攻擂: Unlock (1千字)
尚未成功. 但似乎程序并不在乎输入的是什么,而是所输字串的长度. 下面的这段代码是关键.* Reference To: MSVBVM50.__vbaLenBstr, Ord:0000h
|
:0041333E E8A1DEFEFF Call 004011E4
:00413343 69C04D010000 imul eax, 0000014D <-字串的长度乘以333
:00413349 898560FFFFFF mov dword ptr [ebp+FFFFFF60], eax
:0041334F DB8560FFFFFF fild dword ptr [ebp+FFFFFF60]<-这里
用WF打开浮点寄存器窗,好象TRW2000不行
:00413355 DC3560104000 fdiv qword ptr [00401060]
:0041335B DC3568104000 fdiv qword ptr [00401068]
:00413361 DC2570104000 fsub qword ptr [00401070]
:00413367 DC2578104000 fsub qword ptr [00401078]
:0041336D DC2590104000 fsub qword ptr [00401090]
:00413373 DD1D4C404100 fstp qword ptr [0041404C]
:00413379 DD0544404100 fld qword ptr [00414044]
:0041337F DC1D98104000 fcomp qword ptr [00401098]<-比较
:00413385 DFE0 fstsw ax
:00413387 9E sahf
:00413388 7528 jne 004133B2 <-这里如果不跳,且eax=0即可
:0041338A 833DAC44410000 cmp dword ptr [004144AC], 00000000
:00413391 750F jne 004133A2
