丢进IDA,F5查看。
发现关键代码
判断条件:
*(_BYTE *)(i + a1) + 9 != ((unsigned __int8)((*(_BYTE *)(i + 134520896) & 0xAA) >> 1) | (unsigned __int8)(2 * (*(_BYTE *)(i + 134520896) & 0x55)));
将134520896转换成16进制 ;然后到Hex 窗口找到0x804A040,将这个地址后面的数据提取出来,下面附上C++脚本:
#include <iostream>
using namespace std;
int main()
{
int a[48]={0x8F,0xAA,0x85,0xA0,0x48,0xAC,0x40,0x95,0xB6,0x16,0xBE,0x40,0xB4,0x16,0x97,0xB1,0xBE,0xBC,0x16,0xB1,0xBC,0x16,0x9D,0x95,0xBC,0x41,0x16,0x36,0x42,0x95,0x95,0x16,0x40,0xB1,0xBE,0xB2,0x16,0x36,0x42,0x3D,0x3D,0x49,0x00};
for(int i=0;i<48;i++){
int j=((a[i]&0xAA)>>1)|(2*(a[i]&0x55));
cout<<(char)(j-9);
}
return 0;
}
网友评论