[分享]学习Nolan Blender“A Detailed Look at Crypt Filters ”
发表于:
2011-5-30 23:26
7699
[分享]学习Nolan Blender“A Detailed Look at Crypt Filters ”
呵呵,学习Nolan Blender关于filter的文章“A Detailed Look at Crypt Filters”(96bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4N6G2L8$3c8E0j5h3&6F1i4K6u0W2j5$3!0E0i4K6u0r3j5%4u0S2j5$3E0*7i4K6u0r3g2s2g2@1L8%4u0A6j5h3I4K6i4K6u0r3e0X3u0#2k6X3W2D9N6q4)9J5k6h3S2@1L8g2!0q4c8W2!0n7b7#2)9^5z5g2!0q4c8W2!0n7b7#2)9^5b7#2!0q4y4q4!0n7b7W2)9^5c8g2!0q4y4g2!0n7b7#2)9^5x3q4!0q4y4g2!0m8y4#2)9^5b7W2!0q4y4q4!0n7z5q4)9^5c8q4!0q4y4g2!0m8y4q4!0m8b7g2!0q4y4W2)9^5y4#2)9^5x3W2!0q4c8W2!0n7b7#2)9^5b7#2!0q4y4g2)9^5z5q4!0n7x3q4!0q4y4W2)9&6b7#2)9^5x3q4!0q4y4g2)9&6x3q4)9^5c8g2!0q4y4g2)9^5x3g2)9&6b7g2!0q4y4g2)9^5y4#2!0n7b7h3I4A6j5$3g2F1M7$3g2Q4c8f1k6Q4b7V1y4Q4z5p5y4Q4c8e0c8Q4b7U0W2Q4z5f1k6Q4c8e0S2Q4z5p5q4Q4b7U0q4Q4c8e0c8Q4b7V1q4Q4z5o6k6Q4c8e0c8Q4b7U0S2Q4z5p5c8Q4c8e0g2Q4b7U0m8Q4z5e0q4Q4c8e0k6Q4z5e0N6Q4b7U0k6Q4c8e0W2Q4z5e0N6Q4b7U0c8Q4c8f1k6Q4b7V1y4Q4z5p5y4Q4c8e0S2Q4b7V1k6Q4z5e0W2Q4c8e0W2Q4z5o6N6Q4z5p5y4Q4c8e0g2Q4z5p5k6Q4b7f1q4Q4c8e0k6Q4z5e0S2Q4b7f1k6Q4c8e0c8Q4b7U0S2Q4z5p5g2Q4c8e0k6Q4z5f1y4Q4z5o6W2Q4c8e0g2Q4z5o6g2Q4b7U0c8Q4c8e0S2Q4b7U0k6Q4b7e0y4Q4c8e0N6Q4z5f1q4Q4z5o6c8Q4c8e0k6Q4z5f1y4Q4z5p5u0Q4c8e0g2Q4z5p5k6Q4z5p5u0Q4c8e0g2Q4z5o6S2Q4z5o6k6Q4c8e0c8Q4b7V1q4Q4b7f1u0Q4c8e0c8Q4b7U0S2Q4z5p5u0Q4c8f1k6Q4b7V1y4Q4z5p5y4Q4c8e0W2Q4b7f1u0Q4z5e0S2Q4c8e0k6Q4z5o6W2Q4z5p5u0Q4c8e0S2Q4b7f1k6Q4b7U0N6Q4c8e0W2Q4b7e0y4Q4z5e0S2Q4c8e0S2Q4b7V1k6Q4z5o6N6Q4c8f1k6Q4b7V1y4Q4z5f1q4Q4c8f1k6Q4b7V1y4Q4z5o6V1`.
另外谢谢NoFlexlm兄的指点。
1. 所用SDK为6.1g
2. 产生的blenderd的函数地址与Nolan Blender文章略有不同,不过不影响分析
.text:0042BC6C mov eax, off_44B050
.text:0042BC71 push eax ; Source
.text:0042BC72 push 4Ah ; int
.text:0042BC74 push dword_45D3C8 ; int
.text:0042BC7A call sub_40495F
.data:0044B050 ; void *off_44B050
.data:0044B050 off_44B050 dd offset sub_4019A2
.data:0044B050
sub_4019A2即为filter函数
3. 参考phydora的文章“Dump The filter of flexlm”,用Hex-Rays 将sub_4019A2转成c code,分析起来会容易不少,其余的参照Nolan Blender的文章就可以了。
http://bbs.pediy.com/showthread.php?t=68402
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
上传的附件: