027-ce,xdbg分析喊话CALL【瑞客论坛 www.ruike1.com】.txt

1、027-ce,xdbg分析喊话CALL2021在线班郁金香灬老师 QQ 150330575交流群:158280115学习目标: 分析喊话CALL 参考:023-用ce,xdbg分析技能call 原理:喊话CALL上层-?-喊话CALL-明文组包-明文压包-封包加密-封包加密2-send,sendto,WSASend,WSASendto 原理:喊话CALL上层-?-喊话CALL-明文组包-明文压包-send3-send2-send,sendto,WSASend,WSASendto 原理:技能CALL0?-?-技能CALL2-技能CALL1-明文压包-send3-send2-send,sendto

2、,WSASend,WSASendto0050D84B | 83FF 11 | cmp edi,11 |0050D84E | 75 0C | jne wow.50D85C |0050D850 | 8B45 F0 | mov eax,dword ptr ss:ebp-10 |0050D853 | 50 | push eax |0050D854 | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D857 | E8 A4DAF6FF | call wow.47B300 |0050D85C | 53 | push ebx | ebx:333axxxxxxxaddd

3、d0050D85D | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D860 | E8 9BDAF6FF | call wow.47B300 |0050D865 | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D868 | 51 | push ecx |0050D869 | C745 E4 0000000 | mov dword ptr ss:ebp-1C,0 |0050D870 | E8 DB321A00 | call wow.6B0B50 |0050D875 | 83C4 04 | add esp,4 |0

4、050D878 | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D87B | E8 0060EFFF | call wow.403880 |0050D880 | 5F | pop edi |0050D881 | 5E | pop esi |0050D882 | 5B | pop ebx | ebx:333axxxxxxxadddd0050D883 | 33C0 | xor eax,eax |0050D885 | 8BE5 | mov esp,ebp |0050D887 | 5D | pop ebp |0050D888 | C3 | ret |/组包压包

5、 技能和喊话共用 明文发包send4006B0B50 | 55 | push ebp |006B0B51 | 8BEC | mov ebp,esp |006B0B53 | 8B0D F49CC700 | mov ecx,dword ptr ds:C79CF4 |006B0B59 | 85C9 | test ecx,ecx |006B0B5B | 74 0B | je wow.6B0B68 |006B0B5D | 8B45 08 | mov eax,dword ptr ss:ebp+8 |006B0B60 | 50 | push eax |006B0B61 | E8 EA1FF8FF | cal

6、l wow.632B50 | send3006B0B66 | 5D | pop ebp |006B0B67 | C3 | ret |0050D865 | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D868 | 51 | push ecx 一个参数0050D869 | C745 E4 0000000 | mov dword ptr ss:ebp-1C,0 |0050D870 | E8 DB321A00 | call wow.6B0B50 这个CALL可能是喊话CALL0050D875 | 83C4 04 | add esp,4 |0050D878 |

7、8D4D D0 | lea ecx,dword ptr ss:ebp-30 寄存器ecx0050D87B | E8 0060EFFF | call wow.403880 |0050D880 | 5F | pop edi |$ = 009E0E24 wow.009E0E24$+4 2C2685A8 ?$+8 00000000 相同$+C 00000100 相同$+10 0000001D 相同$+14 0000001D ?$+18 1BF5F1C0 相同$+1C 0000012C 相同$+20 00000000 固定$+24 1BE55784 333axxxxxxxadddd$ = 009E0E2

8、4 wow.009E0E24$+4 2C268AD0 $+8 00000000 相同$+C 00000100 相同$+10 0000001D 相同$+14 00000000 ?$+18 1BF5F1C0 相同$+1C 0000012C 相同$+20 00000000 相同$+24 1C070264 imj3333333333xxx$+28 00000007 $ = 009E0E24 wow.009E0E24$+4 2C268290 重点 /+4+0C 喊话内容$+8 00000000 相同$+C 00000100 相同$+10 0000001D 相同$+14 00000000 ?相同$+18

9、1BF5F1C0 相同$+1C 0000012C 相同$+20 00000000 相同$+24 1C071D44 3333xxxx5555aaaq 不是$+28 00000007 /+4$ = 00000095 $+4 00000001 $+8 00000007 $+C 34343433 +4+0C 喊话内容$+10 34343434 $+14 34343434 $+18 00343434 $+1C 00000000 $+20 00000000 $+24 00000000 $+28 00000000 $ = 00000095 $+4 00000001 /say 说$+8 00000007 $+

