morning伸请加入BCG破文之三 (6千字)
morning伸请加入BCG破文之三目标软件：聊天圣手之增强版2.0 For OICQ2000 作者主页：HeadTec.MyEtang.com
实验工具：TRW1.23
这个软件是用来聊天的，不注册的话发50条信息就不行了。
实验过程：
1。启动聊天圣手，点注册
2。在注册名处填morning，注册码：12345678
3。启动TRW1.23,按CTRL+N 呼出TRW,下BPX HMEMCPY,F5返回目标,按下注册，被TRW拦下
4。按F10无数，直到下面：
015F:0040658E AND ECX,BYTE +01
015F:00406591 MOV EDX,02
015F:00406596 PUSH ECX
015F:00406597 DEC DWORD [EBP-30]
015F:0040659A CALL 0047BA4C 〈-----④呵呵~~秘密一定是在这个CALL里啦，按F9，然后再注册一次
015F:0040659F DEC DWORD [EBP-30] 在这里拦下后按F8进入，代码在下面
015F:004065A2 LEA EAX,[EBP-10]
015F:004065A5 MOV EDX,02
015F:004065AA CALL 0047BA4C
015F:004065AF POP ECX 〈-------------③哦，有个POP所以上面的CALL就不进啦
015F:004065B0 TEST CL,CL 《----------②呵呵~~有个判断，再向上看
015F:004065B2 JZ NEAR 00406708 〈-------另：把里改成JNZ可以出现成功对话框，但实际上
015F:004065B8 MOV DL,01 并没有成功，大概是另有暗桩，所以在这里用
015F:004065BA MOV EAX,[004216F8] 爆破法不可取。
015F:004065BF CALL 004217F8
015F:004065C4 MOV EBX,EAX
015F:004065C6 MOV EAX,[EBP-50]
015F:004065C9 MOV [EAX+0310],EBX
015F:004065CF MOV EAX,EBX
015F:004065D1 MOV EDX,80000002
015F:004065D6 CALL 0047B81C
015F:004065DB MOV WORD [EBP-3C],38
015F:004065E1 MOV EDX,0047FC93
015F:004065E6 LEA EAX,[EBP-18]
015F:004065E9 CALL 0047B8A8
015F:004065EE INC DWORD [EBP-30]
015F:004065F1 MOV CL,01
015F:004065F3 MOV EDX,[EAX]
015F:004065F5 MOV EAX,[EBP-50]
015F:004065F8 MOV EAX,[EAX+0310]
015F:004065FE CALL 004218FC
015F:00406603 DEC DWORD [EBP-30]
015F:00406606 LEA EAX,[EBP-18]
015F:00406609 MOV EDX,02
015F:0040660E CALL 0047BA4C
015F:00406613 XOR ECX,ECX
015F:00406615 MOV [EBP-20],ECX
015F:00406618 LEA EDX,[EBP-20]
015F:0040661B INC DWORD [EBP-30]
015F:0040661E MOV EAX,[EBP-50]
015F:00406621 MOV EAX,[EAX+02E0]
015F:00406627 CALL 0044EE04
015F:0040662C LEA EDX,[EBP-20]
015F:0040662F LEA EAX,[EBP-1C]
015F:00406632 MOV ECX,[EDX]
015F:00406634 MOV EDX,0047FCB4
015F:00406639 PUSH ECX
015F:0040663A MOV WORD [EBP-3C],44
015F:00406640 CALL 0047B8A8
015F:00406645 INC DWORD [EBP-30]
015F:00406648 MOV EDX,[EAX]
015F:0040664A MOV EAX,[EBP-50]
015F:0040664D MOV EAX,[EAX+0310]
015F:00406653 POP ECX
015F:00406654 CALL 00421A98
015F:00406659 DEC DWORD [EBP-30]
015F:0040665C LEA EAX,[EBP-20]
015F:0040665F MOV EDX,02
015F:00406664 CALL 0047BA4C
015F:00406669 DEC DWORD [EBP-30]
015F:0040666C LEA EAX,[EBP-1C]
015F:0040666F MOV EDX,02
015F:00406674 CALL 0047BA4C
015F:00406679 XOR ECX,ECX
015F:0040667B MOV [EBP-28],ECX
015F:0040667E LEA EDX,[EBP-28]
015F:00406681 INC DWORD [EBP-30]
015F:00406684 MOV EAX,[EBP-50]
015F:00406687 MOV EAX,[EAX+02E8]
015F:0040668D CALL 0044EE04
015F:00406692 LEA EDX,[EBP-28]
015F:00406695 LEA EAX,[EBP-24]
015F:00406698 MOV ECX,[EDX]
015F:0040669A MOV EDX,0047FCBE
