Нужен совет

Discussion in 'Реверсинг' started by Testosteron, 22 Jun 2013.

  1. Testosteron

    Testosteron New Member

    Joined:
    18 Jun 2010
    Messages:
    8
    Likes Received:
    0
    Reputations:
    0
    Собственно софт шлет запросы на "localhost" как это обойти? Вот код:
    Code:
     0046D770    push       ebp
     0046D771    mov        ebp,esp
     0046D773    push       ecx
     0046D774    mov        ecx,9
     0046D779    push       0
     0046D77B    push       0
     0046D77D    dec        ecx
    <0046D77E    jne        0046D779
     0046D780    xchg       ecx,dword ptr [ebp-4]
     0046D783    push       ebx
     0046D784    push       esi
     0046D785    push       edi
     0046D786    mov        dword ptr [ebp-8],ecx
     0046D789    mov        esi,edx
     0046D78B    mov        dword ptr [ebp-4],eax
     0046D78E    mov        edi,dword ptr [ebp+18]
     0046D791    mov        eax,dword ptr [ebp-4]
     0046D794    call       @LStrAddRef
     0046D799    xor        eax,eax
     0046D79B    push       ebp
     0046D79C    push       46DAE1
     0046D7A1    push       dword ptr fs:[eax]
     0046D7A4    mov        dword ptr fs:[eax],esp
     0046D7A7    mov        eax,esi
     0046D7A9    mov        edx,46DAFC; 'http'
     0046D7AE    call       @LStrAsg
     0046D7B3    mov        eax,dword ptr [ebp-8]
     0046D7B6    call       @LStrClr
     0046D7BB    mov        eax,dword ptr [ebp+1C]
     0046D7BE    call       @LStrClr
     0046D7C3    mov        eax,dword ptr [ebp+14]
     0046D7C6    mov        edx,46DB0C; '80'
     0046D7CB    call       @LStrAsg
     0046D7D0    mov        eax,dword ptr [ebp+0C]
     0046D7D3    call       @LStrClr
     0046D7D8    mov        edx,dword ptr [ebp-4]
     0046D7DB    mov        eax,46DB18; '://'
     0046D7E0    call       @LStrPos
     0046D7E5    mov        ebx,eax
     0046D7E7    test       ebx,ebx
    >0046D7E9    jle        0046D817
     0046D7EB    lea        ecx,[ebp-1C]
     0046D7EE    mov        edx,46DB18; '://'
     0046D7F3    mov        eax,dword ptr [ebp-4]
     0046D7F6    call       0046D6F8
     0046D7FB    mov        edx,dword ptr [ebp-1C]
     0046D7FE    mov        eax,esi
     0046D800    call       @LStrAsg
     0046D805    lea        ecx,[ebp-0C]
     0046D808    mov        edx,46DB18; '://'
     0046D80D    mov        eax,dword ptr [ebp-4]
     0046D810    call       0046D730
    >0046D815    jmp        0046D822
     0046D817    lea        eax,[ebp-0C]
     0046D81A    mov        edx,dword ptr [ebp-4]
     0046D81D    call       @LStrLAsg
     0046D822    lea        edx,[ebp-20]
     0046D825    mov        eax,dword ptr [esi]
     0046D827    call       UpperCase
     0046D82C    mov        eax,dword ptr [ebp-20]
     0046D82F    mov        edx,46DB24; 'HTTPS'
     0046D834    call       @LStrCmp
    >0046D839    jne        0046D848
     0046D83B    mov        eax,dword ptr [ebp+14]
     0046D83E    mov        edx,46DB34; '443'
     0046D843    call       @LStrAsg
     0046D848    lea        edx,[ebp-24]
     0046D84B    mov        eax,dword ptr [esi]
     0046D84D    call       UpperCase
     0046D852    mov        eax,dword ptr [ebp-24]
     0046D855    mov        edx,46DB40; 'FTP'
     0046D85A    call       @LStrCmp
    >0046D85F    jne        0046D86E
     0046D861    mov        eax,dword ptr [ebp+14]
     0046D864    mov        edx,46DB4C; '21'
     0046D869    call       @LStrAsg
     0046D86E    mov        edx,dword ptr [ebp-0C]
     0046D871    mov        eax,46DB58; '@'
     0046D876    call       @LStrPos
     0046D87B    mov        ebx,eax
     0046D87D    mov        edx,dword ptr [ebp-0C]
     0046D880    mov        eax,46DB64; '/'
     0046D885    call       @LStrPos
     0046D88A    test       ebx,ebx
    >0046D88C    jle        0046D91E
