遠端控制程式,http://hbsafe.yeah.net 可控制滑鼠、鍵盤、螢幕、硬碟、可遠端提取密碼、。。。
dede就是好用,反編譯一下,什麼都看見了。
call 00426E28
call 00407DD4
這兩個call可以不用理會,why?,看看下面,已經寫得很清楚了^_^
00462FC1 64FF30
push dword ptr fs:[eax]
00462FC4 648920
mov fs:[eax], esp
00462FC7 8D55F4
lea edx, [ebp-$0C]
* Reference to control Edit1 : TEdit
|
00462FCA 8B83EC020000 mov
eax, [ebx+$02EC]
* Reference to: controls.TControl.GetText(TControl):System.String;
|
00462FD0 E8533EFCFF call
00426E28
00462FD5 8B45F4
mov eax, [ebp-$0C]
* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer;
|
00462FD8 E8F74DFAFF call
00407DD4
00462FDD 8BF0
mov esi, eax 把第1個框內的數值放入esi
00462FDF 8D55F0
lea edx, [ebp-$10]
* Reference to control Edit2 : TEdit
|
00462FE2 8B83F0020000 mov
eax, [ebx+$02F0]
* Reference to: controls.TControl.GetText(TControl):System.String;
|
00462FE8 E83B3EFCFF call
00426E28
00462FED 8B45F0
mov eax, [ebp-$10]
* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer;
|
00462FF0 E8DF4DFAFF call
00407DD4
00462FF5 03F0
add esi, eax 把第2個框內的數值加入esi
00462FF7 8D55EC
lea edx, [ebp-$14]
* Reference to control Edit3 : TEdit
|
00462FFA 8B83F4020000 mov
eax, [ebx+$02F4]
* Reference to: controls.TControl.GetText(TControl):System.String;
|
00463000 E8233EFCFF call
00426E28
00463005 8B45EC
mov eax, [ebp-$14]
* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer;
|
00463008 E8C74DFAFF call
00407DD4
0046300D 8BF8
mov edi, eax 把第3個框內的數值放入edi
0046300F 8D55E8
lea edx, [ebp-$18]
* Reference to control Edit4 : TEdit
|
00463012 8B8300030000 mov
eax, [ebx+$0300]
* Reference to: controls.TControl.GetText(TControl):System.String;
|
00463018 E80B3EFCFF call
00426E28
0046301D 8B45E8
mov eax, [ebp-$18]
* Reference to: sysutils.StrToInt(System.AnsiString):System.Integer;
|
00463020 E8AF4DFAFF call
00407DD4
00463025 0FAFF8
imul edi, eax 第3個框的數值和第4個框的數值相乘
00463028 03F7
add esi, edi 加上第1、2框內數值之和
0046302A 81FED0070000 cmp
esi, $000007D0 比較是否等於十進位制的2000
00463030 0F85C7000000 jnz
004630FD 等於則透過
最簡單的註冊碼就是 2000 0 0 0
軟體註冊後會在windows\system下生成一個6個位元組大小的檔案sysdat.dat
內容為
0x02 0x6Fh 0x6B 0x00 0x00 0x00