Ⅰ 镐庢牱镆ョ湅QQ瀵嗙爜銆傦纻
濡傛灉鎭ㄦ兂瑕佹煡鐪婹Q瀵嗙爜锛屽彲浠ュ皾璇曚互涓嬫柟娉曪细
1. 阃氲繃瀵嗕缭镓嬫満镆ョ湅瀵嗙爜锛氩傛灉鎭ㄧ殑QQ璐﹀彿缁戝畾浜嗗瘑淇濇坠链猴纴鍙浠ラ氲繃鍙戦佺煭淇￠獙璇佺爜镄勬柟寮忔垒锲炲瘑镰併傝风橱褰昋Q瀹夊叏涓蹇冿纴阃夋嫨钬滃瘑淇濆伐鍏封濓纴铹跺悗阃夋嫨钬滃瘑淇濇坠链衡濓纴鎸夌収鎻愮ず镎崭綔鍗冲彲銆
2. 阃氲繃瀵嗕缭闂棰樻煡鐪嫔瘑镰侊细濡傛灉鎭ㄧ殑QQ璐﹀彿缁戝畾浜嗗瘑淇濋梾棰桡纴鍙浠ラ氲繃锲炵瓟瀵嗕缭闂棰樼殑鏂瑰纺𨱒ユ垒锲炲瘑镰併傝风橱褰昋Q瀹夊叏涓蹇冿纴阃夋嫨钬滃瘑淇濆伐鍏封濓纴铹跺悗阃夋嫨钬滃瘑淇濋梾棰樷濓纴鎸夌収鎻愮ず镎崭綔鍗冲彲銆
3. 阃氲繃濂藉弸鍗忓姪镆ョ湅瀵嗙爜锛氩傛灉鎭ㄧ殑QQ璐﹀彿缁戝畾浜嗗ソ鍙嬶纴鍙浠ヨ峰ソ鍙嫔府蹇欐垒锲炲瘑镰併傝风橱褰昋Q瀹夊叏涓蹇冿纴阃夋嫨钬滃笎鍙风敌璇夆濓纴铹跺悗鎸夌収鎻愮ず镎崭綔锛屾彁浜ょ敌璇夊悗锛屾偍镄勫ソ鍙嬩细鏀跺埌鐢宠瘔阈炬帴锛岀偣鍑婚摼鎺ヨ繘鍏ョ敌璇夐〉闱锛屽府锷╂偍镓惧洖瀵嗙爜銆
4. 阃氲繃闾绠辨煡鐪嫔瘑镰侊细濡傛灉鎭ㄧ殑QQ璐﹀彿缁戝畾浜嗛偖绠憋纴鍙浠ラ氲繃闾绠辨垒锲炲瘑镰併傝风橱褰昋Q瀹夊叏涓蹇冿纴阃夋嫨钬滃笎鍙风敌璇夆濓纴铹跺悗鎸夌収鎻愮ず镎崭綔锛屾彁浜ょ敌璇夊悗锛岀郴缁熶细钖戞偍镄勯偖绠卞彂阃佷竴灏侀偖浠讹纴闾浠朵腑鍖呭惈閲岖疆瀵嗙爜镄勬搷浣滈摼鎺ワ纴镣瑰嚮阈炬帴鍗冲彲閲岖疆瀵嗙爜銆
5. 阃氲繃瀹樻柟瀹㈡湇镓惧洖瀵嗙爜锛氩傛灉浠ヤ笂鏂规硶閮芥棤娉曟垒锲炲瘑镰侊纴寤鸿鎭ㄨ仈绯籕Q瀹樻柟瀹㈡湇瀵绘眰甯锷┿傛偍鍙浠ラ氲繃瀹樻柟缃戠珯銆佸㈡埛绔鎴栬呭㈡湇鐢佃瘽绛夋柟寮忚仈绯诲㈡湇锛岃存槑鎭ㄧ殑𨱍呭喌锛屽㈡湇浼氩岗锷╂偍镓惧洖鎴栭吨缃瀵嗙爜銆
Ⅱ QQ瀵嗙爜锷犲瘑铡熺悊
QQ2005 璐哄瞾鐗堢橱褰曞彛浠ゅ姞瀵嗙畻娉曞强鍏舵簮浠ｇ爜http://www.cnhello.com Binny锛圔[email protected]锛 2005-12-11 3:27:33 镆ョ湅: 娆 鏄熺骇: 鏂囧瓧澶у皬: 杈冨ぇ 姝ｅ父 杈冨皬 鏀惰棌姝ら〉鍒365Key 鏀惰棌姝ら〉鍒版柊娴猇iVi 銆愬艰汇戞嬁鍒癚Q 2005璐哄瞾鐗埚悗锛屽彂鐜板叾锷犲瘑铡熺悊骞舵病链夋柊镄勬敼鍙桡纴缁忚繃璺熻釜鍜屽垎鏋愶纴缂栧埗鍑烘毚锷涚牬瑙ｆ湰鍦癚Q瀵嗙爜镄勭▼搴忋俀Q瀵嗙爜鍦ㄦｇ‘锏婚檰钖庯纴浼氩皢锷犲瘑镄勭粨鏋滀缭瀛桦湪鐢ㄦ埛鐩褰旷殑ewh.db鏂囦欢涓锛屽姞瀵嗛噰鐢ㄥ叕寮镄凪D5绠楁硶锛岄氲繃N娆″惊鐜浠ュ强寮傛垨钖庢眰鍙嶏纴链缁堣＄畻鍑哄姞瀵嗙殑缁撴灉锛屼笌鐢ㄦ埛镄别wh.db鏂囦欢涓镄勫瘑鏂囨瘆杈冨悗锛屽彂鍑衡滆緭鍏ュ瘑镰佷笌涓婃℃垚锷熺橱褰旷殑瀵嗙爜涓崭竴镊,$0A鏄钖﹀埌链嶅姟鍣ㄩ獙璇?钬濓纸杩欐浔淇℃伅鍦˙asicCtrlDll.dll镄勮祫婧愪腑锛$0A鍦–镄勬牸寮忓寲涓涓哄洖杞︼级銆傛牴鎹杩欎釜鎻愮ず锛屽畬鎴愭湰鍦癚Q瀵嗙爜镄勬毚锷涚牬瑙ｃ 𨰾垮埌QQ 2005璐哄瞾鐗埚悗锛屽彂鐜板叾锷犲瘑铡熺悊骞舵病链夋柊镄勬敼鍙桡纴缁忚繃璺熻釜鍜屽垎鏋愶纴缂栧埗鍑烘毚锷涚牬瑙ｆ湰鍦癚Q瀵嗙爜镄勭▼搴忋
QQ瀵嗙爜鍦ㄦｇ‘锏婚檰钖庯纴浼氩皢锷犲瘑镄勭粨鏋滀缭瀛桦湪鐢ㄦ埛鐩褰旷殑ewh.db鏂囦欢涓锛屽姞瀵嗛噰鐢ㄥ叕寮镄凪D5绠楁硶锛岄氲繃N娆″惊鐜浠ュ强寮傛垨钖庢眰鍙嶏纴链缁堣＄畻鍑哄姞瀵嗙殑缁撴灉锛屼笌鐢ㄦ埛镄别wh.db鏂囦欢涓镄勫瘑鏂囨瘆杈冨悗锛屽彂鍑衡滆緭鍏ュ瘑镰佷笌涓婃℃垚锷熺橱褰旷殑瀵嗙爜涓崭竴镊,$0A鏄钖﹀埌链嶅姟鍣ㄩ獙璇?钬濓纸杩欐浔淇℃伅鍦˙asicCtrlDll.dll镄勮祫婧愪腑锛$0A鍦–镄勬牸寮忓寲涓涓哄洖杞︼级銆傛牴鎹杩欎釜鎻愮ず锛屽畬鎴愭湰鍦癚Q瀵嗙爜镄勬毚锷涚牬瑙ｃ
鍦≦Q绯荤粺涓锛屸淨D钬濇爣蹇椾唬琛≦Q Data锛屼緥濡傦纴鎴戜滑鍙浠ュ湪鏂囦欢User.db鎴杄wh.db涓镓惧埌杩欎釜浠QD寮澶寸殑鏁版嵁缁撴瀯銆
涓銆 ewh.db铡熷嬫暟鎹
51 44 01 01 03 00 04 03 00 BD AF A8 04 00 00 00
00 2E 06 00 07 03 00 B9 AB B4 10 00 00 00 07 22
AA 96 56 19 A3 9E 82 19 B7 2B BD 2D 34 4A 04 03
00 A9 B5 B2 04 00 00 00 3C A8 93 06
鍏朵腑锛岀孩镩蹭负AST寰鐜娆℃暟锛屽叞镩蹭负EWH锷犲瘑瀛楃︿覆锛岀豢镩蹭负UIN QQ鍙凤纸110340156=0x0693A83C锛孖ntel浣撶郴鍐呭瓨涓鎺掑垪椤哄簭涓猴细3CA89306锛夈
浜屻 ewh.db鏁版嵁缁撴瀯
HEX
锅忕Щ DEC
锅忕Щ 鏁版嵁 娉ㄩ喷 鍙橀噺
镙囧织
0000 1 51 44 QD锛孮Q Data 鏁版嵁镙囧织 Flag
0002 3 01 01 淇濈暀镄勬暟鎹缁撴瀯 Reserve
0004 5 03 00 镐绘暟鎹娈碉纸Data Sections锛夌殑涓鏁 Sections
0006 7 04 绗涓涓鏁版嵁娈碉纸绠绉1S锛屼笅钖岋级镄勭被鍨嬶纴鍙浠ヤ粠0x01鍒0x0F锛04浠ｈ〃链鏁版嵁娌＄粡杩囧姞瀵嗗勭悊銆 Type1S
0007 8 03 00 1S镙囧织镄勯暱搴︺ LenFlag1S
0009 10 BD AF A8 1S镙囧织锛堜緥濡侫ST銆乁IN銆丒WH绛夛级锛屾槸缁忚繃绠鍗旷殑寮傛垨骞舵眰鍙嶈＄畻澶勭悊镄勶纴姝ゅ勬槸AST锛屽彲鑳芥槸Algorithm Shift Times 鎴朅xxx Switch Time锛岀′粬镄勫憿锛 Flag1S
000C 13 04 00 00 00 1S鏁版嵁镄勯暱搴 LenData1S
0010 17 00 2E 06 00
= (404992) 1S鏁版嵁锛岃繖閲屾槸杩涜孧D5杞鎹㈢殑娆℃暟銆
杩欎釜鏁版嵁鏄钖岃＄畻链虹殑镐ц兘链夊叧镄勶纴镐ц兘瓒婇珮镄勮＄畻链猴纴鍦≦Q娉ㄥ唽鎴愬姛钖庝骇鐢熺殑杩欎釜寰鐜鎺у埗鍙橀噺灏辫秺澶с Data1S
0014 21 07 2S鏁版嵁镄勭被鍨嬶纴07浠ｈ〃浣跨敤MD5杩涜屽姞瀵 Type2S
0015 22 03 00 2S镙囧织镄勯暱搴 LenFlag2S
0017 24 B9 AB B4 2S镙囧织锛屾ゅ勬槸EWH锛屼唬琛ㄦ湰鏁版嵁娈垫槸EWH瀵嗙爜鏁版嵁锛屽彲鑳芥槸Encrypt With Hash镄勭缉鍐 Flag2S
001A 27 10 00 00 00 2S鏁版嵁镄勯暱搴 LenData2S
001E 31 07 22 AA 96
56 19 A3 9E
82 19 B7 2B
BD 2D 34 4A 2S鏁版嵁锛屾槸缁忚繃MD5锷犲瘑璁＄畻钖庝骇鐢熺殑鏁版嵁锛屽綋铹惰缮瑕佺粡杩囧纾鎴栧苟姹傚弽镄勮＄畻澶勭悊锛屽弬钥冧笅闱㈢▼搴忎腑镄1000B858 琛屼唬镰併 Data2S
002E 47 04 3S鏁版嵁镄勭被鍨 Type3S
002F 48 03 00 3S镙囧织镄勯暱搴 LenFlag3S
0031 50 A9 B5 B2 3S镙囧织锛屾ゅ勬槸UIN锛屼唬琛ㄦ湰鏁版嵁娈垫槸QQ鍙风爜锛屽彲鑳芥槸锛歎ser Identifier Number镄勭缉鍐 Flag3S
0034 53 04 00 00 00 3S鏁版嵁镄勯暱搴 LenData3S
0038 57 3C A8 93 06 3S鏁版嵁锛3C A8 93 06 = 110340156 Data3S
涓夈 锷犲瘑铡熺悊
涓嬮溃VB浼浠ｇ爜镄勯儴鍒嗙﹀彿寮曡嚜浠ヤ笂绗浜岀偣銆婄粨鏋勮存槑銆嬩腑镄勫彉閲忔爣蹇楋纴璇锋敞镒忕悊瑙ｏ细
Pwd = MD5(Pwd, Len(Pwd)) ' Pwd涓虹敤鎴疯緭鍏ョ殑瀵嗙爜锛岀涓杞甅D5钖庯纴Pwd鎴愪负16浣嶅瓧鑺傞暱搴︾殑MD5涓层
XorKey As Long = 0 'XorKey涓虹敤浜庤В瀵嗙殑瀛楄妭
For k = 1 To Data1S 钬 1 '锲犱负鍓嶉溃宸茬粡锅氲繃涓杞锛屾墍浠ユゅ勮佸噺涓
Pwd = MD5(Pwd, 16)
Next k
XorKey = XorKey And &HFFFF
XorKey = (LenData2S And &HFF) Xor (LenData2S \ 256)
XorKey = &HFF - XorKey '姹傚弽
For k = 1 To 16
Pwd(k) = Pwd(k) Xor XorKey
Next k
If Pwd <> Data2S Then
MsgBox "杈揿叆瀵嗙爜涓庝笂娆℃垚锷熺橱褰旷殑瀵嗙爜涓崭竴镊," & vbcrlf & "鏄钖﹀埌链嶅姟鍣ㄩ獙璇?"
End If
阃氲繃浠ヤ笂镄勬祦绋嬶纴鎴戠湡镄勪僵链峇Q镄勮捐¤咃纴濡傛ゅ法澶х殑寰鐜閲忥纴锷犱笂寰鐜娆℃暟镄勯殢链烘э纴濡傛灉甯屾湜浜х敓涓涓猀Q MD5璇嶅吀绠鐩翠笉鍙鑳姐傝槠铹剁悊璁轰笂锛屽彲浠ヤ骇鐢熶竴涓狭D5瀛楀吀锛屼絾鏄锛岃繖涓瀛楀吀灏嗘湁1.15E+77*16涓瀛楄妭涔嫔法锛屽洜姝わ纴鍙濂芥牴鎹甧wh.db鏂囦欢鎻愪緵镄勬暟鎹𨱌村姏镰磋В浜嗭纴涓岖煡鏄涓嶆槸链夋洿濂界殑鏂规硶锻锛
涓嶈繃鎴戠殑镒熻夋槸锛屽惊鐜娆℃暟锷犲氢简锛屽簲璇ヤ细浜х敓镟村氱殑MD5纰版挒锛屼笉瑙佸缑鏄涓濂戒簨銆
杩樻湁涓绉岖牬瑙ｆ濊矾锛屼篃璁告洿锷犵洿鎺ワ纴灏嗗湪钖庨溃镄勬枃绔犱腑璇︾粏鎺㈣ㄣ备絾鏄鎴戝彧链夊湪链夋椂闂村仛瀹屽疄楠屽悗镓嶆湁璧勬牸璇勮堪锛屼笉鍦ㄦ湰鏂囩珷镄勮ㄨ鸿寖锲村唴銆
锲涖 镰磋В绠楁硶
閲嶅嶈繘琛屾暟鍗佷竾娆MD5锷犲瘑锛屼细娑堣楄＄畻链哄緢澶氭椂闂达纴濡傛灉浣跨敤浼犵粺镄刅B鎴胧C锛屽逛簬涓涓瀵嗙爜镄勭瓑寰呮椂闂翠篃鏄寰埚彲瑙傜殑锛堜緥濡备娇鐢╒B浠ｇ爜锛屾秷钥楃殑镞堕棿鍙鑳芥槸姹囩紪镄400鍊嶏级锛屽洜姝わ纴鎴戜娇鐢ㄦ眹缂栬瑷𨱒ョ紪鍒朵绠灞傚姞瀵呜В瀵嗙畻娉曪纴阃氲繃MASM32缂栬疟杩炴帴锛屾渶钖庣敤楂樼骇璇瑷璋幂敤銆傞氲繃鎻愪緵绠楁硶锷ㄦ佸簱镄勬柟寮忥纴鏂逛究鍏朵粬链夊叴瓒ｇ殑璇昏呰嚜宸卞炲姞涓板瘜镄勫姛鑳姐备緥濡傚炲姞澶氱嚎绋嬬瓑锛岃繖涔熷皢鍦ㄤ互钖庣殑鎺㈣ㄤ腑瀹炵幇銆傚湪姝や笉锅氭繁鍏ヨㄨ恒
闄勫甫镄勪緥瀛愪负VB鍜孷C璋幂敤姹囩紪璇瑷锷ㄦ佸簱镄勪緥瀛愶纴VB浠ｇ爜绠鍗曞疄鐜颁简阃氲繃瀵嗙爜瀛楀吀杩涜屽崟绾跨▼镰磋В镄勫姛鑳斤纴璇昏呭彲浠ヤ赴瀵屽叾鍐呭广傚炲姞镟村氱殑锷熻兘銆
浜斻 QQ鏁版嵁缁撴瀯鍒嗘瀽
涓嬮溃涓哄姩镐佸簱BasicCtrlDll.dll涓鍙嶆眹缂栫殑浠ｇ爜浠ュ强浠ｇ爜鍒嗘瀽锛屼富瑕佺敤浜庡垎鏋怑WH.DB涓鏁版嵁缁撴瀯浠ュ强QQ鏁版嵁瑙ｈ皟绠楁硶镄勯梾棰樸傚彟澶栵纴杩欎釜绠楁硶涔熷彲浠ュ皢User.db涓镄勬暟鎹鎻愬彇鍑烘潵銆傛繁鍏ョ爷绌朵笅铡伙纴锅氢竴涓镵婂ぉ璁板綍镆ョ湅鍣ㄤ箣绫荤殑杞浠朵篃闱为毦浜嬨