015F:0040669F PUSH ECX
015F:004066A0 MOV WORD [EBP-3C],50
015F:004066A6 CALL 0047B8A8
015F:004066AB INC DWORD [EBP-30]
015F:004066AE MOV EDX,[EAX]
015F:004066B0 MOV EAX,[EBP-50]
015F:004066B3 MOV EAX,[EAX+0310]
015F:004066B9 POP ECX
015F:004066BA CALL 00421A98
015F:004066BF DEC DWORD [EBP-30]
015F:004066C2 LEA EAX,[EBP-28]
015F:004066C5 MOV EDX,02
015F:004066CA CALL 0047BA4C
015F:004066CF DEC DWORD [EBP-30]
015F:004066D2 LEA EAX,[EBP-24]
015F:004066D5 MOV EDX,02
015F:004066DA CALL 0047BA4C
015F:004066DF MOV ECX,[EBP-50]
015F:004066E2 MOV EAX,[ECX+0310]
015F:004066E8 CALL 00421868
015F:004066ED MOV EAX,[00486608]
015F:004066F2 PUSH BYTE +00
015F:004066F4 MOV ECX,0047FCC9
015F:004066F9 LEA EDX,[EBP+FFFFFDA8]
015F:004066FF MOV EAX,[EAX]
015F:00406701 CALL 0047B7E4
015F:00406706 JMP SHORT 00406720
015F:00406708 MOV EAX,[00486608]
015F:0040670D PUSH BYTE +00
015F:0040670F MOV ECX,0047FCFB
015F:00406714 MOV EDX,0047FCD8
015F:00406719 MOV EAX,[EAX]
015f:00406719 CALL 0047B7E4 《--------------①⑦⑧⑨⑩到这里就完了，所以就向上找
================================================================================
在015F:0040659A CALL 0047BA4C 处进入后看到：
-------------------------------------------------------------------------------
015F:0047BA4C PUSH EBP
015F:0047BA4D MOV EBP,ESP
015F:0047BA4F PUSH ECX
015F:0047BA50 PUSH EBX
015F:0047BA51 PUSH ESI
015F:0047BA52 MOV ESI,EDX
015F:0047BA54 MOV [EBP-04],EAX
015F:0047BA57 CMP DWORD [EBP-04],BYTE +00
015F:0047BA5B JZ 0047BA76
015F:0047BA5D MOV EAX,[EBP-04]
015F:0047BA60 CALL 0046DE98 〈---------⑤在这里下断点，再注册一次，来到这里后F8进入，代码在下面
015F:0047BA65 TEST ESI,01《------------④？这里还有个测试？？进上面的CALL里看看
015F:0047BA6B JZ 0047BA76
015F:0047BA6D PUSH DWORD [EBP-04]
015F:0047BA70 CALL 0046FB0C
015F:0047BA75 POP ECX
015F:0047BA76 POP ESI
015F:0047BA77 POP EBX
015F:0047BA78 POP ECX
015F:0047BA79 POP EBP
——————————————————————————————————————————
在015F:0047BA60 CALL 0046DE98 处进入后看到：
####################################################################################
015F:0046DE98 MOV EDX,[EAX]
015F:0046DE9A TEST EDX,EDX 〈-------⑥在这里下D EDX，呵呵~~这就是想要的东东啦~~
015F:0046DE9C JZ 0046DEBA
015F:0046DE9E MOV DWORD [EAX],00
015F:0046DEA4 MOV ECX,[EDX-08]
015F:0046DEA7 DEC ECX
015F:0046DEA8 JL 0046DEBA
015F:0046DEAA LOCK DEC DWORD [EDX-08]
015F:0046DEAE JNZ 0046DEBA
015F:0046DEB0 PUSH EAX
015F:0046DEB1 LEA EAX,[EDX-08]
015F:0046DEB4 CALL 0046CDEC
015F:0046DEB9 POP EAX
###################################################################################
=====================================================================================
总结：这个东东用了两层CALL所以在破时易使人迷失方向，呵呵~~本人就被它骗了好长时间。本来
想用它写第一篇的，结果在写第三篇时才破了它。
