调试很多遍daemon,找到的data和job的值都不同,但计算出的seed1和seed2的前4位相同,后四位老是变化多端,请问这种情况怎么找seed?
我的方法是在lm_ckout.c下方的add esp 0ch处下断,采用calcseed计算的seed。郁闷!
004183EC /$ 55 push ebp
004183ED |. 8BEC mov ebp, esp
004183EF |. 83EC 24 sub esp, 24
004183F2 |. C745 F4 B8307>mov dword ptr [ebp-C], 6F7330B8
004183F9 |. C745 F0 03000>mov dword ptr [ebp-10], 3
00418400 |. 8B45 08 mov eax, dword ptr [ebp+8]
00418403 |. 8B48 6C mov ecx, dword ptr [eax+6C]
00418406 |. 8B91 94030000 mov edx, dword ptr [ecx+394]
0041840C |. 81E2 00800000 and edx, 8000
00418412 |. 85D2 test edx, edx
00418414 74 23 je short 00418439 (断点无法停下来,将此处改位jne)
00418416 |. 833D B0324900>cmp dword ptr [4932B0], 0
0041841D 74 1A je short 00418439
0041841F |. 8B45 10 mov eax, dword ptr [ebp+10]
00418422 |. 50 push eax
00418423 |. 8B4D 0C mov ecx, dword ptr [ebp+C]
00418426 |. 51 push ecx
00418427 |. 8B55 08 mov edx, dword ptr [ebp+8]
0041842A |. 52 push edx
0041842B |. FF15 B0324900 call dword ptr [4932B0]
00418431 |. 83C4 0C add esp, 0C <--此处下断
请高手指点!谢谢!
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课