今天下了 个投票软件，是 VB写 的，无壳！
用VBExplorer找到了字符串“恭喜你,投票成功”的地址40c398，把程序载入OD
---------------------下面是入口点----------------------------------
00401F7C > $ 68 FC5C4000 push 00405CFC ; (initial cpu selection)
00401F81 . E8 F0FFFFFF call <jmp.&MSVBVM60.#100>
00401F86 . 0000 add byte ptr [eax], al
00401F88 . 0000 add byte ptr [eax], al
00401F8A . 0000 add byte ptr [eax], al
00401F8C . 3000 xor byte ptr [eax], al
00401F8E . 0000 add byte ptr [eax], al
00401F90 . 3800 cmp byte ptr [eax], al
00401F92 . 0000 add byte ptr [eax], al
00401F94 . 0000 add byte ptr [eax], al
00401F96 . 0000 add byte ptr [eax], al
00401F98 . FF96 237539DB call dword ptr [esi+DB397523]
00401F9E . 57 push edi
00401F9F . 43 inc ebx
00401FA0 . 8BC0 mov eax, eax
00401FA2 . DF87 118F94C3 fild word ptr [edi+C3948F11]
00401FA8 . 0000 add byte ptr [eax], al
------------------------找到40c398----------------------------------
0040C31F 00 db 00
0040C320 02 db 02
0040C321 00 db 00
0040C322 00 db 00
0040C323 00 db 00
0040C324 D2 db D2
0040C325 79 db 79 ; CHAR 'y'
0040C326 00 db 00
0040C327 00 db 00
0040C328 0A db 0A
0040C329 00 db 00
0040C32A 00 db 00
0040C32B 00 db 00
0040C32C 02 db 02
0040C32D 63 db 63 ; CHAR 'c'
0040C32E AD db AD
0040C32F . 65 DE 8F A5 6>ascii "e迯 ",0
0040C336 00 db 00
0040C337 00 db 00
0040C338 18 db 18
0040C339 00 db 00
0040C33A 00 db 00
0040C33B 00 db 00
0040C33C . 7400 7800 740>unicode "txtCheck"
0040C34C . 4300 6F00 640>unicode "Code",0
0040C356 00 db 00
0040C357 00 db 00
0040C358 . 5600 6100 6C0>unicode "Value",0
0040C364 0E db 0E
0040C365 00 db 00
0040C366 00 db 00
0040C367 00 db 00
0040C368 . 6200 7400 6E0>unicode "btnGree",0
0040C378 . 4300 6C00 690>unicode "Click",0
0040C384 08 db 08
0040C385 00 db 00
0040C386 00 db 00
0040C387 00 db 00
0040C388 95 db 95 ------------------这里是投票失败的字符串
0040C389 . 62 68 79 31 5>ascii "bhy1Y%?,0
0040C391 00 db 00
0040C392 00 db 00
0040C393 00 db 00
0040C394 10 db 10
0040C395 00 db 00
0040C396 00 db 00
0040C397 00 db 00
0040C398 . 6D 60 9C 55 6>ascii "m`淯`O,",0 ----- 这里是VBExplorer查到字符串地址
0040C3A0 95 db 95
0040C3A1 62 db 62 ; CHAR 'b'
0040C3A2 68 db 68 ; CHAR 'h'
0040C3A3 79 db 79 ; CHAR 'y'
0040C3A4 10 db 10
0040C3A5 . 62 9F 52 00 ascii "b烺",0
0040C3A9 00 db 00
0040C3AA 00 db 00
0040C3AB 00 db 00
0040C3AC 18 db 18
0040C3AD 00 db 00
0040C3AE 00 db 00
0040C3AF 00 db 00
0040C3B0 01 db 01
0040C3B1 00 db 00
0040C3B2 92 db 92
0040C3B3 00 db 00
0040C3B4 04 db 04
0040C3B5 00 db 00
0040C3B6 00 db 00
0040C3B7 00 db 00
0040C3B8 00 db 00
0040C3B9 00 db 00
0040C3BA 00 db 00
0040C3BB 00 db 00
0040C3BC 00 db 00
0040C3BD 00 db 00
0040C3BE 00 db 00
0040C3BF 00 db 00
0040C3C0 0A db 0A
0040C3C1 00 db 00
0040C3C2 00 db 00
0040C3C3 00 db 00
0040C3C4 00 db 00
