为什么没有人回复呢？

在user32.dll中搜索几个十六进制字符，下断即可。
具体哪几个，不记得了。看文章。

It searches USER32.DLL for the following byte-pattern:
8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 E8

Once it is found, it returns you the address of the location it was found + 5.. i.e: before the memory copying.

This pattern should occur in the first 0x3FFFF bytes of USER32.
Example:

Code:

77D46706                 mov     eax, ecx
77D46708                 shr     ecx, 2
77D4670B                 repe movsd              ;  <-- break on this instruction
77D4670D                 mov     ecx, eax
77D4670F                 and     ecx, 3
77D46712                 repe movsb                 
77D46714                 call    sub_77D46722

I haven't researched this for long, but this piece of code appears to be where memory is copied from the gui-item to the user-supplied buffer. Tracing up a little brings up a bunch of references to SendMessage & GetWindowXXXX stuff... which would make sense.

nice job, to whoever found this.

搜索了，但是搜索不到啊

10fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6g2)9J5b7g2)9J5b7g2)9J5b7g2)9J5b7g2)9J5b7g2)9J5b7g2)9J5b7g2)9J5b7g2)9J5b7g2)9J5k6h3y4G2L8g2)9J5c8Y4k6A6k6i4N6@1K9s2u0W2j5h3c8Q4x3X3g2H3K9s2m8Q4x3@1k6@1K9h3c8Q4x3@1b7%4y4e0j5J5