10、C 33333333 $+10 00000033 $+14 00000000 $+18 00000000 $ = 00000095 $+4 00000001 /说$+8 00000007 $+C 33333333 $+10 33333333 $+14 33333333 $+18 78783333 $+1C 61617878 $+20 00006161 $+24 00000000 $ = 00000095 /$+4 00000011 本地防务 综合 /1 /2 /3 说$+8 00000007 /$+C E5BCBBE7 $+10 2D208890 $+14 BE89E820 $+18 E694

11、B0E5 $+1C A3E68796 $+20 979EE6AE $+24 33333300 $+28 33333333 $ = 00000095 $+4 00000011 $+8 00000007 $+C E5AC9CE6 $+10 98E9B09C $+14 A18AE5B2 $+18 E8202D20 $+1C B0E5BE89 $+20 8796E694 $+24 E6AEA3E6 $+28 3300979E $+2C 00003333 $+30 00000000 0050D7C1 | 5B | pop ebx | ebx:33333333333333333xxadsasd0050D7

12、C2 | 33C0 | xor eax,eax |0050D7C4 | 8BE5 | mov esp,ebp |0050D7C6 | 5D | pop ebp |0050D7C7 | C3 | ret |0050D7C8 | 8B45 F0 | mov eax,dword ptr ss:ebp-10 |0050D7CB | 56 | push esi |0050D7CC | 50 | push eax |0050D7CD | E8 FEBFFFFF | call wow.5097D0 |0050D7D2 | 83C4 08 | add esp,8 |0050D7D5 | EB 45 | jmp

13、 wow.50D81C |0050D7D7 | 8B75 F0 | mov esi,dword ptr ss:ebp-10 |0050D7DA | 56 | push esi |0050D7DB | E8 C0DEFEFF | call wow.4FB6A0 |0050D7E0 | 83C4 04 | add esp,4 |0050D7E3 | 85C0 | test eax,eax |0050D7E5 | 75 35 | jne wow.50D81C |0050D7E7 | E8 34D63500 | call wow.86AE20 |0050D7EC | 8BD0 | mov edx,ea

14、x |0050D7EE | 52 | push edx |0050D7EF | E8 FCE0FEFF | call wow.4FB8F0 |0050D7F4 | 83C4 04 | add esp,4 |0050D7F7 | 85C0 | test eax,eax |0050D7F9 | 74 18 | je wow.50D813 |0050D7FB | 8B4D F8 | mov ecx,dword ptr ss:ebp-8 |0050D7FE | 53 | push ebx | ebx:33333333333333333xxadsasd0050D7FF | 56 | push esi |

15、0050D800 | 51 | push ecx |0050D801 | 57 | push edi |0050D802 | E8 9957FFFF | call wow.502FA0 |0050D807 | 83C4 10 | add esp,10 |0050D80A | 5F | pop edi |0050D80B | 5E | pop esi |0050D80C | 5B | pop ebx | ebx:33333333333333333xxadsasd0050D80D | 33C0 | xor eax,eax |0050D80F | 8BE5 | mov esp,ebp |0050D8

16、11 | 5D | pop ebp |0050D812 | C3 | ret |0050D813 | 52 | push edx |0050D814 | E8 07E1FEFF | call wow.4FB920 |0050D819 | 83C4 04 | add esp,4 |0050D81C | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D81F | E8 2C38EFFF | call wow.401050 |0050D824 | 68 95000000 | push 95 |0050D829 | 8D4D D0 | lea ecx,dword

17、 ptr ss:ebp-30 |0050D82C | E8 6FD8F6FF | call wow.47B0A0 |0050D831 | 57 | push edi |0050D832 | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D835 | E8 66D8F6FF | call wow.47B0A0 |0050D83A | 8B55 F8 | mov edx,dword ptr ss:ebp-8 |0050D83D | 52 | push edx |0050D83E | 8D4D D0 | lea ecx,dword ptr ss:ebp-30

18、|0050D841 | E8 5AD8F6FF | call wow.47B0A0 |0050D846 | 83FF 07 | cmp edi,7 |0050D849 | 74 05 | je wow.50D850 |0050D84B | 83FF 11 | cmp edi,11 |0050D84E | 75 0C | jne wow.50D85C |0050D850 | 8B45 F0 | mov eax,dword ptr ss:ebp-10 |0050D853 | 50 | push eax |0050D854 | 8D4D D0 | lea ecx,dword ptr ss:ebp-3

