QQ宠物大乐斗圆梦外挂-逆向分析详细过程
小猪猪登场 这个圆梦FZ之前一直被TMTT X***(Bi~~)由于后来加VM后 TMTT就被圆梦给(Bi~~) 了 为了解决这一困惑 还论坛Q宠大乐斗用户的使用权，写个分析逆向过程，给论坛逆向不了这个FZ的人一些思路 即便发出去后这个FZ可能以后就再也逆向不了了首先上图
大家可以看到 点击VIP 即粗体的功能后 他就会告诉你 不能用滴 要掏出你滴小钱包才能给你用滴 我们就要逆向这个
先把他拖入我们万恶的欧弟的身体里，对他进行凌辱
载入可以看到满满的都是邪恶 VM神马太恶心了 重口味的说
OK 首先不管他 我们先整理思路 首先呢 他是点击功能后出现的提示 而且弹出的是信息框 那么我们就有几个思路PJ了
1.易语言按钮事件FF55FC5F5E
2.信息框APIbp MessageBoxA
按钮事件呢 思路好点的就可以知道 断下跟进去满满又是邪恶 所以就直接先搁置1了 先下API断点吧
在命令栏输入 bp MessageBoxA 或者是 Ctrl+G 跳转到 MessageBoxA 然后F2断点
记得先F9运行后再下断点 否则VMP壳会检测滴
然后我们在FZ里点击VIP功能 成功断下
然后再堆栈窗口 右键 反汇编窗口跟随
堆栈里有很多返回 我们一个一个在反汇编查看 会发现很多返回都在虚拟机里 我们不管他 继续向下找 直到找到.....
跟出来以后发现并不是按钮事件的末端 而是一个子程序的调用 下面还有个call 那当然是要进去一探究竟
00403A1B 55 push ebp
00403A1C 8BEC mov ebp,esp
00403A1E 81EC 04000000 sub esp,0x4
00403A24 833D D802C200 0>cmp dword ptr ds:,0x0 //判断全局变量是否为0
00403A2B 0F85 53040000 jnz Q宠大乐?00403E84 //如果等于0则不跳转
00403A31 6A 00 push 0x0 //以下代码都是对选择框的禁止=真
00403A33 68 00000000 push 0x0
00403A38 6A FF push -0x1
00403A3A 6A 12 push 0x12
00403A3C 68 81000216 push 0x16020081
00403A41 68 03000152 push 0x52010003
00403A46 E8 888A1D00 call Q宠大乐?005DC4D3
00403A4B 83C4 18 add esp,0x18
00403A4E 6A 00 push 0x0
00403A50 68 00000000 push 0x0
00403A55 6A FF push -0x1
00403A57 6A 12 push 0x12
00403A59 68 FBFE0116 push 0x1601FEFB
00403A5E 68 03000152 push 0x52010003
00403A63 E8 6B8A1D00 call Q宠大乐?005DC4D3
00403A68 83C4 18 add esp,0x18
00403A6B 6A 00 push 0x0
00403A6D 68 00000000 push 0x0
00403A72 6A FF push -0x1
00403A74 6A 12 push 0x12
00403A76 68 62F80116 push 0x1601F862
00403A7B 68 03000152 push 0x52010003
00403A80 E8 4E8A1D00 call Q宠大乐?005DC4D3
00403A85 83C4 18 add esp,0x18
00403A88 6A 00 push 0x0
00403A8A 68 00000000 push 0x0
00403A8F 6A FF push -0x1
00403A91 6A 12 push 0x12
00403A93 68 61F80116 push 0x1601F861
00403A98 68 03000152 push 0x52010003
00403A9D E8 318A1D00 call Q宠大乐?005DC4D3
00403AA2 83C4 18 add esp,0x18
00403AA5 6A 00 push 0x0
00403AA7 68 00000000 push 0x0
00403AAC 6A FF push -0x1
00403AAE 6A 12 push 0x12
00403AB0 68 63F80116 push 0x1601F863
00403AB5 68 03000152 push 0x52010003
00403ABA E8 148A1D00 call Q宠大乐?005DC4D3
00403ABF 83C4 18 add esp,0x18
00403AC2 6A 00 push 0x0
00403AC4 68 00000000 push 0x0
00403AC9 6A FF push -0x1
00403ACB 6A 12 push 0x12
00403ACD 68 6EF80116 push 0x1601F86E
00403AD2 68 03000152 push 0x52010003
00403AD7 E8 F7891D00 call Q宠大乐?005DC4D3
00403ADC 83C4 18 add esp,0x18
00403ADF 6A 00 push 0x0
00403AE1 68 00000000 push 0x0
00403AE6 6A FF push -0x1
00403AE8 6A 12 push 0x12
00403AEA 68 7CF80116 push 0x1601F87C
00403AEF 68 03000152 push 0x52010003
00403AF4 E8 DA891D00 call Q宠大乐?005DC4D3
00403AF9 83C4 18 add esp,0x18
00403AFC 6A 00 push 0x0
00403AFE 68 00000000 push 0x0
00403B03 6A FF push -0x1
00403B05 6A 12 push 0x12
00403B07 68 7EF80116 push 0x1601F87E
