?? lesson14042.htm
字號:
'Save softice history as,...'. Save this file as Log1.txt . If you <br>
load this file into a text editor like wordpad or notepad, you will <br>
see that it has logged the command windows activity from softice. This <br>
is our 'First Call Flow' file. Get the idea :-)..... <br>
<br>
<br>
Step 7 : Set the date forward and do it all again. <br>
************************************************** <br>
What you need to do now is to create a second call log file, but <br>
this time you need to set the date of your system forwards so that <br>
the time trial will show the expired message. :-). This will force <br>
the flow of the program to take a different path sometime after the <br>
'GetSystemTime' Function, but before the nag screen appears. </span></p>
<p><span class="p9">Step 8 : Compare the two log files. <br>
*********************************** <br>
After you have completed all the steps again and saved a second log <br>
file, you need to compare them. Below, I have included two sample <br>
log files from a new Micro$oft drawing package that supposedly is <br>
well protected. : <br>
<br>
LOG FILE 1. ( You have % days left ) <br>
*********** <br>
Break due to BPX KERNEL32!GetSystemTime (ET=33.15 milliseconds) <br>
Break due to G (ET=383.02 microseconds) <br>
015F:78026B90 663B0512870378 CMP AX,[78038712]
<br>
015F:78026B97 756B
JNZ 78026C04
(JUMP ) <br>
015F:78026C04 8D8534FFFFFF LEA
EAX,[EBP-00CC] <br>
015F:78026C0A 50
PUSH EAX <br>
015F:78026C0B FF1540D10278 CALL
[KERNEL32!GetTimeZoneInformation] <br>
015F:78026C11 83F8FF CMP
EAX,-01 <br>
015F:78026C14 7430
JZ 78026C46
(NO JUMP) <br>
015F:78026C16 83F802 CMP
EAX,02 <br>
015F:78026C19 7527
JNZ 78026C42
(NO JUMP) <br>
015F:78026C1B 66837DCE00 CMP
WORD PTR [EBP-32],00 <br>
015F:78026C20 7420
JZ 78026C42
(NO JUMP) <br>
015F:78026C22 837DDC00 CMP
DWORD PTR [EBP-24],00 <br>
015F:78026C26 741A
JZ 78026C42
(NO JUMP) <br>
015F:78026C28 6A01
PUSH 01 <br>
015F:78026C2A 58
POP EAX <br>
015F:78026C2B 56
PUSH ESI <br>
015F:78026C2C 57
PUSH EDI <br>
015F:78026C2D 8D75E0 LEA
ESI,[EBP-20] <br>
015F:78026C30 BF08870378 MOV
EDI,78038708 <br>
015F:78026C35 A5
MOVSD <br>
015F:78026C36 A5
MOVSD <br>
015F:78026C37 A5
MOVSD <br>
015F:78026C38 A5
MOVSD <br>
015F:78026C39 5F
POP EDI <br>
015F:78026C3A A300870378 MOV
[78038700],EAX <br>
015F:78026C3F 5E
POP ESI <br>
015F:78026C40 EB90
JMP 78026CD2
(JUMP ) <br>
015F:78026BD2 50
PUSH EAX <br>
015F:78026BD3 0FB745FC MOVZX
EAX,WORD PTR [EBP-04] <br>
015F:78026BD7 50
PUSH EAX <br>
015F:78026BD8 0FB745FA MOVZX
EAX,WORD PTR [EBP-06] <br>
015F:78026BDC 50
PUSH EAX <br>
015F:78026BDD 0FB745F8 MOVZX
EAX,WORD PTR [EBP-08] <br>
015F:78026BE1 50
PUSH EAX <br>
015F:78026BE2 0FB745F6 MOVZX
EAX,WORD PTR [EBP-0A] <br>
015F:78026BE6 50
PUSH EAX <br>
015F:78026BE7 0FB745F2 MOVZX
EAX,WORD PTR [EBP-0E] <br>
015F:78026BEB 50
PUSH EAX <br>
015F:78026BEC 0FB745F0 MOVZX
EAX,WORD PTR [EBP-10] <br>
015F:78026BF0 50
PUSH EAX <br>
