记一次去除连接数限制问题

最新推荐文章于 2023-04-20 17:38:34 发布

friendan

最新推荐文章于 2023-04-20 17:38:34 发布

阅读量396

点赞数

分类专栏： PJ 汇编

本文链接：https://blog.csdn.net/friendan/article/details/105566172

版权

PJ 同时被 2 个专栏收录

7 篇文章 0 订阅

订阅专栏

汇编

7 篇文章 0 订阅

订阅专栏

有这么一段代码，连接数超过100后，再次连接就连接不上了，直接返回0

.版本 2

    .计次循环首 (150, i)
        连接句柄 ＝ 模块类.UConnect (客户句柄, “127.0.0.1”, 2020, 到长整数 (id), 假, 1, “”)
        编辑框1.加入文本 (到文本 (i) ＋ “ ” ＋ 取十六进制文本 (连接句柄) ＋ #换行符)
    .计次循环尾 ()

关键信息：UConnect 和 0

IDA载入目标文件，查看字符串窗口，看到：

.data:10044074 00000011 C UConnect called\n

双击字符串来到：

.data:10044074 aUconnectCalled db 'UConnect called',0Ah,0

然后鼠标右键点击 Xrefs graph to

发现只有函数 FastUdxApi_6 里面引用到字符串 UConnect called'

IDA进入函数FastUdxApi_6 然后F5代码如下：

int __stdcall FastUdxApi_6(int a1, int a2, int a3, int a4, int a5, int a6, __int16 a7, int a8)
{
  void *v8; // eax
  int v9; // eax
  int v10; // esi
  int v12; // [esp+8h] [ebp-Ch]
  int v13; // [esp+Ch] [ebp-8h]
  char v14; // [esp+10h] [ebp-4h]

  v8 = sub_10002B30();                          // call 1
  (*(void (__thiscall **)(void *, char *))(*(_DWORD *)v8 + 12))(v8, aUconnectCalled);// call 2
  v12 = 0;
  v13 = 0;
  v14 = 0;
  LOWORD(v12) = a7;
  v9 = (*(int (__stdcall **)(int, int, int, int, int, _DWORD, _DWORD, signed int, int, int *, _DWORD, signed int))(*(_DWORD *)a1 + 8))(
         a2,
         a3,
         a6,
         a4,
         a5,
         0,
         0,
         100,
         a8,
         &v12,
         0,
         1);                                    // call 3 sub_10006740
  v10 = v9;
  if ( a6 && (*(int (__thiscall **)(int))(*(_DWORD *)v9 + 68))(v9) )// call 4
    (*(void (__thiscall **)(int))(*(_DWORD *)v10 + 60))(v10);// call 5
  return v10;
}

