crackcode代码分享笔记(一)问题跟踪 (4千字)
以下是两位组织代号为[BCG]的回答：（感谢这两位热心的朋友）6767[BCG]
1.pop ecx应该是对应前面的那个push eax,测试call的返回值；
2.在许多程序中见过，可能与编译器有关
冷雨飘心[BCG]
1.test ecx,3->>判断是否从内存存储以4为节的地址开始,这可能是某种编译器所要求的存储方式,还有
2.是一段经典程序,估计是Vc生的代码,在于判断最后取到的四个字符是否全部为0,加7EFEFEFF
然后再XOR FFFFFFFF变反最后与81010100 比较正是起到了这种作用,你可以自己运算一下就会明白了.
于是我用vc模拟crackcode，通过strcat来实现该功能。发现用VC6编译出来，和crackcode的代码完全不
同。估计是作者使用另一函数来实现。（原因在于如果人为的去写程序，估计不会用到TEST EAX,3这段程序。）
#include <afx.h>
#include<string.h>
int main()
{
char buffer[20];
char aaa[]="/";
char bbb[]="a xia";
strcpy(buffer,"I am");
strcat(buffer,aaa);
strcat(buffer,bbb);
return 0 ;
}
00401010 56 push esi
:00401011 894C240C mov dword ptr [esp+0C], ecx
:00401015 57 push edi
:00401016 668944240E mov word ptr [esp+0E], ax
:0040101B 83C9FF or ecx, FFFFFFFF
* Possible StringData Ref from Data Obj ->"I am"
|
:0040101E BF30504000 mov edi, 00405030
:00401023 33C0 xor eax, eax
:00401025 F2 repnz
:00401026 AE scasb
:00401027 668B153C504000 mov dx, word ptr [0040503C]
:0040102E F7D1 not ecx
:00401030 2BF9 sub edi, ecx
:00401032 6689542414 mov word ptr [esp+14], dx
:00401037 8D542418 lea edx, dword ptr [esp+18]
:0040103B 8BC1 mov eax, ecx
:0040103D 8BF7 mov esi, edi
:0040103F 8BFA mov edi, edx
:00401041 C1E902 shr ecx, 02
:00401044 F3 repz
:00401045 A5 movsd
:00401046 8BC8 mov ecx, eax
:00401048 33C0 xor eax, eax
:0040104A 83E103 and ecx, 00000003
:0040104D 8D542418 lea edx, dword ptr [esp+18]
:00401051 F3 repz
:00401052 A4 movsb
:00401053 8D7C240E lea edi, dword ptr [esp+0E]
:00401057 83C9FF or ecx, FFFFFFFF
:0040105A F2 repnz
:0040105B AE scasb
:0040105C F7D1 not ecx
:0040105E 2BF9 sub edi, ecx
:00401060 8BF7 mov esi, edi
:00401062 8BD9 mov ebx, ecx
:00401064 8BFA mov edi, edx
:00401066 83C9FF or ecx, FFFFFFFF
:00401069 F2 repnz
:0040106A AE scasb
:0040106B 8BCB mov ecx, ebx
:0040106D 4F dec edi
:0040106E C1E902 shr ecx, 02
:00401071 F3 repz
:00401072 A5 movsd
:00401073 8BCB mov ecx, ebx
:00401075 8D542418 lea edx, dword ptr [esp+18]
:00401079 83E103 and ecx, 00000003
:0040107C F3 repz
:0040107D A4 movsb
:0040107E 8D7C2410 lea edi, dword ptr [esp+10]
:00401082 83C9FF or ecx, FFFFFFFF
:00401085 F2 repnz
:00401086 AE scasb
:00401087 F7D1 not ecx
:00401089 2BF9 sub edi, ecx
:0040108B 8BF7 mov esi, edi
:0040108D 8BD9 mov ebx, ecx
:0040108F 8BFA mov edi, edx
:00401091 83C9FF or ecx, FFFFFFFF
:00401094 F2 repnz
:00401095 AE scasb
:00401096 8BCB mov ecx, ebx
:00401098 4F dec edi
:00401099 C1E902 shr ecx, 02
:0040109C F3 repz
:0040109D A5 movsd
:0040109E 8BCB mov ecx, ebx
:004010A0 83E103 and ecx, 00000003
:004010A3 F3 repz
:004010A4 A4 movsb
:004010A5 5F pop edi
:004010A6 5E pop esi
:004010A7 5B pop ebx
:004010A8 83C420 add esp, 00000020
:004010AB C3 ret
今天就到这里，就到这里。。。。。。 豆豆虾
2001.8.10 15：10完成
历时：0.5个小时。
