\u6df1\u5ea6\u603b\u7ed3\u5404\u79cd\u8bed\u8a00\u6309\u7ebd\u4e8b\u4ef6\u7684\u627e\u6cd5<\/title><\/head><body><\/p>\n<h1 style=\"display:none\">\u6df1\u5ea6\u603b\u7ed3\u5404\u79cd\u8bed\u8a00\u6309\u7ebd\u4e8b\u4ef6\u7684\u627e\u6cd5<\/h1>\n<div>\n\u8c03\u8bd5\u8f6f\u4ef6,\u6700\u91cd\u8981\u7684\u5c31\u662f\u4e0b\u65ad\u70b9,\u90a3\u4e48\u5982\u4f55\u4e0b\u65ad\u70b9,\u5c31\u662f\u4e00\u95e8\u91cd\u8981\u7684\u6280\u5de7.<\/span> \u6bd4\u5982:\u5f39\u63d0\u793a\u6846,\u5c31\u4e0bMessageBoxA,\u6ce8\u518c\u8868\u7684,\u5c31\u4e0bRegOpenKeyA\u7b49\u7b49.<\/span> \u5f53\u7136,\u80fd\u76f4\u63a5\u4e0b\u5230\u6309\u7ebd\u4e8b\u4ef6,\u5f53\u7136\u66f4\u4e3a\u65b9\u4fbf,\u56e0\u4e3a\u5230\u4e86\u6309\u7ebd\u4e8b\u4ef6\u540e,\u5f88\u5feb\u5c31\u4f1a\u5230\u8fbe\u6838\u5fc3\u4ee3\u7801,\u79bb\u4f60\u7684\u7834\u89e3\u4e5f\u5c31\u4e0d\u8fdc\u4e86.<\/span> \u672c\u6587\u5c31\u603b\u7ed3\u4e00\u4e0b\u5404\u7c7b\u8bed\u8a00\u627e\u6309\u7ebd\u4e8b\u4ef6\u7684\u65b9\u6cd5,\u5f53\u7136\u4e5f\u53ef\u4ee5\u501f\u52a9\u5de5\u5177,\u5982VBexplorer,DEDE,ECE\u7b49\u7b49.<\/span><\/p>\n\u4e00\u3001VB\u7a0b\u5e8f<\/span> \u5176\u5b9e,VB\u7684\u6309\u7ebd\u4e8b\u4ef6\u7684\u627e\u6cd5\u662f\u6700\u4e3a\u666e\u904d\u7684,\u4e5f\u5c31\u662f\u5927\u5bb6\u6240\u8c13\u7684\u4e07\u80fd\u65ad\u70b9.\u5176\u5b9e\u4e5f\u4e0d\u4ec5\u4ec5\u662f\u9488\u5bf9\u6309\u7ebd\u4e8b\u4ef6,\u8fd8\u6709\u5f88\u591a\u5176\u4ed6\u7684\u7528\u5904,\u5982\u53d6\u6d88NAG,\u542f\u52a8\u6846,\u7070\u8272\u6309\u7ebd\u6216\u9690\u85cf\u6309\u7ebd,\u542f\u52a8\u65f6\u7684timer\u4e8b\u4ef6\u7b49\u7b49,\u5177\u4f53\u7684\u5c31\u81ea\u5df1\u53bb\u603b\u7ed3\u5427,\u8fd9\u91cc\u53ea\u6f14\u793a\u6309\u7ebd\u4e8b\u4ef6!<\/span><\/p>\nOD\u8f7d\u5165\u540e,CTRL+B,816C24<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/d8642b2c89b11179359bf743.jpg\" width=\"438\" height=\"263\" small=\"0\"><\/span><\/p>\n\u786e\u5b9a\u540e,\u5c31\u4f1a\u6765\u5230\u4e0b\u56fe\u5904:<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/eb7ef5f3dd8aaa5eb17ec543.jpg\" width=\"568\" height=\"354\" small=\"0\"><\/span><\/p>\n\u7136\u540e,\u5c31\u5728\u4e0b\u9762\u7684JMP\u5904F2\u4e0b\u65ad,\u4e0b\u5b8c\u540eCTRL+L,\u5982\u679c\u8fd8\u6709,\u5c31\u7ee7\u7eed\u4e0b\u65ad\u70b9.<\/span><\/p>\n\u4e0b\u5b8c\u65ad\u70b9\u540e,\u8fd0\u884c\u7a0b\u5e8f,\u70b9\u51fb\u76f8\u5e94\u7684\u6309\u7ebd,OD\u5c31\u4f1a\u65ad\u4e0b\u6765\u4e86<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/ecda38d0a2b580759a502743.jpg\" width=\"607\" height=\"349\" small=\"0\"><\/span><\/p>\n\u4e0b\u9762\u7684\u4efb\u52a1\u5c31\u662f\u8003\u9a8c\u5927\u5bb6\u7684\u8010\u5fc3,F8\u8ddf\u8e2a\u5427,\u4e0d\u518d\u8d58\u8ff0\u4e86.