cracker都使用过softice中d功能
比如d eax来看eax指向内存中是什么
不过
有些人可能不知道d功能远不止此如果需要看看eax指向
内存中其地址指向内存地址你会如何做？比如eax＝493576你d 493576发现那里内存是1A22D23于是你再d 1A22D23发现里面放是你注册名那么如何
次性地指向1A22D23呢？无论在softice或者trw2000中
都可以使用d *eax这个命令注意前面*就是它使得softice下子就知道你需要指向eax内存处指向地方此外
对于浮点运算很多cracker很头疼下面我举个例子如何使用d来简化我们工作让我们来看看Trojan Remover 4.2.9吧
在其注册中有这么段:016F:004B0531 LEA EAX,[EBP-18]
016F:004B0534 MOV EDI,EBX
016F:004B0536 MOV EDX,[EBP-04]
016F:004B0539 MOV DL,[EDX+EDI-01] <------ 序列号第个
016F:004B053D CALL `VCL30!
.@LStrFromChar@001FB870`
016F:004B0542 MOV EAX,[EBP-18]
016F:004B0545 CALL `VCL30!SysUtils.StrToInt@0F6FDFF6`
016F:004B054A CMP EAX,BYTE +02
016F:004B054D JNL 004B0593 <------ >=2
016F:004B054F LEA EAX,[EBP-18] <------ <2
016F:004B0552 MOV EDX,[EBP-04]
016F:004B0555 MOV DL,[EDX+EDI-01]
016F:004B0559 CALL `VCL30!.@LStrFromChar@001FB870`
016F:004B055E MOV EAX,[EBP-18]
016F:004B0561 CALL `VCL30!SysUtils.StrToInt@0F6FDFF6`
016F:004B0566 ADD EAX,BYTE +03
016F:004B0569 JNO 004B0570
016F:004B056B CALL `VCL30!.@IntOver@51F89FF7`
016F:004B0570 IMUL EAX,EAX,BYTE +51 <------ x51H 放到eax里
016F:004B0573 JNO 004B057A
016F:004B0575 CALL `VCL30!.@IntOver@51F89FF7`
016F:004B057A MOV EDI,EAX
016F:004B057C LEA EDX,[EBP-18]
016F:004B057F MOV EAX,EDI
016F:004B0581 CALL `VCL30!SysUtils.IntToStr@0F6FDFF6`
016F:004B0586 MOV EDX,[EBP-18]
016F:004B0589 LEA EAX,[EBP-08]
016F:004B058C CALL `VCL30!.@LStrCat@51F89FF7`
016F:004B0591 JMP SHORT 004B05CB
016F:004B0593 LEA EAX,[EBP-18]
016F:004B0596 MOV EDX,[EBP-04]
016F:004B0599 MOV DL,[EDX+EDI-01]
016F:004B059D CALL `VCL30!.@LStrFromChar@001FB870`
016F:004B05A2 MOV EAX,[EBP-18]
016F:004B05A5 CALL `VCL30!SysUtils.StrToInt@0F6FDFF6`
016F:004B05AA IMUL EAX,EAX,BYTE +2F
016F:004B05AD JNO 004B05B4
016F:004B05AF CALL `VCL30!.@IntOver@51F89FF7`
016F:004B05B4 MOV EDI,EAX
016F:004B05B6 LEA EDX,[EBP-18]
016F:004B05B9 MOV EAX,EDI
016F:004B05BB CALL `VCL30!SysUtils.IntToStr@0F6FDFF6`
016F:004B05C0 MOV EDX,[EBP-18]
016F:004B05C3 LEA EAX,[EBP-08]
016F:004B05C6 CALL `VCL30!.@LStrCat@51F89FF7`
016F:004B05CB INC EBX
016F:004B05CC DEC ESI
016F:004B05CD JNZ NEAR 004B0531
016F:004B05D3 MOV EAX,[EBP-08]
016F:004B05D6 CALL `VCL30!SysUtils.StrToFloat@044134E0`
016F:004B05DB FSTP TWORD [EBP-12] <---------- 记着打开softice浮点窗口
最新评论