0040C3C5 00 db 00
0040C3C6 00 db 00
0040C3C7 00 db 00
0040C3C8 18 db 18
0040C3C9 00 db 00
0040C3CA 00 db 00
0040C3CB 00 db 00
0040C3CC . 5F00 5F00 560>unicode "__VIEWST"
0040C3DC . 4100 5400 450>unicode "ATE=",0
0040C3E6 00 db 00
0040C3E7 00 db 00
0040C3E8 16 db 16
0040C3E9 00 db 00
0040C3EA 00 db 00
0040C3EB 00 db 00
0040C3EC . 5F00 5F00 560>unicode "__VIEWST"
0040C3FC . 4100 5400 450>unicode "ATE",0
0040C404 . 6700 6500 740>unicode "getEleme"
0040C414 . 6E00 7400 420>unicode "ntById",0
0040C422 00 db 00
0040C423 00 db 00
0040C424 1C db 1C
0040C425 00 db 00
0040C426 00 db 00
0040C427 00 db 00
0040C428 . 2600 7400 780>unicode "&txtChec"
0040C438 . 6B00 4300 6F0>unicode "kCode=",0
郁闷让人不明白。
然后试着在把其中一处修改为NOP，然后右键“撤销选择处修改”代码变成了～～～
-------------------变成这样了 ----------------------------
0040C31F 0002 add byte ptr [edx], al
0040C321 0000 add byte ptr [eax], al
0040C323 00D2 add dl, dl
0040C325 79 00 jns short 0040C327
0040C327 000A add byte ptr [edx], cl
0040C329 0000 add byte ptr [eax], al
0040C32B 0002 add byte ptr [edx], al
0040C32D 63AD 65DE8FA5 arpl word ptr [ebp+A58FDE65], bp
0040C333 6320 arpl word ptr [eax], sp
0040C335 0000 add byte ptr [eax], al
0040C337 0018 add byte ptr [eax], bl
0040C339 0000 add byte ptr [eax], al
0040C33B 007400 78 add byte ptr [eax+eax+78], dh
0040C33F 007400 43 add byte ptr [eax+eax+43], dh
0040C343 0068 00 add byte ptr [eax], ch
0040C346 65:0063 00 add byte ptr gs:[ebx], ah
0040C34A 6B00 43 imul eax, dword ptr [eax], 43
0040C34D 006F 00 add byte ptr [edi], ch
0040C350 64:0065 00 add byte ptr fs:[ebp], ah
0040C354 0000 add byte ptr [eax], al
0040C356 0000 add byte ptr [eax], al
0040C358 56 push esi
0040C359 0061 00 add byte ptr [ecx], ah
0040C35C 6C ins byte ptr es:[edi], dx
0040C35D 0075 00 add byte ptr [ebp], dh
0040C360 65:0000 add byte ptr gs:[eax], al
0040C363 000E add byte ptr [esi], cl
0040C365 0000 add byte ptr [eax], al
0040C367 0062 00 add byte ptr [edx], ah
0040C36A 74 00 je short 0040C36C
0040C36C 6E outs dx, byte ptr es:[edi]
0040C36D 0047 00 add byte ptr [edi], al
0040C370 72 00 jb short 0040C372
0040C372 65:0065 00 add byte ptr gs:[ebp], ah
0040C376 0000 add byte ptr [eax], al
0040C378 43 inc ebx
0040C379 006C00 69 add byte ptr [eax+eax+69], ch
0040C37D 0063 00 add byte ptr [ebx], ah
0040C380 6B00 00 imul eax, dword ptr [eax], 0
0040C383 0008 add byte ptr [eax], cl
0040C385 0000 add byte ptr [eax], al
0040C387 0095 62687931 add byte ptr [ebp+31796862], dl
0040C38D 59 pop ecx
0040C38E 25 8D000000 and eax, 8D
0040C393 0010 add byte ptr [eax], dl
0040C395 0000 add byte ptr [eax], al
0040C397 006D 60 add byte ptr [ebp+60], ch ----貌似是这里
0040C39A 9C pushfd
0040C39B 55 push ebp
0040C39C 60 pushad
