Reverse analysis of MFC programs

1. View version

2. Run the program to see

The goal is to light up to determine the number of twisting ideas (straight to exe file string search, etc.) here with the API down analysis
You can see that it's vc2013. Click on the breakpoint idea to find the signature (related to the version)
2013 Press Twist Event

特征码VS2013 Debug 静态编译CALL DWORD PTR SS:[EBP-0x8]VS2013 Release 版静态编译CALL DWORD PTR SS:[EBP+0x14]

Loading OD search signatures directly


Run the program first
And then they all break down and try to get rid of it.

Start analysis
Click the first one

Step into the discovery symmetry
At the beginning

At last

Can be sure it is
UpdateData (TRUE)
UpdateData (FALSE)
The middle code is pretty much the user implementation. Call should be decrypted.
There was a jump and call.

You should think about where the numbers on the button are kept.
Which one is here?

Should be the first address of the class plus offset no, go inside and look at the contrast.
The following can be seen ecx as this pointer and it gives EAX

At the same time, I think the member variable is very far away from the first address guess Eax+0xe4

The data window follows the address that was initialized to 0.

I found the data, and then one button, one button, and a twist.

Through the analysis

What is behind or not clear?
Then get in.
UpdateData (TRUE)
UpdateData (FALSE) between the call look
Before the condition first NOP

Entered

Find some suspicious data
Take a look at the data window

Discovery is the data from the back section.
Analysis results
The data starting from that must be 011010101.

Back out here means that the sum must be equal to 9 (each point plus the number of buttons)

Then analyze the memory before the first paragraph is each pressed data after the next paragraph is pressed for 1 the second time and then to 0 plus the preceding sum must be 9 which means that all the buttons must be pressed once
That's the answer. Some press twice (0) Some press once (1)
Analyze correctly

Reverse analysis of MFC programs