<\/span><\/p>\n\u5f53\u7136,\u4e3a\u4e86\u65b9\u4fbf\u5927\u5bb6,\u53ef\u4ee5\u5199\u4e2a\u7b80\u5355\u7684\u811a\u672c,\u514d\u7684\u6bcf\u6b21\u90fd\u53bb\u624b\u52a8\u8bbe\u7f6e\u4e86,\u8282\u7701\u65f6\u95f4:<\/span><\/p>\n\u7a0b\u5e8f\u4ee3\u7801<\/span> var Addr<\/span> mov Addr,401000<\/span> loop:<\/span> find Addr,#816C2404??000000#<\/span> cmp $RESULT,0<\/span> je Exit<\/span> add $RESULT,08<\/span> bp $RESULT<\/span> add $RESULT,1<\/span> mov Addr,$RESULT<\/span> jmp loop<\/span> Exit:<\/span> eval “\u6309\u7ebd\u4e8b\u4ef6\u67e5\u627e\u5b8c\u6bd5!”<\/span> msg $RESULT<\/span> ret<\/span><\/p>\n\u4e8c\u3001Delphi\u548cBC++\u7a0b\u5e8f<\/span><\/p>\nDelphi\u548cBC++\u90fd\u662f\u540c\u4e00\u516c\u53f8\u5f00\u53d1\u7684,\u6545\u67e5\u627e\u65b9\u6cd5\u90fd\u4e00\u6837,\u5f53\u7136\u4f60\u4e5f\u53ef\u4ee5\u4f7f\u7528DEDE.<\/span><\/p>\nOD\u8f7d\u5165\u540e,CTRL+G,\u8f6c\u523000401000\u5904<\/span> \u7136\u540e\u5c31CTRL+B,\u67e5\u627e\u7279\u5f81\u7801740E8BD38B83????????FF93????????<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/9713b73914cb768fd4622543.jpg\" width=\"510\" height=\"348\" small=\"0\"><\/span><\/p>\n\u7136\u540e\u5c31\u4f1a\u627e\u5230\u4e0b\u9762\u7684\u5730\u65b9:<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/1553d3c5b241b88638db4943.jpg\" width=\"558\" height=\"343\" small=\"0\"><\/span><\/p>\n\u7136\u540e\u5c31\u5728\u4e0b\u9762\u7684CALL\u5904\u4e0b\u65ad\u5427.<\/span><\/p>\n\u4e0b\u9762\u7684\u5de5\u4f5c\u5c31\u662f\u4e0d\u65ad\u7684CTRL+L\u7ee7\u7eed\u67e5\u627e\u548cF2\u4e0b\u65ad\u4e86.<\/span><\/p>\n\u8fd0\u884c\u4e0b\u770b\u770b\u6548\u679c\u5427:<\/span><\/p>\n<img decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/32bfb700450ccf4e728da54c.jpg\" small=\"0\"><\/span><\/p>\n\u770b,\u65ad\u4e0b\u4e86\u5427,\u4e0b\u9762\u5c31F7\u8ddf\u8fdb\u8fd9\u4e2aCALL\u5427,\u5c31\u6765\u5230\u8fd9\u4e2a\u6309\u7ebd\u4e8b\u4ef6\u5904\u4e86.<\/span><\/p>\n\u540c\u6837\u5199\u4e2a\u811a\u672c,\u65b9\u4fbf\u5927\u5bb6\u64cd\u4f5c:<\/span><\/p>\n\u7a0b\u5e8f\u4ee3\u7801<\/span> var Addr<\/span> mov Addr,401000<\/span> loop:<\/span> find Addr,#740E8BD38B83????????FF93????????#<\/span> cmp $RESULT,0<\/span> je Exit<\/span> add $RESULT,0A<\/span> bp $RESULT<\/span> add $RESULT,1<\/span> mov Addr,$RESULT<\/span> jmp loop<\/span> Exit:<\/span> ret<\/span><\/p>\n\u4e09\u3001\u6613\u8bed\u8a00<\/span><\/p>\n\u6613\u8bed\u8a00\u7684\u8fd9\u79cd\u67e5\u627e\u65b9\u6cd5,\u540c\u6837\u9002\u5408\u6709\u58f3\u7684\u7a0b\u5e8f,\u5176\u4ed6\u7684\u5c31\u5fc5\u987b\u8131\u58f3\u540e\u518d\u7ee7\u7eed\u64cd\u4f5c\u4e86.