experiment用OD下消息斷點(diǎn),捕獲按鈕操作

experiment 用OD下消息斷點(diǎn),捕獲按鈕操作.實(shí)驗(yàn)?zāi)康?想直接攔截按鈕操作的消息處理,分析按鈕操作的邏輯.實(shí)驗(yàn)程序:<<使用OllyDbg從零開(kāi)始Cracking第一章翻譯>>中附帶的一個(gè)CrackMe.使用OD加載目標(biāo)程序,當(dāng)程序運(yùn)行起來(lái)后 ,暫停OD經(jīng)過(guò)實(shí)驗(yàn),點(diǎn)擊菜單會(huì)觸發(fā)主窗體 WM_COMMAND 消息.如果直接捕獲彈出的注冊(cè)窗口的 WM_COMMAND, 捕獲不到.準(zhǔn)備捕獲主窗體的WM_COMMAND消息,找到菜單生成注冊(cè)窗體的處理.找到注冊(cè)窗體的創(chuàng)建函數(shù)傳入的注冊(cè)窗口處理過(guò)程，從而找到注冊(cè)窗體的所有消息處理實(shí)現(xiàn)邏輯 .點(diǎn)擊菜單屬于WM_COMMAND, 按照消息名稱(chēng)排序 ,好找一些.下完消息斷電后,確認(rèn)一下是否消息斷點(diǎn)已下 .F9,讓程序跑起來(lái).點(diǎn)擊注冊(cè)菜單.程序被斷在 WM_COMMAND 消息斷點(diǎn)處.[cpp]viewplaincopy00401128>$C8000000 ENTER0,0 ; 主窗體消息斷點(diǎn)WM_COMMAND 0040112C .56 PUSHESI 0040112D .57 PUSHEDI0040112E .53 PUSHEBX0040112F.837D0C02CMPDWORDPTRSS:[EBP+C],200401133.745EJESHORTCRACKME.0040119300401135.817D0C040200>CMPDWORDPTRSS:[EBP+C],2040040113C.7465JESHORTCRACKME.004011A3F8往下走，找到創(chuàng)建注冊(cè)窗體的代碼.[cpp]viewplaincopy00401209>6A00PUSH0;/lParam=NULL0040120B.6853124000PUSHCRACKME.00401253;|DlgProc=CRACKME.0040125300401210.FF7508PUSHDWORDPTRSS:[EBP+8];|hOwner00401213.6815214000PUSHCRACKME.00402115;|pTemplate="DLG_REGIS"00401218.FF35CA204000PUSHDWORDPTRDS:[4020CA];|hInst=004000000040121E.E87D020000CALL<JMP.&USER32.DialogBoxParamA>;\DialogBoxParamACRACKME.00401253是注冊(cè)窗體的消息處理過(guò)程.轉(zhuǎn)到那看看.[cpp]viewplaincopy00401253/.C8000000ENTER0,0;注冊(cè)窗體消息處理過(guò)程00401257|.53PUSHEBX00401258|.56PUSHESI00401259|.57PUSHEDI0040125A|.817D0C100100>CMPDWORDPTRSS:[EBP+C],110;WM_INITDIALOG00401261|.7434JESHORTCRACKME.0040129700401263|.817D0C110100>CMPDWORDPTRSS:[EBP+C],111;WM_COMMAND0040126A|.7435JESHORTCRACKME.004012A10040126C|.837D0C10CMPDWORDPTRSS:[EBP+C],10;WM_CLOSE00401270|.0F8481000000JECRACKME.004012F700401276|.817D0C010200>CMPDWORDPTRSS:[EBP+C],201;WM_LBUTTONDOWN0040127D|.740CJESHORTCRACKME.0040128B0040127F|.B800000000MOVEAX,000401284|>5FPOPEDI00401285|.5EPOPESI00401286|.5BLEAVE