1000B71D B8 AC160110 mov eax,BasicCtr.100116AC
1000B722 E8 89460000 call BasicCtr.1000FDB0
1000B727 83EC 3C sub esp,3C
1000B72A 8B45 08 mov eax,dword ptr ss:[ebp+8] 灏嗘暟鎹镄勫紑濮嫔湴鍧璧嬬粰EAX锛屽疄闄呮暟鎹涓**Data锛孍AX=*Data
1000B72D 53 push ebx
1000B72E 56 push esi
1000B72F 57 push edi
1000B730 8B30 mov esi,dword ptr ds:[eax] 闇瑕佽浆鎹㈢殑瀛楃︿覆锛孍AX鎸囩ず涓涓缁撴瀯锛岀涓涓鎴愬憳涓哄疄闄呯殑鏁版嵁鎸囬拡
1000B732 894D D8 mov dword ptr ss:[ebp-28],ecx 灞閮ㄥ彉閲廪ebp-28]淇濆瓨鍏ㄥ眬镄勬爣蹇楃粨鏋勶纴ECX涓哄叏灞鍙傛暟鍦板潃锛屽湪璋幂敤链鍑芥暟镞惰窡鍏
1000B735 8B46 F8 mov eax,dword ptr ds:[esi-8] 涓篊String缁撴瀯涓闀垮害镄勬垚锻桡纴琛ㄧず镐诲叡澶氩皯涓瀛楄妭
1000B738 83F8 06 cmp eax,6 濡傛灉闀垮害灏忎簬6锛屽垯涓烘棤鏁堢殑鏁版嵁
1000B73B 0F82 81020000 jb BasicCtr.1000B9C2 濡傛灉姣6灏忓垯璺宠浆阃鍑猴纴璇存槑鏁版嵁閲忎笉澶熻В璋幂殑
1000B741 803E 51 cmp byte ptr ds:[esi],51 鏄钖︿负 QQ Data 镄勬暟鎹锛孮D涓篞Q鏁版嵁镙囧织
1000B744 0F85 78020000 jnz BasicCtr.1000B9C2
1000B74A 807E 01 44 cmp byte ptr ds:[esi+1],44
1000B74E 0F85 6E020000 jnz BasicCtr.1000B9C2
1000B754 66:8B7E 04 mov di,word ptr ds:[esi+4] 瀵逛簬EWH𨱒ヨ达纴涓虹4+1涓瀛楄妭锛屼负0003
1000B758 83C6 04 add esi,4 鎸囧悜鏁版嵁娈(Sections)镄勪釜鏁
1000B75B 46 inc esi
1000B75C 83C0 FA add eax,-6 EAX铡绘帀6涓瀛楄妭锛屽逛簬EWH𨱒ヨ达纴鍓╀笅36H涓瀛楄妭
1000B75F 46 inc esi
1000B760 8945 08 mov dword ptr ss:[ebp+8],eax 鎸囧悜绗涓涓鏁版嵁娈
1000B763 E8 CE050000 call BasicCtr.1000BD36 鍦ㄥ唴瀛桡纸ECX+9C锛夊勫紑杈熶竴涓(100H)瀛楄妭镄勭┖闂达纴绌洪棿鍦板潃杩斿洖鍒癊AX
1000B768 8365 E0 00 and dword ptr ss:[ebp-20],0 灞閮ㄥ彉閲廪ebp-20]娓呴浂
1000B76C 0FB7C7 movzx eax,di 杞鎹㈠埌EAX锛屽逛簬EWH锛宒i=3銆傝〃绀烘湁3娈垫暟鎹
1000B76F 85C0 test eax,eax
1000B771 8945 B8 mov dword ptr ss:[ebp-48],eax 灞閮ㄥ彉閲廪ebp-48]淇濆瓨鏁版嵁镄勬垫暟
1000B774 0F8E 21020000 jle BasicCtr.1000B99B
1000B77A 837D 08 07 cmp dword ptr ss:[ebp+8],7 濡傛灉鏁翠釜闀垮害灏忎簬7锛屽垯鍓╀笅镄勫簲璇ユ槸QQ鍙蜂简銆傜涓娆¤繘鍏ユ椂=36H
1000B77E 0F82 3E020000 jb BasicCtr.1000B9C2 濡傛灉鍓╀綑镄勬暟鎹闀垮害灏忎簬7鍒欓鍑
1000B784 8A06 mov al,byte ptr ds:[esi] 绗涓娆¤繘鍏ユ椂锛孍SI鎸囧悜绗7涓鏁版嵁鍗虫暟鎹娈电殑绫诲瀷锛屼緥濡 04
1000B786 66:8B4E 01 mov cx,word ptr ds:[esi+1] CX=钖庝竴涓鏁版嵁锛屽强鏁版嵁娈垫爣蹇楃殑闀垮害锛屼緥濡 0003
1000B78A 46 inc esi
1000B78B 8B55 08 mov edx,dword ptr ss:[ebp+8] 鍓╀綑镄勬暟鎹闀垮害锛屽36H
1000B78E 836D 08 03 sub dword ptr ss:[ebp+8],3 铡绘帀3涓锛屼緥濡傛垚涓33H=51
1000B792 894D C8 mov dword ptr ss:[ebp-38],ecx 灞閮ㄥ彉閲廪ebp-38]淇濆瓨鏁版嵁娈典腑镙囧织闀垮害
1000B795 0FB7F9 movzx edi,cx EDI涓烘爣蹇楅暱搴︿简
1000B798 46 inc esi
1000B799 8845 E4 mov byte ptr ss:[ebp-1C],al 灞閮ㄥ彉閲廪ebp-1C]淇濆瓨链娈电殑绫诲瀷