19、0 |0050D857 | E8 A4DAF6FF | call wow.47B300 |0050D85C | 53 | push ebx | ebx:33333333333333333xxadsasd0050D85D | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D860 | E8 9BDAF6FF | call wow.47B300 |0050D865 | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D868 | 51 | push ecx |0050D869 | C745 E4 0000000 | mo

20、v dword ptr ss:ebp-1C,0 |0050D870 | E8 DB321A00 | call wow.6B0B50 |0050D875 | 83C4 04 | add esp,4 |0050D878 | 8D4D D0 | lea ecx,dword ptr ss:ebp-30 |0050D87B | E8 0060EFFF | call wow.403880 |0050D880 | 5F | pop edi |0050D881 | 5E | pop esi |0050D882 | 5B | pop ebx | ebx:33333333333333333xxadsasd0050

21、D883 | 33C0 | xor eax,eax |0050D885 | 8BE5 | mov esp,ebp |0050D887 | 5D | pop ebp |0050D888 | C3 | ret |0050D889 | 68 E0CC9F00 | push wow.9FCCE0 | 9FCCE0:Usage: SendChatMessage(text ,type ,language ,targetPlayer)0050D88E | 53 | push ebx | ebx:33333333333333333xxadsasd0050D88F | E8 EC193400 | call wo

22、w.84F280 |0050D894 | 83C4 08 | add esp,8 |0050D897 | 5F | pop edi |0050D898 | 5E | pop esi |0050D899 | 5B | pop ebx | ebx:33333333333333333xxadsasd0050D89A | 33C0 | xor eax,eax |0050D89C | 8BE5 | mov esp,ebp |0050D89E | 5D | pop ebp |0050D89F | C3 | ret |136EB6D0 00000095 136EB6D4 00000001 136EB6D8

23、00000007 136EB6DC 78783333 136EB6E0 78787878 136EB6E4 78787878 136EB6E8 64656178 136EB6EC 00736461 136EB6F0 00000000 $ = 00000095 $+4 00000001 $+8 00000007 $+C 00333231 $+10 00000000 $+14 00000000 $+18 00000000 $+1C 00000000 $+20 00000000 $+24 00000000 $+28 00000000 0096655F | 5D | pop ebp |00966560

24、 | C2 0400 | ret 4 |00966563 | 90 | nop |00966564 | 4E | dec esi |00966565 | 65:96 | xchg esi,eax |00966567 | 0030 | add byte ptr ds:eax,dh |00966569 | 65:96 | xchg esi,eax |0096656B | 0026 | add byte ptr ds:esi,ah |0096656D | 64:96 | xchg esi,eax |0096656F | 00CA | add dl,cl |00966571 | 64:96 | xch

25、g esi,eax |00966573 | 00CA | add dl,cl |00966575 | 64:96 | xchg esi,eax |00966577 | 000D 6596000D | add byte ptr ds:D009665,cl |0096657D | 65:96 | xchg esi,eax |0096657F | 0055 8B | add byte ptr ss:ebp-75,dl |00966582 | EC | in al,dx |00966583 | 53 | push ebx |00966584 | 56 | push esi |00966585 | 8B

26、F1 | mov esi,ecx | ecx:33333333xxxxxaaaa00966587 | 8B86 E4020000 | mov eax,dword ptr ds:esi+2E4 |0096658D | 57 | push edi |0096658E | 33FF | xor edi,edi |00966590 | 3B86 E8020000 | cmp eax,dword ptr ds:esi+2E8 |00966596 | 74 13 | je wow.9665AB |00966598 | 838E A4020000 0 | or dword ptr ds:esi+2A4,2

27、|0096659F | 89BE E8020000 | mov dword ptr ds:esi+2E8,edi |009665A5 | 89BE E4020000 | mov dword ptr ds:esi+2E4,edi |009665AB | 8B8E B4020000 | mov ecx,dword ptr ds:esi+2B4 | ecx:33333333xxxxxaaaa, esi+2B4:33333333xxxxxaaaa009665B1 | 8B5D 08 | mov ebx,dword ptr ss:ebp+8 |009665B4 | 68 FFFFFF7F | push 7FFFFFFF |009665B9 | 51 | push ecx ecx:33333333xxxxxaaaa009665BA | 53 | push ebx ebx=21088E54=在这里输入关键字009665BB | E8 A081E0FF | call wow.76E760 |009665C0 | 85C0 | test eax,eax |009665C2 | 74 2F | je wow.9665F3 |009665C4 | 8B96 C0020000 | mov edx,dword ptr ds:esi+2C0 |