-----------------------------------------------------
文件名称:破解飓风视频播放密码的方法
目标程序:“05第五讲单例模式.exe”
操作环境:Windows XP-SP2
使用工具:Ollydbg 1.10版
编写作者:Coderui
编写时间:2009年11月27日
联系方式:coderui@163.com
作者博客:http://hi.baidu.com/coderui
-----------------------------------------------------
“视频文件”使用“飓风视频加密工具”加密以后,播放时需要播放密码。
“视频文件”使用“飓风视频加密工具”加密以后,文件会变成EXE可执行程序,采用delphi编写。
“视频文件”使用“飓风视频加密工具”加密以后,使用PEID查壳显示为“MoleBox v2.0 [Overlay] *”。
-----------------------------------------------------
声明:
本文没有任何技术含量可言,只是为了做笔记备份而用。
如有朋友喜欢可以拿去转载,但误用于非法用途,谢谢。
-----------------------------------------------------
[确定]按扭的入口点,判断用户输入的密码是否为8位:
00480A6B B9 4E000000 MOV ECX,4E
00480A70 6A 00 PUSH 0
00480A72 6A 00 PUSH 0
00480A74 49 DEC ECX
00480A75 ^ 75 F9 JNZ SHORT 05第五讲.00480A70
00480A77 51 PUSH ECX
00480A78 53 PUSH EBX
00480A79 56 PUSH ESI
00480A7A 57 PUSH EDI
00480A7B 8BD8 MOV EBX,EAX
00480A7D 33C0 XOR EAX,EAX
00480A7F 55 PUSH EBP
00480A80 68 50104800 PUSH 05第五讲.00481050
00480A85 64:FF30 PUSH DWORD PTR FS:[EAX]
00480A88 64:8920 MOV DWORD PTR FS:[EAX],ESP
00480A8B 8D95 0CFEFFFF LEA EDX,DWORD PTR SS:[EBP-1F4]
00480A91 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+300]
00480A97 E8 2CCCFBFF CALL 05第五讲.0043D6C8 ; 读取用户输入的密码字符串*
00480A9C 8B85 0CFEFFFF MOV EAX,DWORD PTR SS:[EBP-1F4]
00480AA2 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00480AA5 E8 927EF8FF CALL 05第五讲.0040893C
00480AAA 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00480AAD E8 9E3FF8FF CALL 05第五讲.00404A50
00480AB2 83F8 08 CMP EAX,8
00480AB5 75 12 JNZ SHORT 05第五讲.00480AC9 ; 判断用户输入的密码是否为8位*
判断播放密码的前2位是否正确:
00480C0D /E9 DD030000 JMP 05第五讲.00480FEF
00480C12 |8BC6 MOV EAX,ESI
00480C14 |E8 272EF8FF CALL 05第五讲.00403A40
00480C19 |8D95 DCFDFFFF LEA EDX,DWORD PTR SS:[EBP-224]
00480C1F |A1 5C814800 MOV EAX,DWORD PTR DS:[48815C]
00480C24 |8B00 MOV EAX,DWORD PTR DS:[EAX]
00480C26 |E8 952E0000 CALL 05第五讲.00483AC0
00480C2B |8D85 DCFDFFFF LEA EAX,DWORD PTR SS:[EBP-224]
00480C31 |50 PUSH EAX
00480C32 |8D95 D8FDFFFF LEA EDX,DWORD PTR SS:[EBP-228]
00480C38 |8B83 FC020000 MOV EAX,DWORD PTR DS:[EBX+2FC]
00480C3E |E8 85CAFBFF CALL 05第五讲.0043D6C8 ; 读取程序界面文本框中显示出来的“电脑标识”*
00480C43 |8B95 D8FDFFFF MOV EDX,DWORD PTR SS:[EBP-228]
00480C49 |58 POP EAX
00480C4A |E8 093EF8FF CALL 05第五讲.00404A58
00480C4F |8B85 DCFDFFFF MOV EAX,DWORD PTR SS:[EBP-224]
00480C55 |8D95 E0FDFFFF LEA EDX,DWORD PTR SS:[EBP-220]
00480C5B |E8 C87AF8FF CALL 05第五讲.00408728
00480C60 |8B85 E0FDFFFF MOV EAX,DWORD PTR SS:[EBP-220]
00480C66 |8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
00480C69 |E8 3E2F0000 CALL 05第五讲.00483BAC
00480C6E |8D95 C0FDFFFF LEA EDX,DWORD PTR SS:[EBP-240]
00480C74 |8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00480C77 |E8 442E0000 CALL 05第五讲.00483AC0
00480C7C |FFB5 C0FDFFFF PUSH DWORD PTR SS:[EBP-240]
00480C82 |68 AC104800 PUSH 05第五讲.004810AC ; yaomediakj1jf*
00480C87 |68 C4104800 PUSH 05第五讲.004810C4 ; m
00480C8C |68 D0104800 PUSH 05第五讲.004810D0 ; ly