015F:78026BF1 E8EE000000 CALL
78026CE4 <br>
015F:78026BF6 8B4D08 MOV
ECX,[EBP+08] <br>
015F:78026BF9 83C41C ADD
ESP,1C <br>
015F:78026BFC 85C9
TEST ECX,ECX <br>
015F:78026BFE 7402
JZ 78026C02
(NO JUMP) <br>
015F:78026C00 8901
MOV [ECX],EAX <br>
015F:78026C02 C9
LEAVE <br>
015F:78026C03 C3
RET <br>
015F:300D2072 83C404 ADD
ESP,04 <br>
015F:300D2075 8D4C2410 LEA
ECX,[ESP+10] <br>
015F:300D2079 51
PUSH ECX <br>
015F:300D207A FF15B4841030 CALL
[301084B4] <br>
015F:300D2080 83C404 ADD
ESP,04 <br>
015F:300D2083 8BF0
MOV ESI,EAX <br>
015F:300D2085 8D54243C LEA
EDX,[ESP+3C] <br>
015F:300D2089 B909000000 MOV
ECX,00000009 <br>
015F:300D208E 8D7C2418 LEA
EDI,[ESP+18] <br>
015F:300D2092 8D442418 LEA
EAX,[ESP+18] <br>
015F:300D2096 52
PUSH EDX <br>
015F:300D2097 50
PUSH EAX <br>
015F:300D2098 F3A5
REPZ MOVSD <br>
015F:300D209A E8E1FDFFFF CALL
300D1E80 <br>
015F:300D209F 83C408 ADD
ESP,08 <br>
015F:300D20A2 85C0
TEST EAX,EAX <br>
015F:300D20A4 7E19
JLE 300D20BF
(JUMP ) <br>
015F:300D20BF 8D442460 LEA
EAX,[ESP+60] <br>
015F:300D20C3 8D4C2418 LEA
ECX,[ESP+18] <br>
015F:300D20C7 50
PUSH EAX <br>
015F:300D20C8 51
PUSH ECX <br>
015F:300D20C9 E8B2FDFFFF CALL
300D1E80 <br>
015F:300D20CE 83C408 ADD
ESP,08 <br>
015F:300D20D1 85C0
TEST EAX,EAX <br>
015F:300D20D3 7E33
JLE 300D2108
(JUMP ) <br>
015F:300D2108 6820D91630 PUSH
3016D920 <br>
015F:300D210D E83EFCFFFF CALL
300D1D50 <br>
015F:300D2112 83C404 ADD
ESP,04 <br>
015F:300D2115 85C0
TEST EAX,EAX <br>
015F:300D2117 7410
JZ 300D2129
(JUMP ) <br>
015F:300D2129 391D20D91630 CMP
[3016D920],EBX <br>
015F:300D212F 0F85D6010000 JNZ
300D230B (JUMP
) <br>
015F:300D230B 6A4C
PUSH 4C <br>
015F:300D230D 6824D91630 PUSH
3016D924 <br>
015F:300D2312 E8E9F9FFFF CALL
300D1D00 <br>
015F:300D2317 8B0D20D91630 MOV
ECX,[3016D920] <br>
015F:300D231D 83C408 ADD
ESP,08 <br>
015F:300D2320 3BC1
CMP EAX,ECX <br>
015F:300D2322 0F841DFEFFFF JZ
300D2145
(JUMP ) <br>
015F:300D2145 8D542418 LEA
EDX,[ESP+18] <br>
015F:300D2149 6848D91630 PUSH
3016D948 <br>
015F:300D214E 52
PUSH EDX <br>
015F:300D214F E82CFDFFFF CALL
300D1E80 <br>
015F:300D2154 83C408 ADD
ESP,08 <br>
015F:300D2157 85C0
TEST EAX,EAX <br>
015F:300D2159 7D26
JGE 300D2181
(JUMP ) <br>
015F:300D2181 803DA480163003 CMP BYTE
PTR [301680A4],03 <br>
015F:300D2188 0F876D010000 JA
300D22FB
(NO JUMP) <br>
015F:300D218E 8BAC24D0000000 MOV EBP,[ESP+000000D0]
<br>
015F:300D2195 C745009F860100 MOV DWORD
PTR [EBP+00],0001869F <br>
015F:300D219C A0A4801630 MOV
AL,[301680A4] <br>
015F:300D21A1 A801
TEST AL,01 <br>
015F:300D21A3 744B
JZ 300D21F0
(NO JUMP) <br>
015F:300D21A5 33C0
XOR EAX,EAX <br>
015F:300D21A7 8D4C2418 LEA
ECX,[ESP+18] <br>
015F:300D21AB A0A5801630 MOV
AL,[301680A5] <br>
015F:300D21B0 51
PUSH ECX <br>
015F:300D21B1 6824D91630 PUSH
3016D924 <br>
015F:300D21B6 8D3440 LEA
ESI,[EAX*2+EAX] <br>
015F:300D21B9 C1E603 SHL
ESI,03 <br>
015F:300D21BC E85FFDFFFF CALL
300D1F20 <br>
015F:300D21C1 83C408 ADD
ESP,08 <br>
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -