VB P-CODE完整逆向分析 之 QQ挂太阳专家1.0(国外英语资料).doc

VB P-CODE完整逆向分析 之 QQ挂太阳专家1.0(国外英语资料) VB P-CODE complete reverse analysis of QQ sun Expert 1 decrease font font increases by anonymous source unknown release time: 2009-11-3 4:58:44 To discuss cooperation [Objective] CSDN: QQ sun expert V1.0 [tools]: PEiD0.94, VBExplorer1.1 [tasks] VB P-CODE reverse analysis [operation platform]: Win2003.SE.sp1 [author]: KuNgBiM{BCG}{DFCG}{DCM}{DCT}{SLT}{NCPH} [related links]: N/A Brief description: [] QQ upgrading has been an important part of QQ we use, as long as you advance to enter the QQ number and password, and then click the upgrade, you can simulate the QQ login, its main characteristic is to be used at the same time, tens of thousands of QQ on a single machine upgrade! Point every day, 000 a QQ upgrade easily (in order to protect your QQ password, please do not use the software on the Internet) [author] statement: what a long time did not write the article, hands are rusty, today from online caught a small software used to practice, which know.... [detailed process]: first of all, we must check the shell, as a beginner crack friends, this is very important. If the software program is a hard shell word, is going to make the quit... Ado... Began today to do VB program P-CODE easy trip. Fortunately, the author may also be a beginner ~ ~ Oh, without any protective measures to the software program, Microsoft Visual Basic 5 / 6 of the program, initially with Ollydbg loading, just set up several breakpoints (?????) I wonder... What? API isnt there? Is it the way P-CODE compiles? Try another debugger (not exactly a debugger, but a VB resource modifier), and this VBExplorer goes on stage... Just do a ~ ~ seems indeed P-CODE the program compiled by the compiler. After loading, double-click the frmLogin form on the left to see all the call instructions in the form: : 0040592B 050000; ImpAdLdRf; Push PTR : 0040592E 240100; NewIfNullPr; [Pop] [SR] :0VCallHresult; Call ptr_004043BC :1A78FF FFree1Ad; Push [LO