00480C91 |68 DC104800 PUSH 05第五讲.004810DC ; 1
00480C96 |8D85 C4FDFFFF LEA EAX,DWORD PTR SS:[EBP-23C]
00480C9C |BA 05000000 MOV EDX,5
00480CA1 |E8 6A3EF8FF CALL 05第五讲.00404B10
00480CA6 |8B85 C4FDFFFF MOV EAX,DWORD PTR SS:[EBP-23C]
00480CAC |8D95 C8FDFFFF LEA EDX,DWORD PTR SS:[EBP-238]
00480CB2 |E8 F52E0000 CALL 05第五讲.00483BAC
00480CB7 |8B85 C8FDFFFF MOV EAX,DWORD PTR SS:[EBP-238]
00480CBD |8D95 CCFDFFFF LEA EDX,DWORD PTR SS:[EBP-234]
00480CC3 |E8 607AF8FF CALL 05第五讲.00408728
00480CC8 |8B85 CCFDFFFF MOV EAX,DWORD PTR SS:[EBP-234]
00480CCE |8D95 E8FDFFFF LEA EDX,DWORD PTR SS:[EBP-218]
00480CD4 |E8 2F6AFEFF CALL 05第五讲.00467708
00480CD9 |8D85 E8FDFFFF LEA EAX,DWORD PTR SS:[EBP-218]
00480CDF |8D95 D0FDFFFF LEA EDX,DWORD PTR SS:[EBP-230]
00480CE5 |E8 926AFEFF CALL 05第五讲.0046777C
00480CEA |8B85 D0FDFFFF MOV EAX,DWORD PTR SS:[EBP-230]
00480CF0 |8D8D D4FDFFFF LEA ECX,DWORD PTR SS:[EBP-22C]
00480CF6 |BA 02000000 MOV EDX,2 ; 计算播放密码的前2位*
00480CFB |E8 28E9FAFF CALL 05第五讲.0042F628 ; 真实密码前2位的明文*
00480D00 |8B85 D4FDFFFF MOV EAX,DWORD PTR SS:[EBP-22C]
00480D06 |8D95 E8FDFFFF LEA EDX,DWORD PTR SS:[EBP-218]
00480D0C |E8 F769FEFF CALL 05第五讲.00467708
00480D11 |8D85 E8FDFFFF LEA EAX,DWORD PTR SS:[EBP-218]
00480D17 |8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
00480D1A |E8 5D6AFEFF CALL 05第五讲.0046777C
00480D1F |8D8D BCFDFFFF LEA ECX,DWORD PTR SS:[EBP-244]
00480D25 |BA 02000000 MOV EDX,2 ; 取用户输入的密码字符串的前2位*
00480D2A |A1 D8AD4800 MOV EAX,DWORD PTR DS:[48ADD8]
00480D2F |E8 F4E8FAFF CALL 05第五讲.0042F628 ; 所提取用户输入密码前2位的明文*
00480D34 |8B85 BCFDFFFF MOV EAX,DWORD PTR SS:[EBP-244]
00480D3A |8D95 E8FDFFFF LEA EDX,DWORD PTR SS:[EBP-218]
00480D40 |E8 C369FEFF CALL 05第五讲.00467708
00480D45 |8D85 E8FDFFFF LEA EAX,DWORD PTR SS:[EBP-218]
00480D4B |8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
00480D4E |E8 296AFEFF CALL 05第五讲.0046777C
00480D53 |8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
00480D56 |8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00480D59 |E8 3E3EF8FF CALL 05第五讲.00404B9C
00480D5E |0F95C0 SETNE AL
00480D61 |84C0 TEST AL,AL
00480D63 |74 0F JE SHORT 05第五讲.00480D74 ; 判断前2位密码是否正确
00480D65 |B8 E8104800 MOV EAX,05第五讲.004810E8 ; 播放密码不正确
00480D6A |E8 55B9FAFF CALL 05第五讲.0042C6C4
00480D6F |E9 7B020000 JMP 05第五讲.00480FEF
判断播放密码的中间4位是否正确:
00480E5B /74 0F JE SHORT 05第五讲.00480E6C
00480E5D |B8 E8104800 MOV EAX,05第五讲.004810E8 ; 播放密码不正确
00480E62 |E8 5DB8FAFF CALL 05第五讲.0042C6C4
00480E67 |E9 83010000 JMP 05第五讲.00480FEF
00480E6C /8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
00480E6F 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00480E72 E8 253DF8FF CALL 05第五讲.00404B9C
00480E77 0F95C0 SETNE AL
00480E7A 84C0 TEST AL,AL
00480E7C 0F85 6D010000 JNZ 05第五讲.00480FEF
00480E82 8D95 94FDFFFF LEA EDX,DWORD PTR SS:[EBP-26C]
00480E88 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00480E8B E8 302C0000 CALL 05第五讲.00483AC0
00480E90 FFB5 94FDFFFF PUSH DWORD PTR SS:[EBP-26C]
00480E96 68 28114800 PUSH 05第五讲.00481128 ; yaomediakj2jf*
