FCG的作業,regetjr去除廣告條 (7千字)

目標：regetrj
組織：CCG,FCG
作者: BlueBoy
軟體說明：用於下載,FCG的Test,去除它的廣告條
工具：soft-ice,wasm,UltraEdit

開啟system\cd_clint.dll反彙編，匯入函式發現只有一處呼叫GDI32.CreateCompatibleDC
* Referenced by a CALL at Address:
|:10012860

:10012356 56 push esi
:10012357 8BF1 mov esi, ecx
:10012359 FF760C push [esi+0C]

* Reference To: USER32.GetDC, Ord:00FDh
|
:1001235C FF15DC820310 Call dword ptr [100382DC]
:10012362 50 push eax
:10012363 898654010000 mov dword ptr [esi+00000154], eax

* Reference To: GDI32.CreateCompatibleDC, Ord:002Ah《-----此處呼叫
|
:10012369 FF1540800310 Call dword ptr [10038040]
:1001236F 8B0E mov ecx, dword ptr [esi]
:10012371 898658010000 mov dword ptr [esi+00000158], eax
:10012377 85C9 test ecx, ecx
:10012379 7422 je 1001239D
:1001237B E893050000 call 10012913
:10012380 85C0 test eax, eax
:10012382 894614 mov dword ptr [esi+14], eax
:10012385 743B je 100123C2
:10012387 8B0E mov ecx, dword ptr [esi]
:10012389 E8270B0000 call 10012EB5
:1001238E 663D0100 cmp ax, 0001
:10012392 0F9FC0 setg al
:10012395 88868E010000 mov byte ptr [esi+0000018E], al
:1001239B EB07 jmp 100123A4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10012379(C)
|
:1001239D 80A68E01000000 and byte ptr [esi+0000018E], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1001239B(U)
|
:100123A4 80BE8E01000000 cmp byte ptr [esi+0000018E], 00
:100123AB 752E jne 100123DB
:100123AD 8B0E mov ecx, dword ptr [esi]
:100123AF 85C9 test ecx, ecx
:100123B1 7413 je 100123C6
:100123B3 8D4618 lea eax, dword ptr [esi+18]
:100123B6 6A00 push 00000000
:100123B8 50 push eax
:100123B9 E85D060000 call 10012A1B
:100123BE 84C0 test al, al
:100123C0 7504 jne 100123C6

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10012385(C)
|
:100123C2 32C0 xor al, al
:100123C4 5E pop esi
:100123C5 C3 ret
向上看在程式是由10012860這裡呼叫，所以在此子程式的第一句下斷點，並動態改變為
ret 發現程式的廣告條沒有了，但是在滑鼠點選的時候仍能連線到該程式的站點，從
程式設計的角度來講該區域為一個視窗所以用Createwindowex下斷點，重新執行程式發現共
有四處呼叫在第四處向上找
:10011D76 FF15A8820310 Call dword ptr [100382A8]
:10011D7C 6685C0 test ax, ax
:10011D7F 0F84E6000000 je 10011E6B
:10011D85 33C0 xor eax, eax
:10011D87 81CB00000040 or ebx, 40000000
:10011D8D 50 push eax 〈---這寫push應該是傳遞給createwindowex
:10011D8E 50 push eax 引數
:10011D8F 50 push eax
:10011D90 FF7604 push [esi+04]
:10011D93 FFB694060000 push dword ptr [esi+00000694]
:10011D99 FFB690060000 push dword ptr [esi+00000690]
:10011D9F FFB68C060000 push dword ptr [esi+0000068C]
:10011DA5 FFB688060000 push dword ptr [esi+00000688]
:10011DAB 53 push ebx
:10011DAC 6818540410 push 10045418
:10011DB1 57 push edi
:10011DB2 6A24 push 00000024

* Reference To: USER32.CreateWindowExA, Ord:0059h
|
:10011DB4 FF15B0820310 Call dword ptr [100382B0]〈―第四次呼叫
:10011DBA 33FF xor edi, edi
:10011DBC 894608 mov dword ptr [esi+08], eax
:10011DBF 3BC7 cmp eax, edi
:10011DC1 0F84A4000000 je 10011E6B
:10011DC7 8B4E18 mov ecx, dword ptr [esi+18]
:10011DCA F7C100000010 test ecx, 10000000
:10011DD0 7406 je 10011DD8
:10011DD2 83C904 or ecx, 00000004
:10011DD5 894E18 mov dword ptr [esi+18], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10011DD0(C)
|
:10011DD8 8B4E18 mov ecx, dword ptr [esi+18]
:10011DDB 83E104 and ecx, 00000004
:10011DDE FEC9 dec cl
:10011DE0 F6D9 neg cl
:10011DE2 1AC9 sbb cl, cl
:10011DE4 FEC1 inc cl
:10011DE6 888EA40A0000 mov byte ptr [esi+00000AA4], cl
:10011DEC 7519 jne 10011E07
:10011DEE 8D8E90060000 lea ecx, dword ptr [esi+00000690]
:10011DF4 51 push ecx
:10011DF5 8D4E20 lea ecx, dword ptr [esi+20]
:10011DF8 FF7610 push [esi+10]
:10011DFB FFB660060000 push dword ptr [esi+00000660]
:10011E01 50 push eax
:10011E02 E83AB40000 call 1001D241

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10011DEC(C)
|
:10011E07 57 push edi
:10011E08 6A64 push 00000064
:10011E0A 6A01 push 00000001
:10011E0C FF7608 push [esi+08]

* Reference To: USER32.SetTimer, Ord:0252h
|
:10011E0F FF15AC820310 Call dword ptr [100382AC]〈-此處呼叫Settimer
:10011E15 F6461808 test [esi+18], 08
:10011E19 8986E4050000 mov dword ptr [esi+000005E4], eax
:10011E1F 7514 jne 10011E35
:10011E21 6A05 push 00000005
:10011E23 FF7608 push [esi+08]

* Reference To: USER32.ShowWindow, Ord:026Ah
|
:10011E26 FF159C820310 Call dword ptr [1003829C]<--此處呼叫showwindow
:10011E2C FF7608 push [esi+08]

* Reference To: USER32.UpdateWindow, Ord:0291h
|
:10011E2F FF15A4820310 Call dword ptr [100382A4]<--此處呼叫updatewindow

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10011E1F(C)
|
:10011E35 F6461908 test [esi+19], 08
:10011E39 7530 jne 10011E6B

* Reference To: USER32.GetMessageA, Ord:012Ah
|
:10011E3B 8B35A0820310 mov esi, dword ptr [100382A0]<--此處將sendmessage
的地址傳遞給esi;
:10011E41 57 push edi
:10011E42 57 push edi
:10011E43 8D45E4 lea eax, dword ptr [ebp-1C]
:10011E46 57 push edi
:10011E47 50 push eax
所以將:10011DB4 FF15B0820310 Call dword ptr [100382B0] nop掉就可以了，或者
將:10011D8D 50 push eax 改為跳轉語句跳到:10011E3B這裡就行了。
修改之後廣告條訊息，而且點選之後也沒有反應，成功了！！！（不過我沒有測試該軟體是否好用）

由於小弟的水平有限，難免出現錯誤，希望各位多多指教！！！

FCG的作業,regetjr去除廣告條 (7千字)

相關文章