POPEBX0040128700401288|.C21000

|.C9RETN10可以看到 CRACKME.004012A1 是注冊(cè)窗體WM_COMMAND 命令處理函數(shù).注冊(cè)窗體一共處理了 4種消息(窗體初始化,退出,確定,命令處理)在地址0040126A上回車(chē),去看看按鈕處理邏輯.[cpp]viewplaincopy004012A1|>33C0/XOREAX,EAX;注冊(cè)窗體:按鈕處理邏輯004012A3|.817D10EB0300>|CMPDWORDPTRSS:[EBP+10],3EB004012AA|.744B|JESHORTCRACKME.004012F7004012AC|.817D10EA0300>|CMPDWORDPTRSS:[EBP+10],3EA004012B3|.753B|JNZSHORTCRACKME.004012F0004012B5|.6A0B|PUSH0B;/Count=B(11.)004012B7|.688E214000|PUSHCRACKME.0040218E;|Buffer=CRACKME.0040218E004012BC|.68E8030000|PUSH3E8;|ControlID=3E8(1000.)004012C1|.FF7508|PUSHDWORDPTRSS:[EBP+8];|hWnd004012C4|.E807020000|CALL<JMP.&USER32.GetDlgItemTextA>;\GetDlgItemTextA004012C9|.83F801|CMPEAX,1004012CC|.C74510EB0300>|MOVDWORDPTRSS:[EBP+10],3EB004012D3|.^72CC\JBSHORTCRACKME.004012A1004012D5|.6A0BPUSH0B;/Count=B(11.)004012D7|.687E214000PUSHCRACKME.0040217E;|Buffer=CRACKME.0040217E004012DC|.68E9030000PUSH3E9;|ControlID=3E9(1001.)004012E1|.FF7508PUSHDWORDPTRSS:[EBP+8];|hWnd004012E4|.E8E7010000CALL<JMP.&USER32.GetDlgItemTextA>;\GetDlgItemTextA004012E9|.B801000000MOVEAX,1004012EE|.EB07JMPSHORTCRACKME.004012F7004012F0|>B800000000MOVEAX,0004012F5|.^EB8DJMPSHORTCRACKME.00401284004012F7|>50PUSHEAX;/Result004012F8|.FF7508PUSHDWORDPTRSS:[EBP+8];|hWnd004012FB|.E8B2010000CALL<JMP.&USER32.EndDialog>;\EndDialog00401300|.B801000000MOVEAX,100401305\.^E97AFFFFFFJMPCRACKME.00401284如果F2在地址004012A1上下普通代碼斷點(diǎn),已經(jīng)斷住了注冊(cè)窗體的 WM_COMMAND 邏輯為了只斷住按鈕(OK,Quit)的處理,將斷點(diǎn)下在004012B5F9,讓程序跑起來(lái).填入Name,SN,按下確定按鈕可以看出,注冊(cè)窗口消息處理只是得到用戶(hù)輸入[cpp]viewplaincopy004012A1|>33C0/XOREAX,EAX;注冊(cè)窗體:按鈕處理邏輯004012A3|.817D10EB0300>|CMPDWORDPTRSS:[EBP+10],3EB004012AA|.744B|JESHORTCRACKME.004012F7004012AC|.817D10EA0300>|CMPDWORDPTRSS:[EBP+10],3EA004012B3|.753B|JNZSHORTCRACKME.004012F0004012B5|.6A0B|PUSH0B;/Count=B(11.)004012B7|.688E214000|PUSHCRACKME.0040218E;|name004012BC|.68E8030000|PUSH3E8;|ControlID=3E8(1000.)004012C1|.FF7508|PUSHDWORDPTRSS:[EBP+8];|hWnd004012C4|.E807020000|CALL<JMP.&USER32.GetDlgItemTextA>;\GetDlgItemTextA004012C9|.83F801|CMPEAX,1004012CC|.C74510EB0300>|MOVDWORDPTRSS:[EBP+10],3EB004012D3|.^72CC\JBSHORTCRACKME.004012A1004012D5|.6A0BPUSH0B;/Count=B(11.)004012D7|.687E214000PUSHCRACKME.0040217E;|pwd004012DC|.68E9030000PUSH3E9;|ControlID=3E9(1001.)004012E1|.FF7508PUSHDWORDPTRSS:[EBP+8];|hWnd004012E4|.E8E7010000CALL<JMP.&USER32.GetDlgItemTextA>;\GetDlgItemTextA004012E9|.B801000000MOVEAX,1004012EE|.EB07JMPSHORTCRACKME.004012F7004012F0|>B800000000MOVEAX,0004012F5|.^EB8DJMPSHORTCRACKME.00401284004012F7|>50PUSHEAX;/Result004012F8|.FF7508PUSHDWORDPTR