发现里面有5个Call，Call1的代码IDA可以直接看到，进去Call1里面，没发现异常的地方

另外4个Call的地址无法在IDA里面看到，怎么办？

打开 x96dbg，在地址 FastUdxApi_6 下断，断下后，不要急着看汇编代码

直接F8一路走下去，看看5个Call中是哪个Call返回了连接句柄，Call返回值在EAX寄存器中，注意观察

F8单步发现Call3执行后，EAX返回了连接句柄，说明Call3就是我们要找的函数

100011A0 | 83EC 0C                  | sub esp,C                                                                        | UConnect called
100011A3 | 56                       | push esi                                                                         |
100011A4 | 57                       | push edi                                                                         |
100011A5 | E8 86190000              | call tongxin.10002B30                                                            | Call 1
100011AA | 8B10                     | mov edx,dword ptr ds:[eax]                                                       |
100011AC | 68 74400410              | push tongxin.10044074                                                            | 10044074:"UConnect called\n"
100011B1 | 8BC8                     | mov ecx,eax                                                                      |
100011B3 | FF52 0C                  | call dword ptr ds:[edx+C]                                                        | Call 2
100011B6 | 33C0                     | xor eax,eax                                                                      |
100011B8 | 6A 01                    | push 1                                                                           |
100011BA | 894424 0C                | mov dword ptr ss:[esp+C],eax                                                     |
100011BE | 66:8B4C24 34             | mov cx,word ptr ss:[esp+34]                                                      |
100011C3 | 894424 10                | mov dword ptr ss:[esp+10],eax                                                    |
100011C7 | 8B7C24 30                | mov edi,dword ptr ss:[esp+30]                                                    |
100011CB | 884424 14                | mov byte ptr ss:[esp+14],al                                                      |
100011CF | 50                       | push eax                                                                         |
100011D0 | 8D4424 10                | lea eax,dword ptr ss:[esp+10]                                                    |
100011D4 | 66:894C24 10             | mov word ptr ss:[esp+10],cx                                                      |
100011D9 | 50                       | push eax                                                                         |
100011DA | 8B4424 40                | mov eax,dword ptr ss:[esp+40]                                                    |
100011DE | 50                       | push eax                                                                         |
100011DF | 8B4424 38                | mov eax,dword ptr ss:[esp+38]                                                    |
100011E3 | 8B4C24 28                | mov ecx,dword ptr ss:[esp+28]                                                    |
100011E7 | 6A 64                    | push 64                                                                          |
100011E9 | 6A 00                    | push 0                                                                           |
100011EB | 6A 00                    | push 0                                                                           |
100011ED | 8B11                     | mov edx,dword ptr ds:[ecx]                                                       |
100011EF | 50                       | push eax                                                                         |
100011F0 | 8B4424 44                | mov eax,dword ptr ss:[esp+44]                                                    |
100011F4 | 50                       | push eax                                                                         |
100011F5 | 8B4424 44                | mov eax,dword ptr ss:[esp+44]                                                    |
100011F9 | 57                       | push edi                                                                         |
100011FA | 50                       | push eax                                                                         |
100011FB | 8B4424 48                | mov eax,dword ptr ss:[esp+48]                                                    |
100011FF | 50                       | push eax                                                                         |
10001200 | FF52 08                  | call dword ptr ds:[edx+8]                                                        | Call 3 获取连接句柄
10001203 | 85FF                     | test edi,edi                                                                     |
10001205 | 8BF0                     | mov esi,eax                                                                      |
10001207 | 74 12                    | je tongxin.1000121B                                                              |
10001209 | 8B16                     | mov edx,dword ptr ds:[esi]                                                       |
1000120B | 8BCE                     | mov ecx,esi                                                                      |
1000120D | FF52 44                  | call dword ptr ds:[edx+44]                                                       | Call 4
10001210 | 85C0                     | test eax,eax                                                                     |
10001212 | 74 07                    | je tongxin.1000121B                                                              |
10001214 | 8B06                     | mov eax,dword ptr ds:[esi]                                                       |
10001216 | 8BCE                     | mov ecx,esi                                                                      |
10001218 | FF50 3C                  | call dword ptr ds:[eax+3C]                                                       | Call 5
1000121B | 8BC6                     | mov eax,esi                                                                      |
1000121D | 5F                       | pop edi                                                                          |
1000121E | 5E                       | pop esi                                                                          |
1000121F | 83C4 0C                  | add esp,C                                                                        |
10001222 | C2 2000                  | ret 20                                                                           |

然后在Call3下个断点，重新载入程序，在Call3断下后，F7跟进去，得到Call 3的地址为 10006740

此时回到IDA，打开sub_10006740 然后F5代码如下：

_DWORD *__thiscall sub_10006740(void *this, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9, int ArgList, int a11, int a12, int a13)
{
  char *v13; // ebx
  int *v14; // edi
  _DWORD *v15; // ebp
  const char *v16; // esi
  unsigned int v17; // kr04_4
  unsigned int v18; // kr08_4
  _DWORD *result; // eax
  int v20; // eax
  unsigned __int8 v21; // cl
  int (__thiscall ***v22)(_DWORD); // eax
  int v23; // eax
  int v24; // ecx
  int v25; // eax
  int v26; // esi
  int *v27; // eax
  int v28; // esi
  int v29; // eax
  int v30; // eax
  bool v31; // zf
  unsigned int v32; // kr14_4
  unsigned int v33; // kr14_4
  int v34; // esi
  int v35; // ecx
  int v36; // edx
  int v37; // edi
  int v38; // eax
  int v39; // edx
  int v40; // eax
  char v41; // dl
  int v42; // eax
  int v43; // edx
  int v44; // edx
  char v45; // al
  char v46; // [esp-10h] [ebp-64h]
  int v47; // [esp-Ch] [ebp-60h]
  int v48; // [esp-8h] [ebp-5Ch]
  signed int v49; // [esp-4h] [ebp-58h]
  int v50; // [esp+10h] [ebp-44h]
  int v51; // [esp+14h] [ebp-40h]
  int v52; // [esp+18h] [ebp-3Ch]
  int v53; // [esp+1Ch] [ebp-38h]
  char *v54; // [esp+20h] [ebp-34h]
  unsigned int v55; // [esp+24h] [ebp-30h]
  int v56; // [esp+28h] [ebp-2Ch]
  char v57; // [esp+2Ch] [ebp-28h]
  int v58; // [esp+48h] [ebp-Ch]
  int v59; // [esp+50h] [ebp-4h]
  int ArgLista; // [esp+78h] [ebp+24h]