1000B79C 8D4F 04 lea ecx,dword ptr ds:[edi+4] ECX涓哄彇寰楃殑镙囧织闀垮害鍐嶅姞涓4锛屼緥濡=7
1000B79F 46 inc esi 绗涓娆℃椂锛孍SI鎸囧悜绗涓涓鏁版嵁娈电殑镙囧织瀛楁典简锛屼緥濡傛寚钖态DAFA8锛岀9涓鏁版嵁寮濮
1000B7A0 394D 08 cmp dword ptr ss:[ebp+8],ecx 濡傛灉鍓╀綑镄勬暟鎹姣斺沧爣蹇楅暱搴+4钬濊缮灏戯纴鍒欐病链夋暟鎹锛屽洜姝や笉杩涜屽勭悊
1000B7A3 0F82 19020000 jb BasicCtr.1000B9C2
1000B7A9 8B0C37 mov ecx,dword ptr ds:[edi+esi] 璺宠繃鏁版嵁娈电殑镙囧织閮ㄥ垎锛屽皢鏁版嵁娈电殑闀垮害璧嫔肩粰ECX銆备緥濡俒edi+esi]=4
1000B7AC 8D1C37 lea ebx,dword ptr ds:[edi+esi] EBX淇濆瓨鏂扮殑鎸囬拡锛屾寚钖戞暟鎹娈典腑鏁版嵁閮ㄥ垎镄勯暱搴﹂儴鍒嗭纴渚嫔傦纴[EBX]=4
1000B7AF 895D C4 mov dword ptr ss:[ebp-3C],ebx 灞閮ㄥ彉閲廪ebp-3C]淇濆瓨鏁版嵁娈典腑鏁版嵁閮ㄥ垎镄勯暱搴︽寚阍
1000B7B2 8D4C0F 07 lea ecx,dword ptr ds:[edi+ecx+7] 浠庢爣蹇楋纸镊韬闀3锛屽姞涓4涓闀垮害浣=7锛夊紑濮嬶纴锷犱笂鏁版嵁闀垮害锛屼负瀹屾暣鏁版嵁闀垮害銆备緥濡侲
1000B7B6 3BCA cmp ecx,edx 濡傛灉鍓╀笅镄勬暟鎹闀垮害锛埚36H锛変笉澶燂纴鍒欓鍑
1000B7B8 894D CC mov dword ptr ss:[ebp-34],ecx 灞閮ㄥ彉閲廪ebp-34]淇濆瓨链鏁版嵁娈电殑镐婚暱搴
1000B7BB 0F87 01020000 ja BasicCtr.1000B9C2 濡傛灉灏忎簬鍒欓鍑虹▼搴
1000B7C1 8365 F0 00 and dword ptr ss:[ebp-10],0 灞閮ㄥ彉閲廪ebp-10]娓呴浂
1000B7C5 3C 01 cmp al,1 al淇濆瓨链娈电殑绫诲瀷锛屾湁鏁堢殑绫诲瀷鏄4鎴7
1000B7C7 74 18 je short BasicCtr.1000B7E1
1000B7C9 3C 02 cmp al,2
1000B7CB 74 14 je short BasicCtr.1000B7E1
1000B7CD 3C 03 cmp al,3
1000B7CF 74 10 je short BasicCtr.1000B7E1
1000B7D1 3C 04 cmp al,4
1000B7D3 74 0C je short BasicCtr.1000B7E1
1000B7D5 3C 05 cmp al,5
1000B7D7 74 08 je short BasicCtr.1000B7E1
1000B7D9 3C 07 cmp al,7
1000B7DB 74 04 je short BasicCtr.1000B7E1
1000B7DD 3C 06 cmp al,6
1000B7DF 75 19 jnz short BasicCtr.1000B7FA
1000B7E1 51 push ecx 涓烘湰娈电殑镐婚暱搴︼纴鍖呮嫭锛堟电被鍨+镙囧织闀垮害+镙囧织+鏁版嵁闀垮害+鏁版嵁锛夛纴渚嫔傦纴瀵逛簬瀵嗙爜娈=1AH
1000B7E2 E8 23430000 call <MFC42.operator new>
1000B7E7 FF75 CC push dword ptr ss:[ebp-34] n=[ebp-34]锛屽眬閮ㄥ彉閲廪ebp-34]淇濆瓨链鏁版嵁娈电殑镐婚暱搴
1000B7EA 8D4E FD lea ecx,dword ptr ds:[esi-3] [esi-3]鎸囧悜链娈电殑寮濮嬶纸浠庢电被鍨嬬畻璧凤级
1000B7ED 8945 F0 mov dword ptr ss:[ebp-10],eax 灞閮ㄥ彉閲廪ebp-10]淇濆瓨𨰾疯礉钖庣殑鏁版嵁
1000B7F0 51 push ecx src
1000B7F1 50 push eax dest
1000B7F2 E8 E5450000 call <MSVCRT.memcpy> memcpy锛屽皢链娈电殑鏁存垫暟鎹𨰾疯礉鍒版柊镄勫湴鏂癸纴鏁版嵁鎸囬拡淇濆瓨鍦ㄥ眬閮ㄥ彉閲廪ebp-10]涓
1000B7F7 83C4 10 add esp,10
1000B7FA 8B45 C8 mov eax,dword ptr ss:[ebp-38] 灞閮ㄥ彉閲廪ebp-38]淇濆瓨鏁版嵁娈典腑镙囧织闀垮害
1000B7FD 33C9 xor ecx,ecx
1000B7FF 32C4 xor al,ah 灏嗕绠浣嶉暱搴︿笌楂树綅寮傛垨锛屼緥濡3 xor 0=3
1000B801 85FF test edi,edi EDI涓烘爣蹇椾綅镄勯暱搴
1000B803 76 12 jbe short BasicCtr.1000B817 濡傛灉链娈垫病链夋垫爣蹇楋纴鍒栾烦杞
