针对非法关键字更新单机版

猛击此处下载!

针对验证的代码(注释为nop的全部nop掉):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
00557135  |. /0F8C E0020000 jl      0055741B                         ;  没有找到帐号
0055713B  |. |40            inc     eax
0055713C  |. |8945 EC       mov     dword ptr [ebp-14], eax
0055713F  |. |C745 F0 00000>mov     dword ptr [ebp-10], 0
00557146  |> |8D4D E4       /lea     ecx, dword ptr [ebp-1C]
00557149  |. |8B55 F0       |mov     edx, dword ptr [ebp-10]
0055714C  |. |8B45 F4       |mov     eax, dword ptr [ebp-C]
0055714F  |. |8B30          |mov     esi, dword ptr [eax]
00557151  |. |FF56 0C       |call    dword ptr [esi+C]
00557154  |. |8B55 E4       |mov     edx, dword ptr [ebp-1C]
00557157  |. |8BC3          |mov     eax, ebx
00557159  |. |E8 2689ECFF   |call    0041FA84
0055715E  |. |8BC3          |mov     eax, ebx
00557160  |. |8B10          |mov     edx, dword ptr [eax]
00557162  |. |FF52 14       |call    dword ptr [edx+14]
00557165  |. |8BF0          |mov     esi, eax
00557167  |. |4E            |dec     esi
00557168  |. |85F6          |test    esi, esi
0055716A  |. |0F8C 9F020000 |jl      0055740F
00557170  |. |46            |inc     esi
00557171  |> |8D55 E0       |/lea     edx, dword ptr [ebp-20]
00557174  |. |8B45 FC       ||mov     eax, dword ptr [ebp-4]
00557177  |. |8B80 00030000 ||mov     eax, dword ptr [eax+300]
0055717D  |. |E8 AECEF3FF   ||call    00494030
00557182  |. |8B45 E0       ||mov     eax, dword ptr [ebp-20]
00557185  |. |50            ||push    eax
00557186  |. |8D4D DC       ||lea     ecx, dword ptr [ebp-24]
00557189  |. |33D2          ||xor     edx, edx
0055718B  |. |8BC3          ||mov     eax, ebx
0055718D  |. |8B38          ||mov     edi, dword ptr [eax]
0055718F  |. |FF57 0C       ||call    dword ptr [edi+C]
00557192  |. |8B55 DC       ||mov     edx, dword ptr [ebp-24]
00557195  |. |58            ||pop     eax
00557196  |. |E8 49DAEAFF   ||call    00404BE4
0055719B     |0F85 67020000 ||jnz     00557408                       ;  nop
005571A1  |. |8D55 C0       ||lea     edx, dword ptr [ebp-40]
005571A4  |. |8B45 FC       ||mov     eax, dword ptr [ebp-4]
005571A7  |. |8B80 0C030000 ||mov     eax, dword ptr [eax+30C]
005571AD  |. |E8 86AFF5FF   ||call    004B2138
005571B2  |. |8B55 C0       ||mov     edx, dword ptr [ebp-40]
005571B5  |. |8D4D C4       ||lea     ecx, dword ptr [ebp-3C]
005571B8  |. |8B45 F8       ||mov     eax, dword ptr [ebp-8]
005571BB  |. |E8 AC2CFDFF   ||call    00529E6C
005571C0  |. |8D55 C4       ||lea     edx, dword ptr [ebp-3C]
005571C3  |. |8D4D D4       ||lea     ecx, dword ptr [ebp-2C]
005571C6  |. |8B45 F8       ||mov     eax, dword ptr [ebp-8]
005571C9  |. |8B00          ||mov     eax, dword ptr [eax]
005571CB  |. |E8 0C2DFDFF   ||call    00529EDC
005571D0  |. |8B45 D4       ||mov     eax, dword ptr [ebp-2C]
005571D3  |. |8D55 D8       ||lea     edx, dword ptr [ebp-28]
005571D6  |. |E8 0D1DEBFF   ||call    00408EE8
005571DB  |. |8B45 D8       ||mov     eax, dword ptr [ebp-28]
005571DE  |. |50            ||push    eax
005571DF  |. |8D4D BC       ||lea     ecx, dword ptr [ebp-44]
005571E2  |. |BA 01000000   ||mov     edx, 1
005571E7  |. |8BC3          ||mov     eax, ebx
005571E9  |. |8B30          ||mov     esi, dword ptr [eax]
005571EB     |FF56 0C       ||call    dword ptr [esi+C]              ;  nop
005571EE  |. |8B55 BC       ||mov     edx, dword ptr [ebp-44]
005571F1  |. |58            ||pop     eax
005571F2  |. |E8 EDD9EAFF   ||call    00404BE4
005571F7     |0F85 FF010000 ||jnz     005573FC                       ;  密码错误,不允许登录,nop
005571FD  |. |8D55 B4       ||lea     edx, dword ptr [ebp-4C]
00557200  |. |8B45 FC       ||mov     eax, dword ptr [ebp-4]
00557203  |. |8B80 10030000 ||mov     eax, dword ptr [eax+310]
00557209  |. |E8 22CEF3FF   ||call    00494030
