-
ÄúµÄλÖãºÊ×Ò³ ¡ú ¾«ÎÄÜöÝÍ ¡ú ÆƽâÎÄÕ ¡ú diy pe½Ìѧ3
diy pe½Ìѧ3
ʱ¼ä£º2004/10/15 0:58:00À´Ô´£º±¾Õ¾ÕûÀí×÷ÕߣºÀ¶µãÎÒÒªÆÀÂÛ(0)
-
¡¡diy ÄãµÄpe Íê½áƪ
ÉÏÁ½ÆªÎҽ̸ø´ó¼ÒÈçºÎdiy pe£¬ÓÉÓÚÖÖÖÖÔÒò£¬¶¼ÊÇûÓÐ̫ʵ¼ÊµÄÀý×Ó¡£½ñÌìÎҾͽ²ÊöÒ»¸öʵ¼ÊµÄÀý×Ó¡£
ÎÒÏë¿´Ñ©ÂÛ̳µÄÈËûÓв»ÓÃw32asmµÄ°É£¬Õâ¸öʵÓõŤ¾ß´ó¼Ò¶¼°®Ëü¡£µ«ÊÇw32asmÒ²ÓÐЩ²»ÍêÉƵĵط½¡£
Ê×ÏÈËü²»Ö§³Ö¹öÂÖÊó±êµÄ¹ö¶¯£¨µ±È»ÊÇÔÚÄãûÓÐÓø¨ÖúÊó±êÈí¼þµÄÇé¿öÏ£©£¬È»ºóÊDz»Ö§³ÖÎļþµÄÍÏ·Å
Äã´ò¿ªw32asmºóÍϸöÎļþ½øÈ¥£¬Êó±êÊǸö½ûÖ¹ÍϷŵÄͼ±ê¡£ÏëʵÏÖÕâЩ¹¦ÄÜô£¬ÄǾʹøÉÏÄãµÄÀÏ»¢Ç¯£¨trw£©
£¬°âÊÖ£¨hiew£©ÎÒÃdzö·¢ÐÞÀí»ú´²£¨w32asm£¬ÎÒÐÞÀíµÄw32asmÊÇkiller Ð޸ĹýµÄw32asm10£¬ÔÎļþÓÃpecompackѹËõ¹ý£¬
×Ô¼ºÍÑ¿ÇÐ޸ģ©£¬£¨ÉùÃ÷£ºÎÒµÄϵͳÊÇ98£¬2000ÏÂÎÒûÓвâÊÔ¡£¿´ÍêÎÒÕâƪÎÄÕµÄÓÐÐËȤµÄÈË£¬¿ÉÒÔÔÚ2000ÏÂÊÔÊÔ£©
ºÃ£¬ÎÒÃÇÏÈ×öµÚÒ»¸ö¹¦ÄܰɼÓÈëÊó±ê¹öÂÖ¹¦ÄÜ£¨ÕâʱºòÎÒµÄÏë·¨ÊǼÙÈçÎÒÓÐw32asmµÄÔ´³ÌÐòµÄ»°¶àºÃ°¡£¬Ã»ÓУ¿ÄÇÖ»Óдӷ´±àÒëµÄpeÎļþ¸É»îÁË£¬
¸Ð¾õÏñÔÚÐÞÀïúÆø¹ÜµÀ©Æø£©
µÚÒ»²½£º·ÖÎöÎÊÌ⣨ÿ¸ödiyÕ߶¼Ó¦¸ÃÑø³ÉÕâ¸öÏ°¹ß£¬²»ÒªÉÏÀ´¾Íbpx ¶ÏµãÂÒÏÂһͨ£©
²»Ö§³Ö¹öÂÖÊÇʲôÔÒòÔì³ÉµÄ£¿
windowsÊǸöÏûϢϵͳ£¬w32asm²»Ö§³Ö¹öÂÖÊÇÒòΪËü½ÓÊܵ½¹öÂÖµÄÏûÏ¢µ«ÊǸù±¾²»´¦ÀíËü£¬
ÎÒÃǵÄÄ¿±ê¾ÍÊÇÕÒµ½w32asm´¦ÀíwindowsÏûÏ¢µÄµØ·½£¬È»ºó¼ÓÈë´¦Àí¹öÂÖÏûÏ¢£¬Èç¹ûÄãÎÊÎÒÔõô´¦Àí¹öÂÖÏûÏ¢£¬ºÜ¼òµ¥£¬
ÎÒÃǰѹöÂÖµÄÏûϢת»¯³É°´¼üµÄÏûÏ¢£¬w32asm²»ÊÇ¿ÉÒÔ°´ÉÏϼüÀ´¹ö¶¯Ã´£¬ÎÒÃǰѹöÂÖµÄÉÏϹö¶¯µÄÏûϢת»¯ÎªÉÏÏ°´¼ü
µÄÏûÏ¢£¬È»ºóÆäËûµÄÊÂÇé½»¸øw32asm×Ô¼ºÈ¥´¦Àí¾Íok£¬ºÃÁËÐÞÀí˼·¶¨ºÃÁË£¬¿ªÊ¼¶¯¹¤
µÚ¶þ²½£ºÕÒµ½win32asm´¦ÀíÏûÏ¢µÄµØ·½
ÔõôÕÒ´¦ÀíÏûÏ¢£¬ÎÒÔÚÉÏһƪÎÄÕÂÒѾ½²¹ýÁË£¬ÕâÀïÎҾͲ»ÔÚÖظ´ÁË¡£
ÕÒµ½´¦ÀíÏûÏ¢µÄµØ·½ÈçÏÂ
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045E471(U)
|
:0045261E 8B4604 mov eax, dword ptr [esi+04]£½£½£½¡·¡¾ÕâÀïÊǺ¯Êý²ÎÊýµÄ´«µÝ£¬esi+04¾ÍÊÇmsg µÄunit¡¿
:00452621 3D21010000 cmp eax, 00000121======>ÕâÀïeax¾ÍÊÇwindowsÏûÏ¢µÄ´úÂë
:00452626 7F41 jg 00452669
:00452628 0F84A30D0000 je 004533D1
:0045262E 3D11010000 cmp eax, 00000111===>¿´¹ýÎÒÉÏƪÎÄÕµÄÈ˾ÍÊìϤÕâ¸ö°É£¬¾ÍÊÇwm_command
:00452633 7F1B jg 00452650 *´¦ÀíÏûÏ¢µÄµØ·½ºÜ³¤£¬ÒòΪw32asmÓкܶàÏûÏ¢Òª´¦Àí*
:00452635 7463 je 0045269A *ÏÞÓÚƪ·ù£¬ÎÒÖ»Ìù¹Ø¼üµØ·½£¬ÓÐÐËȤµÄÅóÓÑ¿ÉÒÔ×Ô¼º*
:00452637 2DA0000000 sub eax, 000000A0 *·´»ã±àÔÎļþ¹Û²ì *
:0045263C 0F84530D0000 je 00453395 * *
:00452642 83E860 sub eax, 00000060
:00452645 0F8493000000 je 004526DE
:0045264B E92F120000 jmp 0045387F
ºÃÎÒÃÇ϶ϵãbpx 45261e
ÕâʱºòÄã»á·¢ÏÖ²»¶ÏµÄÖжÏÍ£ÔÚÕâ¸öµØ·½£¬ÕâºÜÕý³££¬ÕâÀïÊÇw32asm´¦ÀíÏûÏ¢µÄºËÐIJ¿·Ö£¬Ã¿Ò»¸ö¸øw32asmµÄÏûÏ¢¶¼¾¹ýÕâÀï¹ýÂË¡£
Ƶ·±µÄwindowsÏûÏ¢µ±È»¾Í»áƵ·±µÄÖжÏÁË£º£©¡£Õâ¸öûÓйØϵ£¬Ã¿´ÎÖжÏÎÒÃǾÍf5£¬È»ºóÔÚ°´f5µÄʱºòµÄ¼ä¸ô¾Í¹ö¶¯Êó±êµÄ¹öÂÖ£¬¿´¿´
¹öÂÖµÄÏûÏ¢ÊǶàÉÙ£¨×¢£ºÕâ¸öÔÚwindows±à³ÌÊÖ²áÀï¿ÉÒԲ鵽wm_mousewhellÏûÏ¢µÄ´úÂëÊÇ20A£¬ÎÒÕâÑùÀ´µÄÄ¿µÄÊÇÒòΪÎÒ²»ÖªµÀÆäwaramµÄ
×Ó²ÎÊý£¬Ò²¾ÍÊÇÈçºÎÅжϹöÂÖÏòÉϹö¶¯ºÍÏòϹö¶¯µÄ×Ó²ÎÊýÊÇÈçºÎ¶¨ÒåµÄ£¬¶øÇÒÊÖÍ·ÉÏûÓÐÀàËƵĹöÂÖ³ÌÐò£¬ÎÒÖ»ÓÐ×Ô¼º²âÊÔÁË£¬Õâ¸ö·½·¨
ÊDZȽϱ¿ÁËÒ»µã£¬µ«ÊÇÎÒÃÇÏëÈ˼ҹù¾¸¶¼ÊÇ´óÖÇÈôÓÞ£¬°²Î¿Ò»ÏÂ×Ô¼º£©£¬µ±¿´µ½esi£«04µÄֵΪ20aµÄʱºòÎÒÃÇd esi£«08£¨Ò»°ã×Ó²ÎÁ¿¶¼ÊÇÕâ¸ö
λÖã¬windows ÏûÏ¢±¾Éí¾ÍÊÇÕâô¶¨ÒåµÄ£©£¬±È½ÏÏòÉϹö¶¯ºÍÏòϹö¶¯esi£«08µØÖ·ÓÐʲô²»Í¬£¬ÎÒÕâÀï¿´µ½µÄÊǵ±ÏòÉϹö¶¯µÄʱºòesi£«0aÊÇ7800
µ±ÏòϹö¶¯µÄʱºòesi£«0aÊÇ88ff£¬ÎҾͳõ²½È·¶¨ÏòÉϹö¶¯ºÍÏòϹö¶¯µÄÅжÏÁË¡£ÖªµÀÁ˹öÂֵĹö¶¯£¬ÎÒÃÇ»¹Òª²âÊÔһϰ´¼üµÄ×Ó²ÎÊý£¬°´¼üµÄÏûÏ¢
ÊÇwm_keydown 100,wm_keyup 101,wm_char 102ÕâÀïw32asmÖ»´¦Àíwm_keydownµÄÏûÏ¢£¨¿´w32asmÏûÏ¢´¦ÀíµÄµØ·½£¬ÎÒûÓÐÌù³öÀ´£¬ÓÐÐËȤ¿ÉÒÔ×Ô¼º·´
±àÒë×Ô¼ºÍù45264BÏÂÃæ¿´£©£¬ºÃ¼ÈȻֻ´¦Àíwm_keydownµÄÏûÏ¢£¬ÎÒÃÇ»¹ÊÇÀÏ°ì·¨£¬f5¼ÓÉÏÔÚ¼ä¸ôµÄʱºò°´ÏÂÏòÉÏ£¬Ïòϵݴ¼ü£¬È»ºó¹Û²ìesi£«08µÄµØÖ·
µÄ×Ó²ÎÁ¿£¬ÎÒÕâÀïµ±°´ÏòÉϼüesi£«08ÊÇ26£¬Ïòϼüesi£«08ÊÇ28£¬ºÃÏÖÔÚÎÒÃÇÖªµÀÁËËùÓÐÒªÖªµÀµÄ¶«Î÷ÁË£¬¿ªÊ¼ÓðâÊÖÈ¥ÐÞÀí»ú´²°É
Ê×ÏÈÕÒµ½ÔÚ³ÌÐòÀï¿Õ³öÀ´µÄµØ·½
°ÑÔÀ´µÄ
