[推荐]QQ聊天记录文件解密方式

   热 荐  ★★★★

附算法:

代码:--------------------------------------------------------------------------------
* Referenced by a CALL at Address:
|:00444DD3  
|
:00444C96 55                      push ebp
:00444C97 8BEC                    mov ebp, esp
:00444C99 51                      push ecx
:00444C9A 51                      push ecx
:00444C9B 8B4510                  mov eax, dword ptr [ebp+10]        值为 45db38
:00444C9E 8B5508                  mov edx, dword ptr [ebp+08]            后4字节
:00444CA1 8B4D0C                  mov ecx, dword ptr [ebp+0C]            前4位
:00444CA4 56                      push esi 值为 8 /（长度）
:00444CA5 57                      push edi 值为 a661a0， baefe0
:00444CA6 8B38                    mov edi, dword ptr [eax] 值为5073425d
:00444CA8 897D08                  mov dword ptr [ebp+08], edi 值为5073425d
:00444CAB 8B7804                  mov edi, dword ptr [eax+04] 值为7c7f7e59
:00444CAE 897D10                  mov dword ptr [ebp+10], edi
:00444CB1 8B7808                  mov edi, dword ptr [eax+08]           值为384b3a45
:00444CB4 8B400C                  mov eax, dword ptr [eax+0C]           值为74477641
:00444CB7 33F6                    xor esi, esi esi置0
:00444CB9 897DFC                  mov dword ptr [ebp-04], edi    值为384b3a45
:00444CBC 8945F8                  mov dword ptr [ebp-08], eax     值为74477641
:00444CBF C7450C10000000          mov [ebp+0C], 00000010              循环16次

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00444D01(C)
|
:00444CC6 8D0416                  lea eax, dword ptr [esi+edx]
:00444CC9 334508                  xor eax, dword ptr [ebp+08]
:00444CCC 8BFA                    mov edi, edx
:00444CCE C1E704                  shl edi, 04
:00444CD1 03C7                    add eax, edi
:00444CD3 8BFA                    mov edi, edx
:00444CD5 C1EF05                  shr edi, 05
:00444CD8 037D10                  add edi, dword ptr [ebp+10]
:00444CDB 81EE4786C861            sub esi, 61C88647
:00444CE1 33C7                    xor eax, edi
:00444CE3 03C8                    add ecx, eax
:00444CE5 8D040E                  lea eax, dword ptr [esi+ecx]
:00444CE8 3345FC                  xor eax, dword ptr [ebp-04]
:00444CEB 8BF9                    mov edi, ecx
:00444CED C1E704                  shl edi, 04
:00444CF0 03C7                    add eax, edi
:00444CF2 8BF9                    mov edi, ecx
:00444CF4 C1EF05                  shr edi, 05
:00444CF7 037DF8                  add edi, dword ptr [ebp-08]
:00444CFA 33C7                    xor eax, edi
:00444CFC 03D0                    add edx, eax
:00444CFE FF4D0C                  dec [ebp+0C]
:00444D01 75C3                    jne 00444CC6
//这个循环将ECX,EDX加密，并仍旧存在ECX,EDX中，就是没看懂这个循环到地怎么做的。

:00444D03 8B4514                  mov eax, dword ptr [ebp+14]
:00444D06 5F                      pop edi
:00444D07 8908                    mov dword ptr [eax], ecx         //把加密后的ECX存入内存
:00444D09 895004                  mov dword ptr [eax+04], edx      //把加密后的EDX存入内存
:00444D0C 5E                      pop esi
:00444D0D C9                      leave
:00444D0E C3                      ret
-------------------------------------------------------

上一页  [1] [2]