<\/span><\/p>\nOD\u8f7d\u5165\u540e,\u5c31F9\u8fd0\u884c\u7a0b\u5e8f\u5427,\u5f53\u7a0b\u5e8f\u8fd0\u884c\u540e,ALT+E<\/span> \u9009\u4e2d\u6613\u8bed\u8a00\u7684\u6838\u5fc3\u5e93krnln,\u53cc\u51fb\u8fdb\u53bb<\/span> <img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/3e25387bc32873a02f73b34c.jpg\" width=\"433\" height=\"339\" small=\"0\"><\/span><\/p>\n\u7136\u540eCTRL+B,\u67e5\u627eFF 55 FC<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/322e6d26554cce4e908f9d4c.jpg\" width=\"567\" height=\"342\" small=\"0\"><\/span><\/p>\n\u67e5\u627e\u5230\u7684\u8fd9\u4e2aCALL\u5c31\u662f\u4e86,F2\u4e0b\u65ad\u5427<\/span><\/p>\n\u73b0\u5728\u8f93\u5165\u5fc5\u987b\u7684\u5185\u5bb9\u540e,\u5355\u51fb\u5bf9\u5e94\u7684\u6309\u7ebd\u5427<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/4a22b0083affcf696a60fb4c.jpg\" width=\"582\" height=\"367\" small=\"0\"><\/span><\/p>\n\u770b,\u65ad\u4e0b\u4e86\u5427,\u4e0b\u9762\u5c31F7\u8ddf\u8fdb\u5427,\u5c31\u6765\u5230\u6309\u7ebd\u4e8b\u4ef6\u5904\u4e86<\/span><\/p>\n\u540c\u6837,\u5199\u4e2a\u811a\u672c,\u65b9\u4fbf\u5927\u5bb6<\/span><\/p>\n\u7a0b\u5e8f\u4ee3\u7801<\/span> gpa “GetProcessHeap”,”kernel32.dll”<\/span> cmp $RESULT,0<\/span> je err<\/span> bp $RESULT<\/span> run<\/span> run<\/span> run<\/span> bc $RESULT<\/span> rtu<\/span> find 10001000,#FF55FC5F5E895D??8945#<\/span> bp $RESULT<\/span> find eip,#FFE0#<\/span> cmp $RESULT,0<\/span> je err<\/span> bp $RESULT<\/span> run<\/span> bc $RESULT<\/span> sto<\/span> MSG “\u6309\u7ebd\u4e8b\u4ef6\u67e5\u627e\u5b8c\u6bd5\uff01”<\/span> ret<\/span> err:<\/span> MSG “\u811a\u672c\u8fd0\u884c\u9519\u8bef\uff01\u8bf7\u68c0\u67e5\u9519\u8bef\u540e\u518d\u7ee7\u7eed\u8fd0\u884c\u811a\u672c\uff01”<\/span> ret<\/span><\/p>\n\u56db\u3001VC++\u7a0b\u5e8f(\u975eMFC\u7a0b\u5e8f)<\/span><\/p>\nOD\u8f7d\u5165\u540e,\u5355\u51fb\u9f20\u6807\u53f3\u952e,\u9009\u62e9”\u67e5\u627e”,\u7136\u540e\u662f”\u6240\u6709\u547d\u4ee4”<\/span> \u5728\u5f39\u51fa\u7684\u8f93\u5165\u6846\u91cc,\u5199\u5165\u7279\u5f81\u4ee3\u7801”sub eax,0a”<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/3f79e5f94dd06842d8f9fd4c.jpg\" width=\"431\" height=\"249\" small=\"0\"><\/span><\/p>\n\u786e\u5b9a\u540e,\u5c31\u6765\u5230\u4e0b\u9762\u7684\u7a97\u53e3<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/adf338d2b0a58f4d3bf3cf4c.jpg\" width=\"578\" height=\"211\" small=\"0\"><\/span><\/p>\n\u5728\u4e0b\u9762\u7684sub eax,0A\u5904,\u53cc\u51fb\u8fdb\u53bb\u5427:<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/8990c5ee0995727badafd54c.jpg\" width=\"604\" height=\"366\" small=\"0\"><\/span><\/p>\n\u6765\u627e\u8fd9\u91cc\u540e,\u5728\u4e0b\u9762\u7684je\u5904\u8ddf\u968f\u8fc7\u53bb<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/cab649116a8ef1b1c2ce794c.jpg\" width=\"784\" height=\"367\" small=\"0\"><\/span><\/p>\n\u8ddf\u968f\u6765\u5230\u7684\u8fd9\u4e2aCALL,\u5c31\u662f\u4e86,F2\u4e0b\u65ad\u5427<\/span><\/p>\n\u7136\u540e\u65ad\u4e0b\u540e,F7\u8ddf\u8fdb,F8\u51e0\u6b21,\u5c31\u6765\u5230\u6309\u7ebd\u4e8b\u4ef6\u4e86.