1000B805 8A1431 mov dl,byte ptr ds:[ecx+esi] 寮濮嫔惊鐜锛屽惊鐜娆℃暟涓烘爣蹇楃殑闀垮害銆 ECX绗涓娆℃椂涓0锛屽皢绗涓涓鏁版嵁锷犺浇鍒瘅L涓銆
1000B808 32D0 xor dl,al AL涓洪暱搴︾殑楂树綅鍜屼绠浣岖殑寮傛垨锛岃繖閲屼负3
1000B80A F6D2 not dl DL=NOT ([鏁版嵁] xor [鏁版嵁娈垫爣蹇楅暱搴︾殑楂树綅 xor 鏁版嵁娈垫爣蹇楅暱搴︾殑浣庝綅])
1000B80C 881431 mov byte ptr ds:[ecx+esi],dl 鏁版嵁淇濆瓨鍦ㄥ师濮嬬殑鍐呭瓨涓鐩稿簲镄勫湴鏂
1000B80F 41 inc ecx
1000B810 3BCF cmp ecx,edi
1000B812 72 F1 jb short BasicCtr.1000B805
1000B814 8B5D C4 mov ebx,dword ptr ss:[ebp-3C] 灞閮ㄥ彉閲廪ebp-3C]淇濆瓨鏁版嵁娈典腑鏁版嵁閮ㄥ垎镄勯暱搴︽寚阍
1000B817 57 push edi EDI涓烘爣蹇椾綅镄勯暱搴
1000B818 56 push esi ESI涓烘寚钖戣В瀵嗕互钖庣殑鏁版嵁锛屼緥濡侫ST
1000B819 8D4D E8 lea ecx,dword ptr ss:[ebp-18] 灞閮ㄥ彉閲廪ebp-18]瀛樻斁寮哄埗绫诲瀷杞鎹浠ュ悗镄勬暟鎹鎸囬拡镄勬寚阍堬纴渚嫔侫ST
1000B81C E8 5B430000 call <MFC42.CString::CString> 灏呜В瀵嗗悗镄勬暟鎹鍙樻垚CString绫诲瀷銆傝繑锲炵殑绫诲瀷鏀惧湪EAX鎸囩ず镄勫湴鍧涓
1000B821 8365 FC 00 and dword ptr ss:[ebp-4],0 灞閮ㄥ彉閲廪ebp-4]娓呴浂
1000B825 6A FC push -4
1000B827 58 pop eax EAX=-4=FFFFFFFC
1000B828 8BF3 mov esi,ebx ebx淇濆瓨鏁版嵁娈典腑鏁版嵁閮ㄥ垎镄勯暱搴︽寚阍
1000B82A 2BC7 sub eax,edi EAX=EAX-EDI=FFFFFFFC-3=FFFFFFF9
1000B82C 8B1E mov ebx,dword ptr ds:[esi] ebx涓烘暟鎹娈典腑鏁版嵁閮ㄥ垎镄勯暱搴︿简
1000B82E 0145 08 add dword ptr ss:[ebp+8],eax 绗涓娆℃椂锛孾EBP+8]=33銆傛墽琛屽悗=2C锛岀浉褰扑簬33H-7H=2CH
1000B831 83C6 04 add esi,4 ESI鎸囧悜鏁版嵁娈典腑镄勬暟鎹閮ㄥ垎浜
1000B834 395D 08 cmp dword ptr ss:[ebp+8],ebx [ebp+8]=2C锛宔bx=4
1000B837 0F82 6A010000 jb BasicCtr.1000B9A7
1000B83D 807D E4 07 cmp byte ptr ss:[ebp-1C],7 灞閮ㄥ彉閲廪ebp-1C]淇濆瓨链娈电殑绫诲瀷锛 4鎴栬7
1000B841 74 06 je short BasicCtr.1000B849
1000B843 807D E4 06 cmp byte ptr ss:[ebp-1C],6 濡傛灉绫诲瀷涓崭负6锛屽垯镓ц1000B862
1000B847 75 19 jnz short BasicCtr.1000B862
1000B849 8AC3 mov al,bl 濡傛灉鏁版嵁娈电殑绫诲瀷涓7锛屽垯镓ц屾よ鍙ャ侭L鍖呭惈链娈电殑闀垮害
1000B84B 33FF xor edi,edi
1000B84D 32C7 xor al,bh al=锛堥暱搴︾殑浣庝綅 xor 闀垮害镄勯珮浣嶏级
1000B84F 85DB test ebx,ebx
1000B851 76 0F jbe short BasicCtr.1000B862 濡傛灉闀垮害涓0锛屽垯琛ㄧず娌℃湁瀵嗙爜
1000B853 8A0C37 mov cl,byte ptr ds:[edi+esi]
1000B856 32C8 xor cl,al
1000B858 F6D1 not cl DL=NOT ([鏁版嵁] xor [鏁版嵁娈垫爣蹇楅暱搴︾殑楂树綅xor 鏁版嵁娈垫爣蹇楅暱搴︾殑浣庝綅])
1000B85A 880C37 mov byte ptr ds:[edi+esi],cl
1000B85D 47 inc edi
1000B85E 3BFB cmp edi,ebx
1000B860 72 F1 jb short BasicCtr.1000B853 寰鐜鐩村埌鍏ㄩ儴鏁版嵁瑙ｈ皟瀹屾瘯
1000B862 53 push ebx 鏁版嵁涓茬殑闀垮害
1000B863 56 push esi 铡熷嬬殑闇瑕佸彉鎹㈢殑鏁版嵁
1000B864 8D4D EC lea ecx,dword ptr ss:[ebp-14] 灞閮ㄥ彉閲廪ebp-14]瀛樻斁寮哄埗CString绫诲瀷杞鎹浠ュ悗镄勬暟鎹鎸囬拡镄勬寚阍堬纴渚嫔侱B2E0600
1000B867 E8 10430000 call <MFC42.CString::CString>