     0046D892    cmp        eax,ebx
    >0046D894    jg         0046D89D
     0046D896    dec        eax
    >0046D897    jge        0046D91E
     0046D89D    lea        ecx,[ebp-10]
     0046D8A0    mov        edx,46DB58; '@'
     0046D8A5    mov        eax,dword ptr [ebp-0C]
     0046D8A8    call       0046D6F8
     0046D8AD    lea        ecx,[ebp-28]
     0046D8B0    mov        edx,46DB58; '@'
     0046D8B5    mov        eax,dword ptr [ebp-0C]
     0046D8B8    call       0046D730
     0046D8BD    mov        edx,dword ptr [ebp-28]
     0046D8C0    lea        eax,[ebp-0C]
     0046D8C3    call       @LStrLAsg
     0046D8C8    mov        edx,dword ptr [ebp-10]
     0046D8CB    mov        eax,46DB70; ':'
     0046D8D0    call       @LStrPos
     0046D8D5    mov        ebx,eax
     0046D8D7    test       ebx,ebx
    >0046D8D9    jle        0046D913
     0046D8DB    lea        ecx,[ebp-2C]
     0046D8DE    mov        edx,46DB70; ':'
     0046D8E3    mov        eax,dword ptr [ebp-10]
     0046D8E6    call       0046D6F8
     0046D8EB    mov        edx,dword ptr [ebp-2C]
     0046D8EE    mov        eax,dword ptr [ebp-8]
     0046D8F1    call       @LStrAsg
     0046D8F6    lea        ecx,[ebp-30]
     0046D8F9    mov        edx,46DB70; ':'
     0046D8FE    mov        eax,dword ptr [ebp-10]
     0046D901    call       0046D730
     0046D906    mov        edx,dword ptr [ebp-30]
     0046D909    mov        eax,dword ptr [ebp+1C]
     0046D90C    call       @LStrAsg
    >0046D911    jmp        0046D91E
     0046D913    mov        eax,dword ptr [ebp-8]
     0046D916    mov        edx,dword ptr [ebp-10]
     0046D919    call       @LStrAsg
     0046D91E    mov        edx,dword ptr [ebp-0C]
     0046D921    mov        eax,46DB64; '/'
     0046D926    call       @LStrPos
     0046D92B    mov        ebx,eax
     0046D92D    test       ebx,ebx
    >0046D92F    jle        0046D953
     0046D931    lea        ecx,[ebp-14]
     0046D934    mov        edx,46DB64; '/'
     0046D939    mov        eax,dword ptr [ebp-0C]
     0046D93C    call       0046D6F8
     0046D941    lea        ecx,[ebp-18]
     0046D944    mov        edx,46DB64; '/'
     0046D949    mov        eax,dword ptr [ebp-0C]
     0046D94C    call       0046D730
    >0046D951    jmp        0046D966
     0046D953    lea        eax,[ebp-14]
     0046D956    mov        edx,dword ptr [ebp-0C]
     0046D959    call       @LStrLAsg
     0046D95E    lea        eax,[ebp-18]
     0046D961    call       @LStrClr
     0046D966    mov        edx,dword ptr [ebp-14]
     0046D969    mov        eax,46DB7C; '['
     0046D96E    call       @LStrPos
     0046D973    dec        eax
    >0046D974    jne        0046D9E9
     0046D976    lea        ecx,[ebp-34]
     0046D979    mov        edx,46DB88; ']'
     0046D97E    mov        eax,dword ptr [ebp-14]
     0046D981    call       0046D6F8
     0046D986    mov        edx,dword ptr [ebp-34]
     0046D989    mov        eax,edi
     0046D98B    call       @LStrAsg
     0046D990    mov        eax,edi
     0046D992    mov        ecx,1
     0046D997    mov        edx,1
     0046D99C    call       @LStrDelete
     0046D9A1    lea        ecx,[ebp-38]
     0046D9A4    mov        edx,46DB88; ']'
     0046D9A9    mov        eax,dword ptr [ebp-14]
     0046D9AC    call       0046D730
     0046D9B1    mov        edx,dword ptr [ebp-38]
     0046D9B4    lea        eax,[ebp-14]
     0046D9B7    call       @LStrLAsg
     0046D9BC    mov        edx,dword ptr [ebp-14]
     0046D9BF    mov        eax,46DB70; ':'
     0046D9C4    call       @LStrPos
     0046D9C9    dec        eax
    >0046D9CA    jne        0046DA3D
     0046D9CC    lea        ecx,[ebp-3C]
     0046D9CF    mov        edx,46DB70; ':'
     0046D9D4    mov        eax,dword ptr [ebp-14]
     0046D9D7    call       0046D730