00480E9B 68 40114800 PUSH 05第五讲.00481140 ; mm
00480EA0 68 D0104800 PUSH 05第五讲.004810D0 ; ly
00480EA5 68 DC104800 PUSH 05第五讲.004810DC ; 1
00480EAA 8D85 98FDFFFF LEA EAX,DWORD PTR SS:[EBP-268]
00480EB0 BA 05000000 MOV EDX,5
00480EB5 E8 563CF8FF CALL 05第五讲.00404B10
00480EBA 8B85 98FDFFFF MOV EAX,DWORD PTR SS:[EBP-268]
00480EC0 8D95 9CFDFFFF LEA EDX,DWORD PTR SS:[EBP-264]
00480EC6 E8 E12C0000 CALL 05第五讲.00483BAC
00480ECB 8B85 9CFDFFFF MOV EAX,DWORD PTR SS:[EBP-264]
00480ED1 8D95 A0FDFFFF LEA EDX,DWORD PTR SS:[EBP-260]
00480ED7 E8 4C78F8FF CALL 05第五讲.00408728
00480EDC 8B85 A0FDFFFF MOV EAX,DWORD PTR SS:[EBP-260]
00480EE2 8D95 E8FDFFFF LEA EDX,DWORD PTR SS:[EBP-218]
00480EE8 E8 1B68FEFF CALL 05第五讲.00467708
00480EED 8D85 E8FDFFFF LEA EAX,DWORD PTR SS:[EBP-218]
00480EF3 8D95 A4FDFFFF LEA EDX,DWORD PTR SS:[EBP-25C]
00480EF9 E8 7E68FEFF CALL 05第五讲.0046777C
00480EFE 8B85 A4FDFFFF MOV EAX,DWORD PTR SS:[EBP-25C]
00480F04 8D8D A8FDFFFF LEA ECX,DWORD PTR SS:[EBP-258]
00480F0A BA 0E000000 MOV EDX,0E
00480F0F E8 14E7FAFF CALL 05第五讲.0042F628
00480F14 8B85 A8FDFFFF MOV EAX,DWORD PTR SS:[EBP-258]
00480F1A 8D8D ACFDFFFF LEA ECX,DWORD PTR SS:[EBP-254]
00480F20 BA 04000000 MOV EDX,4 ; 计算播放密码的中间4位*
00480F25 E8 6EE7FAFF CALL 05第五讲.0042F698
00480F2A 8B85 ACFDFFFF MOV EAX,DWORD PTR SS:[EBP-254] ; 真实密码中间4位的明文*
00480F30 8D95 E8FDFFFF LEA EDX,DWORD PTR SS:[EBP-218]
00480F36 E8 CD67FEFF CALL 05第五讲.00467708
00480F3B 8D85 E8FDFFFF LEA EAX,DWORD PTR SS:[EBP-218]
00480F41 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
00480F44 E8 3368FEFF CALL 05第五讲.0046777C
00480F49 8D8D 8CFDFFFF LEA ECX,DWORD PTR SS:[EBP-274]
00480F4F BA 06000000 MOV EDX,6
00480F54 A1 D8AD4800 MOV EAX,DWORD PTR DS:[48ADD8]
00480F59 E8 CAE6FAFF CALL 05第五讲.0042F628
00480F5E 8B85 8CFDFFFF MOV EAX,DWORD PTR SS:[EBP-274]
00480F64 8D8D 90FDFFFF LEA ECX,DWORD PTR SS:[EBP-270]
00480F6A BA 04000000 MOV EDX,4 ; 取用户输入的密码字符串的中间4位*
00480F6F E8 24E7FAFF CALL 05第五讲.0042F698 ; 所提取用户输入密码中间4位的明文*
00480F74 8B85 90FDFFFF MOV EAX,DWORD PTR SS:[EBP-270]
00480F7A 8D95 E8FDFFFF LEA EDX,DWORD PTR SS:[EBP-218]
00480F80 E8 8367FEFF CALL 05第五讲.00467708
00480F85 8D85 E8FDFFFF LEA EAX,DWORD PTR SS:[EBP-218]
00480F8B 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
00480F8E E8 E967FEFF CALL 05第五讲.0046777C
00480F93 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
00480F96 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00480F99 E8 FE3BF8FF CALL 05第五讲.00404B9C
00480F9E 74 0C JE SHORT 05第五讲.00480FAC ; 判断中间4位密码是否正确
00480FA0 B8 E8104800 MOV EAX,05第五讲.004810E8 ; 播放密码不正确
00480FA5 E8 1AB7FAFF CALL 05第五讲.0042C6C4
00480FAA EB 43 JMP SHORT 05第五讲.00480FEF
00480FAC 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00480FAF E8 9C3AF8FF CALL 05第五讲.00404A50
00480FB4 83F8 08 CMP EAX,8
00480FB7 7E 0E JLE SHORT 05第五讲.00480FC7
00480FB9 8B4D E0 MOV ECX,DWORD PTR SS:[EBP-20]
00480FBC 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00480FBF 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18]