1000B86C 8A45 E4 mov al,byte ptr ss:[ebp-1C] 灞閮ㄥ彉閲廪ebp-1C]淇濆瓨链娈电殑绫诲瀷锛4鎴栬7
1000B86F 295D 08 sub dword ptr ss:[ebp+8],ebx 铡绘帀宸茬粡澶勭悊镄勬暟鎹锛屾墽琛屽悗 [ebp+8]=28H锛宔bx涓烘暟鎹娈典腑鏁版嵁閮ㄥ垎镄勯暱搴
1000B872 03F3 add esi,ebx ESI鎸囧悜涓嬩竴涓鏁版嵁娈电殑寮濮嬮儴鍒嗭纴ebx淇濆瓨鏁版嵁娈典腑鏁版嵁閮ㄥ垎镄勯暱搴︽寚阍
1000B874 33FF xor edi,edi
1000B876 84C0 test al,al 娴嬭瘯链娈电殑绫诲瀷鏄钖︿负0
1000B878 C645 FC 01 mov byte ptr ss:[ebp-4],1 灞閮ㄥ竷灏斿瀷鍙橀噺[ebp-4]=1
1000B87C 0F86 A3010000 jbe BasicCtr.1000BA25 濡傛灉链娈电殑鏁版嵁绫诲瀷涓0锛屽垯镓ц 1000BA25钖庨鍑
1000B882 3C 07 cmp al,7
1000B884 0F86 B6000000 jbe BasicCtr.1000B940 濡傛灉灏忎簬绛変簬7锛屽垯璺宠浆鍒1000B940镓ц屻傚逛簬EWH𨱒ヨ村氨鏄杩欐牱
1000B88A 3C 08 cmp al,8
1000B88C 0F84 74010000 je BasicCtr.1000BA06 濡傛灉鏁版嵁绫诲瀷涓8锛屽垯鐩存帴阃鍑恒
1000B892 3C 09 cmp al,9
1000B894 74 5D je short BasicCtr.1000B8F3
1000B896 3C 0A cmp al,0A
1000B898 0F85 87010000 jnz BasicCtr.1000BA25
1000B89E 8B4D D8 mov ecx,dword ptr ss:[ebp-28] 褰撴暟鎹绫诲瀷涓篈镞讹纴镓ц屾湰绋嫔簭浠ｇ爜
1000B8A1 8D45 D4 lea eax,dword ptr ss:[ebp-2C]
1000B8A4 50 push eax
1000B8A5 E8 47FEFFFF call BasicCtr.1000B6F1
1000B8AA 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B8AD FF75 EC push dword ptr ss:[ebp-14]
1000B8B0 8B08 mov ecx,dword ptr ds:[eax]
1000B8B2 53 push ebx
1000B8B3 50 push eax
1000B8B4 FF91 BC000000 call dword ptr ds:[ecx+BC]
1000B8BA 8BD8 mov ebx,eax
1000B8BC 85DB test ebx,ebx
1000B8BE 0F85 12010000 jnz BasicCtr.1000B9D6
1000B8C4 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B8C7 6A 04 push 4
1000B8C9 8945 DC mov dword ptr ss:[ebp-24],eax
1000B8CC 8D45 DC lea eax,dword ptr ss:[ebp-24]
1000B8CF 50 push eax
1000B8D0 8D4D C0 lea ecx,dword ptr ss:[ebp-40]
1000B8D3 E8 A4420000 call <MFC42.CString::CString>
1000B8D8 50 push eax
1000B8D9 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B8DC C645 FC 03 mov byte ptr ss:[ebp-4],3
1000B8E0 E8 C3400000 call <MFC42.CString::operator=>
1000B8E5 C645 FC 01 mov byte ptr ss:[ebp-4],1
1000B8E9 8D4D C0 lea ecx,dword ptr ss:[ebp-40]
1000B8EC E8 AB400000 call <MFC42.CString::~CString>
1000B8F1 EB 50 jmp short BasicCtr.1000B943
1000B8F3 8B4D D8 mov ecx,dword ptr ss:[ebp-28] 褰撴暟鎹绫诲瀷涓9镞讹纴镓ц岃繖涓镎崭綔
1000B8F6 8D45 D0 lea eax,dword ptr ss:[ebp-30]
1000B8F9 50 push eax
1000B8FA E8 4E180000 call BasicCtr.1000D14D
1000B8FF 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B902 FF75 EC push dword ptr ss:[ebp-14]