:00452621 3D21010000 cmp eax, 00000121
¸ÄΪ
00452621: E90ACD0500 jmp .0004AF330 £½£½¡·Ìøµ½ÎÒÃÇ×Ô¼ºµÄÏûÏ¢´¦Àí²¹¶¡ÉÏ
|
×Ô¼ºµÄÏûÏ¢´¦Àí²¹¶¡£º
004AF330: 3D0A020000 cmp eax,00000020A ;" £½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊǹöÂÖ
"
004AF335: 7415 je .0004AF34C ----- (1)£½£½ÊǵĻ°×ªµ½¹öÂÖ´¦Àí
004AF337: 3D33020000 cmp eax,000000233 ;" 3"£½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊÇÍÏ·ÅÎļþ£¨Õâ¸öÊDz¹¶¡µÚ¶þ¸ö¹¦ÄÜÓõģ¬ÔÚÏÂÃæÓвûÊö£©
004AF33C: 7400 je .0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
004AF33E: 90 nop£½£½£½£½£½¡·¿Õ³öÕâô¶ànopÊÇÒòΪÎÒŵÈһϲ¹¶¡ je .0004AF33EÒÔºó»á±ä³É³¤ÌøתËùÒÔÔ¤ÁôÕâЩ×Ö½Ú
004AF33F: 90 nop
004AF340: 90 nop
004AF341: 90 nop
004AF342: 3D21010000 cmp eax,000000121 ;" !"£½£½¡·»Ö¸´Ô³ÌÐò¶¯×÷
004AF347: E9DA32FAFF jmp .000452626 ----- (3)£½£½¡·Ìø»ØÔ³ÌÐòµØ·½
004AF34C: 668B460A mov ax,[esi][0A]£½£½¡·È¡³ö¹öÂÖµÄ×Ó²ÎÊý
004AF350: 663DFF00 cmp ax,000FF ;" ÿ"£½£½¡·±È½ÏÊÇÏòÉϹö»¹ÊÇÏòϹö
004AF354: 720A jb .0004AF360 ----- (4)
004AF356: B828000000 mov eax,000000028 ;" ("£½£½¡·ÏòϹö¶¯£¬¸Ä¶¯ÏûÏ¢×Ó²ÎÊýΪ°´¼üÏÂ
004AF35B: 894608 mov [esi][08],eax
004AF35E: EB08 jmps .0004AF368 ----- (5)
004AF360: B826000000 mov eax,000000026 ;" &"£½£½¡·ÏòÉϹö¶¯£¬¸Ä¶¯ÏûÏ¢×Ó²ÎÊýΪ°´¼üÉÏ
004AF365: 894608 mov [esi][08],eax
004AF368: B800010000 mov eax,000000100 ;" "£½£½¡·¸Ä¶¯ÏûϢΪ°´¼üÏûÏ¢
004AF36D: 894604 mov [esi][04],eax
004AF370: EBD0 jmps .0004AF342 ----- (6)£½£½¡·Ìø»ØÔ³ÌÐò
ºÃµ½ÏÖÔÚΪֹ£¬ÎÒÃDzâÊÔ¿´¿´£¬¹þ¹þ£¬¹ûÈ»¹ö¶¯ÁË£¬³É¹¦£¡Ê²Ã´£¿Äã˵¹ö¶¯µÄÌ«Âý£¡£©¡ò£©¡ò¡ù£¤£©¡ù£©£¨¡ò£¬Èç¹ûÏÓÂýµÄ»°£¬×Ô¼º°Ñ°´¼üÏûÏ¢×Ó²ÎÊý¸Ä³Épgdn¡£ºÍpgupÒ»´Î¹ö¶¯Ò»Ò³£¬¿ìÁË°É¡£Ê²Ã´£¿Äã˵Äܲ»Äܲ»ÒªÕâô¿ì£¬Ò»´Î¹ö¶¯3ÐУ¬»òÕß5ÐУ¬×îºÃ¼Ó¸ö¶¨Òå´°¿ÚÏë¹ö¶¯¼¸Ðоͼ¸ÐУ¿ÎÒÒªÔε¹ÁË£¬
´ó¸ç£¬ÎÒÊǸĶ¯peÎļþ£¬²»ÊǸÄÔ´³ÌÐò¡£Èç¹ûÄãÏëÕâÑùµÄ»°£¬ÎÒ¸æËßÄã˼·£¬Äã×Ô¼º×ö.Ê×ÏÈ×Ô¼ºÔÚw32asmµÄmenuÀïÃæ¼Ó¸ö¶¨Òå¹öÂÖ¹ö¶¯µÄ×ÓÑ¡ÏÎҵĵڶþƪ
ÎÄÕÂÓÐ˵Ôõô×öµÄ£¬È»ºó¼ÓÈëµã»÷Õâ¸ö×ÓÑ¡ÏîµÄÏûÏ¢´¦Àí£¬Èõã»÷Õâ¸ö×ÓÑ¡ÏîµÄʱºòµ¯³öÒ»¸ödialog£¬¿ÉÒÔÓÃCreateDialogµÄapiº¯Êý£¬µ±È»ÄãµÄÏÈ×öºÃÕâ¸ödialogµÄ×ÊÔ´£¬È»ºó¼ÓÈëÕâ¸ödialogµÄµÄÏûÏ¢º¯Êý£¬ÔÚdialogÀïÃæ×ö¸öeditµÄ¿Ø¼þºÍÒ»¸öbutton¿Ø¼þµ±µã»÷buttonµÄʱºò¾Í°ÑeditÀïÃæµÄÊýÖµ±£´æµ½Ò»¸öµØÖ·
£¬È»ºóÄãµÄ¹öÂÖÅжϵĵط½¶ÁÈëÕâ¸öµØÖ·µÄÖµ£¬¸ù¾ÝÕâ¸öÖµÅжÏÓÃsendmessageº¯ÊýÏòw32asm·¢ËͶàÉÙ¸ö°´¼üÏûÏ¢£¬1¾Í·¢1¸ö£¬50¾Í·¢50¸ö£¬ÕâÑùÄãÀÖÒâ¹ö¶¯¶àÉÙÐоͶàÉÙÐУ¬»¹¿ÉÒÔ×Ô¶¨Ò壺£©¡£ÎÒÊǺÜÀÛ£¬²»×öÁË£¬ÄǸö´ó¸ç²»ÂúÒâÎÒ×öµÄ¾Í×Ô¼º¾Í×öÒ»¸öÏë¹ö¶¯¼¸Ðоͼ¸Ðеİɣ¬¼ÇµÃ×öºÃÁË·¢Ò»¸ö¸øÎÒÓÃÓþÍÐÐÁË!ºÃÁË
µ½ÏÖÔÚΪֹÎÒÃǵĹöÂÖ°æÒѾ×öºÃÁË¡£ÐÝÏ¢Ò»ÏÂÑÛ¾¦£¬ÎÒÃÇÒª¿ªÊ¼´ó¶¯¸É¸ê£¬¿ªÊ¼×öÍÏ·Å°æÁË£¨Èç¹ûÊdzõѧÕ߾Ͳ»ÒªÍùÏ¿´ÁË£¬½²ÊöµÄרҵ±È½Ï¶à£©
ÏÖÔÚ¼ÌÐøÎÒÃǵÄdiyÖ®ÂÃ
´ò¿ªw32asmÊÔÊÔÍÏ·ÅÒ»¸öÎļþ£¬ºÇºÇ£¬Êó±êÊǽûÖ¹ÍϷŵÄͼ±ê£¬Ö¤Ã÷ÊÇw32asmÊǸù±¾²»Ö§³ÖÍÏ·Å£¬Ëµ°×ÁËÒ²¾ÍÊDz»´¦ÀíÍϷŵÄÏûÏ¢¡£
ºÃ£¬¼ÈÈ»ÎÒÃÇÒªÊÇÕâ¸öw32asmÖ§³ÖÍÏ·Å£¬Ê×ÏÈÎÒÃÇÏÈÁ˽âÒ»ÏÂÍϷŵÄ֪ʶ£¬windowsÊǸöͼÐνçÃæϵͳ£¬¸÷ÖÖ¸÷ÑùµÄ³ÌÐò¶¼ÊÇ»ùÓÚͼÐνçÃæµÄ£¬
Õâ¸ö½çÃæÊÇÎÒÃÇÒ²¿ÉÒÔ³ÆΪ´°¿Ú£¬´°¿ÚºÜ¶àÊôÐÔ£¬±ÈÈç´ó¼Ò¶¼Á˽âµÄenablewindow¾ÍÊÇÉèÖô°¿ÚµÄÊôÐԵģ¬²»¹ýÕâ¸öº¯ÊýÊÇÉèÖô°¿ÚÊÇ·ñ¿ÉÓõÄ
ÊôÐÔ¡£ÏÖÔÚÎÒÃÇÐèÒªµÄÊÇ´°¿ÚÊÇ·ñ½ÓÊÜÍϷŵÄÊôÐÔ£¬ÎÒ¸æËß´ó¼Ò£¬Õâ¸öº¯Êý¾ÍÊÇDragAcceptFiles£¬ËüÊÇshell32.dllµÄº¯Êý£¬ÓëÍÏ·ÅÓйصĺ¯Êý»¹ÓÐDragFinishºÍDragQueryFile£¬ÎÒÃÇÒª²¹¶¡Ò²¾ÍÒªÓõ½Õâ¸öÈý¸öº¯Êý£¬
Ê×ÏÈÎÒÃÇ¿´¿´DragAcceptFilesÕâ¸öº¯ÊýÊÇÉèÖô°¿ÚÊÇ·ñÄܽÓÊÜÍϷŵÄÏûÏ¢£¬Ò²¾ÍÊÇwindowsÊÇ·ñ·¢ËÍWM_DROPFILESÏûÏ¢¸øÕâ¸ö´°¿Ú¡£Ê¹Óõķ½·¨ÊÇapiÊÖ²áÉϲ鵽Ϊ£º
VOID DragAcceptFiles(
HWND hWnd, // handle to the registering window ×¢²á´°¿ÚµÄhwnd
BOOL fAccept // acceptance option ÊÇ·ñ½ÓÊÜÍϷŵÄÏûÏ¢
);
ÖªµÀÁËDragAcceptFilesµÄÓ÷¨ºó.ÎÒµÄ˼·ÊÇ°Ñw32asmµÄËùÓеĴ°¿Ú¶¼¼ÓÉÏÒ»¸ö
invoke DragAcceptFiles,hwnd,TRUE
µ±È»Õâ¸öÊÇÔÚ»ã±àÀïʵÏÖ£¬µ«ÊÇÔÚÒѾÁ¬½ÓºÃµÄpeÎļþÀïÈçºÎʵÏÖ
invoke DragAcceptFiles,hDlg,TRUEÄØ£¿
Òª´ïµ½Õâ¸öÄ¿µÄ
µÚÒ»£ºÊ×ÏÈÎÒÃÇÐèÒªpeÎļþµÄimport±í£¨×¢£ºÈç¹û²»¶®import±íµÄ¿ÉÒÔ×Ô¼ºÏÈѧϰһÏÂpeÎļþµÄ¸ñʽ£¬²»ÄÑ£¬Ö»ÊÇÓе㷳¶øÒÑ£©ÓÐDragAcceptFilesÕâ¸öÒýÈ뺯Êý
µÚ¶þ£ºÈ»ºó¾ÍÊÇÎÒÃÇÐèÒªÔÚpeÎļþÖеĵ½´°¿ÚµÄhwnd
´ïµ½ÒÔÉÏÌõ¼þÒÔºó
Ö»ÒªÔÚpe¿Õ°×¿Õ¼äÓÃÒÔÏ´úÂë¾Í¿ÉʵÏÖ
push 1
push hwnd
call DragAcceptFiles
ÎÒÃÇÏÖÔÚÏÈÀ´´ïµ½µÚÒ»¸öÌõ¼þ
ÄóöÎÒÍѿǵÄw32asm(×¢£ºÎÒ×Ô¼ºÍѿǵÄÓÐÁ½¸ö°æ±¾£¬µÚÒ»¸öÊÇÔÚÈë¿ÚµãdumpÍêÈ«µÄpe£¬È»ºóÊÖ¶¯ÐÞ¸´import£¬Õâ¸ö°æ±¾ºÜÒź¶£¬Ö»ÄÜÔÚ98ÏÂÔËÐУ¬²»ÄÜÔÚ2000ÏÂÔËÐУ¬ÔÒòÊÇÐèÒªÐÞ²¹µÄimportÌ«¶à¿ÉÄÜÓÐÒÅ©£¬»òÕßÎÒÒ²²»ÖªµÀ£¬µÚ¶þ¸ö°æ±¾£¬ÊÇÇéÀÇ´ó¸çÔÚÈë¿ÚµãÓÃtrw2000µÄpedumpÃüÁîdump³öÀ´°æ±¾£¬Õâ¸ö°æ±¾ÄÜ¿çƽ̨£¬µ«ÊÇÒ²Òź¶£¬ÓÃpe±à¼Æ÷¿´²»µ½ÈκεÄimport±í£©
ΪÁËÄÜ¿çƽ̨£¬ÎÒ¾ö¶¨Óõڶþ¸ö°æ±¾¿ªÊ¼¸ÄÔ죬ÓÉÓÚûÓÐÈκεÄimport±í£¬ÎÒÃǸù±¾²»ÖªµÀÊÇ·ñ°üº¬ÓÐDragAcceptFilesÕâ¸öº¯Êý£¬ÓÃstud_pe´ò¿ª×Ô¼º×öµÄµÚÒ»¸ö°æ±¾£¨Ò²¾ÍÊÇÐÞ¸´ÁËimport±íµÄÄǸö°æ±¾£©£¬µã»÷function°´Å¥£¬¹Û²ìimportµÄº¯ÊýÐÅÏ¢·¢ÏÖÆ亯ÊýÓÐkernell32¡¢gdi32.dll
µÈ£¬Ã»Óаüº¬shell32.dll£¬Ò²¾ÍÊÇ˵£¬²»¿ÉÄÜÓÐDragAcceptFilesÕâ¸öÎÒÃÇÐèÒªµÄº¯ÊýÁË£¬Ã»Óк¯Êý£¬ÎÒÃÇÓÖÏëÓã¬ÄǾÍÖ»ÓÐ×Ô¼ºÊÖ¶¯¹¹ÔìÁË£¬Èý¸öÏà¹ØµÄº¯Êý¹¹ÔìÆðÀ´£¬»¹ÊDZȽÏÈÝÒ׵ģ¬²»¹ýÎÒ»¹Êǽ̴ó¼ÒÔõôʹÓÃlordpe¹¹Ôì°É£¨ÓÃstud_peºÍpeeditor¶¼²î²»¶à£¬ÊÖ¶¯Ò²ÐУ¬Èç¹ûÀ´¸ö¶þÈýÊ®¸öº¯ÊýµÄ»°£¬ÎÒ¿´ÊÖ¶¯µÄ¿É¾Í³Ô¿÷ÁË£©
¹¹Ô캯Êýƪ£º
ÓÃlordpe´ò¿ªµÚ¶þ¸öÍÑ¿Ç°æ±¾£¬µã»÷directories°´Å¥£¬È»ºóµã»÷importtabl°´Å¥£¬Ö»ÄÜ¿´µ½Ò»¸ökernell32.dll£¬ÔÚÉÏÃæµã»÷ÓÒ¼ü£¬Ñ¡Ôñ add import£¬µ¯³ö´°¿Ú£¬ÔÚdllÌîÈëSHELL32.dll£¬apiÌîÈëDragAcceptFilesµã»÷ÄǸö¼ÓºÅµÄ°´Å¥¿´µ½DragAcceptFilesÒѾÌí¼Ó½øÈ¥ÁËÈ»ºóÓÃÕâ¸ö·½·¨Ìí¼ÓDragFinishºÍDragQueryFileº¯ÊýÌí¼ÓÍê³Éºóµã»÷ok£¬¿´µ½import±í¶àÁËÒ»¸öshell32µÄdllÁË°É£¬ÀïÃæÓÐÎÒÃÇÌí¼ÓµÄÈý¸öº¯Êý,¼ÇÏÂÕâ¸öÈý¸öº¯ÊýµÄthunkrvaÖµ£¨ÒÔºóÒªÓõ½£©£¬ÎÒÕâÀïÈçÏÂ:
ThunkRva ThunkOffset ThunkValue Hint ApiName
0015803B 0015803B 0015800C 0000 DragAcceptFiles
0015803F 0015803F 0015801E 0000 DragQueryFile
00158043 00158043 0015802E 0000 DragFinish
ÆäʵÄãÒ²¿ÉÒÔ×Ô¼ºÓÃwinhex¹¹ÔìÕâ¸öÈý¸öº¯Êý£¬²»ÄÑ£¬¿´¿´Ïà¹ØµÄpe¸ñʽÎĵµ¾ÍÄÜ×öµ½£¬×Ô¼º¹¹ÔìµÄÓиöºÃ´¦¾ÍÊǽṹ±È½Ï·ÖÃ÷£¬¿´ÆðÀ´±È½ÏÊæ·þ£¬Èí¼þ¹¹ÔìµÄÊÇÖØж¨Î»¹ýimportËùÒÔÓеã»ìÂÒ£¬²»¹ýÄãÏë͵ÀÁ¾ÍÓÃÈí¼þ¹¹Ôì°É£¬Õâ¸ö·½±ã
¹¹ÔìÍêÁ˺¯Êý,ÎÒÃǵĸøËüÒ»¸öfirshthunk£¬·ñÔòÔÚ³ÌÐòÀïÃæÔõôcallÄÇÀïÄØ£¿ÕâÀï¾ÍÓõ½ÁËthunkrvaµÄÖµÁË£¬ÏÖÔÚ¹¤¾ß»»³ÉÁËhiew,ÓÃhiew´ò¿ªÍѿǺóµÄw32asmÎÒÃÇÀ´µ½004AF29C
ÈçÏ£º
004AF29C: FF25244B4D00 jmp d,[004D4B24]
004AF2A2: FF252C4B4D00 jmp d,[004D4B2C]
004AF2A8: FF25304B4D00 jmp d,[004D4B30]
004AF2AE: FF25344B4D00 jmp d,[004D4B34]==>ÕâЩjmp¶¼ÊǶ¨Î»apiº¯ÊýµÄ£¬Ã¿¸öjmp´ú±í³ÌÐòÒªÓõ½apiº¯ÊýµØÖ·
004AF2B4: 0000 add [eax],al *************************************************************
004AF2B6: 0000 add [eax],al *ÄãÎÊ£¬ÔõôÕÒµ½Õâ¸öµØ·½µÄ£¬ºÜ¼òµ¥£¬Ëæ±ãϸö³ÌÐòÒªÓõ½µÄapiº¯*
004AF2B8: 0000 add [eax],al *Êý£¬¿´¿´ÆäcallµÄÊÇÄǸöµØÖ·£¬¾ÍÄÜÕÒµ½Õâ¸öµØ·½ *
004AF2BA: 0000 add [eax],al *************************************************************
ÎÒÃÇÏÖÔÚ¾ÍÒª¼ÓÈëDragAcceptFiles¡¢DragQueryFile¡¢DragFinishÈý¸öº¯ÊýµÄjmp£¬
jmpµ½ÄÇÀï,Æäʵ¾ÍÊÇjmpÄǸöThunkRva+imagebaseµÄÖµ,imagebaseÖµÊÇ4000000
ËùÒÔÎÒÃÇÒªÔÚ004AF2B4´¦ÌîÈ룺
004AF2B4£ºjmp d,[0055803B] *55803b=15803B(ThunkRva)+4000000(imagebase)ÒÔÏÂÒ»Ñù¼ÆËã
jmp d,[0055803f]
jmp d,[00558043]
ÌíÍêºóÈçÏ£º
004AF29C: FF25244B4D00 jmp d,[004D4B24]
004AF2A2: FF252C4B4D00 jmp d,[004D4B2C]
004AF2A8: FF25304B4D00 jmp d,[004D4B30]
004AF2AE: FF25344B4D00 jmp d,[004D4B34]
004AF2B4: FF253B805500 jmp DragAcceptFiles ;SHELL32.dl==>¿´µ½ÎÒÃǹ¹ÔìµÄº¯ÊýÁËô£¬ÕæÊÇhappy°¡
004AF2BA: FF253F805500 jmp DragQueryFile ;SHELL32.dll
004AF2C0: FF2543805500 jmp DragFinish ;SHELL32.dll
