|
研究了一会EXE里和自动使用豆相关的代码
发现有2段比较类似
分别是
00405BB4 . /0F86 8F000000 JBE Ekd5.00405C49
00405BBA . 6A 3E PUSH 3E
00405BBC . 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
00405BBF . 33C0 XOR EAX,EAX
00405BC1 . 8A42 01 MOV AL,BYTE PTR DS:[EDX+1]
00405BC4 . 8BC8 MOV ECX,EAX
00405BC6 . 6BC9 24 IMUL ECX,ECX,24
00405BC9 . 81C1 502C4B00 ADD ECX,Ekd5.004B2C50
00405BCF . E8 9C9A0500 CALL Ekd5.0045F670
00405BD4 . 8BC8 MOV ECX,EAX ;
00405BD6 . 6BC9 48 IMUL ECX,ECX,48 ;
00405BD9 . 81C1 681B4A00 ADD ECX,Ekd5.004A1B68 ;
00405BDF . E8 251E0000 CALL Ekd5.00407A09 ; \Ekd5.00407A09
00405BE4 . 85C0 TEST EAX,EAX
00405BE6 . 74 61 JE SHORT Ekd5.00405C49
00405BE8 . 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00405BEB . 33D2 XOR EDX,EDX
00405BED . 8A51 01 MOV DL,BYTE PTR DS:[ECX+1]
00405BF0 . 8BCA MOV ECX,EDX
00405BF2 . 6BC9 24 IMUL ECX,ECX,24
00405BF5 . 81C1 502C4B00 ADD ECX,Ekd5.004B2C50
00405BFB . E8 54A30300 CALL Ekd5.0043FF54
00405C00 . 85C0 TEST EAX,EAX
00405C02 . 74 2E JE SHORT Ekd5.00405C32
00405C04 . 6A 57 PUSH 57 ; /Arg1 = 00000057
00405C06 . B9 70074B00 MOV ECX,Ekd5.004B0770 ;
00405C0B . E8 2E7F0000 CALL Ekd5.0040DB3E ; \Ekd5.0040DB3E
00405C10 . 25 FF000000 AND EAX,0FF
00405C15 . 85C0 TEST EAX,EAX
00405C17 . 7E 17 JLE SHORT Ekd5.00405C30
00405C19 . 6A 00 PUSH 0 ; /Arg4 = 00000000
00405C1B . 6A 00 PUSH 0 ; Arg3 = 00000000
00405C1D . 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ;
00405C20 . 8A48 01 MOV CL,BYTE PTR DS:[EAX+1] ;
00405C23 . 51 PUSH ECX ; Arg2
00405C24 . 6A 57 PUSH 57 ; Arg1 = 00000057
00405C26 . B9 50774900 MOV ECX,Ekd5.00497750 ;
00405C2B . E8 13800100 CALL Ekd5.0041DC43 ; \Ekd5.0041DC43
00405C30 > EB 17 JMP SHORT Ekd5.00405C49
00405C32 > 6A 01 PUSH 1 ; /Arg4 = 00000001
00405C34 . 6A 00 PUSH 0 ; Arg3 = 00000000
00405C36 . 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C] ;
00405C39 . 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ;
00405C3C . 50 PUSH EAX ; Arg2
00405C3D . 6A 57 PUSH 57 ; Arg1 = 00000057
00405C3F . B9 50774900 MOV ECX,Ekd5.00497750 ;
00405C44 . E8 FA7F0100 CALL Ekd5.0041DC43 ; \Ekd5.0041DC43
和下面的
00422C85 . /0F86 B3000000 JBE Ekd5.00422D3E
00422C8B . 6A 3E PUSH 3E
00422C8D . 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C]
00422C90 . 33D2 XOR EDX,EDX
00422C92 . 8A51 0C MOV DL,BYTE PTR DS:[ECX+C]
00422C95 . 8BCA MOV ECX,EDX
00422C97 . 6BC9 24 IMUL ECX,ECX,24
00422C9A . 81C1 502C4B00 ADD ECX,Ekd5.004B2C50
00422CA0 . E8 CBC90300 CALL Ekd5.0045F670
00422CA5 . 8BC8 MOV ECX,EAX ;
00422CA7 . 6BC9 48 IMUL ECX,ECX,48 ;
00422CAA . 81C1 681B4A00 ADD ECX,Ekd5.004A1B68 ;
00422CB0 . E8 544DFEFF CALL Ekd5.00407A09 ; \Ekd5.00407A09
00422CB5 . 85C0 TEST EAX,EAX
00422CB7 . 0F84 81000000 JE Ekd5.00422D3E
