- 注册时间
- 2011-3-6
- 最后登录
- 1970-1-1
该用户从未签到
|
前几天搞了个CE插件,给CE添加DXF解密搜索功能。
现在是卡住了。功能还没完善。插件先不放上来献丑了。
如果解决本文最后的问题之后,我会将插件完善,再共享给大家。
先摆一下C++版本的加密解密函数的写法。- int nDeAdd=0x19434E8; //解密基址
- int nEnAdd=0x1943528; //加密基址
- int nEnParam1=0x16C8188; //加密参数1
- int nEnParam2=0x16C8388; //加密参数2
- int WriteMem(HANDLE hProcess,int Address,int Data)
- {
- DWORD dwWrite;
- WriteProcessMemory(hProcess,(LPVOID)Address,&Data,4,&dwWrite);
- return dwWrite;
- }
- int ReadMem(HANDLE hProcess,int Address)
- {
- int lpBuffer;
- ReadProcessMemory(hProcess,(LPVOID)Address,&lpBuffer,4,NULL);
- return lpBuffer;
- }
- int DNFEnCode(HANDLE hProcess, int Address,int Data)
- {
- DWORD nEdi,nEcx,nEax,nEsi,nEdx,nSs;
- nEcx=Address;
- nEax=ReadMem(hProcess,nEnAdd);
- nEax+=1;
- WriteMem(hProcess,nEnAdd,nEax);
- nEdx = nEax;
- nEdx = (nEdx%0x10000)/0x100;
- nEdx = ReadMem(hProcess,nEdx*2+nEnParam1);
- nEdx %= 0x100;
- nEax %= 0x10000;
- nSs=ReadMem(hProcess,nEax*2+nEnParam2);
-
- nSs %= 0x100; //取双字
- nEax= nEdx ^ nSs;
-
- nEax %= 0x100;
- nEdx=Data/0x10000; //右移16
-
- nSs = Data % 0x100; //取双字
- nEdx += nSs;
- nEdi=nEdx ^ nEax;
- nEdx=nEax;
- nEax=(nEax%0x10000)*0x10000;
- nEax=nEax + nEdx;
- nEax=nEax ^ Data;
- nEsi=Address + 8;
- WriteMem(hProcess,nEsi,nEax);
- nEax = ReadMem(hProcess,Address);
- nEsi = ReadMem(hProcess,nDeAdd);
- nEcx = nEdi;
- nEcx = nEcx%0x10000*0x10000;//左移16
- nEcx = nEcx+nEdx;
-
- nEdx = nEax;
-
- nEdx /=0x10000;
- nEdx = ReadMem(hProcess,nEsi+nEdx*4+36);
-
- nEax %= 0x100;
-
- WriteMem(hProcess,nEdx+nEax*4+8468,nEcx);
-
- return 0;
- }
- int DNFDeCode(HANDLE hProcess, int Address)
- {
-
- DWORD nEax,nEcx8,nEsi,nEdx,nTmp;
- nEax=ReadMem(hProcess,Address);
-
- if (nEax==-1)
- return nEax;
- nEcx8=ReadMem(hProcess,Address+8);
- if (nEcx8==-1)
- return nEcx8;
- nEsi=ReadMem(hProcess,nDeAdd);
-
- nEdx=nEax>>16;
-
- nTmp=(nEdx<<2)+nEsi+36;
-
- nEdx=ReadMem(hProcess,nTmp);
- if (nEdx==-1)
- return nEdx;
- nEax=nEax & 65535;
-
- nTmp=(nEax<<2)+nEdx+8468;
-
- nEax=ReadMem(hProcess,nTmp);
- if (nEax==-1)
- return nEax;
-
- _asm
- {
- mov eax,nEax
- movzx edx,ax
- mov nEdx,edx
- }
- nEsi=nEdx<<16;
- nEsi=nEsi|nEdx;
-
- nEax=nEsi^nEcx8;
- return nEax;
-
- }
复制代码 |
|