004AF2C6: 0000 add [eax],al
004AF2C8: 0000 add [eax],al
ÏÖÔÚ¼ÇÏÂ004AF2B4¡¢004AF2BA¡¢004AF2C0ÕâÈý¸öÖµ.ÒÔºócall 004AF2B4¾ÍÊÇcall DragAcceptFilesÁË£¬µ÷ÓÃDragQueryFile Ò²¾ÍÊÇcall 004AF2BAÁË£¬ÒÔ´ËÀàÍÆ
º¯Êý¹¹ÔìÍê³ÉµÚÒ»¸öÌõ¼þÒ²¾ÍÂú×ãÁË£¬¿ªÊ¼ÎÒÃǵڶþ¸öÌõ¼þhwndµÄÑ°ÕÒ°É
Ñ°ÕÒhwnd´ò²¹¶¡Æª£º
ÈçºÎÕÒµ½hwndÖµÄØ£¬¶Ôwindows±à³ÌÊìϤµÄÈË(Äã²»ÊìϤ¾ÍÂýÂýѧ£¬×ÜÓÐÒ»Ìì»áÊìϤµÄ£©ÖªµÀGetWindowRectº¯ÊýÒ²ÐèÒªÒ»¸öhwndÖµ£¬ÎÒÃǽػñ
getwindowsrectº¯Êý£¬±£´æÕâ¸öhwnd£¬ÔÙʹÓÃÕâ¸öhwndÀ´DragAcceptFiles ²»¾Íok£¬ºÃÈ·¶¨Ë¼Â·£¬´ò¿ªtrwÈ»ºóbpx getwindowsrect
Æô¶¯w32asm·¢ÏÖÆäÔÚÕâÀïµ÷ÓÃgetwindowsrect£º
0167:00492941 52 PUSH EDX=========>Õâ¸öÊÇÒ»¸örectµÄstructµÄpoint£¬Ò²¾ÍÊÇÒ»¸ö¾ØÕó½á¹¹µÄÖ¸Õë
0167:00492942 FF700C PUSH DWORD [EAX+0C]===>ÕâÀï¾ÍÊÇÎÒÃÇÐèÒªµÄhwnd
0167:00492945 E810C90100 CALL `USER32!GetWindowRect===>µ÷ÓÃÕâ¸öº¯ÊýÁËÒ²¾ÍÊÇcall .0004AF25A
0167:0049294A EB1B JMP SHORT 00492967
0167:0049294C 8B582C MOV EBX,[EAX+2C]
³ÌÐòÆô¶¯µ÷ÓÃÁ˺ܶà´ÎGetWindowRectº¯Êý£¬Ã¿´Îhwnd¶¼²»Í¬£¬ÕâÊÇÒòΪw32asm´°¿Ú·ÖΪºÃ¼¸¸ö£¬edit´°¿Ú£¬menu´°¿Ú£¬toolbar£¬×´Ì¬À¸µÈµÈ
ÎÒÃDz»¹ÜËü£¬°Ñÿ¸ö´°¿ÚµÄDragAcceptFiles Öµ¶¼ÉèÖÃΪture¾ÍÐÐÁË£¬¹ÜËüÓжàÉÙ¸öÄØ£¬ÓжàÉÙ¸ö£¬¾Íture¶àÉÙ¸ö£¬¸ö¸ö¶¼ÄܽÓÊÜÍÏ·Å£¬ÏëÍù
ÄÇÀïÍϾÍÍùÄÇÀïÍÏ
°ÑÕâ¾ä£º
0167:00492945 E810C90100 CALL `USER32!GetWindowRect
¸ÄΪ£º
00492945: E996C90100 jmp .0004AF2E0 -----ÕâÀïÊÇÎÒÃÇ×Ô¼ºµÄ²¹¶¡³ÌÐòÁË
×Ô¼º²¹¶¡µÄµØ·½£º
004AF2E0: 58 pop eax££££¡·È¡³öѹÈë¶ÑÕ»µÄhwnd
004AF2E1: A3C6F24A00 mov [004AF2C6],eax£££¡·±£´æµ½Ò»¸öµØÖ·£¬ÎÒÑ¡ÔñµÄÊÇ004AF2C6
004AF2E6: 50 push eax£££¡·Ñ¹hwndÈë¶ÑÕ»
004AF2E7: E86EFFFFFF call .0004AF25A -----¡· CALL `USER32!GetWindowRect
004AF2EC: 6A01 push 001£½£½£½´«µÝture
004AF2EE: FF35C6F24A00 push d,[004AF2C6]£½£½¡·´«µÝhwnd
004AF2F4: E8BBFFFFFF call DragAcceptFiles ;SHELL32.dll£½£½£½¡·Ò²¾ÍÊÇcall 004AF2B4ÎÒÃÇÔÚÉÏÃæ¹¹ÔìµÄµØ·½
004AF2F9: E96936FEFF jmp .000492967 -----¡·»Øµ½³ÌÐòÔÀ´µÄµØ·½
ÏÖÔÚ´ò¿ª²¹¶¡ÍêµÄ³ÌÐò£¬ÍϸöÎļþÊÔÊÔ£¬ÊDz»ÊÇͼ±êÒѾ±äÁË£¬Äã˵£¬±äÊDZäÁË,ÔõôûÓз´Ó¦°¡£¬»¹Ã»ÓмÓÈëʼþÔõô»áÓз´Ó¦£¿ÕæÊǵģ¬Â·Òª
Ò»²½Ò»²½µÄ×ß¡£²»ÒªÌ«¼±
ÏÖÔÚ¿ªÊ¼ÎÒÃǼÓÈëʼþµÄ¹ý³ÌÁË£¬Ê×ÏÈÕÒµ½½ÓÊÜÏûÏ¢µÄµØ·½£¬¼ÓÈëÅжÏÍÏ·ÅÏûÏ¢µÄ´úÂ룬ÉÏÃæÒѾ˵¹ýÁËÔÚ
:0045261E 8B4604 mov eax, dword ptr [esi+04]£½£½£½¡·¡¾ÕâÀïÊǺ¯Êý²ÎÊýµÄ´«µÝ£¬esi+04¾ÍÊÇmsg µÄunit¡¿
:00452621 3D21010000 cmp eax, 00000121======>ÕâÀïeax¾ÍÊÇwindowsÏûÏ¢µÄ´úÂë
¶øÇÒ
:00452621 3D21010000 cmp eax, 00000121
ÒѾ¸ÄΪ£º
00452621: E90ACD0500 jmp .0004AF330
Ò²¾ÍÊÇÏûÏ¢´¦ÀíÒѾÔÚÎÒÃÇ×Ô¼ºµÄ²¹¶¡µØ·½ÁË
004AF330: 3D0A020000 cmp eax,00000020A ;" £½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊǹöÂÖ
"
004AF335: 7415 je .0004AF34C ----- (1)£½£½ÊǵĻ°×ªµ½¹öÂÖ´¦Àí
004AF337: 3D33020000 cmp eax,000000233 ;" 3"£½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊÇÍÏ·ÅÎļþ
004AF33C: 7400 je .0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
ºÃÏÖÔÚÎÒÃÇ¿ÉÒÔ°Ñ004AF33C: 7400 je .0004AF33Eתµ½ÎÒÃÇ×Ô¼ºÍÏ·Å´¦ÀíµÄµØ·½ÁË
ÏÖÔÚ³ÌÐòÒ²ÄÜÅжÏÍÏ·ÅÏûÏ¢£¬ÎÒÃǾÍÐèÒª¸ù¾ÝÕâ¸öÏûÏ¢×öÏà¹ØµÄ¶¯×÷ÁË£¬Ò²¾ÍÊÇÐèÒª×ö´ò¿ªÕâ¸öÍÏ·ÅÎļþ²¢ÇÒ·´»ã±àËü¡£
ѧϰµ½ÕâÀ´ó¼ÒÊDz»ÊÇÒѾ±È½ÏÓÐ˼·ÁË£¬Ê×ÏÈÎÒÃDZØÐëµÃµ½ÍÏ·ÅÎļþµÄÎļþÃû£¬Õâ¾ÍÐèÒªDragQueryFile º¯ÊýÁË
The DragQueryFile function retrieves the filenames of dropped files.
UINT DragQueryFile(
HDROP hDrop, // handle to structure for dropped files£½£½£½¡·ÍϷŵÄhdrop
UINT iFile, // index of file to query£½£½¡·Îª0¾Í¿ÉÒÔÁË
LPTSTR lpszFile, // buffer for returned filename£½£½¡··ÅÎļþÃûµÄµØÖ·
UINT cch // size of buffer for filename£½£½¡·bufferµÄ³ß´ç
);
ÎÒÃÇ¿´¿´Õâ¸öº¯ÊýÐèҪʲô²ÎÊý£¬ÏÖÔÚÐèÒªÕҵľÍÊÇhdropÕâ¸öÀàËÆÓÚwindows´°¿ÚµÄhwndÓÃÀ´Î¨Ò»±êʶÍϷŵģ¬Õâ¸öÒ²¾ÍÊÇmsgµÄ×Ó²ÎÊý