00422CBD . 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
00422CC0 . 33C9 XOR ECX,ECX
00422CC2 . 8A48 0C MOV CL,BYTE PTR DS:[EAX+C]
00422CC5 . 6BC9 24 IMUL ECX,ECX,24
00422CC8 . 81C1 502C4B00 ADD ECX,Ekd5.004B2C50
00422CCE . E8 81D20100 CALL Ekd5.0043FF54
00422CD3 . 85C0 TEST EAX,EAX
00422CD5 . 74 50 JE SHORT Ekd5.00422D27
00422CD7 . 837D F0 00 CMP DWORD PTR SS:[EBP-10],0
00422CDB . 7E 48 JLE SHORT Ekd5.00422D25
00422CDD . 8B55 D4 MOV EDX,DWORD PTR SS:[EBP-2C]
00422CE0 . 33C0 XOR EAX,EAX
00422CE2 . 8A42 0C MOV AL,BYTE PTR DS:[EDX+C]
00422CE5 . 8BC8 MOV ECX,EAX
00422CE7 . 6BC9 24 IMUL ECX,ECX,24
00422CEA . 81C1 502C4B00 ADD ECX,Ekd5.004B2C50
00422CF0 . E8 9BFF0400 CALL Ekd5.00472C90
00422CF5 . 85C0 TEST EAX,EAX
00422CF7 . 76 2C JBE SHORT Ekd5.00422D25
00422CF9 . 6A 57 PUSH 57 ; /Arg1 = 00000057
00422CFB . B9 70074B00 MOV ECX,Ekd5.004B0770 ;
00422D00 . E8 39AEFEFF CALL Ekd5.0040DB3E ; \Ekd5.0040DB3E
00422D05 . 25 FF000000 AND EAX,0FF
00422D0A . 85C0 TEST EAX,EAX
00422D0C . 7E 17 JLE SHORT Ekd5.00422D25
00422D0E . 6A 00 PUSH 0 ; /Arg4 = 00000000
00422D10 . 6A 00 PUSH 0 ; Arg3 = 00000000
00422D12 . 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C] ;
00422D15 . 8A51 0C MOV DL,BYTE PTR DS:[ECX+C] ;
00422D18 . 52 PUSH EDX ; Arg2
00422D19 . 6A 57 PUSH 57 ; Arg1 = 00000057
00422D1B . B9 50774900 MOV ECX,Ekd5.00497750 ;
00422D20 . E8 1EAFFFFF CALL Ekd5.0041DC43 ; \Ekd5.0041DC43
00422D25 > EB 17 JMP SHORT Ekd5.00422D3E
00422D27 > 6A 01 PUSH 1 ; /Arg4 = 00000001
00422D29 . 6A 00 PUSH 0 ; Arg3 = 00000000
00422D2B . 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C] ;
00422D2E . 8A48 0C MOV CL,BYTE PTR DS:[EAX+C] ;
00422D31 . 51 PUSH ECX ; Arg2
00422D32 . 6A 57 PUSH 57 ; Arg1 = 00000057
00422D34 . B9 50774900 MOV ECX,Ekd5.00497750 ;
00422D39 . E8 05AFFFFF CALL Ekd5.0041DC43 ; \Ekd5.0041DC43
00422D3E > EB 22 JMP SHORT Ekd5.00422D62
00422D40 > 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00422D43 . 81E2 FF000000 AND EDX,0FF
00422D49 . 81FA FF000000 CMP EDX,0FF
00422D4F . 74 11 JE SHORT Ekd5.00422D62
我对比了一下两段程序 发现有很多相同但是又有细微不同的地方
都有3E这个特殊效果代码 也有57这个我猜是代表豆编号的代码
还有代表数量的1？
但对汇编不是很懂 所以不了解这2段该改哪一段 或者都改？
希望有过经验的人可以指点一下我 感谢了
还有下面这段在程序里出现了很多次 每次都大同小异 可能也有一些作用？
00412367 > \6A 3E PUSH 3E ; /Arg1 = 0000003E
00412369 . 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8] ;
0041236C . E8 86600000 CALL Ekd5.004183F7 ; \Ekd5.004183F7
00412371 . 66:8945 EC MOV WORD PTR SS:[EBP-14],AX
00412375 . 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00412378 . 81E2 FFFF0000 AND EDX,0FFFF
0041237E . 81FA 00800000 CMP EDX,8000
00412384 . 75 0A JNZ SHORT Ekd5.00412390
00412386 . B8 05000000 MOV EAX,5
0041238B . E9 31020000 JMP Ekd5.004125C1
[ 本帖最后由 ducksuper 于 2006-5-30 20:04 编辑 ]
|