00480FC2 E8 C5050000 CALL 05第五讲.0048158C
00480FC7 A1 047F4800 MOV EAX,DWORD PTR DS:[487F04]
00480FCC BA 4C114800 MOV EDX,05第五讲.0048114C ; ok
00480FD1 E8 0E38F8FF CALL 05第五讲.004047E4
00480FD6 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00480FD9 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
00480FDC E8 8377F8FF CALL 05第五讲.00408764
00480FE1 85C0 TEST EAX,EAX
00480FE3 75 0A JNZ SHORT 05第五讲.00480FEF
00480FE5 A1 C8AD4800 MOV EAX,DWORD PTR DS:[48ADC8]
00480FEA E8 F587FDFF CALL 05第五讲.004597E4
00480FEF 33C0 XOR EAX,EAX
00480FF1 5A POP EDX
00480FF2 59 POP ECX
00480FF3 59 POP ECX
00480FF4 64:8910 MOV DWORD PTR FS:[EAX],EDX
00480FF7 68 57104800 PUSH 05第五讲.00481057
00480FFC 8D85 8CFDFFFF LEA EAX,DWORD PTR SS:[EBP-274]
00481002 BA 13000000 MOV EDX,13
00481007 E8 A837F8FF CALL 05第五讲.004047B4
0048100C 8D85 D8FDFFFF LEA EAX,DWORD PTR SS:[EBP-228]
00481012 E8 7937F8FF CALL 05第五讲.00404790
00481017 8D85 DCFDFFFF LEA EAX,DWORD PTR SS:[EBP-224]
0048101D BA 03000000 MOV EDX,3
00481022 E8 8D37F8FF CALL 05第五讲.004047B4
00481027 8D85 F8FDFFFF LEA EAX,DWORD PTR SS:[EBP-208]
0048102D BA 05000000 MOV EDX,5
00481032 E8 7D37F8FF CALL 05第五讲.004047B4
00481037 8D85 0CFEFFFF LEA EAX,DWORD PTR SS:[EBP-1F4]
0048103D E8 4E37F8FF CALL 05第五讲.00404790
00481042 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00481045 BA 09000000 MOV EDX,9
0048104A E8 6537F8FF CALL 05第五讲.004047B4
0048104F C3 RETN
00481050 ^ E9 3F31F8FF JMP 05第五讲.00404194
00481055 ^ EB A5 JMP SHORT 05第五讲.00480FFC
00481057 5F POP EDI
00481058 5E POP ESI
00481059 5B POP EBX
0048105A 8BE5 MOV ESP,EBP
0048105C 5D POP EBP
0048105D C3 RETN
判断播放密码的后2位是否正确:
0048115E ^/75 F9 JNZ SHORT 05第五讲.00481159
00481160 51 PUSH ECX
00481161 874D FC XCHG DWORD PTR SS:[EBP-4],ECX
00481164 53 PUSH EBX
00481165 56 PUSH ESI
00481166 57 PUSH EDI
00481167 8BD8 MOV EBX,EAX
00481169 33C0 XOR EAX,EAX
0048116B 55 PUSH EBP
0048116C 68 82144800 PUSH 05第五讲.00481482
00481171 64:FF30 PUSH DWORD PTR FS:[EAX]
00481174 64:8920 MOV DWORD PTR FS:[EAX],ESP
00481177 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
0048117A A1 5C814800 MOV EAX,DWORD PTR DS:[48815C]
0048117F 8B00 MOV EAX,DWORD PTR DS:[EAX]
00481181 E8 3A290000 CALL 05第五讲.00483AC0
00481186 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
00481189 50 PUSH EAX
0048118A 8D55 E4 LEA EDX,DWORD PTR SS:[EBP-1C]
0048118D 8B83 FC020000 MOV EAX,DWORD PTR DS:[EBX+2FC]
00481193 E8 30C5FBFF CALL 05第五讲.0043D6C8 ; 读取用户输入的密码字符串*
00481198 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
0048119B 58 POP EAX
0048119C E8 B738F8FF CALL 05第五讲.00404A58
004811A1 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18]
004811A4 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
004811A7 E8 7C75F8FF CALL 05第五讲.00408728
004811AC 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
004811AF 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
004811B2 E8 F5290000 CALL 05第五讲.00483BAC
