bypass 内存校验不难。。。Hook方法比较直接。。。说说间接的。。。
以前写的代码。。。现在贴上
调试原理很简单。CE挂起跟踪读取代码段的。代码地址
然后他会判断HASH是否是。错误的。你得到正确的HASH然后。修改跳转地址
或者直接返回正确的HASH都可以
现在是变成四次循环检测。所以你要挂钩。四个地址。。。code patch。。
直接Hook读取内存有点太暴力了。。现在都用调试寄存器，很少用code patch直接补丁了。。。过时的技术了
复制内容到剪贴板
代码:
#ifndef __ANTINP_WowZF__
#define __ANTINP_WowZF__
#include <stdio.h>
#include <windows.h>
DWORD dw_317C_WowZF = 0;
DWORD dw_3184_WowZF = 0x05D3814;
BYTE szBuf_WowZF[0x100] =
{
0x0C,0x38,0x5D,0x00,0x10,0x38,0x5D,0x00,0xD8,0x3C,0x5B,0x00,0xDC,0x3C,0x5B,0x00,
0xDC,0xBB,0x46,0x00,0xE0,0xBB,0x46,0x00,0xC0,0x4E,0x5B,0x00,0xC4,0x4E,0x5B,0x00,
0xE4,0x97,0x4E,0x00,0xE8,0x97,0x4E,0x00,0x48,0xC9,0x64,0x00,0x4C,0xC9,0x64,0x00,
0xC7,0x89,0x84,0xB5,0xA8,0xFE,0xFF,0xFF,0xA0,0x8B,0x8E,0x24,0x02,0x00,0x00,0x52,
0x51,0x52,0x68,0x44,0xB4,0x83,0x00,0x6A,0x55,0x8B,0xEC,0x83,0xEC,0x74,0x56,0x57,
0x70,0x53,0x56,0x33,0xF6,0x57,0x89,0x0D,0xF6,0x74,0x07,0x8B,0x55,0x0C,0x85,0xD2,
0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xE0,0x3E,0x21,0x01,0xE0,0x3E,0x21,0x01
};
PVOID lp_31D0_WowZF = &szBuf_WowZF[0x30];
PVOID dw_31A0_WowZF = &szBuf_WowZF;
__declspec(naked)void AntiNP_WowZF()
{
__asm
{
sub esp, 0100h
pushad
push edx
push eax
call loc_Start
popad
add esp,0100h
mov eax,dw_317C_WowZF
mov dword ptr [ebp+esi*4-0158h], eax
mov edi,dw_3184_WowZF
jmp edi
loc_Start:
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+0Ch]
xor edx, edx
add eax, -4
mov ecx, dw_31A0_WowZF
loc_1934:
cmp eax, dword ptr [ecx]
je short loc_1950
add ecx,4
inc edx
cmp ecx, lp_31D0_WowZF
jl short loc_1934
mov eax, dword ptr [ebp+8]
mov dw_317C_WowZF, eax
loc_194C:
pop ebp
retn 8
loc_1950:
push eax
mov eax, lp_31D0_WowZF
mov ecx,dword ptr [edx*4+eax]
pop eax
mov edx,ecx
mov dword ptr [ebp+0Ch], ecx
mov eax,ecx
and edx, 0FF00h
shl ecx,10h
or edx,ecx
xor ecx,ecx
mov ch, byte ptr [ebp+0eh]
shr eax,018h
shl edx, 8
or edx,ecx
and eax,0FFh
or edx,eax
mov dw_317C_WowZF, edx
jmp short loc_194C
}
}
#endif上次硬盘浩劫所有数据全部丢失。对不起了大家没有新的代码贴了。。55～～
唉～我最心痛的就是我的H动画全没了～
[
本帖最后由 Anskya 于 2008-3-24 13:44 编辑 ]
