Cracking the Bible (50 times)

Source: Internet
Author: User

(1) classic comparison combination, usually where the registration code appears (by programhunter)
1
Mov eax [] can be an address or another register.
Mov edx [] the preceding two addresses usually store important information.
Call 00 ??????
Test eax
Jz (jnz)
2
Mov eax [] can be an address or another register.
Mov edx [] the preceding two addresses usually store important information.
Call 00 ??????
Jne (je)
3
Mov eax []
Mov edx []
Cmp eax, edx
Jnz (jz)
Or
Begin mov al []
Mov cl []
Cmp al, cl
Jnz (jz)
Mov al [+ 1]
Mov cl [+ 1]
Cmp al, cl
Jnz (jz)
Cmp eax ecx (eax is a counter)
Jnl begin
Mov al 01
4
Lea edi []
Lea esi []
Repz cmpsd
Jz (jnz)
5
Mov eax [] can be an address or another register.
Mov edx [] the preceding two addresses usually store important information.
Call 00 ??????
Setz (setnz) al (bl, cl ...)
6
Mov eax [] can be an address or another register.
Mov edx [] the preceding two addresses usually store important information.
Call 00 ??????
Test eax
Setz (setnz) bl, cl...
7
Call 00 ?????? ***
Push eax (ebx, ecx ...)
......
......
Call 00 ??????
Pop eax (ebx, ecx ...)
Test eax
Jz (jnz)
This form is special. The key is not in the second call, but in the first call.

(2) The registration code is given in bytes.
: 0042A159 0FBE03 movsx eax, byte ptr [ebx]
: 0042A15C 50 push eax ^
: 0042A15D E8228C0400 call 00472D84
: 0042A162 59 pop ecx
: 0042A163 83F84A cmp eax, 2017004a ----> J
: 0042A166 7559 jne 0042A1C1
: 0042A168 0FBE5301 movsx edx, byte ptr [ebx + 01]
: 0042A16C 52 push edx ^
: 0042A16D E8128C0400 call 00472D84
: 0042A172 59 pop ecx
: 0042A173 83F853 cmp eax, 00000053
^ ----> S
: 0042A176 7549 jne 0042A1C1
: 0042A178 0FBE4B02 movsx ecx, byte ptr [ebx + 02]
: 0042A17C 83F924 cmp ecx, 00000024 ^
^ ----> $
: 0042A17F 7540 jne 0042A1C1
: 0042A181 0fbedomain3 movsx eax, byte ptr [ebx + 03]
: 0042A185 83F832 cmp eax, 00000032 ^
^ ----> 2
: 0042a1887537 jne 0042A1C1
: 0042A18A 0FBE5304 movsx edx, byte ptr [ebx + 04]
: 0042A18E 83FA38 cmp edx, 00000038 ^
^ ----> 8
: 0042A191 752E jne 0042A1C1
: 0042A193 0FBE4B05 movsx ecx, byte ptr [ebx + 05]
: 0042A197 83F939 cmp ecx, 00000039 ^
^ ----> 9
: 0042A19A 7525 jne 0042A1C1
: 0042A19C 0fbe00006 movsx eax, byte ptr [ebx + 06]
: 0042A1A0 83F832 cmp eax, 00000032 ^
^ ----> 2
: 0042A1A3 751C & nbs

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.