00403B0C 68 03000152 push 0x52010003
00403B11 E8 BD891D00 call Q宠大乐?005DC4D3
00403B16 83C4 18 add esp,0x18
00403B19 6A 00 push 0x0
00403B1B 68 00000000 push 0x0
00403B20 6A FF push -0x1
00403B22 6A 12 push 0x12
00403B24 68 86F80116 push 0x1601F886
00403B29 68 03000152 push 0x52010003
00403B2E E8 A0891D00 call Q宠大乐?005DC4D3
00403B33 83C4 18 add esp,0x18
00403B36 6A 00 push 0x0
00403B38 68 00000000 push 0x0
00403B3D 6A FF push -0x1
00403B3F 6A 12 push 0x12
00403B41 68 22F80116 push 0x1601F822
00403B46 68 03000152 push 0x52010003
00403B4B E8 83891D00 call Q宠大乐?005DC4D3
00403B50 83C4 18 add esp,0x18
00403B53 6A 00 push 0x0
00403B55 68 00000000 push 0x0
00403B5A 6A FF push -0x1
00403B5C 6A 12 push 0x12
00403B5E 68 83F80116 push 0x1601F883
00403B63 68 03000152 push 0x52010003
00403B68 E8 66891D00 call Q宠大乐?005DC4D3
00403B6D 83C4 18 add esp,0x18
00403B70 6A 00 push 0x0
00403B72 68 01000000 push 0x1
00403B77 6A FF push -0x1
00403B79 6A 05 push 0x5
00403B7B 68 DC040216 push 0x160204DC
00403B80 68 03000152 push 0x52010003
00403B85 E8 49891D00 call Q宠大乐?005DC4D3
00403B8A 83C4 18 add esp,0x18
00403B8D 6A 00 push 0x0
00403B8F 68 00000000 push 0x0
00403B94 6A FF push -0x1
00403B96 6A 12 push 0x12
00403B98 68 6AF80116 push 0x1601F86A
00403B9D 68 03000152 push 0x52010003
00403BA2 E8 2C891D00 call Q宠大乐?005DC4D3
00403BA7 83C4 18 add esp,0x18
00403BAA 6A 00 push 0x0
00403BAC 68 00000000 push 0x0
00403BB1 6A FF push -0x1
00403BB3 6A 12 push 0x12
00403BB5 68 66F80116 push 0x1601F866
00403BBA 68 03000152 push 0x52010003
00403BBF E8 0F891D00 call Q宠大乐?005DC4D3
00403BC4 83C4 18 add esp,0x18
00403BC7 6A 00 push 0x0
00403BC9 68 00000000 push 0x0
00403BCE 6A FF push -0x1
00403BD0 6A 12 push 0x12
00403BD2 68 67F80116 push 0x1601F867
00403BD7 68 03000152 push 0x52010003
00403BDC E8 F2881D00 call Q宠大乐?005DC4D3
00403BE1 83C4 18 add esp,0x18
00403BE4 6A 00 push 0x0
00403BE6 68 00000000 push 0x0
00403BEB 6A FF push -0x1
00403BED 6A 12 push 0x12
00403BEF 68 68F80116 push 0x1601F868
00403BF4 68 03000152 push 0x52010003
00403BF9 E8 D5881D00 call Q宠大乐?005DC4D3
00403BFE 83C4 18 add esp,0x18
00403C01 6A 00 push 0x0
00403C03 68 00000000 push 0x0
00403C08 6A FF push -0x1
00403C0A 6A 12 push 0x12
00403C0C 68 75F80116 push 0x1601F875
00403C11 68 03000152 push 0x52010003
00403C16 E8 B8881D00 call Q宠大乐?005DC4D3
00403C1B 83C4 18 add esp,0x18
00403C1E 6A 00 push 0x0
00403C20 68 00000000 push 0x0
00403C25 6A FF push -0x1
00403C27 6A 12 push 0x12
00403C29 68 69F80116 push 0x1601F869
00403C2E 68 03000152 push 0x52010003
00403C33 E8 9B881D00 call Q宠大乐?005DC4D3
00403C38 83C4 18 add esp,0x18
00403C3B 6A 00 push 0x0
00403C3D 68 00000000 push 0x0
00403C42 6A FF push -0x1
00403C44 6A 12 push 0x12
00403C46 68 6FF80116 push 0x1601F86F
00403C4B 68 03000152 push 0x52010003