     0046D9DC    mov        edx,dword ptr [ebp-3C]
     0046D9DF    mov        eax,dword ptr [ebp+14]
     0046D9E2    call       @LStrAsg
    >0046D9E7    jmp        0046DA3D
     0046D9E9    mov        edx,dword ptr [ebp-14]
     0046D9EC    mov        eax,46DB70; ':'
     0046D9F1    call       @LStrPos
     0046D9F6    mov        ebx,eax
     0046D9F8    test       ebx,ebx
    >0046D9FA    jle        0046DA33
     0046D9FC    lea        ecx,[ebp-40]
     0046D9FF    mov        edx,46DB70; ':'
     0046DA04    mov        eax,dword ptr [ebp-14]
     0046DA07    call       0046D6F8
     0046DA0C    mov        edx,dword ptr [ebp-40]
     0046DA0F    mov        eax,edi
     0046DA11    call       @LStrAsg
     0046DA16    lea        ecx,[ebp-44]
     0046DA19    mov        edx,46DB70; ':'
     0046DA1E    mov        eax,dword ptr [ebp-14]
     0046DA21    call       0046D730
     0046DA26    mov        edx,dword ptr [ebp-44]
     0046DA29    mov        eax,dword ptr [ebp+14]
     0046DA2C    call       @LStrAsg
    >0046DA31    jmp        0046DA3D
     0046DA33    mov        eax,edi
     0046DA35    mov        edx,dword ptr [ebp-14]
     0046DA38    call       @LStrAsg
     0046DA3D    mov        eax,dword ptr [ebp+8]
     0046DA40    mov        ecx,dword ptr [ebp-18]
     0046DA43    mov        edx,46DB64; '/'
     0046DA48    call       @LStrCat3
     0046DA4D    mov        edx,dword ptr [ebp-18]
     0046DA50    mov        eax,46DB94; '?'
     0046DA55    call       @LStrPos
     0046DA5A    mov        ebx,eax
     0046DA5C    test       ebx,ebx
    >0046DA5E    jle        0046DA9D
     0046DA60    lea        ecx,[ebp-48]
     0046DA63    mov        edx,46DB94; '?'
     0046DA68    mov        eax,dword ptr [ebp-18]
     0046DA6B    call       0046D6F8
     0046DA70    mov        ecx,dword ptr [ebp-48]
     0046DA73    mov        eax,dword ptr [ebp+10]
     0046DA76    mov        edx,46DB64; '/'
     0046DA7B    call       @LStrCat3
     0046DA80    lea        ecx,[ebp-4C]
     0046DA83    mov        edx,46DB94; '?'
     0046DA88    mov        eax,dword ptr [ebp-18]
     0046DA8B    call       0046D730
     0046DA90    mov        edx,dword ptr [ebp-4C]
     0046DA93    mov        eax,dword ptr [ebp+0C]
     0046DA96    call       @LStrAsg
    >0046DA9B    jmp        0046DAAD
     0046DA9D    mov        eax,dword ptr [ebp+10]
     0046DAA0    mov        ecx,dword ptr [ebp-18]
     0046DAA3    mov        edx,46DB64; '/'
     0046DAA8    call       @LStrCat3
     0046DAAD    cmp        dword ptr [edi],0
    >0046DAB0    jne        0046DABE
     0046DAB2    mov        eax,edi
     0046DAB4    mov        edx,46DBA0; 'localhost'
     0046DAB9    call       @LStrAsg
     0046DABE    xor        eax,eax
     0046DAC0    pop        edx
     0046DAC1    pop        ecx
     0046DAC2    pop        ecx
     0046DAC3    mov        dword ptr fs:[eax],edx
     0046DAC6    push       46DAE8
     0046DACB    lea        eax,[ebp-4C]
     0046DACE    mov        edx,11
     0046DAD3    call       @LStrArrayClr
     0046DAD8    lea        eax,[ebp-4]
     0046DADB    call       @LStrClr
     0046DAE0    ret
    <0046DAE1    jmp        @HandleFinally
    <0046DAE6    jmp        0046DACB
     0046DAE8    pop        edi
     0046DAE9    pop        esi
     0046DAEA    pop        ebx
     0046DAEB    mov        esp,ebp
     0046DAED    pop        ebp
     0046DAEE    ret        18
    Заранее спасибо.
     
  2. sud0

    sud0 Banned

    Joined:
    1 Jan 2013
    Messages:
    263
    Likes Received:
    40
    Reputations:
    20
    кажеться InDuStRieS думает что надо поменять с jne на jmp по адрессу 0046DAB0
    =)
     
  3. InDuStRieS

    InDuStRieS Banned

    Joined:
    15 Mar 2009
    Messages:
    526
    Likes Received:
    253
    Reputations:
    32
    Хотя их можно наверное занопить