资源描述：
《代理商工具中的软件狗核心操作部份》由会员上传分享，免费在线阅读，更多相关内容在应用文档-天天文库。
1、代理商工具中的软件狗UDA核心操作部份CALL地址：0043834Bsignedint__cdeclsub_43834B(inta1){intv1;//esi@1signedintresult;//eax@2intv3;//eax@4intv4;//eax@5charv5;//[sp+8h][bp-1ECh]@1charv6;//[sp+164h][bp-90h]@4charv7;//[sp+E4h][bp-110h]@9v1=a1;sub_435BB8(&v5,a1,218);if(dword_4A7D10==1){result=sub_43925B(&v5);if(result)r
2、eturnresult;dword_4A7D10=2;}data缓冲区指针也在，v1地址+D2是key1值，+CE是key2值loc_43840E(v1,&v6);//进行加密Call，参数v1中有首地址读取字节数等v3=sub_435CBF()-5;//v3一定要等于2，那这个call的返回值要等于7了if(v3){v4=v3-1;//v4一定要等于1if(!v4)return30003;//30003没有绑定if(v4!=1)return30001;//30001不正确的操作系统}result=sub_438BC3(&v6,&v7,v1);//有操作狗，解码过程也在里面if(res
3、ult==20023)//20023没有通过认证{result=sub_43925B(&v5);if(!result){dword_4A7D10=2;result=sub_438BC3(&v6,&v7,v1);}}returnresult;}------------------------------------------------------------------------------------------------Win32dll.dll中的00F3551D56pushesi00F3551E50pusheax00F3551FE881CAFFFFcall00F31FA50
4、0F3552483C40Caddesp,0C00F35527833D2CBCF30001cmpdwordptr[F3BC2C],100F3552E6A02push200F355305Fpopedi00F355317517jnzshort00F3554A00F355338D8514FEFFFFleaeax,dwordptr[ebp-1EC]00F3553950pusheax;写时的命令字首地址字节数什么的都在这00F3553AE8120F0000call00F3645100F3553F85C0testeax,eax00F3554159popecx00F35542757Fjnzshort0
5、0F355C300F35544893D2CBCF300movdwordptr[F3BC2C],edi00F3554A8D8570FFFFFFleaeax,dwordptr[ebp-90]00F3555050pusheax00F3555156pushesi;首地址，字节数都在这里，嘿嘿00F35552E870000000call00F355C7;进行加密00F3555759popecx00F3555859popecx00F35559E8B8CBFFFFcall00F32116;检测操作系统，正确时返回eax=700F3555E83E805subeax,500F355617414jesho
6、rt00F3557700F3556348deceax00F35564740Ajeshort00F3557000F3556648deceax00F35567740Ejeshort00F3557700F35569B831750000moveax,7531;不正确的操作系统00F3556EEB53jmpshort00F355C300F35570B833750000moveax,7533;没有绑定00F35575EB4Cjmpshort00F355C300F355778D85F0FEFFFFleaeax,dwordptr[ebp-110]00F3557D56pushesi;有首地址、读取字节数
7、、data指针00F3557E50pusheax00F3557F8D8570FFFFFFleaeax,dwordptr[ebp-90]00F3558550pusheax00F35586E804080000call00F35D8F;有操作狗，解码过程也在里面00F3558B83C40Caddesp,0C00F3558E3D374E0000cmpeax,4E37;4E37是20023没有通过认证00F35593752Ejnzshort00F355C
