|
主程序下载地址：
完整版(15M)：http://www.hippo.ru/~sorgelig/files/MyTheatre.v3.12.exe
迷你版(6M)：http://www.hippo.ru/~sorgelig/files/MyTheatre.v3.12.lite.exe
使用工具WIN2000，ollydbg1.10a，import Rec 1.6，PIED092，LordPE。
我采取的步骤：
1、使用PIED092查看主程序MyTheatre.exe为：Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks [Overlay]
2、ollydbg载入，设置BP OpenMutexA ，补丁设隐藏。
3、断下后在401000改为：609C68DCFB120033C05050E8E694A6779D61E98F9FA777，
即：
00401000 60 PUSHAD
00401001 9C PUSHFD
00401002 68 DCFB1200 PUSH 12FBDC ; ASCII "480::DAEE2CA7C8"
00401007 33C0 XOR EAX,EAX
00401009 50 PUSH EAX
0040100A 50 PUSH EAX
0040100B E8 E694A677 CALL KERNEL32.CreateMutexA
00401010 9D POPFD
00401011 61 POPAD
00401012 - E9 8F9FA777 JMP KERNEL32.OpenMutexA
4、设BP GetModuleHandleA，经过
0012EFCC 78001E96 /CALL to GetModuleHandleA from MSVCRT.78001E90
0012EFD0 780322D4 \pModule = "KERNEL32"
0012F054 77A03F02 /CALL to GetModuleHandleA from OLEAUT32.77A03EFC
0012F058 779A0630 \pModule = "kernel32.dll"
0012F048 77A072DB /CALL to GetModuleHandleA from OLEAUT32.77A072D5
0012F04C 779A0994 \pModule = "KERNEL32"
0012EF80 779A83DB /CALL to GetModuleHandleA from OLEAUT32.779A83D5
0012EF84 77A1ADA8 \pModule = "KERNEL32.DLL"
0012EF80 779A83DB /CALL to GetModuleHandleA from OLEAUT32.779A83D5
0012EF84 77A1ADA8 \pModule = "KERNEL32.DLL"
0012F540 008C3248 /CALL to GetModuleHandleA from MyTheatr.008C3242
0012F544 00000000 \pModule = NULL
返回到：
008C3240 |> \6A 00 PUSH 0 ; /pModule = NULL
008C3242 |. FF15 84F18F00 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
008C3248 |. 8945 A4 MOV DWORD PTR SS:[EBP-5C],EAX ; MyTheatr.00400000
008C324B |> 8B55 A4 MOV EDX,DWORD PTR SS:[EBP-5C]
008C324E |. 8955 E4 MOV DWORD PTR SS:[EBP-1C],EDX
008C3251 |. A1 5CF28F00 MOV EAX,DWORD PTR DS:[8FF25C]
008C3256 |. 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX
008C3259 |. C745 EC FFFFFFFF MOV DWORD PTR SS:[EBP-14],-1
008C3260 |. 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C]
008C3263 |. 51 PUSH ECX
008C3264 |. FF55 F0 CALL DWORD PTR SS:[EBP-10]
008C3267 |. 83C4 04 ADD ESP,4
008C326A |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
008C326D |. 837D EC FF CMP DWORD PTR SS:[EBP-14],-1
008C3271 |. 74 0B JE SHORT MyTheatr.008C327E
008C3273 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
008C3276 |. 8915 58549000 MOV DWORD PTR DS:[905458],EDX
008C327C |. EB 10 JMP SHORT MyTheatr.008C328E
008C327E |> 837D FC 01 CMP DWORD PTR SS:[EBP-4],1
008C3282 |. 74 0A JE SHORT MyTheatr.008C328E
008C3284 |. C705 58549000 01000000 MOV DWORD PTR DS:[905458],1
008C328E |> 837D B0 00 CMP DWORD PTR SS:[EBP-50],0
008C3292 74 0A JE SHORT MyTheatr.008C329E
008C3294 |. 8B45 B0 MOV EAX,DWORD PTR SS:[EBP-50]
008C3297 |. 50 PUSH EAX ; /hWnd
008C3298 |. FF15 0CF28F00 CALL DWORD PTR DS:[<&USER32.DestroyWindow>] ; \DestroyWindow
008C329E |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
008C32A1 |> 8BE5 MOV ESP,EBP
008C32A3 |. 5D POP EBP
008C32A4 \. C3 RETN
[1] [2] 下一页 |