  v13 = (char *)this;
  memset(&v57, 0, 0x1Cu);
  v14 = &v58;
  v15 = 0;
  v50 = 0;
  if ( a11 && *(_WORD *)a11 == -6 )
    v50 = 1;
  v16 = (const char *)ArgList;
  v51 = 0;
  if ( !ArgList || (v17 = strlen((const char *)ArgList) + 1, v14 = (int *)(ArgList + v17), v17 == 1) || v50 )
  {
    if ( a2 )
    {
      v49 = (unsigned __int16)a3;
      v48 = a2;
      sub_10002360((int)v13, 0, (int)v14, ArgList, aFastudxNewConn_0, a2, (unsigned __int16)a3);
    }
    else
    {
      v49 = (unsigned __int16)a3;
      sub_10002360((int)v13, 0, (int)v14, ArgList, aFastudxNewConn_1, (unsigned __int16)a3);
    }
  }
  else
  {
    v18 = strlen((const char *)ArgList) + 1;
    v14 = (int *)(ArgList + v18);
    sub_10002360((int)v13, 0, ArgList + v18, ArgList, aFastudxNewConn, ArgList, v18 - 1);
    v51 = 1;
    result = (_DWORD *)sub_1001F580(&v57, ArgList);
    if ( !result )
      return result;
  }
  if ( sub_10009E30((int)v13, (int)v13, 0, (int)v14, 1) )// 注意这个函数，如果返回值是true,则返回0
    return 0;
  v20 = sub_10018AB0(v13 + 3852);
  v21 = v13[4980];
  v52 = v20;
  v22 = (int (__thiscall ***)(_DWORD))(*(_DWORD *)(*((_DWORD *)v13 + 1243)
                                                 + 4 * ((signed int)v21 % *((_DWORD *)v13 + 1244)))
                                     + 36);
  v13[4980] = v21 + 1;
  v23 = (**v22)(v22);
  if ( v23 )
    v15 = (_DWORD *)(v23 - 8);
  v15[7] = v13;
  if ( a11 )
  {
    v24 = (int)(v15 + 593);
    v15[593] = *(_DWORD *)a11;
    *(_DWORD *)(v24 + 4) = *(_DWORD *)(a11 + 4);
    *(_BYTE *)(v24 + 8) = *(_BYTE *)(a11 + 8);
  }
  if ( a12 )
  {
    v25 = (*(int (__thiscall **)(int))(*(_DWORD *)a12 + 8))(a12);
    v26 = v25;
    if ( v25 )
    {
      if ( v25 == 1 )
      {
        if ( !(byte_10049228 & 1) )
        {
          byte_10049228 |= 1u;
          sub_10002500(&dword_10049240);
          atexit(unknown_libname_1);
        }
        v27 = (int *)(*(int (__thiscall **)(int *, signed int))dword_10049240)(&dword_10049240, 10240);
        goto LABEL_31;
      }
      if ( !(byte_10049228 & 1) )
      {
        byte_10049228 |= 1u;
        sub_10002500(&dword_10049240);
        atexit(unknown_libname_1);
      }
      v49 = v26;
    }
    else
    {
      if ( !(byte_10049228 & 1) )
      {
        byte_10049228 |= 1u;
        sub_10002500(&dword_10049240);
        atexit(unknown_libname_1);
      }
      v49 = 1024;
    }
    v27 = (int *)(*(int (__thiscall **)(int *, signed int))dword_10049240)(&dword_10049240, v49);
LABEL_31:
    v15[596] = v27;
    v28 = *v27;
    v29 = (*(int (__thiscall **)(int))(*(_DWORD *)a12 + 8))(a12);
    v30 = (*(int (__thiscall **)(int, int))(*(_DWORD *)a12 + 4))(a12, v29);
    (*(void (__thiscall **)(_DWORD, int))(v28 + 28))(v15[596], v30);
    v16 = (const char *)ArgList;
  }
  sub_10012130(v15);
  sub_10012120(v52);
  v31 = v50 == 0;
  v15[497] = 1000 * *((_DWORD *)v13 + 1248);
  if ( v31 && v51 )
  {
    qmemcpy((void *)v15[474], &v57, 0x1Cu);
    v16 = (const char *)ArgList;
    v15[489] = sub_1001F290(ArgList);
  }
  v54 = 0;
  LOBYTE(v53) = ArgList;
  v55 = 0;
  v56 = 0;
  std::basic_string<char,std::char_traits<char>,std::allocator<char>>::assign(
    &v53,
    aMasterUdxSocke,
    strlen(aMasterUdxSocke));
  v59 = 0;
  if ( v50 )
  {
    if ( v16 )
    {
      if ( strlen(v16) != 0 )
      {
        v32 = strlen(v16) + 1;
        if ( (unsigned __int8)std::basic_string<char,std::char_traits<char>,std::allocator<char>>::_Grow(
                                &v53,
                                v32 - 1,
                                1) )
        {
          v33 = v32 - 1;
          qmemcpy(v54, v16, v33);
          v55 = v33;
          v54[v33] = 0;
        }
      }
    }
  }
  ArgLista = 0;
  if ( *((_DWORD *)v13 + 1098) > 0 )
  {
    v34 = 0;
    do
    {
      v35 = *((_DWORD *)v13 + 1097);
      v36 = *v15;
      v49 = (signed int)v15;
      v37 = v35 + v34;
      v38 = (*(int (__thiscall **)(_DWORD *))(v36 + 100))(v15) & 7;
      if ( v38 < 0 )
        v38 = (((_BYTE)v38 - 1) | 0xFFFFFFF8) + 1;
      if ( !sub_10003530((char **)(v37 + 60 * v38), v49) )
        break;
      v34 += 480;
      ++ArgLista;
    }
    while ( ArgLista < *((_DWORD *)v13 + 1098) );
  }
  v39 = *v15;
  v49 = (signed int)v15;
  v40 = (*(int (__thiscall **)(_DWORD *))(v39 + 100))(v15) & 7;
  if ( v40 < 0 )
    v40 = (((_BYTE)v40 - 1) | 0xFFFFFFF8) + 1;
  sub_10003530((char **)&v13[60 * v40 + 3908], v49);
  v15[488] = *((_DWORD *)v13 + 1246);
  v41 = v53;
  ++*((_DWORD *)v13 + 1246);
  v46 = v41;
  v47 = 0;
  v48 = 0;
  v49 = 0;
  std::basic_string<char,std::char_traits<char>,std::allocator<char>>::assign(
    &v46,
    &v53,
    0,
    std::basic_string<char,std::char_traits<char>,std::allocator<char>>::npos);
  v42 = sub_1001B200(v13 + 516, v46, v47, v48, v49);
  v49 = a3;
  v48 = a2;
  v15[21] = v42;
  sub_100219C0(v48, v49);
  v43 = a6 | a5;
  if ( __PAIR__(a6, a5) )
  {
    v44 = *v15;
    v49 = a6;
    v48 = a5;
    (*(void (__thiscall **)(_DWORD *, int, int))(v44 + 112))(v15, a5, a6);
  }
  if ( __PAIR__(a8, a7) )
    *(_DWORD *)((*(int (__thiscall **)(_DWORD *))(*v15 + 96))(v15) + 20) = a7;
  *(_DWORD *)((*(int (__fastcall **)(_DWORD *, int))(*v15 + 96))(v15, v43) + 16) = a9;
  sub_1000DDF0(v15 + 14);
  sub_10024040(v15 + 18);
  if ( a4 && !*((_DWORD *)v13 + 97) )
    sub_1000DE00(v15[497]);
  if ( !a13 )
    (*(void (__thiscall **)(_DWORD *))(*v15 + 60))(v15);
  (*(void (__thiscall **)(_DWORD *))(v15[2] + 4))(v15 + 2);
  if ( v54 )
  {
    v45 = *(v54 - 1);
    if ( v45 && v45 != -1 )
      *(v54 - 1) = v45 - 1;
    else
      sub_100385C0(v54 - 1);
  }
  return v15;
}