:0045261E 8B4604 mov eax, dword ptr [esi+04]£½£½£½¡·¡¾ÕâÀïÊǺ¯Êý²ÎÊýµÄ´«µÝ£¬esi+04¾ÍÊÇmsg µÄunit¡¿
esi+04ÊÇÏûÏ¢unit£¬ÄÇôÕâ¸ö×Ó²ÎÊý¾ÍÔÚesi+08´¦
ºÃÁËÏà¹ØµÄ²ÎÊý¶¼¸ã¶¨ÁË£¬ÏÂÒ»²½¾ÍÊÇ¿´¿´w32asmÔõô´ò¿ªÒ»¸ö¸ù¾ÝÎļþÃû´ò¿ªÎļþµÄ¶¯×÷µÄ£»´ÓÄÇÀïÏÂÊÖÄØ£¿´ÓdisassemblerµÄopen fileÏÂÊÖ£¿Õâ¸ö»áµ¯³öÒ»¸ö¿ò×Ó³öÀ´£¬²»ºÃ£¬ÄǾʹÓrecent filesÏÂÊÖ£¬rencent files¿ÉÒÔ´ò¿ªÄã×î½ü´ò¿ªµÄÎļþ£¬ºÃÎÒÃÇ¿´¿´ËüÊÇÔõô´ò¿ªµÄ
£¨¸ú×ÙÕâ¸ö¶¯×÷ºÜ¸´ÔÓ£¬ÎÒÒªÏêϸµÄ˵£¬¿ÉÄÜ´òÒ»ÌìµÄ×ÖÒ²´ò²»Í꣬ÎÒ´ò×Öµ½ÏÖÔÚÒѾºÜÀÛÁË£¬´ó¼Ò¾Í½«¾Íһϣ¬ÎÒ½ö½ö½²¸ú×ٵĹؼüµØ·½£©
ÔÚÏûÏ¢Åжϣ¨ÏûÏ¢ÊÇ111 wm_command)µÄµØ·½Ï¶ϵ㣬Ȼºóµã»÷recent filesµÄ°´Å¥£¬·¢ÏÖÆä×Ó²ÎÁ¿Îªbd02È»ºóÓÖµ÷ÓÃ×Ô¼º,ÕâʱºòµÄ×Ó²ÎÁ¿±ä³É
0c5f,µ±Äãµã»÷open fileʱºò·¢ÏÖ×Ó²ÎÁ¿Ò²ÊÇ0c5f£¬¿´À´ÊÇÔÚµã»÷recent filesÎļþµÄʱºò»ápostÒ»¸ö0c5fÏûÏ¢»ØÀ´£¬ÄÇôrencentÀïÃæµÄ×î½ü´ò¿ªµÄÎļþÊÇ´æÔÚÄǸöµØ·½ÄØ£¿¾¹ý¸ú×Ù¿ÉÒÔ·¢ÏÖÊÇ´æÔÚc:\windows\w32dasm8.iniÎļþÀïÃ棬
windowsÓÃÀ´´ò¿ªiniÎļþµÄapiÊÇGetPrivateProfileString£¬ÏÂbpx GetPrivateProfileStringÕâ¸ö¶Ïµã£¬È»ºóµã»÷recent ÀïÃæµÄ×î½ü´ò¿ªµÄÎļþ³ÌÐòÖжÏÔÚÕâÀ£¨ÎÒÃǾÍÀ´·ÖÎöÕâÀïÊÇʲôÒâ˼£©
|:100411F0
|
:1004310C 55 push ebp
:1004310D 8BEC mov ebp, esp£½£½£½¡·ÕâÊÇvc±à³Ì´«µÝ²ÎÊýµÄÐÎʽ£¬ÓÃvc¶¼ÊÇÕâÑù£¬ºÍ±àÒëÆ÷ÓйØϵ
:1004310F 53 push ebx£½£½¡·ÕâÀï´«µÝµÄ²ÎÊýÊÇ´°¿ÚµÄhwnd
:10043110 56 push esi
:10043111 8B450C mov eax, dword ptr [ebp+0C]£½£½¡·ÕâÀïÊÇÏûÏ¢µÄ×Ó²ÎÊý£¬ÕâÀïÊÇ×î½üÎå¸öÎļþµÄid
:10043114 2DBD020000 sub eax, 000002BD
:10043119 D1E0 shl eax, 1
* Possible StringData Ref from Data Obj ->"12345"
|
:1004311B BB3B5A0410 mov ebx, 10045A3B
:10043120 03D8 add ebx, eax£½£½£½¡·°Ñeax×öת»»±ä³ÉÁËtable±í£¬¾ÍÖªµÀÊǵã»÷ÁËÄǸöÎļþ£¬[ebx]»á±ä³É1-5Ö®¼ä
* Possible StringData Ref from Data Obj ->"W32dasm8.ini"
|
:10043122 684A5A0410 push 10045A4A==>²ÎÊý£¬ÎļþÃû
:10043127 6880000000 push 00000080==>buffer size
:1004312C 68575A0410 push 10045A57==>¶ÁÈëÄÚÈݵØÖ·Ö¸Õë
* Possible StringData Ref from Data Obj ->"NULL"
|
:10043131 68455A0410 push 10045A45£½£½¡·È±Ê¡×Ö·û´®µÄÖ¸Õë
:10043136 53 push ebx==>key name
* Possible StringData Ref from Data Obj ->"RECENT"
|
:10043137 68345A0410 push 10045A34===>¶ÎÃû
* Reference To: KERNEL32.GetPrivateProfileStringA, Ord:0125h
|
:1004313C E8AB0B0000 Call 10043CEC==>µÃµ½key nameϵÄÄÚÈÝ
:10043141 A3305A0410 mov dword ptr [10045A30], eax==>·µ»ØµÄµ½×Ö½Ú
:10043146 68575A0410 push 10045A57
* Possible StringData Ref from Data Obj ->"NULL"
|
:1004314B 68455A0410 push 10045A45
* Reference To: KERNEL32.lstrcmpiA, Ord:02D9h
|
:10043150 E8F70B0000 Call 10043D4C==>±È½ÏÉÏÃæÁ½¸ö×Ö·û´®(Õâ¸ö±È½ÏµÄ×÷ÓÃÊÇ¿´ÊDz»ÊÇÒªµ÷Õû×î½ü´ò¿ªµÄÎļþµÄ˳Ðò£©
:10043155 0BC0 or eax, eax
:10043157 745E je 100431B7
:10043159 BF575A0410 mov edi, 10045A57
:1004315E 8B0D305A0410 mov ecx, dword ptr [10045A30]
:10043164 8BF7 mov esi, edi
:10043166 03F9 add edi, ecx
:10043168 FD std
:10043169 B05C mov al, 5C
:1004316B F2 repnz
:1004316C AE scasb
:1004316D 85C9 test ecx, ecx
:1004316F 741C je 1004318D
:10043171 83C702 add edi, 00000002
:10043174 C647FF00 mov [edi-01], 00
:10043178 3BFE cmp edi, esi
:1004317A 7411 je 1004318D£½£½£½¡·ÕâÒ»¶ÎµÄ×÷ÓÃÊÇ°Ñd:\1\hiew.exe±ä³Éd:\1µÄÐÎʽ£¬ÎªSetCurrentDirectoryA×ö×¼±¸
:1004317C 56 push esi==>esiµÄµØÖ·¾ÍÊÇX:\XXX\µÄÐÎʽÁË
* Reference To: KERNEL32.SetCurrentDirectoryA, Ord:023Eh£½£½¡·ÉèÖÃÏÖÔڵķ¾¶ÎªX:\XXX\
|
:1004317D E8A60B0000 Call 10043D28
:10043182 57 push edi
:10043183 68575A0410 push 10045A57
* Reference To: KERNEL32.lstrcpyA, Ord:02DCh
|
:10043188 E8C50B0000 Call 10043D52
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:1004316F(C), :1004317A(C)
