| |
 Mostrar Mensajes
|
|
Páginas: 1 [2] 3
|
|
11
|
Programación / Ingeniería Inversa / Re: Alguien me explica esto...soy novato
|
en: 14 Noviembre 2011, 15:45 pm
|
|
Gracias Adastra y Иōҳ por responder, vereis yo algo ya se, la cuestion es que si entro en la llamada:
10139828 E8F6FAFFFF call 10139323
que me manda aqui:
* Referenced by a CALL at Address:
|:10139828
|
:10139323 55 push ebp
:10139324 8BEC mov ebp, esp
:10139326 51 push ecx
:10139327 51 push ecx
:10139328 837D0C01 cmp dword ptr [ebp+0C], 00000001
:1013932C 56 push esi
:1013932D 0F8593000000 jne 101393C6
:10139333 53 push ebx
:10139334 57 push edi
:10139335 33FF xor edi, edi
:10139337 897D0C mov dword ptr [ebp+0C], edi
:1013933A E815060000 call 10139954
:1013933F E80A060000 call 1013994E
:10139344 57 push edi
* Possible Reference to Dialog:
|
:10139345 68AC121F10 push 101F12AC
:1013934A 57 push edi
:1013934B 8BF0 mov esi, eax
:1013934D FF7508 push [ebp+08]
:10139350 8B5E08 mov ebx, dword ptr [esi+08]
:10139353 E8F0050000 call 10139948
:10139358 85C0 test eax, eax
:1013935A 741E je 1013937A
:1013935C E891F8FFFF call 10138BF2
:10139361 8B7804 mov edi, dword ptr [eax+04]
:10139364 85FF test edi, edi
:10139366 7419 je 10139381
:10139368 8B07 mov eax, dword ptr [edi]
:1013936A 8BCF mov ecx, edi
:1013936C FF5058 call [eax+58]
:1013936F 85C0 test eax, eax
:10139371 750E jne 10139381
:10139373 8B07 mov eax, dword ptr [edi]
:10139375 8BCF mov ecx, edi
:10139377 FF5070 call [eax+70]
y cambio el jne por un je en :1013932D
entro al programa y todo el menu me funciona bien, excepto un icono de dcho menu que si le doy se me sale el programa, con lo cual quiere decir que estoy muy cerca de conseguirlo y es por eso el descifrar esa parte del codigo, que algo se me estara pasando.
Un salu2
|
|
|
|
|
13
|
Programación / Ingeniería Inversa / Alguien me explica esto...soy novato
|
en: 14 Noviembre 2011, 11:09 am
|
|
//******************** Program Entry Point ********
:101397DD 55 push ebp
:101397DE 8BEC mov ebp, esp
:101397E0 53 push ebx
:101397E1 8B5D08 mov ebx, dword ptr [ebp+08]
:101397E4 56 push esi
:101397E5 8B750C mov esi, dword ptr [ebp+0C]
:101397E8 57 push edi
:101397E9 8B7D10 mov edi, dword ptr [ebp+10]
:101397EC 85F6 test esi, esi
:101397EE 7509 jne 101397F9
:101397F0 833D7CF8281000 cmp dword ptr [1028F87C], 00000000
:101397F7 EB26 jmp 1013981F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:101397EE(C)
|
:101397F9 83FE01 cmp esi, 00000001
:101397FC 7405 je 10139803
:101397FE 83FE02 cmp esi, 00000002
:10139801 7522 jne 10139825
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:101397FC(C)
|
* Possible StringData Ref from Code Obj ->""
|
:10139803 A1A00F1F10 mov eax, dword ptr [101F0FA0]
:10139808 85C0 test eax, eax
:1013980A 7409 je 10139815
:1013980C 57 push edi
:1013980D 56 push esi
:1013980E 53 push ebx
:1013980F FFD0 call eax
:10139811 85C0 test eax, eax
:10139813 740C je 10139821
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1013980A(C)
|
:10139815 57 push edi
:10139816 56 push esi
:10139817 53 push ebx
:10139818 E815FFFFFF call 10139732
:1013981D 85C0 test eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:101397F7(U)
|
:1013981F 7504 jne 10139825
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10139813(C)
|
:10139821 33C0 xor eax, eax
:10139823 EB4E jmp 10139873
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:10139801(C), :1013981F(C)
|
:10139825 57 push edi
:10139826 56 push esi
:10139827 53 push ebx
:10139828 E8F6FAFFFF call 10139323
:1013982D 83FE01 cmp esi, 00000001
:10139830 89450C mov dword ptr [ebp+0C], eax
:10139833 750C jne 10139841
:10139835 85C0 test eax, eax
:10139837 7537 jne 10139870
:10139839 57 push edi
:1013983A 50 push eax
:1013983B 53 push ebx
:1013983C E8F1FEFFFF call 10139732
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10139833(C)
|
:10139841 85F6 test esi, esi
:10139843 7405 je 1013984A
:10139845 83FE03 cmp esi, 00000003
:10139848 7526 jne 10139870
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10139843(C)
|
:1013984A 57 push edi
:1013984B 56 push esi
:1013984C 53 push ebx
:1013984D E8E0FEFFFF call 10139732
:10139852 85C0 test eax, eax
:10139854 7503 jne 10139859
:10139856 21450C and dword ptr [ebp+0C], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10139854(C)
|
:10139859 837D0C00 cmp dword ptr [ebp+0C], 00000000
:1013985D 7411 je 10139870
* Possible StringData Ref from Code Obj ->""
|
:1013985F A1A00F1F10 mov eax, dword ptr [101F0FA0]
:10139864 85C0 test eax, eax
:10139866 7408 je 10139870
:10139868 57 push edi
:10139869 56 push esi
:1013986A 53 push ebx
:1013986B FFD0 call eax
:1013986D 89450C mov dword ptr [ebp+0C], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:10139837(C), :10139848(C), :1013985D(C), :10139866(C)
|
:10139870 8B450C mov eax, dword ptr [ebp+0C]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10139823(U)
|
:10139873 5F pop edi
:10139874 5E pop esi
:10139875 5B pop ebx
:10139876 5D pop ebp
:10139877 C20C00 ret 000C
|
|
|
|
|
17
|
Programación / Ingeniería Inversa / Una pregunta
|
en: 17 Octubre 2011, 15:37 pm
|
|
Hola a todos, vereis tengo un software que usa mochila aladin, cuando ejecuto el exe el mensaje que me aparece "key not found" lo gestiona una dll que esta empacada, mi pregunta es que si para saltarse la proteccion hay que desempacar la dll obligatoriamente o se puede hacer a traves del exe que no esta empacado.
Un salu2 y gracias de antemano
|
|
|
|
|
|
| |
|
