金庸群俠傳外掛程式的破解思路(網上驗證)，小球[CCG]請進： (7千字)

金庸群俠外掛程式
by 6767 [BCG]

用dede和si配合容易搞定，具體跳轉該怎樣修改可能要在測試後才能確定，下面是我的改法：

資源段有下列資訊：
object TabSheet1: TTabSheet
Caption = '登入註冊'
OnShow = TabSheet1Show               <- 這個看看
。。。。。。

object WebBrowser1: TWebBrowser
Left = 0
Top = 0
Width = 307
Height = 284
TabStop = False
Align = alClient
TabOrder = 0
OnTitleChange = WebBrowser1TitleChange   <- 這個也看看
。。。。。

先是TabSheet1Show中的程式碼：
....
0045395B 64FF30 push dword ptr fs:[eax]
0045395E 648920 mov fs:[eax], esp

* Possible String Reference to: '金庸外掛I之《神行太保》,       <- 改變標題，啟用WebBrowser1TitleChange呼叫衿?..'
|
00453961 BA003A4500 mov edx, $00453A00

* Possible reference to Form1
|
00453966 A1F0684500 mov eax, dword ptr [$4568F0]

* Reference to: Controls.TControl.SetText(System.AnsiString)   <-
|
0045396B E8A037FDFF call 00427110
00453970 8D45EC lea eax, [ebp-$14]
00453973 33D2 xor edx, edx
.....

那麼我們來看WebBrowser1TitleChange都作了些什麼：

00453A6C 55 push ebp
00453A6D 8BEC mov ebp, esp
00453A6F 83C4F4 add esp, -$0C
00453A72 53 push ebx
00453A73 56 push esi
00453A74 33DB xor ebx, ebx
00453A76 895DF4 mov [ebp-$0C], ebx
00453A79 8BF1 mov esi, ecx
00453A7B 8BD8 mov ebx, eax
00453A7D 33C0 xor eax, eax
00453A7F 55 push ebp

* Possible String Reference to: 'R膃^[]?
|
00453A80 68793B4500 push $00453B79

***** TRY
|
00453A85 64FF30 push dword ptr fs:[eax]
00453A88 648920 mov fs:[eax], esp

* Possible String Reference to: 'xxxxxxxx'
|
00453A8B BA903B4500 mov edx, $00453B90   <- 覺得標題難受就把這裡改掉

* Possible reference to Form1
|
00453A90 A1F0684500 mov eax, dword ptr [$4568F0]

* Reference to: Controls.TControl.SetText(System.AnsiString)   <- 設視窗標題
|
00453A95 E87636FDFF call 00427110
00453A9A 8BC6 mov eax, esi       <- 接受前一函式的返回值
00453A9C BAA03B4500 mov edx, $00453BA0

* Reference to: System..WStrCmp()
|
00453AA1 E83A06FBFF call 004040E0       <- 比較了
00453AA6 7507 jnz 00453AAF       <- 不跳就完蛋，改掉
                              <- 改成jmp 453b0b執行沒問題，不知能否正確接收到資料
00453AA8 8BC3 mov eax, ebx

* Reference to: Forms.TCustomForm.Close()
|
00453AAA E871C7FEFF call 00440220
00453AAF 8BC6 mov eax, esi
00453AB1 BAB83B4500 mov edx, $00453BB8

* Reference to: System..WStrCmp()
|
00453AB6 E82506FBFF call 004040E0
00453ABB 7516 jnz 00453AD3       <- 未註冊在這裡會跳走
00453ABD 8D45F4 lea eax, [ebp-$0C]
00453AC0 8BD6 mov edx, esi

* Reference to: System..LStrFromWStr(System.AnsiString; System.WideString)
|
00453AC2 E88D00FBFF call 00403B54
00453AC7 8B45F4 mov eax, [ebp-$0C]

* Reference to: Sysutils.StrToFloat(System.AnsiString)
|
00453ACA E8054FFBFF call 004089D4
00453ACF DD5DF8 fstp qword ptr [ebp-$08]
00453AD2 9B wait
00453AD3 DD45F8 fld qword ptr [ebp-$08]
00453AD6 83C4F4 add esp, -$0C
00453AD9 DB3C24 fstp tbyte ptr [esp]
00453ADC 9B wait
00453ADD 8D45F4 lea eax, [ebp-$0C]