00403C50 E8 7E881D00 call Q宠大乐?005DC4D3
00403C55 83C4 18 add esp,0x18
00403C58 6A 00 push 0x0
00403C5A 68 00000000 push 0x0
00403C5F 6A FF push -0x1
00403C61 6A 12 push 0x12
00403C63 68 6BF80116 push 0x1601F86B
00403C68 68 03000152 push 0x52010003
00403C6D E8 61881D00 call Q宠大乐?005DC4D3
00403C72 83C4 18 add esp,0x18
00403C75 6A 00 push 0x0
00403C77 68 00000000 push 0x0
00403C7C 6A FF push -0x1
00403C7E 6A 12 push 0x12
00403C80 68 7AF80116 push 0x1601F87A
00403C85 68 03000152 push 0x52010003
00403C8A E8 44881D00 call Q宠大乐?005DC4D3
00403C8F 83C4 18 add esp,0x18
00403C92 6A 00 push 0x0
00403C94 68 00000000 push 0x0
00403C99 6A FF push -0x1
00403C9B 6A 12 push 0x12
00403C9D 68 76F80116 push 0x1601F876
00403CA2 68 03000152 push 0x52010003
00403CA7 E8 27881D00 call Q宠大乐?005DC4D3
00403CAC 83C4 18 add esp,0x18
00403CAF 6A 00 push 0x0
00403CB1 68 00000000 push 0x0
00403CB6 6A FF push -0x1
00403CB8 6A 12 push 0x12
00403CBA 68 74F80116 push 0x1601F874
00403CBF 68 03000152 push 0x52010003
00403CC4 E8 0A881D00 call Q宠大乐?005DC4D3
00403CC9 83C4 18 add esp,0x18
00403CCC 6A 00 push 0x0
00403CCE 68 00000000 push 0x0
00403CD3 6A FF push -0x1
00403CD5 6A 12 push 0x12
00403CD7 68 73F80116 push 0x1601F873
00403CDC 68 03000152 push 0x52010003
00403CE1 E8 ED871D00 call Q宠大乐?005DC4D3
00403CE6 83C4 18 add esp,0x18
00403CE9 6A 00 push 0x0
00403CEB 68 00000000 push 0x0
00403CF0 6A FF push -0x1
00403CF2 6A 12 push 0x12
00403CF4 68 70F80116 push 0x1601F870
00403CF9 68 03000152 push 0x52010003
00403CFE E8 D0871D00 call Q宠大乐?005DC4D3
00403D03 83C4 18 add esp,0x18
00403D06 6A 00 push 0x0
00403D08 68 00000000 push 0x0
00403D0D 6A FF push -0x1
00403D0F 6A 12 push 0x12
00403D11 68 7BF80116 push 0x1601F87B
00403D16 68 03000152 push 0x52010003
00403D1B E8 B3871D00 call Q宠大乐?005DC4D3
00403D20 83C4 18 add esp,0x18
00403D23 6A 00 push 0x0
00403D25 68 00000000 push 0x0
00403D2A 6A FF push -0x1
00403D2C 6A 12 push 0x12
00403D2E 68 72F80116 push 0x1601F872
00403D33 68 03000152 push 0x52010003
00403D38 E8 96871D00 call Q宠大乐?005DC4D3
00403D3D 83C4 18 add esp,0x18
00403D40 6A 00 push 0x0
00403D42 68 00000000 push 0x0
00403D47 6A FF push -0x1
00403D49 6A 12 push 0x12
00403D4B 68 91F80116 push 0x1601F891
00403D50 68 03000152 push 0x52010003
00403D55 E8 79871D00 call Q宠大乐?005DC4D3
00403D5A 83C4 18 add esp,0x18
00403D5D 6A 00 push 0x0
00403D5F 68 00000000 push 0x0
00403D64 6A FF push -0x1
00403D66 6A 12 push 0x12
00403D68 68 8DF80116 push 0x1601F88D
00403D6D 68 03000152 push 0x52010003
00403D72 E8 5C871D00 call Q宠大乐?005DC4D3
00403D77 83C4 18 add esp,0x18
00403D7A 6A 00 push 0x0
00403D7C 68 00000000 push 0x0
00403D81 6A FF push -0x1
00403D83 6A 12 push 0x12
00403D85 68 85F80116 push 0x1601F885
00403D8A 68 03000152 push 0x52010003
