[ASM]查看加密的vba代码

效果如上。具体原理，把gc= 改为 cc=

ASM代码：

  1 ;*********************************************************************
  2 .386
  3 .model flat,stdcall
  4 option casemap:none
  5 ;*********************************************************************
  6 include windows.inc
  7 include user32.inc
  8 include kernel32.inc
  9 includelib user32.lib
 10 includelib kernel32.lib
 11 include comdlg32.inc
 12 includelib comdlg32.lib
 13  _OpenFile proto ;打开文件并映射文件到内存
 14  
 15 .data
 16 szMsgTileTxt db 'File ERROR',0
 17 szMsgTileMap db 'Map ERROR',0
 18 szMsgTileView db 'View ERROR',0
 19 ;szFilter    db    'xls Files(*.xls)',0,'*.xls','xla Files(*.xla)',0,'*.xla',0,0
 20 szFilter    db    'XLS Files(*.xls)',0,'*.xls',0,'xla Files(*.xla)',0,'*.xla',0,0
 21 szCreateFileError db '打开文件失败',0
 22 szCreateFileMappingError db '创建文件映射失败',0
 23 szMapViewOfFileError db '映射文件到内存失败',0
 24 szError db 'ERROR',0
 25 szNFind db 'no find',0
 26 szFind db 'find',0
 27 szFmat db '%d',0
 28 szOKT db 'by 153785587',0
 29 szOKFIND db 'VBA密码已解除',0
 30 .data?
 31 hFile dd ?
 32 hMap dd ?
 33 szCurrentPath db MAX_PATH dup (?) ;当前程序路径
 34 szFullFilePath db MAX_PATH dup (?) ;完整的文件名
 35 szBuffer db MAX_PATH dup (?)
 36 
 37 .const
 38 szcmp db 0Ah,47h,43h,3Dh ;gc=
 39 szwc db 0Ah,43h,43h,3Dh ;cc=
 40 .code
 41 
 42 _OpenFile proc
 43       local @hFile:DWORD,@hFileMap:DWORD
 44       local @lpMem:DWORD
 45       local @szFileNameBuf[MAX_PATH]:BYTE
 46       local @stFile:OPENFILENAME
 47       local @dwFileLength:DWORD,@incnum:DWORD
 48     pushad
 49           invoke RtlZeroMemory,addr @szFileNameBuf,sizeof @szFileNameBuf
 50           invoke RtlZeroMemory,addr @stFile,sizeof @stFile 
 51           mov @stFile.lStructSize,sizeof @stFile
 52           mov @stFile.lpstrFilter,offset szFilter
 53           lea eax,@szFileNameBuf
 54           mov @stFile.lpstrFile,eax
 55           mov @stFile.nMaxFile,MAX_PATH
 56           mov @stFile.Flags,OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST
 57           invoke GetOpenFileName,addr @stFile
 58           .if !eax      ;getopenfilename打开成功的话返回非0值
 59              popad 
 60              ret
 61           .endif
 62          ;invoke MessageBox,NULL,addr @szFileNameBuf,addr @szFileNameBuf,0
 63      invoke CreateFile,addr @szFileNameBuf,GENERIC_READ+GENERIC_WRITE,FILE_SHARE_READ+FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL
 64      ;.if eax==INVALID_HANDLE_VALUE
 65      ;     jmp CreateFileError
 66      ;.endif
 67          .if eax == -1 
 68             invoke MessageBox,NULL,addr szCreateFileError,addr szCreateFileError,0
 69               popad  
 70            ret
 71         .endif
 72      mov @hFile,eax
 73 
 74      invoke GetFileSize,@hFile,NULL
 75       .if !eax ;等于0失败
 76          invoke ExitProcess,NULL
 77      .endif
 78     mov @dwFileLength,eax ;文件大小  字节为单位    8位为1字节　1024字节为1KB
 79      ;invoke wsprintf,addr szBuffer,addr szFmat,@dwFileLength
 80     ;invoke MessageBox,NULL,addr szBuffer,addr szBuffer,0
 81     
 82   invoke CreateFileMapping,@hFile,NULL,PAGE_READWRITE,0,0,NULL ; 这里若是都设0表示是以原文件的尺寸映射到内存中
 83      .if !eax
 84      invoke CloseHandle,@hFile
 85             invoke MessageBox,NULL,addr szCreateFileMappingError,addr szCreateFileMappingError,0
 86               popad  
 87            ret
 88      .endif
 89      mov @hFileMap,eax
 90      invoke MapViewOfFile,@hFileMap,FILE_MAP_READ+FILE_MAP_WRITE+FILE_MAP_COPY,NULL,NULL,NULL
 91      .if !eax
 92           invoke CloseHandle,@hFile
 93                invoke CloseHandle,@hFileMap
 94             invoke MessageBox,NULL,addr szMapViewOfFileError,addr szMapViewOfFileError,0
 95               popad  
 96            ret
 97      .endif
 98 
 99       mov @lpMem,eax
100          mov esi,eax
101          invoke wsprintf,addr szBuffer,addr szFmat,edi
102          mov @incnum,0
103          mov edi,@dwFileLength 
104         .while TRUE
105             .if DWORD ptr [esi] == 3D43470AH
106                 
107                 mov DWORD ptr [esi],3D43430AH
108                 invoke MessageBox,NULL,addr szOKFIND,addr szOKT,MB_OK
109                 jmp ExitOpenFile
110             .endif
111             .break .if @incnum == edi
112             ;invoke MessageBox,NULL,addr szFind,addr szFind,MB_OK
113             inc esi ;add 1
114             inc @incnum
115         .endw    
116  
117  
118  
119  
120  
121           
122           
123 ;*********************************************************************     
124       ExitOpenFile:
125                  invoke UnmapViewOfFile, @lpMem
126                  invoke CloseHandle, @hFileMap
127                  invoke CloseHandle, @hFile  
128            popad  
129            ret
130       
131           
132 _OpenFile endp         
133 
134 start:
135 
136 invoke _OpenFile
137 
138 invoke ExitProcess,NULL
139 end start

 

转载于:https://www.cnblogs.com/onepc/archive/2011/10/25/2223750.html