1000B905 8B08 mov ecx,dword ptr ds:[eax]
1000B907 53 push ebx
1000B908 50 push eax
1000B909 FF51 78 call dword ptr ds:[ecx+78]
1000B90C 8BD8 mov ebx,eax
1000B90E 85DB test ebx,ebx
1000B910 0F85 D4000000 jnz BasicCtr.1000B9EA
1000B916 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B919 6A 04 push 4
1000B91B 8945 DC mov dword ptr ss:[ebp-24],eax
1000B91E 8D45 DC lea eax,dword ptr ss:[ebp-24]
1000B921 50 push eax
1000B922 8D4D BC lea ecx,dword ptr ss:[ebp-44]
1000B925 E8 52420000 call <MFC42.CString::CString>
1000B92A 50 push eax
1000B92B 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B92E C645 FC 02 mov byte ptr ss:[ebp-4],2
1000B932 E8 71400000 call <MFC42.CString::operator=>
1000B937 C645 FC 01 mov byte ptr ss:[ebp-4],1
1000B93B 8D4D BC lea ecx,dword ptr ss:[ebp-44]
1000B93E EB AC jmp short BasicCtr.1000B8EC
1000B940 6A 01 push 1 褰撴暟鎹娈电殑绫诲瀷<=7镞讹纴鐩存帴浠庢ゅ勬墽琛
1000B942 5F pop edi
1000B943 8B5D D8 mov ebx,dword ptr ss:[ebp-28] 灞閮ㄥ彉閲廪ebp-28]淇濆瓨鍏ㄥ眬镄勬爣蹇楃粨鏋
1000B946 8D45 EC lea eax,dword ptr ss:[ebp-14] 灞閮ㄥ彉閲廪ebp-14]瀛樻斁寮哄埗绫诲瀷杞鎹浠ュ悗镄勬暟鎹鎸囬拡镄勬寚阍堬纴渚嫔侱B2E0600
1000B949 50 push eax EAX瀛樻斁寮哄埗绫诲瀷杞鎹浠ュ悗镄勬暟鎹鎸囬拡
1000B94A 8D45 E8 lea eax,dword ptr ss:[ebp-18] 灞閮ㄥ彉閲廪ebp-18]瀛樻斁寮哄埗绫诲瀷杞鎹浠ュ悗镄勬暟鎹鎸囬拡镄勬寚阍堬纴渚嫔侫ST
1000B94D FF75 E4 push dword ptr ss:[ebp-1C] 灞閮ㄥ彉閲廪ebp-1C]涓镄勭涓涓瀛楄妭淇濆瓨链娈电殑绫诲瀷锛4鎴栬7
1000B950 8BCB mov ecx,ebx
1000B952 50 push eax
1000B953 E8 B4FCFFFF call BasicCtr.1000B60C call 1000B60C(CString,Flag,CString)
1000B958 85FF test edi,edi
1000B95A 74 18 je short BasicCtr.1000B974
1000B95C 8B45 E0 mov eax,dword ptr ss:[ebp-20] 灞閮ㄥ彉閲廪ebp-28]绗涓娆′负0锛屼负涓涓璁℃暟鍣
1000B95F 8B4B 64 mov ecx,dword ptr ds:[ebx+64] 瀛桦湪浜庢爣蹇楃粨鏋勪腑锛屼负涓涓鍏ㄥ眬鍦板潃
1000B962 8B55 F0 mov edx,dword ptr ss:[ebp-10] 灞閮ㄥ彉閲廪ebp-10]淇濆瓨𨰾疯礉钖庣殑鏁版嵁锛屽嵆娌℃湁缁忚繃澶勭悊镄勚备緥濡040300BDAF钬︹
1000B965 C1E0 02 shl eax,2 EAX=EAX*2
1000B968 891401 mov dword ptr ds:[ecx+eax],edx 灏嗘湭锅氲В璋幂殑铡熷嬫暟鎹鏀惧埌鍏ㄥ眬缁撴瀯涓镆愪釜鎸囬拡鎸囩ず镄勫唴瀛树腑
1000B96B 8B4B 78 mov ecx,dword ptr ds:[ebx+78] 瀛桦湪浜庢爣蹇楃粨鏋勪腑锛屼负涓涓鍏ㄥ眬鍦板潃
1000B96E 8B55 CC mov edx,dword ptr ss:[ebp-34] 灞閮ㄥ彉閲廪ebp-34]淇濆瓨链鏁版嵁娈电殑镐婚暱搴
1000B971 891401 mov dword ptr ds:[ecx+eax],edx 灏嗘暟鎹闀垮害鏀惧埌鍏ㄥ眬缁撴瀯涓镆愪釜鎸囬拡鎸囩ず镄勫唴瀛树腑
1000B974 8065 FC 00 and byte ptr ss:[ebp-4],0 灞閮ㄥ竷灏斿瀷鍙橀噺[ebp-4]=0
