悬赏（一款http连接器，跳不出程序领空）简单破解
前言：我错了，希望恒大大解除我的访问IP，一不小心用了论坛网站做测试了！悬赏地址： https://www.52hb.com/thread-33160-1-1.html
楼主说找不到关键字暂停法不能用！我发现可以找到关键字，出个简单的逆向教程
发现我这发帖不能上传图，不知道什么原因，全程文字
————————————开始——————————————————
把软件拖入OD直接运行起来
查找ascll码就发现关键字 “禁止对非私有IP测试!”，双击进去
002063E2 50 push eax
002063E3 E8 49D5FFFF call httptest.00203931
002063E8 E8 AB520100 call httptest.0021B698
002063ED E8 462C0100 call httptest.00219038
002063F2 E8 982C0100 call httptest.0021908F
002063F7 8D9D 60FFFFFF lea ebx,dword ptr ss:
002063FD E8 5D510100 call httptest.0021B55F
00206402 8B95 60FFFFFF mov edx,dword ptr ss:
00206408 E8 3B510100 call httptest.0021B548
0020640D B8 01000000 mov eax,0x1
00206412 B9 08000000 mov ecx,0x8
00206417 91 xchg eax,ecx
00206418 E8 56CB0000 call httptest.00212F73
0020641D BA 94462200 mov edx,httptest.00224694 ; 192.168.
00206422 E8 59520100 call httptest.0021B680
00206427 E8 943B0100 call httptest.00219FC0
0020642C 0F84 09010000 je httptest.0020653B
00206432 8B95 60FFFFFF mov edx,dword ptr ss:
00206438 E8 0B510100 call httptest.0021B548
0020643D B8 01000000 mov eax,0x1
00206442 B9 03000000 mov ecx,0x3
00206447 91 xchg eax,ecx
00206448 E8 26CB0000 call httptest.00212F73
0020644D BA A4462200 mov edx,httptest.002246A4 ; 10.
00206452 E8 29520100 call httptest.0021B680
00206457 E8 643B0100 call httptest.00219FC0
0020645C 0F84 D9000000 je httptest.0020653B
00206462 8B95 60FFFFFF mov edx,dword ptr ss:
00206468 E8 DB500100 call httptest.0021B548
0020646D B8 01000000 mov eax,0x1
00206472 B9 04000000 mov ecx,0x4
00206477 91 xchg eax,ecx
00206478 E8 F6CA0000 call httptest.00212F73
0020647D BA B0462200 mov edx,httptest.002246B0 ; 172.
00206482 E8 F9510100 call httptest.0021B680
00206487 E8 343B0100 call httptest.00219FC0
0020648C 0F85 38000000 jnz httptest.002064CA
00206492 8B95 60FFFFFF mov edx,dword ptr ss:
00206498 E8 AB500100 call httptest.0021B548
0020649D B9 05000000 mov ecx,0x5
002064A2 B8 02000000 mov eax,0x2
002064A7 E8 C7CA0000 call httptest.00212F73
002064AC B8 01000000 mov eax,0x1
002064B1 E8 A5330100 call httptest.0021985B
002064B6 DF7D 94 fistp qword ptr ss:
002064B9 8B75 94 mov esi,dword ptr ss:
002064BC 83FE 10 cmp esi,0x10
002064BF 7E 09 jle Xhttptest.002064CA
002064C1 83FE 1F cmp esi,0x1F
002064C4 0F8C 71000000 jl httptest.0020653B
002064CA 8B95 60FFFFFF mov edx,dword ptr ss:
002064D0 E8 73500100 call httptest.0021B548
002064D5 BA BC462200 mov edx,httptest.002246BC ; 127.0.0.1
002064DA E8 A1510100 call httptest.0021B680
002064DF E8 DC3A0100 call httptest.00219FC0
002064E4 0F84 51000000 je httptest.0020653B
002064EA 6A 00 push 0x0
002064EC 6A 00 push 0x0
002064EE 6A 40 push 0x40
002064F0 BA 88462200 mov edx,httptest.00224688 ; 提示
002064F5 E8 86510100 call httptest.0021B680
002064FA 8D5C24 08 lea ebx,dword ptr ss:
002064FE E8 72380100 call httptest.00219D75
00206503 BA CC462200 mov edx,httptest.002246CC ; 禁止对非私有IP测试!
00206508 E8 73510100 call httptest.0021B680
0020650D 8D5C24 08 lea ebx,dword ptr ss:
00206511 E8 5F380100 call httptest.00219D75
00206516 8B05 04362200 mov eax,dword ptr ds:
0020651C 50 push eax
0020651D FF15 44672200 call dword ptr ds:[<&USER32.MessageBoxA>>; USER32.MessageBoxA
往上找到 002063E250 push eax下断 然后直接F8步过 ，第一个CALL需要暂停一下再运行才能到第二个CALL
一直到下面第一个大跳转处0020642C /0F84 09010000 je httptest.0020653B 把判断JE修改JMP
也可以不用在Push eax 处下断,直接在判断处下断也行.
修改好了第一处再F8就会到达
0020653B |8D9D 60FFFFFF lea ebx,dword ptr ss:
00206541 |E8 A3540100 call httptest.0021B9E9
00206546 |8BC3 mov eax,ebx
00206548 |50 push eax
00206549 |FF15 30682200 call dword ptr ds:[<&WS2_32.inet_addr>]; WS2_32.inet_addr
0020654F |D96D F0 fldcw word ptr ss:
00206552 |8905 F4392200 mov dword ptr ds:,eax
00206558 |6A 00 push 0x0
0020655A |8B05 F4392200 mov eax,dword ptr ds:
00206560 |50 push eax
00206561 |FF15 34682200 call dword ptr ds:[<&WS2_32.ntohl>] ; WS2_32.ntohl
00206567 |D96D F0 fldcw word ptr ss:
0020656A |8BDC mov ebx,esp
0020656C |53 push ebx
0020656D |8903 mov dword ptr ds:,eax
0020656F |E8 C2040000 call httptest.00206A36
00206574 |83C4 04 add esp,0x4
00206577 |F7D0 not eax
00206579 |85C0 test eax,eax
0020657B |74 05 je Xhttptest.00206582
0020657D |E9 90040000 jmp httptest.00206A12
00206582 |66:C705 D43A220>mov word ptr ds:,0x1
0020658B |BA 38462200 mov edx,httptest.00224638 ; 最小耗时:
00206590 |E8 EB500100 call httptest.0021B680
00206595 |6A 00 push 0x0
一直F8到0020657B /74 05 je Xhttptest.00206582 处修改跳转为 jmp 00206582
即可爆破，超级简单的
我测试时习惯用上了论坛网站，然后ping了IP测试软件是否成功，没想到被限制了访问网站
现在我都是用的DL访问网站的，求解救啊 ！
额，貌似能访问论坛了！没限制？？？？ 感谢楼主分享 感谢分享！ [吾爱汇编论坛52HB.COM]-很简单实用的教程，谢谢楼主。 不错不错，学习下 楼主辛苦了，谢谢分享!
页:
[1]
2