|
:1004318D 68575A0410 push 10045A57
:10043192 68515E0410 push 10045E51
* Reference To: KERNEL32.lstrcpyA, Ord:02DCh
|
:10043197 E8B60B0000 Call 10043D52£½£½£½¡·ÉÏÃæÒ»¶ÎµÄ×÷ÓÃÊǵ÷Õû×î½üÎļþ´ò¿ªµÄ˳Ðò
:1004319C C605505E041002 mov byte ptr [10045E50], 02£½£½¡·Õâ¸ö¿ÉÊDZê־λŶ£¬Èç¹ûΪÁãµÄ»°£¬ÄǾͻᵯ³öÄǸö´ò¿ªÎļþµÄ´°¿Ú
:100431A3 6A00 push 00000000
* Possible Ref to Menu: MenuID_00CB, Item: "Open File to Disassemble.."
|
:100431A5 680C5F0000 push 00005F0C
:100431AA 6811010000 push 00000111
:100431AF FF7508 push [ebp+08]==>´°¿ÚµÄhwnd
* Reference To: USER32.PostMessageA, Ord:01DBh
|
:100431B2 E8E70A0000 Call 10043C9E£½£½¡·ÎÒ¹ûȻûÓÐ²Â´í£¬¾ÍÊÇpostÒ»¸öµã»÷open fileÏûÏ¢¸ø×Ô¼º
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10043157(C)
|
:100431B7 5E pop esi
:100431B8 5B pop ebx
:100431B9 C9 leave
:100431BA C20800 ret 0008
Õâ¶Î´úÂëÎÒÒѾ·ÖÎöÍê±Ï£¬ÏÖÔÚÎÒÃÇÒª×öµÄÊÂÇé¾ÍÊÇÔڵĵ½DragQueryFile µÄÏûÏ¢ºó£¬×öÒ»ÑùµÄ´¦Àí¶¯×÷£¬È»ºópostÒ»¸öopen fileÏûÏ¢¸ø×Ô¼º
£¬¾Í´ïµ½Ä¿µÄÁË£¬¹Ø¼üµÄµØ·½ÊÇÈçºÎµÃµ½PostMessageAµÄhwndÄØ£¿Õâ¸öhwndÊÇw32asm muneµÄid£¬windows³ÌÐòÔ±¶¼ÖªµÀsetmenuµÄº¯Êý°É£¬ÎÒÃÇ϶ϵãbpx setmenu£¬¿´µ½Ô³ÌÐòÊÇÔÚÕâÀïsetmenu
:0049CD86 8BF7 mov esi, edi
:0049CD88 56 push esi£½£½£½¡·¾Éhwnd
:0049CD89 8B0B mov ecx, dword ptr [ebx]
:0049CD8B FF710C push [ecx+0C]£½£½¡·ÐÂhwnd
* Reference To: user32.SetMenu, Ord:0221h
|
:0049CD8E E865230100 Call 004AF0F8
:0049CD93 85C0 test eax, eax
ÎÒÃÇÒª×öµÄÊÂÇé¾ÍÊDZ£´æÕâ¸öеÄhwnd£¬ÒÔ±äPostMessageAµÄʱºòÓõ½
:0049CD8E E865230100 Call 004AF0F8
¸ÄΪ£º
0049CD8E: E97D250100 jmp .0004AF310 -----µ½ÎÒÃÇ×Ô¼º±£´æhwndµÄ´úÂë
×Ô¼º±£´æhwndµÄ´úÂ룺
004AF310: 58 pop eax£½£½¡·È¡³öhwnd
004AF311: A3CAF24A00 mov [004AF2CA],eax£½£½¡·±£´æÔÚ[004AF2CA]£¬ÒÔ±ãÓõ½µÄʱºòÔÚÕâÀïÈ¡»Ø
004AF316: 50 push eax
004AF317: E8DCFDFFFF call .0004AF0F8 -----call setmenu
004AF31C: E972DAFEFF jmp .00049CD93 -----»Øµ½³ÌÐòÔÀ´µØ·½
004AF321: 0000 add [eax],al
004AF323: 0000 add [eax],al
004AF325: 0000 add [eax],al
ÏÖÔÚhwndÒ²ÓÐÁË£¬¶øÇÒDragQueryFile»á·µ»Ø´ò¿ªÎļþµÄ×Ö½Ú£¬ÍêÈ«ºÍGetPrivateProfileStringA·µ»ØµÄÒ»Ñù£¬Ò²¾ÍÊÇÔÚÔÀ´GetPrivateProfileStringA´¦¸ÄΪDragQueryFile¾Íok£¬ÄÇôÆäËûµÄPostMessageA¡¢lstrcpyA¡¢SetCurrentDirectoryA¡¢lstrcmpiAµÄcallµ½ÄÇÀïÈ¥ÕÒÄØ£¬Èç¹ûÄÜ¿´µ½import±í¾ÍÖ±½Ó´Óimport±íÕÒ£¬µ«ÊÇÕâ¸öÍÑ¿Ç°æµÄÎÞimport±íÕæÊÇÂé·³£¬Ã»Óа취£¬Ï¶ϵãÒ»¸öÒ»¸ö¿´£¬ÏÈÀ´bpx postmessagea
Ô³ÌÐòÖжÏÔÚ
:00453402 E85DBD0500 Call 004AF164£½£½¡·Õâ¸ö¾ÍÊÇcall postmessagea
ÆäËû¼¸¸öº¯ÊýÈçÏ£º
postmessagea :00453402 E85DBD0500 Call 004AF164
lstrcpyA :00451C49 E80CD00500 Call 004AEC5A
SetCurrentDirectoryA :0043E679 E8B8050700 Call 004AEC36
lstrcmpiA :0043E468 E815070700 Call 004AEB82
ºÃÁËÏÖÔÚÐèÒªµÄº¯ÊýµØÖ·Ò²ÓÐÁË£¬ÎÒÃÇ¿ªÊ¼²¹¶¡
004AF330: 3D0A020000 cmp eax,00000020A ;" £½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊǹöÂÖ
"
004AF335: 7415 je .0004AF34C ----- (1)£½£½ÊǵĻ°×ªµ½¹öÂÖ´¦Àí
004AF337: 3D33020000 cmp eax,000000233 ;" 3"£½£½¡·±È½ÏÏûÏ¢ÊÇ·ñÊÇÍÏ·ÅÎļþ
004AF33C: 7400 je .0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
ÏÈ°Ñ
004AF33C: 7400 je .0004AF33E ----- (2)£½£½¡·ÊǵĻ°¾Íתµ½£¨ÍÏ·ÅÎļþµÄ´¦Àí£©
¸Ä³É£º
004AF33C: 7442 je .0004AF380 -----µ÷µ½´¦ÀíÍϷŵÄ×Ó³ÌÐòÖÐ
´¦ÀíÍϷŵÄ×Ó³ÌÐò£º
*Õâ¶Î³ÌÐò¾ÍÊDzÎÕÕÔÀ´´¦Àí³ÌÐòдµÄ
004AF380: FF7608 push d,[esi][08]
004AF383: 8F05CEF24A00 pop d,[004AF2CE]==>±£´æÍϷŵÄhDropµ½[004AF2CE]
004AF389: 6800010000 push 000000100 ;" "==>»º³åÇøΪ100ËùÒÔ²»ÒªÍ϶¯Â·¾¶³¤¶È´óÓÚ256µÄÎļþŶ£¬¿ÉÄÜÒª³ö´í
004AF38E: 68575A0410 push 010045A57 ;"ZW"£½£½¡·±£´æÎļþÃû³ÆµÄµØÖ·