1000B978 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B97B E8 1C400000 call <MFC42.CString::~CString> 娓呴櫎鏁版嵁娈典腑镄勬暟鎹閮ㄥ垎CString
1000B980 834D FC FF or dword ptr ss:[ebp-4],FFFFFFFF 灞閮ㄥ竷灏斿瀷鍙橀噺[ebp-4]=-1锛屼负True
1000B984 8D4D E8 lea ecx,dword ptr ss:[ebp-18]
1000B987 E8 10400000 call <MFC42.CString::~CString> 娓呴櫎鏁版嵁娈典腑镄勬爣蹇楅儴鍒咰String锛屼緥濡侫ST
1000B98C FF45 E0 inc dword ptr ss:[ebp-20] 灞閮ㄥ彉閲廪ebp-28]璁℃暟鍣ㄥ姞涓
1000B98F 8B45 E0 mov eax,dword ptr ss:[ebp-20]
1000B992 3B45 B8 cmp eax,dword ptr ss:[ebp-48] 灞閮ㄥ彉閲廪ebp-48]淇濆瓨鏁版嵁镄勬垫暟
1000B995 0F8C DFFDFFFF jl BasicCtr.1000B77A 寰鐜瑙ｈ皟姣忎釜鏁版嵁娈
1000B99B 8B45 08 mov eax,dword ptr ss:[ebp+8] 链钖庡墿浣欑殑闀垮害
1000B99E F7D8 neg eax
1000B9A0 1BC0 sbb eax,eax
1000B9A2 83E0 04 and eax,4
1000B9A5 EB 1E jmp short BasicCtr.1000B9C5
1000B9A7 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9AB 74 09 je short BasicCtr.1000B9B6
1000B9AD FF75 F0 push dword ptr ss:[ebp-10]
1000B9B0 E8 FF3F0000 call <MFC42.operator delete>
1000B9B5 59 pop ecx
1000B9B6 834D FC FF or dword ptr ss:[ebp-4],FFFFFFFF
1000B9BA 8D4D E8 lea ecx,dword ptr ss:[ebp-18]
1000B9BD E8 DA3F0000 call <MFC42.CString::~CString>
1000B9C2 6A 04 push 4
1000B9C4 58 pop eax
1000B9C5 8B4D F4 mov ecx,dword ptr ss:[ebp-C]
1000B9C8 5F pop edi
1000B9C9 5E pop esi
1000B9CA 5B pop ebx
1000B9CB 64:890D 000000 mov dword ptr fs:[0],ecx
1000B9D2 C9 leave
1000B9D3 C2 0400 retn 4
1000B9D6 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9DA 74 09 je short BasicCtr.1000B9E5
1000B9DC FF75 F0 push dword ptr ss:[ebp-10]
1000B9DF E8 D03F0000 call <MFC42.operator delete>
1000B9E4 59 pop ecx
1000B9E5 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B9E8 EB 12 jmp short BasicCtr.1000B9FC
1000B9EA 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9EE 74 09 je short BasicCtr.1000B9F9
1000B9F0 FF75 F0 push dword ptr ss:[ebp-10]
1000B9F3 E8 BC3F0000 call <MFC42.operator delete>
1000B9F8 59 pop ecx
1000B9F9 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B9FC 8B08 mov ecx,dword ptr ds:[eax]
1000B9FE 50 push eax
1000B9FF FF51 08 call dword ptr ds:[ecx+8]
1000BA02 8BF3 mov esi,ebx
1000BA04 EB 03 jmp short BasicCtr.1000BA09
1000BA06 6A 04 push 4
1000BA08 5E pop esi
1000BA09 8065 FC 00 and byte ptr ss:[ebp-4],0
1000BA0D 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000