0040C39D 4F dec edi
0040C39E 2C 00 sub al, 0
0040C3A0 95 xchg eax, ebp
0040C3A1 6268 79 bound ebp, qword ptr [eax+79]
0040C3A4 1062 9F adc byte ptr [edx-61], ah
0040C3A7 52 push edx
0040C3A8 0000 add byte ptr [eax], al
0040C3AA 0000 add byte ptr [eax], al
0040C3AC 1800 sbb byte ptr [eax], al
0040C3AE 0000 add byte ptr [eax], al
0040C3B0 0100 add dword ptr [eax], eax
0040C3B2 92 xchg eax, edx
0040C3B3 000400 add byte ptr [eax+eax], al
0040C3B6 0000 add byte ptr [eax], al
0040C3B8 0000 add byte ptr [eax], al
0040C3BA 0000 add byte ptr [eax], al
0040C3BC 0000 add byte ptr [eax], al
0040C3BE 0000 add byte ptr [eax], al
0040C3C0 0A00 or al, byte ptr [eax]
0040C3C2 0000 add byte ptr [eax], al
0040C3C4 0000 add byte ptr [eax], al
0040C3C6 0000 add byte ptr [eax], al
0040C3C8 1800 sbb byte ptr [eax], al
0040C3CA 0000 add byte ptr [eax], al
0040C3CC 5F pop edi
0040C3CD 005F 00 add byte ptr [edi], bl
0040C3D0 56 push esi
0040C3D1 0049 00 add byte ptr [ecx], cl
0040C3D4 45 inc ebp
0040C3D5 0057 00 add byte ptr [edi], dl
0040C3D8 53 push ebx
0040C3D9 005400 41 add byte ptr [eax+eax+41], dl
0040C3DD 005400 45 add byte ptr [eax+eax+45], dl
0040C3E1 003D 00000000 add byte ptr [0], bh
0040C3E7 0016 add byte ptr [esi], dl
0040C3E9 0000 add byte ptr [eax], al
0040C3EB 005F 00 add byte ptr [edi], bl
0040C3EE 5F pop edi
0040C3EF 0056 00 add byte ptr [esi], dl
0040C3F2 49 dec ecx
0040C3F3 0045 00 add byte ptr [ebp], al
0040C3F6 57 push edi
0040C3F7 0053 00 add byte ptr [ebx], dl
0040C3FA 54 push esp
0040C3FB 0041 00 add byte ptr [ecx], al
0040C3FE 54 push esp
0040C3FF 0045 00 add byte ptr [ebp], al
0040C402 0000 add byte ptr [eax], al
0040C404 67:0065 00 add byte ptr [di], ah
0040C408 74 00 je short 0040C40A
0040C40A 45 inc ebp
0040C40B 006C00 65 add byte ptr [eax+eax+65], ch
0040C40F 006D 00 add byte ptr [ebp], ch
0040C412 65:006E 00 add byte ptr gs:[esi], ch
0040C416 74 00 je short 0040C418
0040C418 42 inc edx
0040C419 0079 00 add byte ptr [ecx], bh
0040C41C 49 dec ecx
0040C41D 006400 00 add byte ptr [eax+eax], ah
0040C421 0000 add byte ptr [eax], al
0040C423 001C00 add byte ptr [eax+eax], bl
0040C426 0000 add byte ptr [eax], al
0040C428 26:007400 78 add byte ptr es:[eax+eax+78], dh
0040C42D 007400 43 add byte ptr [eax+eax+43], dh
0040C431 0068 00 add byte ptr [eax], ch
0040C434 65:0063 00 add byte ptr gs:[ebx], ah
0040C438 6B00 43 imul eax, dword ptr [eax], 43
0040C43B 006F 00 add byte ptr [edi], ch
0040C43E 64:0065 00 add byte ptr fs:[ebp], ah
0040C442 3D 00000000 cmp eax, 0
找里面的40c398 居然没有。只有这个
0040C397 006D 60 add byte ptr [ebp+60], ch
请教大虾们这个改怎么修改啊 。
基本想法是让投票失败也写到投票成功里面
投票失败的地址是40c388
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