有200多行代码，不用仔细看，粗劣浏览了下，在85行看到了可疑的地方：

if ( sub_10009E30((int)v13, (int)v13, 0, (int)v14, 1) )// 注意这个函数，如果返回值是true,则返回0
return 0;

子函数 sub_10009E30 很是可疑，直接双击进去看看：

int __userpurge sub_10009E30@<eax>(int a1@<ecx>, int a2@<ebx>, int a3@<ebp>, int a4@<edi>, int ArgList)
{
  void *v5; // esi
  int v6; // eax

  v5 = (void *)(a1 + 3852);
  if ( sub_10018A20((void *)(a1 + 3852)) < 100 )// 终于看到了熟悉的数字 100
    return 0;
  v6 = sub_10018A20(v5);
  sub_10002360(a2, a3, a4, (int)v5, aServerOverflow, ArgList, v6);
  return 1;
}

哈哈就是它了，代码不多, sub_10018A20 函数应该就是获取当前连接数的函数了

到这里分析就结束了，怎么修改就不说了。。。

friendan

关注

0
点赞
踩
2

收藏

觉得还不错? 一键收藏
打赏
1
评论
记一次去除连接数限制问题

有这么一段代码，连接数超过100后，再次连接就连接不上了，直接返回0.版本 2 .计次循环首 (150, i) 连接句柄＝模块类.UConnect (客户句柄, “127.0.0.1”, 2020, 到长整数 (id), 假, 1, “”) 编辑框1.加入文本 (到文本 (i) ＋ “ ” ＋取十六进制文本 (连接句柄) ＋ #换行符) ...
复制链接

扫一扫