* Reference to: Sysutils.FloatToStr(Extended)
|
00453AE0 E8BF4EFBFF call 004089A4
00453AE5 8B45F4 mov eax, [ebp-$0C]

* Possible String Reference to: '9412.11'
|
00453AE8 BAD03B4500 mov edx, $00453BD0

* Reference to: System..LStrCmp()
|
00453AED E8AA01FBFF call 00403C9C
00453AF2 756F jnz 00453B63       <- 跳下去也沒戲了
00453AF4 8D45F4 lea eax, [ebp-$0C]
00453AF7 8BD6 mov edx, esi

* Reference to: System..LStrFromWStr(System.AnsiString; System.WideString)
|
00453AF9 E85600FBFF call 00403B54
00453AFE 8B45F4 mov eax, [ebp-$0C]

* Reference to: Sysutils.StrToFloat(System.AnsiString)
|
00453B01 E8CE4EFBFF call 004089D4

* Reference to: System..ROUND()
|
00453B06 E835EEFAFF call 00402940

* Reference to field TForm1.OFFS_031C
|
00453B0B 89831C030000 mov [ebx+$031C], eax   <- 正常程式從這裡或稍上處開始
00453B11 B201 mov dl, $01

* Reference to control TForm1.TabSheet2 : TTabSheet       <-
|
00453B13 8B83D4020000 mov eax, [ebx+$02D4]

* Reference to: Controls.TControl.SetVisible(bool)       <- 顯示地圖內容，下略
|
00453B19 E8B234FDFF call 00426FD0
00453B1E B201 mov dl, $01

* Reference to control TForm1.TabSheet2 : TTabSheet
|
00453B20 8B83D4020000 mov eax, [ebx+$02D4]

* Reference to: Comctrls.TTabSheet.SetTabVisible(bool)
|
00453B26 E84DBAFFFF call 0044F578
00453B2B B201 mov dl, $01

* Reference to control TForm1.TabSheet2 : TTabSheet
|
00453B2D 8B83D4020000 mov eax, [ebx+$02D4]
00453B33 8B08 mov ecx, [eax]
00453B35 FF5160 call dword ptr [ecx+$60]
00453B38 33D2 xor edx, edx

* Reference to control TForm1.TabSheet1 : TTabSheet
|
00453B3A 8B83C8020000 mov eax, [ebx+$02C8]

* Reference to: Controls.TControl.SetVisible(bool)
|
00453B40 E88B34FDFF call 00426FD0
00453B45 33D2 xor edx, edx

* Reference to control TForm1.TabSheet1 : TTabSheet
|
00453B47 8B83C8020000 mov eax, [ebx+$02C8]

* Reference to: Comctrls.TTabSheet.SetTabVisible(bool)
|
00453B4D E826BAFFFF call 0044F578

* Reference to control TForm1.TabSheet2 : TTabSheet
|
00453B52 8B93D4020000 mov edx, [ebx+$02D4]

* Reference to control TForm1.PageControl1 : TPageControl
|
00453B58 8B83C4020000 mov eax, [ebx+$02C4]

* Reference to: Comctrls.TPageControl.SetActivePage(Comctrls.TTabSheet)
|
00453B5E E8D5C0FFFF call 0044FC38
00453B63 33C0 xor eax, eax
00453B65 5A pop edx
00453B66 59 pop ecx
00453B67 59 pop ecx
00453B68 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '^[]?
|
00453B6B 68803B4500 push $00453B80
00453B70 8D45F4 lea eax, [ebp-$0C]

* Reference to: System..LStrClr(System.AnsiString)
|
00453B73 E898FDFAFF call 00403910
00453B78 C3 ret

00453B79 E952F8FAFF jmp 004033D0
00453B7E EBF0 jmp 00453B70

****** END
|
00453B80 5E pop esi
00453B81 5B pop ebx
00453B82 8BE5 mov esp, ebp
00453B84 5D pop ebp
00453B85 C3 ret

關鍵的跳轉處都列出來了，至於怎樣改需要測試。

那個記錄地址的文字檔案是需要的，否則這個東東沒用。

金庸群俠傳外掛程式的破解思路(網上驗證)，小球[CCG]請進： (7千字)

相關文章