0055720E  |. |8D45 B4       ||lea     eax, dword ptr [ebp-4C]
00557211  |. |BA C0745500   ||mov     edx, 005574C0                  ;  <aw20.com.shenqizuofang.!@#~$#@>
00557216  |. |E8 85D8EAFF   ||call    00404AA0
0055721B  |. |8B55 B4       ||mov     edx, dword ptr [ebp-4C]
0055721E  |. |8D4D C4       ||lea     ecx, dword ptr [ebp-3C]
00557221  |. |8B45 F8       ||mov     eax, dword ptr [ebp-8]
00557224  |. |E8 432CFDFF   ||call    00529E6C
00557229  |. |8D55 C4       ||lea     edx, dword ptr [ebp-3C]
0055722C  |. |8D4D B8       ||lea     ecx, dword ptr [ebp-48]
0055722F  |. |8B45 F8       ||mov     eax, dword ptr [ebp-8]
00557232  |. |8B00          ||mov     eax, dword ptr [eax]
00557234  |. |E8 A32CFDFF   ||call    00529EDC
00557239  |. |8B45 B8       ||mov     eax, dword ptr [ebp-48]
0055723C  |. |50            ||push    eax
0055723D  |. |8D4D B0       ||lea     ecx, dword ptr [ebp-50]
00557240  |. |BA 02000000   ||mov     edx, 2
00557245  |. |8BC3          ||mov     eax, ebx
00557247  |. |8B30          ||mov     esi, dword ptr [eax]
00557249     |FF56 0C       ||call    dword ptr [esi+C]              ;  nop
0055724C  |. |8B55 B0       ||mov     edx, dword ptr [ebp-50]
0055724F  |. |58            ||pop     eax
00557250  |. |E8 8FD9EAFF   ||call    00404BE4
00557255     |0F85 95010000 ||jnz     005573F0                       ;  帐号必须在指定的电脑上使用,nop
0055725B  |. |8D4D AC       ||lea     ecx, dword ptr [ebp-54]
0055725E  |. |BA 03000000   ||mov     edx, 3
00557263  |. |8BC3          ||mov     eax, ebx
00557265  |. |8B30          ||mov     esi, dword ptr [eax]
00557267     |FF56 0C       ||call    dword ptr [esi+C]              ;  nop
0055726A  |. |8B45 AC       ||mov     eax, dword ptr [ebp-54]
0055726D  |. |BA EC745500   ||mov     edx, 005574EC                  ;  15
00557272  |. |E8 6DD9EAFF   ||call    00404BE4
00557277     |74 22         je      short 0055729B                   ;  jmp short 0055729B
00557279  |. |8D4D A8       ||lea     ecx, dword ptr [ebp-58]
0055727C  |. |BA 03000000   ||mov     edx, 3
00557281  |. |8BC3          ||mov     eax, ebx
00557283  |. |8B18          ||mov     ebx, dword ptr [eax]
00557285  |. |FF53 0C       ||call    dword ptr [ebx+C]
00557288  |. |8B45 A8       ||mov     eax, dword ptr [ebp-58]
0055728B  |. |BA F8745500   ||mov     edx, 005574F8                  ;  2
00557290  |. |E8 4FD9EAFF   ||call    00404BE4
00557295  |. |0F85 49010000 ||jnz     005573E4                       ;  该帐号不允许使用插件版
0055729B  |> |68 04755500   ||push    00557504                       ;  ASCII "GAS2010"
005572A0  |. |A1 88E95500   ||mov     eax, dword ptr [55E988]
005572A5  |. |FF30          ||push    dword ptr [eax]
005572A7  |. |68 14755500   ||push    00557514                       ;   授权给
005572AC  |. |8D55 A0       ||lea     edx, dword ptr [ebp-60]
005572AF  |. |8B45 FC       ||mov     eax, dword ptr [ebp-4]
005572B2  |. |8B80 00030000 ||mov     eax, dword ptr [eax+300]
005572B8  |. |E8 73CDF3FF   ||call    00494030
005572BD  |. |FF75 A0       ||push    dword ptr [ebp-60]
005572C0  |. |68 28755500   ||push    00557528
005572C5  |. |8D45 A4       ||lea     eax, dword ptr [ebp-5C]
005572C8  |. |BA 05000000   ||mov     edx, 5
005572CD  |. |E8 86D8EAFF   ||call    00404B58
005572D2  |. |8B55 A4       ||mov     edx, dword ptr [ebp-5C]
005572D5  |. |A1 D0EE5500   ||mov     eax, dword ptr [55EED0]

修改登录窗口为直接返回,retn:

1
2
3
4
5
00556FF8      55            push    ebp                              ;  retn
00556FF9      8BEC          mov     ebp, esp
00556FFB      6A 00         push    0
00556FFD  |.  53            push    ebx
00556FFE  |.  8BD8          mov     ebx, eax

原创文章,转载请注明: 转载自 obaby@mars

本文标题: 《针对非法关键字更新单机版》

本文链接地址: http://www.h4ck.org.cn/2010/07/gas/

You may also like

发表评论

电子邮件地址不会被公开。 必填项已用*标注