<\/span><\/p>\n\u4e94\u3001MFC\u7c7b\u7a0b\u5e8f<\/span><\/p>\n\u5f53\u7136\u5224\u65adMFC\u548c\u975eMFC\u7684\u7a0b\u5e8f,\u9760\u5927\u5bb6\u81ea\u5df1\u53bb\u5224\u65ad\u4e86<\/span><\/p>\nOD\u8f7d\u5165\u540e.ALT+E,\u6765\u5230\u53ef\u6267\u884c\u6a21\u5757,\u627eMFC\u7684\u6838\u5fc3DLL:MFC42<\/span><\/p>\n\u7136\u540e\u5c31\u53cc\u51fb\u8fdb\u53bb<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/77c11016871f804c4b90a74d.jpg\" width=\"870\" height=\"338\" small=\"0\"><\/span><\/p>\n\u7136\u540e\u5c31CTRL+F,\u67e5\u627e\u7279\u5f81\u4ee3\u7801:sub eax,0a<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/003375eddf7a0f9c2e2e214d.jpg\" width=\"618\" height=\"315\" small=\"0\"><\/span><\/p>\n\u540c\u6837,\u627e\u5230\u540e,\u5c31\u5728\u4e0b\u9762\u7684je\u5904\u8ddf\u968f,\u8ddf\u968f\u540e\u770b\u5230\u7684CALL,\u5c31\u662f\u90a3\u4e2a\u5173\u952eCALL\u4e86!<\/span><\/p>\n<img loading=\"lazy\" decoding=\"async\" class=\"blogimg\" border=\"0\" src=\".\/wp-content\/uploads\/hibaidu\/e9e78fcadc468fb053664f4d.jpg\" width=\"586\" height=\"378\" small=\"0\"><\/span><\/p>\n\u65ad\u4e0b\u540eF7\u8ddf\u8fdb,F8\u51e0\u6b21,\u5c31\u4f1a\u6765\u5230\u6309\u7ebd\u4e8b\u4ef6\u4ee3\u7801\u5904\u4e86!<\/span><\/p>\n\u65b9\u6cd5\u5c31\u7b80\u5355\u7684\u4ecb\u7ecd\u5230\u8fd9\u91cc\u4e86,\u5f53\u7136\u53ea\u662f\u629b\u7816\u5f15\u7389,\u5176\u4ed6\u7684,\u8fd8\u5f97\u591a\u9760\u5927\u5bb6\u81ea\u5df1\u6162\u6162\u603b\u7ed3\u5427!<\/span><\/p>\n<\/div>\n<\/body><\/html><\/p>\n","protected":false},"excerpt":{"rendered":"\u6df1\u5ea6\u603b\u7ed3\u5404\u79cd\u8bed\u8a00\u6309\u7ebd\u4e8b\u4ef6\u7684\u627e\u6cd5 \u6df1\u5ea6\u603b\u7ed3\u5404\u79cd\u8bed\u8a00\u6309\u7ebd\u4e8b\u4ef6\u7684\u627e\u6cd5 \u8c03\u8bd5\u8f6f\u4ef6,\u6700\u91cd\u8981\u7684\u5c31\u662f\u4e0b\u65ad\u70b9,\u90a3\u4e48\u5982\u4f55\u4e0b\u65ad\u70b9, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1420","post","type-post","status-publish","format-standard","hentry","category-skill"],"_links":{"self":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/1420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/comments?post=1420"}],"version-history":[{"count":0,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/1420\/revisions"}],"wp:attachment":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/media?parent=1420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/categories?post=1420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/tags?post=1420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1420,"date":"2010-12-11T08:47:00","date_gmt":"2010-12-11T12:47:00","guid":{"rendered":""},"modified":"2010-12-11T08:47:00","modified_gmt":"2010-12-11T12:47:00","slug":"","status":"publish","type":"post","link":"https:\/\/kyle.ai\/blog\/1420.html","title":{"rendered":"\u6df1\u5ea6\u603b\u7ed3\u5404\u79cd\u8bed\u8a00\u6309\u7ebd\u4e8b\u4ef6\u7684\u627e\u6cd5"},"content":{"rendered":"