代码安全,网络安全,系统内核
« »
2007-11-10逆向分析

13 views

Flashget 1.72 线程破解 (快车)

关键代码段

0041738D |. 6A 0A push 0A
0041738F |. 68 98FC5000 push flashget.0050FC98 ; ASCII “Max Parallel Num”
00417394 |. 68 FCE45000 push flashget.0050E4FC ; ASCII “General”
00417399 |. 8BCE mov ecx,esi
0041739B |. 8986 E8000000 mov dword ptr ds:[esi+E8],eax

004173A1 |. E8 1A7D0B00 call flashget.004CF0C0
004173A6 |. 83F8 1E cmp eax,1E ; cmp with 30

004173A9 |. 8986 CC010000 mov dword ptr ds:[esi+1CC],eax
004173AF |. 7E 0A jle short flashget.004173BB
004173B1 |. C786 CC010000 1>mov dword ptr ds:[esi+1CC],1E
004173BB |> 6A 08 push 8
004173BD |. 68 8CFC5000 push flashget.0050FC8C ; ASCII “MaxSimJobs”
004173C2 |. 68 FCE45000 push flashget.0050E4FC ; ASCII “General”
004173C7 |. 8BCE mov ecx,esi
004173C9 |. E8 F27C0B00 call flashget.004CF0C0
004173CE |. 83F8 64 cmp eax,64 ; cmp with 100
004173D1 |. 8986 D0010000 mov dword ptr ds:[esi+1D0],eax

004173A1 |. E8 1A7D0B00 call flashget.004CF0C0
——————————————————–
004CF0C0 /$ 55 push ebp
004CF0C1 |. 8BEC mov ebp,esp
004CF0C3 |. 51 push ecx
004CF0C4 |. 51 push ecx
004CF0C5 |. 8379 7C 00 cmp dword ptr ds:[ecx+7C],0
004CF0C9 |. 56 push esi
004CF0CA |. 74 46 je short flashget.004CF112
004CF0CC |. FF75 08 push dword ptr ss:[ebp+8]
004CF0CF |. E8 A6FFFFFF call flashget.004CF07A ;HKEY_CURRENT_USER\Software\JetCar\JetCar\General
004CF0D4 |. 8BF0 mov esi,eax
004CF0D6 |. 85F6 test esi,esi
004CF0D8 |. 75 05 jnz short flashget.004CF0DF
004CF0DA |> 8B45 10 mov eax,dword ptr ss:[ebp+10]
004CF0DD |. EB 48 jmp short flashget.004CF127
004CF0DF |> 8D45 08 lea eax,dword ptr ss:[ebp+8]
004CF0E2 |. 57 push edi
004CF0E3 |. 50 push eax ; pBufSize
004CF0E4 |. 8D45 FC lea eax,dword ptr ss:[ebp-4] ;
004CF0E7 |. 50 push eax ; Buffer
004CF0E8 |. 8D45 F8 lea eax,dword ptr ss:[ebp-8] ;
004CF0EB |. 50 push eax ; pValueType
004CF0EC |. 6A 00 push 0 ; Reserved = NULL
004CF0EE |. FF75 0C push dword ptr ss:[ebp+C] ; ValueName
004CF0F1 |. C745 08 0400000>mov dword ptr ss:[ebp+8],4 ;
004CF0F8 |. 56 push esi ; hKey –Max parallel Num
004CF0F9 |. FF15 0C504E00 call dword ptr ds:[<&ADVAPI32.RegQu>; RegQueryValueExA
004CF0FF |. 56 push esi ; hKey
004CF100 |. 8BF8 mov edi,eax ;
004CF102 |. FF15 28504E00 call dword ptr ds:[<&ADVAPI32.RegCl>; RegCloseKey
004CF108 |. 85FF test edi,edi
004CF10A |. 5F pop edi
004CF10B ^ 75 CD jnz short flashget.004CF0DA
004CF10D |. 8B45 FC mov eax,dword ptr ss:[ebp-4]
004CF110 |. EB 15 jmp short flashget.004CF127
004CF112 |> FFB1 90000000 push dword ptr ds:[ecx+90] ; IniFileName
004CF118 |. FF75 10 push dword ptr ss:[ebp+10] ; Default
004CF11B |. FF75 0C push dword ptr ss:[ebp+C] ; Key
004CF11E |. FF75 08 push dword ptr ss:[ebp+8] ; Section
004CF121 |. FF15 08534E00 call dword ptr ds:[<&KERNEL32.GetPr>; GetPrivateProfileIntA
004CF127 |> 5E pop esi
004CF128 |. C9 leave
004CF129 \. C2 0C00 retn 0C



日志信息 »

该日志于2007-11-10 22:24由 老周 发表在逆向分析分类下, 你可以发表评论。除了可以将这个日志以保留源地址及作者的情况下引用到你的网站或博客,还可以通过RSS 2.0订阅这个日志的所有评论。

没有评论

发表评论 »

发表评论您必须先登录

返回顶部