00403D8F E8 3F871D00 call Q宠大乐?005DC4D3
00403D94 83C4 18 add esp,0x18
00403D97 6A 00 push 0x0
00403D99 68 00000000 push 0x0
00403D9E 6A FF push -0x1
00403DA0 6A 12 push 0x12
00403DA2 68 84F80116 push 0x1601F884
00403DA7 68 03000152 push 0x52010003
00403DAC E8 22871D00 call Q宠大乐?005DC4D3
00403DB1 83C4 18 add esp,0x18
00403DB4 6A 00 push 0x0
00403DB6 68 00000000 push 0x0
00403DBB 6A FF push -0x1
00403DBD 6A 12 push 0x12
00403DBF 68 6CF80116 push 0x1601F86C
00403DC4 68 03000152 push 0x52010003
00403DC9 E8 05871D00 call Q宠大乐?005DC4D3
00403DCE 83C4 18 add esp,0x18
00403DD1 6A 00 push 0x0
00403DD3 68 00000000 push 0x0
00403DD8 6A FF push -0x1
00403DDA 6A 12 push 0x12
00403DDC 68 82F80116 push 0x1601F882
00403DE1 68 03000152 push 0x52010003
00403DE6 E8 E8861D00 call Q宠大乐?005DC4D3
00403DEB 83C4 18 add esp,0x18
00403DEE 6A 00 push 0x0
00403DF0 68 00000000 push 0x0
00403DF5 6A FF push -0x1
00403DF7 6A 12 push 0x12
00403DF9 68 84F80116 push 0x1601F884
00403DFE 68 03000152 push 0x52010003
00403E03 E8 CB861D00 call Q宠大乐?005DC4D3
00403E08 83C4 18 add esp,0x18
00403E0B 6A 00 push 0x0
00403E0D 68 00000000 push 0x0
00403E12 6A FF push -0x1
00403E14 6A 12 push 0x12
00403E16 68 83F80116 push 0x1601F883
00403E1B 68 03000152 push 0x52010003
00403E20 E8 AE861D00 call Q宠大乐?005DC4D3
00403E25 83C4 18 add esp,0x18
00403E28 6A 00 push 0x0
00403E2A 68 00000000 push 0x0
00403E2F 6A FF push -0x1
00403E31 6A 12 push 0x12
00403E33 68 64F80116 push 0x1601F864
00403E38 68 03000152 push 0x52010003
00403E3D E8 91861D00 call Q宠大乐?005DC4D3
00403E42 83C4 18 add esp,0x18
00403E45 6A 00 push 0x0
00403E47 68 00000000 push 0x0
00403E4C 6A FF push -0x1
00403E4E 6A 12 push 0x12
00403E50 68 5FF80116 push 0x1601F85F
00403E55 68 03000152 push 0x52010003
00403E5A E8 74861D00 call Q宠大乐?005DC4D3
00403E5F 83C4 18 add esp,0x18
00403E62 6A 00 push 0x0
00403E64 68 00000000 push 0x0
00403E69 6A FF push -0x1
00403E6B 6A 12 push 0x12
00403E6D 68 5EF80116 push 0x1601F85E
00403E72 68 03000152 push 0x52010003
00403E77 E8 57861D00 call Q宠大乐?005DC4D3
00403E7C 83C4 18 add esp,0x18
00403E7F E9 1D000000 jmp Q宠大乐?00403EA1
00403E84 6A 00 push 0x0
00403E86 68 00000000 push 0x0
00403E8B 6A FF push -0x1
00403E8D 6A 05 push 0x5
00403E8F 68 DC040216 push 0x160204DC
00403E94 68 03000152 push 0x52010003
00403E99 E8 35861D00 call Q宠大乐?005DC4D3
00403E9E 83C4 18 add esp,0x18
00403EA1 8BE5 mov esp,ebp
00403EA3 5D pop ebp
00403EA4 C3 retn
这里没有被VM掉 经过我对易语言一些了解 发现这里的判断一个全局变量 0xC202D8 的值是不是 0 如果是的话 就禁止所有选择框的点击 如果不是则解禁 这就是关键点了
圆梦就这样被搞了 只要我们 mov dword ptr ds:,0x1 就可以使用VIP功能了
自从学会逆向版圆梦FZ 粉蘑菇都爱上我了呢
记得加精加热心哦 亲~~
补: 膜拜 Xjun、恒、H; All大大
真不错，学习了，支持{:5_117:}
学习了，感谢楼主
感谢分享,学习了
真不错，学习了，支持
学习了，谢恒大，对新手来说，很详细的说
看着好像很简单的样子，为什么自己分析就不行了呢还是要慢慢来吧
终于找到了，自己试了好多次，逆向不了，谢谢恒大大，吃完饭好好看看
咦？这个不是真一牛写的教程吗？
[快捷回复]-感谢楼主热心分享！
页:
[1]
2