004AF393: 6A00 push 000£½£½¡·UINT iFile
004AF395: FF35CEF24A00 push d,[004AF2CE]£½£½¡·push hDrop
004AF39B: E81AFFFFFF call DragQueryFile ;SHELL32.dll£½£½¡·µÃµ½Í϶¯µÄÎļþÃû
004AF3A0: A3305A0410 mov [10045A30],eax£½£½¡··µ»ØµÄ×Ö½ÚÊý±£´æ£¬ÒÔ϶¼ÊÇÄ£·ÂÔÀ´³ÌÐòµÄ¶¯×÷£¬ÉÏÃæÒѾÓзÖÎö£¬ÎҾͲ»ÏêϸµÄ˵Ã÷ÁË
004AF3A5: 68575A0410 push 010045A57 ;"ZW"
004AF3AA: 68455A0410 push 010045A45 ;"ZE"
004AF3AF: E8CEF7FFFF call .0004AEB82 ----- (2)£½£½¡·call lstrcmpiA
004AF3B4: 0BC0 or eax,eax
004AF3B6: 0F846A32FAFF je .000452626 ----- (3)£½£½¡·Èç¹ûΪÁã¾ÍÖ±½ÓÍ˳ö£¬Ô¶¯×÷ÊÇÖ±½Óret£¬ÎÒÃǾÍÖ±½Ó·µ»Ø
004AF3BC: 6660 pusha£½£½¡·±£´æËùÓеļĴæÆ÷£¬ÒòΪÏÂÃæÒªÓõ½esiµÈ£¬ËùÒÔÏÖÔÚÏȱ£´æÖ®
004AF3BE: BF575A0410 mov edi,010045A57 ;"ZW"
004AF3C3: 8B0D305A0410 mov ecx,[10045A30]
004AF3C9: 8BF7 mov esi,edi
004AF3CB: 03F9 add edi,ecx
004AF3CD: FD std
004AF3CE: B05C mov al,05C ;"\"
004AF3D0: F2AE repne scasb
004AF3D2: 85C9 test ecx,ecx
004AF3D4: 741D je .0004AF3F3 ----- (4)
004AF3D6: 83C702 add edi,002 ;""
004AF3D9: C647FF00 mov b,[edi][-01],000 ;" "
004AF3DD: 3BFE cmp edi,esi
004AF3DF: 7412 je .0004AF3F3 ----- (1)
004AF3E1: 56 push esi
004AF3E2: E84FF8FFFF call .0004AEC36 ----- (2)¾ÍÊÇcall SetCurrentDirectoryA
004AF3E7: 57 push edi
004AF3E8: 68575A0410 push 010045A57 ;"ZW"
004AF3ED: 90 nop
004AF3EE: E867F8FFFF call .0004AEC5A ----- (3)¾ÍÊÇ call lstrcpyA
004AF3F3: 68575A0410 push 010045A57 ;"ZW"
004AF3F8: 68515E0410 push 010045E51 ;"^Q"
004AF3FD: E858F8FFFF call .0004AEC5A ----- (4)¾ÍÊÇ call lstrcpyA
004AF402: C605505E041002 mov b,[10045E50],002 ;""
004AF409: 6A00 push 000
004AF40B: 680C5F0000 push 000005F0C ;" _
004AF410: 6811010000 push 000000111 ;" "
004AF415: A1CAF24A00 mov eax,[004AF2CA]£½£½¡·Õâ¸ö¾ÍÊÇÎÒÃÇÔÚsetmenu±£´æµÄhwnd
004AF41A: 50 push eax
004AF41B: E844FDFFFF call .0004AF164 ----- (5)¾ÍÊÇ call postmessagea
004AF420: FF35CEF24A00 push d,[004AF2CE]£½£½¡·Õâ¸öÊDZ£´æµÄ hDrop£¬
004AF426: E895FEFFFF call DragFinish ;SHELL32.dll£½£½¡·ÍÏ·Å´¦ÀíÍêºóÒªÊÍ·ÅhDrop£¬µ÷ÓÃDragFinish
004AF42B: 6661 popa »Ö¸´¶ÑÕ»
004AF42D: E9F431FAFF jmp .000452626 ----- (7)Ìø»ØÔ´¦ÀíµØ·½
ºÃÁ˵½ÏÖÔÚΪֹÎÒÃÇdiy¼ÓÇ¿°æµÄw32asmÒѾ³öÀ´ÁË£¬´ó¼ÒÏíÊÜÒ»ÏÂÀͶ¯³É¹û°É£¬Èç¹ûÓÐÐËȤµÄ»°£¬»¹¿É¸øw32asm×öºÜ¶à¸ÄÔ죬ʹ֮¸ü¼ÓÊʺÏÓë
ÎÒÃÇ×Ô¼ºµÄ¹¤×÷Ï°¹ß¡£ÎÒÒѾ°Ñ·½·¨ºÍÔÀí¶¼½Ì¸ø´ó¼ÒÁË£¬ÓÐË×ö³ö¸ü¼ÓpowerµÄ°æ±¾£¬¼ÇµÃ¸øÎÒÒ»·ÝŶ,´Ë³ÌÐòÔÚ98ϲâÊԳɹ¦£¬2000ÏÂÎÒÏëÓ¦¸Ã²»»á³É¹¦£¬ÒòΪ2000ϵÄÍϷź¯Êý²»Í¬£¬ÓÐÐËȤµÄÈË¿ÉÒÔÔÚÀïÃæ¼ÓÉÏgetversionº¯ÊýÅжÏÊÇ98»¹ÊÇ2000,Èç¹ûÊÇ2000ÏÂÓÃÁíÍâÒ»Ì׺¯ÊýʵÏÖ¡£ÎÒ×Ô¼ººÜÉÙÔÚ2000ÏÂʹÓÃw32asmËùÒÔÎҾͲ»×öÁË,¾Íµ±Áô¸ø´ó¼ÒµÄ×÷Òµ°É
-----------------------------------------
ÓÖ¶Ô¹öÂÖ¹¦ÄܸĶ¯ÁËÒ»·¬¡£Õâʱ¹ö¶¯µÄËÙ¶ÈÇ÷ÓÚÕý³£»¯£¬²»ÔÙÄÇôÂýÁË¡£ÄãÖ»Òª¸ü¸ÄÆäÖеÄÒ»¸ö×Ö½Ú£¬¾ÍÄܸıä¹ö¶¯Ëٶȡ£²»¹ý³ÌÐò´úÂë±ÈÔÀ´´óÁË2¸ö×Ö½Ú£¬ºÇºÇ¡£
»ù±¾Ë¼Â·£º
½«ÔÀ´ÀÏ´óµÄ°´ÏòϼýÍ·µÄÏûÏ¢Öض¨Ïò¸ÄΪÁËʵʵÔÚÔÚµÄWM_MOUSEWHEEL£¬¶Ô´°¿Ú·¢ËÍÁËWM_VSCROLLÏûÏ¢£¬¼´×ÝÏò¹ö¶¯Ìõ¹ö¶¯µÄÏûÏ¢¡£²éMSDN£¬ÕÒµ½WM_VSCROLLºÍWM_MOUSEWHEELµÄÏà¹Ø²ÎÊý£º
1¡¢WM_VSCROLL:
WM_VSCROLL nScrollCode = (int)LOWORD(wParam);
nPos = (short int)HIWORD(wParam);
hwndScrollBar = (HWND) lParam;
µÚÒ»¸ö²ÎÊýÓëÎÒÃǵijÌÐò¹ØϵÃÜÇУ¬×÷Ò»ÏÂ˵Ã÷£º
nScrollCode:
SB_BOTTOM Scrolls to the lower right
SB_ENDSCROLL Ends scroll
SB_LINEDOWN Scrolls one line down
SB_LINEUP Scrolls one line up
SB_PAGEDOWN Scrolls one page down
SB_PAGEUP Scrolls one page up
SB_THUMBPOSITION The user has dragged the scroll box (thumb) and released the mouse button. The nPos parameter indicates the position of the scroll box at the end of the drag operation.
