byte ptr [], 00
:29& && && && && && &&&jne
:0040126E BF64C04800& && && && &&&mov edi,
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:B37& && && && && && &&&mov esi, dword ptr [edi]
:F6& && && && && && &&&test esi, esi
:3& && && && && && &&&je 0040128C
: FF7608& && && && && && &push [esi+08]
:0040127C E8C5D00400& && && && &&&call
:& && && && && && && & push esi
:BFD00400& && && && &&&call
:700& && && && && && &and dword ptr [edi],
:& && && && && && && & pop ecx
:& && && && && && && & pop ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:C704& && && && && && &add edi,
:FF80C84800& && && && &cmp edi,
:CDC& && && && && && &&&jl
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:(U), :0040123A(U), :0040126C(C)
: BF98C84800& && && && &&&mov edi,
:0040129C E8F3530000& && && && &&&call
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
: 8D85E4FDFFFF& && && && &lea eax, dword ptr [ebp+FFFFFDE4]
: 50& && && && && && && & push eax
* Reference To: KERNEL32.SetCurrentDirectoryW, Ord:0000h
& && && && && && && && && && && & |
: FF& && && && &Call dword ptr []
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
:004012AE 5E& && && && && && && & pop esi
:004012AF 5B& && && && && && && & pop ebx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
: 5F& && && && && && && & pop edi
: C9& && && && && && && & leave
: C20400& && && && && && &ret 0004
* Referenced by a CALL at Address:
|:0040123C& &
: 55& && && && && && && & push ebp
: 8BEC& && && && && && &&&mov ebp, esp
: 83EC34& && && && && && &sub esp,
:004012BB 53& && && && && && && & push ebx
:004012BC 56& && && && && && && & push esi
:004012BD 57& && && && && && && & push edi
:004012BE 6A0F& && && && && && &&&push 0000000F
* Reference To: USER32.GetSysColorBrush, Ord:0000h
& && && && && && && && && && && & |
: FF15F0654600& && && && &Call dword ptr []
: & && && && &&&push 00007F00
:004012CB 33DB& && && && && && &&&xor ebx, ebx
:004012CD 53& && && && && && && & push ebx
:004012CE 8BF8& && && && && && &&&mov edi, eax
* Reference To: USER32.LoadCursorW, Ord:0000h
& && && && && && && && && && && & |
: FF15EC654600& && && && &Call dword ptr [004665EC]
* Reference To: USER32.LoadIconW, Ord:0000h
& && && && && && && && && && && & |
: 8B35E8654600& && && && &mov esi, dword ptr []
* Possible Reference to String Resource ID=00161: &&If& ?舺& & & & &
& && && && && && && && && && && & |
:004012DC 68A1000000& && && && &&&push
: FF& && && && &push dword ptr []
: 8945FC& && && && && && &mov dword ptr [ebp-04], eax
:004012EA FFD6& && && && && && &&&call esi
* Possible Reference to String Resource ID=00164: &
& && && && && && && && && && && & |
:004012EC 68A4000000& && && && &&&push
: FF& && && && &push dword ptr []
: A3D0A74800& && && && &&&mov dword ptr [], eax
:004012FC FFD6& && && && && && &&&call esi
:004012FE 381DB1A74800& && && && &cmp byte ptr [], bl
:D8A74800& && && && &&&mov dword ptr [], eax
:D& && && && && && &&&jne
:1DBFA74800& && && && &cmp byte ptr [0048A7BF], bl
:5& && && && && && &&&jne
:A04& && && && && && &&&push
:& && && && && && && & pop eax
: EB03& && && && && && &&&jmp 0040131B
来自 过去，站在今天，走向未来 ... ... . ...
回复 #7 清清风风 的帖子
加油，很有前图的说！！
三国英豪难胜数
长风吹处烟云消
把唯一精华挂在屁股上[嘿嘿嘿]
Delphi2.0~~
光看汇编还是有点眼晕~~~~
谁懂汇编或者提供个教程给我都行
我现在有时间可以研究下
现在对着一堆代码无从下手...
[ 本帖最后由 清清风风 于
19:51 编辑 ]
我懂点~~~但是要教你是不可能的~~~~
不了解计算机的机理和你说再多也白搭~
那你有时间么把这个EXE的程序代码看下好么?
可以的话帮我们修改下万分感谢!!
(韓雲水羽)
~§一满盒的月光§~呼風喚雨 召喚法師天師道 俗家弟子
金钱 12890
来自 亲热天堂
很好，完全的看不懂的说~~~~~~~
坐着等成果~~~~~~~~~~~·
韓,井上的木欄
雲,地氣上為雲,山川氣也.雲根(古人認為雲從山石中產生)雲翻雨覆(比喻反復不定)
水,積陰之寒氣為水.五行一曰水.星名,水宿.凖也.北方之行.象眾水並流,中有微陽之氣也.凡水之屬皆從水.
羽,羽蟲三百六十,而鳳為之長.羽族(泛指鳥類)羽翔(首翼色青的鸞鳥)
我只是知道点汇编,要我看程序我还需要修炼2年~
晕倒那偶们只有坐着等成果拉..
& & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &
game.ali213.net
我们每天在进步
游侠游戏社区
当前时区 GMT+8, 现在时间是
Powered by