004811B7 8D55 B8 LEA EDX,DWORD PTR SS:[EBP-48]
004811BA 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004811BD E8 FE280000 CALL 05第五讲.00483AC0
004811C2 FF75 B8 PUSH DWORD PTR SS:[EBP-48]
004811C5 68 98144800 PUSH 05第五讲.00481498 ; yaomediakj3jf*
004811CA 68 B0144800 PUSH 05第五讲.004814B0 ; mmm
004811CF 68 BC144800 PUSH 05第五讲.004814BC ; ly
004811D4 68 C8144800 PUSH 05第五讲.004814C8 ; 1
004811D9 8D45 BC LEA EAX,DWORD PTR SS:[EBP-44]
004811DC BA 05000000 MOV EDX,5
004811E1 E8 2A39F8FF CALL 05第五讲.00404B10
004811E6 8B45 BC MOV EAX,DWORD PTR SS:[EBP-44]
004811E9 8D55 C0 LEA EDX,DWORD PTR SS:[EBP-40]
004811EC E8 BB290000 CALL 05第五讲.00483BAC
004811F1 8B45 C0 MOV EAX,DWORD PTR SS:[EBP-40]
004811F4 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C]
004811F7 E8 2C75F8FF CALL 05第五讲.00408728
004811FC 8B45 C4 MOV EAX,DWORD PTR SS:[EBP-3C]
004811FF 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00481202 E8 0165FEFF CALL 05第五讲.00467708
00481207 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
0048120A 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38]
0048120D E8 6A65FEFF CALL 05第五讲.0046777C
00481212 8B45 C8 MOV EAX,DWORD PTR SS:[EBP-38]
00481215 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00481218 BA 18000000 MOV EDX,18
0048121D E8 06E4FAFF CALL 05第五讲.0042F628
00481222 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34]
00481225 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
00481228 BA 02000000 MOV EDX,2 ; 计算播放密码的后2位*
0048122D E8 66E4FAFF CALL 05第五讲.0042F698 ; 真实密码后2位的明文*
00481232 8B45 D0 MOV EAX,DWORD PTR SS:[EBP-30]
00481235 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00481238 E8 CB64FEFF CALL 05第五讲.00467708
0048123D 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
00481240 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00481243 E8 3465FEFF CALL 05第五讲.0046777C
00481248 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
0048124B BA 02000000 MOV EDX,2 ; 取用户输入的密码字符串的后2位*
00481250 A1 D8AD4800 MOV EAX,DWORD PTR DS:[48ADD8]
00481255 E8 3EE4FAFF CALL 05第五讲.0042F698 ; 所提取用户输入密码后2位的明文*
0048125A 8B45 B4 MOV EAX,DWORD PTR SS:[EBP-4C]
0048125D 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00481260 E8 A364FEFF CALL 05第五讲.00467708
00481265 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
00481268 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
0048126B E8 0C65FEFF CALL 05第五讲.0046777C
00481270 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00481273 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00481276 E8 2139F8FF CALL 05第五讲.00404B9C
0048127B 0F95C3 SETNE BL
0048127E 84DB TEST BL,BL
00481280 74 11 JE SHORT 05第五讲.00481293 ; 判断后2位密码是否正确
00481282 A1 C4824800 MOV EAX,DWORD PTR DS:[4882C4]
00481287 8B00 MOV EAX,DWORD PTR DS:[EAX]
00481289 E8 5685FDFF CALL 05第五讲.004597E4
0048128E E9 B7010000 JMP 05第五讲.0048144A
-----------------------------------------------------
注明:注解中,加“*”号处为重点部分。
-----------------------------------------------------