SB_THUMBTRACK The user is dragging the scroll box. This message is sent repeatedly until the user releases the mouse button. The nPos parameter indicates the position that the scroll box has been dragged to.
SB_TOP Scrolls to the upper left
ÆäÖÐÓëÎÒÃÇÏà¹ØµÄ³£Á¿µÄÖµÊÇÕâÑù¶¨ÒåµÄ£¬ÔÚwindows.incÀïÃæÓУº
WM_VSCROLL equ 115h
SB_LINEUP equ 0
SB_LINEDOWN equ 1
2¡¢WM_MOUSEWHEEL
fwKeys = LOWORD(wParam);
zDelta = HIWORD(wParam);
xPos = LOWORD(lParam);
yPos = HIWORD(lParam);
ÆäÖÐÎÒÃÇ×î¹ØÐĵÄÊǵڶþ¸ö²ÎÊý£¬¼´zDelta£¬ËüÊÇÒ»¸öDWORD²ÎÊýµÄ¸ß16룬ÔÚC³ÌÐòÀïÃæÊÇword ptr [esi+0Ah]£¬Ëü±íʾÁËÊó±ê¹ö¶¯µÄ¾àÀë¡£Õâ¸ö²ÎÊýÊÇÕâÑù˵Ã÷µÄ£º
zDelta
Indicates that the mouse wheel was pressed, expressed in multiples or divisions of WHEEL_DELTA, which is 120. (±ÊÕß×¢£º120¼´78H£¬Èç¹ûÕýÏò¹ö¶¯Îª78H£¬·´Ïò¹ö¶¯Îª-78H£¬ÔÚ»úÆ÷ÀïÃæÒÔ²¹Âë±íʾΪ10000h-78h=0ff88h£¬Õâ¾ÍÊÇÀÏ´ó¸ú×ٵõ½µÄÁ½¸öÖµ¡£)
:004AF34C 60 pushad ;±£´æËùÓеļĴæÆ÷
:004AF34D 668B460A mov ax, word ptr [esi+0A] ;È¡³özDeltaÖµ
:004AF351 98 cwde ;·ûºÅλÀ©Õ¹axµ½eax
:004AF352 99 cdq ;ÔÙ½«·ûºÅÀ©Õ¹eaxµ½edx£¬ÕâÀï¼°xor eax,edx sub eax,edxÈý¾äÊÇΪÁËÇózDeltaµÄ¾ø¶ÔÖµ¡£¾ßÌåÔÀí×Ô¼ºÏë°É¡£
:004AF353 33C2 xor eax, edx
:004AF355 2BC2 sub eax, edx
:004AF357 F7DA neg edx ;edx×÷ΪWM_VSCROLLÀïÃæµÄnScrollCode+10000h*nPos£¬ÕâÀïnPos¿ÉΪ0£¬Êµ¼Ê¾ÍÊÇnScrollCode¡£Èç¹û¹ö¶¯·½ÏòΪÕý£¬edxΪ0£¬¼´SB_LINEUP,·ñÔòΪnot ffffffff=1£¬¼´SB_LINEDOWN¡£
;ÒÔϵÄÑ»·°´zDelta¶Ô78hµÄ±¶ÊýÖµ£¬Öظ´Ïò´°¿Ú·¢ËÍWM_VSCROLLÏûÏ¢£º
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004AF36F(C)
|
:004AF359 52 push edx ;Ïȱ£´ænScrollCodeÖµ£¬ÒÔÃâµ÷ÓÃPostMessageʱ°ÑedxÆÆ»µ¡£
:004AF35A 50 push eax ;ͬÑùµÀÀí£¬±£´æzDeltaÖµ¡£
:004AF35B 6A00 push 00000000 ;hwndScrollBar£¬Îª0
:004AF35D 52 push edx ;nScrollCode
:004AF35E 6815010000 push 00000115 ;WM_VSCROLLÏûÏ¢
:004AF363 FF36 push dword ptr [esi] ;´°¿ÚµÄHandle¡£ÔÚCÀïÊÇÕâÑùµÄ£¬²»ÒªÎÊΪʲô£º)
:004AF365 E83449B90F call 10043C9E ;PostMessageº¯Êý¡£
:004AF36A 58 pop eax ;ÒÔÏÂÁ½¾äµ¯³ö±£´æµÄÁ½¸öÖØÒªÖµ
:004AF36B 5A pop edx
:004AF36C 83E878 sub eax, 00000078 ;¼õÈ¥Ò»¸ö±ê׼λÒÆÁ¿¡£Èç¹ûÄãÏÓËü»¹ÊÇÌ«Âý£¬¸Ä78hΪ¸üСµÄÒ»¸öÊýÖµ¡£²»¹ý×îºÃÊÇ78hµÄ×ÓÒòÊý¡£ÕâÑùÊæ·þЩ¡£
:004AF36F 77E8 ja 004AF359 ;û¼õÍêÔòÖظ´·¢ËÍÏÂÒ»¸öWM_VSCROLLÏûÏ¢¡£
:004AF371 61 popad
:004AF372 EBCE jmp 004AF342 ;תÈëÔ³ÌÐòÁ÷³Ì¡£
=================================================================================================
ÀÏ´óÔÎÄ£º
004AF34C: 668B460A mov ax,[esi][0A]£½£½¡·È¡³ö¹öÂÖµÄ×Ó²ÎÊý
004AF350: 663DFF00 cmp ax,000FF ;" ÿ"£½£½¡·±È½ÏÊÇÏòÉϹö»¹ÊÇÏòϹö
004AF354: 720A jb .0004AF360 ----- (4)
004AF356: B828000000 mov eax,000000028 ;" ("£½£½¡·ÏòϹö¶¯£¬¸Ä¶¯ÏûÏ¢×Ó²ÎÊýΪ°´¼üÏÂ
004AF35B: 894608 mov [esi][08],eax &nb
Ïà¹ØÔĶÁ
Windows´íÎó´úÂë´óÈ« Windows´íÎó´úÂë²éѯ¼¤»îwindowsÓÐʲôÓÃMac QQºÍWindows QQÁÄÌì¼Ç¼ÔõôºÏ²¢ Mac QQºÍWindows QQÁÄÌì¼Ç¼Windows 10×Ô¶¯¸üÐÂÔõô¹Ø±Õ ÈçºÎ¹Ø±ÕWindows 10×Ô¶¯¸üÐÂwindows 10 rs4¿ìËÙÔ¤ÀÀ°æ17017ÏÂÔØ´íÎóÎÊÌâWin10Çï¼¾´´ÒâÕ߸üÐÂ16291¸üÐÂÁËʲô win10 16291¸üÐÂÄÚÈÝwindows10Çï¼¾´´ÒâÕ߸üÐÂʱ¼ä windows10Çï¼¾´´ÒâÕ߸üÐÂÄÚÈÝkb3150513²¹¶¡¸üÐÂÁËʲô Windows 10²¹¶¡kb3150513ÊÇʲô
-
ÈÈÃÅÎÄÕÂ
È¥³ýwinrar×¢²á¿ò·½·¨
×îÐÂÎÄÕÂ
±ÈÌرҲ¡¶¾ÔõôÆƽ⠱ÈÈ¥³ýwinrar×¢²á¿ò·½·¨
»ªÎªÎÞÏß·ÓÉÆ÷HG522-CÆƽâ½Ì³Ì(¸½³¬¼¶ÃÜÂëJEB¸ñʽÎļþ¾©¶«µç×ÓÊéÏÂÔغÍÔĶÁÏÞÖÆÆƽâ½ÌUltraISO×¢²áÂëÈ«¼¯(×îÐÂ)ͨ¹ýAccessÆƽâMSSQL»ñµÃÊý¾Ý
ÈËÆøÅÅÐÐ
»ªÎªÎÞÏß·ÓÉÆ÷HG522-CÆƽâ½Ì³Ì(¸½³¬¼¶ÃÜÂëJEB¸ñʽÎļþ¾©¶«µç×ÓÊéÏÂÔغÍÔĶÁÏÞÖÆÆƽâ½ÌUltraISO×¢²áÂëÈ«¼¯(×îÐÂ)qqÏà²áÃÜÂëÆƽⷽ·¨È¥³ýwinrar×¢²á¿ò·½·¨(ÊÊÓ¦Èκΰ汾)ÔõôÓÃÊÖ»úÆƽâÊÕ·ÑÓÎÏ·»ªÎªÎÞÏßèHG522ÆƽâÈçºÎ¸øÈí¼þÍÑ¿Ç»ù´¡½Ì³Ì
²é¿´ËùÓÐ0ÌõÆÀÂÛ>>