Kris Kasperski                      2:5063/61.8     13 Mar 99  15:16:00

। ࠣ  

  p祭:   p  p⠢ pp
p  "᪠ \p祭 ⥩". p ,
᫨ 襭 訡 - pp.  p⥭ ᪠뢠 
KPNC@Null.ru p⨢ p KPNC@Usa.net

                         HH H

         ppp   pᨨ   ⫨   ⥬,    
 ⥩   ᫥   p.  ᫨  pp  pᬠp
 pp,    筮    p p   . ᥬ
 p㣮  ,   p  pᬮp    pᯮp殮 
 DEMO-p   p祭묨 ﬨ.  p   pp,
     易   ᮡ -   樮 p. p
 p,  祭 p⭮,   ᫥  , ᪮
 , 믮騩 p 㭪樨,  pp 䨧᪨ .
          뢠  ,     ᥣ. ᫨  
 p㣨    ⥩       祭  쭮    (pp,    p
 pp    pᨫ ⠪ ⢮ ,  p 襥
   ᠬ  ),      p    ⠪  ⢠  蠣, 
 ᮧ   ᠬ⥫쭮  騩  .    ᫮    p㤮
 p, p騩 ⥫쭮 祭 p⬠ ⢨ ⠫쭮
   騬.
       ,    ᥣ     䨧᪨ p,  p 
 砥  p. Hpp, p p p 㭪 ,
     file://CD/SRC/CRACK0D/Crack0D.exe    ⢨⥫쭮 p砥
 祭    ppp.   㦭 ᤥ pp 
   pp  ppᮢ   p  p   
 'Disabled'.  H      p  ,  ⠪    p    .
 H室   ᯮ짮    pp  ppp.    p
 짮 'Symantex ResourceStudio 1.0',     
 p㣮.   p㧨        䠩.  쭥訥  ⢨    
 p䥩  p  pp,        맢  p㤭,  
 ᪫祭      権,    p  pp    p
 ᯮ㥬  p ppᮢ  p⭮ p⠥  . Hpp, 
   Borland  Resource  WorkShop    ⠪     㤠 믮 
 p.   p⨬ p⨫ pp ,   pp 
 p ⫨筮.
        pp  p  , 室 맢
 ᢮⢠  ꥪ        'Disabled'    'Grayed', ᫥ 祣
 p  .  ⨬  pp,     pp  p.
 稫!  H  p         p  
 ᥬp  ⫠稪   !
     ⥫쭮,    ⠪        p    ⠪  
 p  p.  宫  pp稪   ⨭  ⠩.
 祭  p㤭     p뢠. , p 㦥, ,
 稭  뢠,    祣 p  p⭥, 祬 pp
 pp    ᯮ塞  䠩,  ⮬ p   맮 API ⨯
 EnableWindow(false).  .. p  p p⢥ 
 p p. 㬥,  p墠  맮 ⫠稪  㤠
   .   ⠪  㯨  堪p   pp. 冷 
 짮⥫  ⠭  ᢮  롮p    pp,    Customizer,
 p    ""    ᢮⢠  ,   ᫥⢨
    ⮬᪨.
       p  室  ᨫ  p  ,  ⠪   
 p⨥    뫮 㯭 p p 짮⥫. 筮 
 p  p ⨯ 'Registered'  pp p ⨨   
 祭.  ᫨  Registered  p ,  짮⥫ - 
 p      p    p  ,    p
 p㥬      p蠥 p, ⨢p  ᠭ樮p
 ⢨ﬨ 짮⥫.
     Hpp,     ⠪    p    crack0E. p 䠩
 pp   ppᮢ      㡥,         pp.
 몫    ,    ⠤  樫樨  , 㭪ﬨ API.
 p㥬  pp    p㬥⮬  ⨯  customizer-.    p
 鸞  ,      p⠫. H p㥬   "hello".
   ᮮ頥    ppp  pᨨ   p .
   p⮣  짮⥫  ⠪  pp  㦥  p.
 ,        ᥬp    ⫠稪,   祣 p㤭
 p  .
     p⨬    MSDN        p ᪠ "Disable Window". p
 祭  㭪権  㤥 ⮫쪮 , p⢥ ⭮騥  win32
 API  -  EnableWindow.    p㧨  ⫠稪  ⠭  ᫥
   ⠭   ᪠ pp 뫪     ᥬp.
 H  ⮬  ,  , 㦥 稫 ⥫.  ᫮ ᥡ  
 p        㤥  pp.   筮  p
 p᭥ p , 祬 孨.
     祢,  ᮮ饭 " ppp " 뤠 
 堭.  ⮣   p 楤p AfxMessageBox ᬥ饭 ⮩
 p.  㬥 p   ᬥ饭  ,    䠩.  
 PE  䠩      㧭,  pp,      HIEW.    ⨫
 ⢥     ⭠p pp, 
 pᬠp  ᬥ饭  PE 䠩.
     H室  p  "  ppp  ",     ᬥ
 p,    p砥  Hiew   p ⮡p  ᬥ饭. 
 襬   砨     㤥  000403030.  H  뢠  p p p冷
 ⮢    ᫮,  饬  ᫥⥫쭮 '30 30 40 00'. ᫨  ᤥ
 p쭮,  稨 ⮫쪮  宦. ᥬp㥬 pאַ  hiew-
  :

      .00401547: 8B4660                  mov       eax,[esi][00060]
      .0040154A: 85C0                    test      eax,eax
      .0040154C: 7516                    jne      .000401564   -------- (1)
      .0040154E: 6830304000              push      000403030 ;" @00"
                                                   ^^^^^^^^^
      .00401553: E8C2020000              call     .00040181A   -------- (2)
      .00401558: 6A00                    push      000
      .0040155A: 8D4E64                  lea       ecx,[esi][00064]
      .0040155D: E8B2020000              call     .000401814   -------- (3)
      .00401562: 5E                      pop       esi
      .00401563: C3                      retn

     p⨬   ᫮ p室. Hᮬ,    㦭 
 ⪥  pp.  ,  㤥 ᯥ  .   祣 
 .    ⠭ -p p묨,    
 誮   㤥  . , 筮,  ᮮ⢥騥
 맮  WindowEnable,   ⨬⥫쭮   pp ⮣,   
    p⨬.
     H  p,  p  p 믮 pp. 祢,
   [esi+0x060]    . H室  , p p 
 祭. ᫨    p⨢,  pp ⮬᪨
 ppp.
      ᤥ ᬥ 蠣, p,  esi 㪠뢠  p
     p  樫p    ⮬  .   ,
 㫨p騩  , 㤥 pᮢ  p. H ᠬ 
   ⢨⥫쭮  ᬥ 蠣, ⮬     pp,  
 㤥   ,   ᮡ    ⨬p  p.  ,  
 ⮫쭮    p뢠,      㦤 ᪠ p㣨 ,  
 p뢠  .    襬 砥  祣    稬 
 p뢠.
    H  p,    hiew 뤠 ᫥騩  p:

     .004013D3: 8B4C240C                     mov       ecx,[esp][0000C]
     .004013D7: C7466000000000               mov       d,[esi][00060],00000
     .004013DE: 5F                           pop       edi

           ,  ᠬ p . p , 
 p   pᬠp  pp樨. p 樫p
     ⥬  祭,   祣  騬. .. 樮 
 p᪠  pᨨ        p pp. H, ⫨騥
 ᥣ  ⮬. p㥬 p᢮ ⮩ p 㤥 祭-

     .004013D7: C7466000000000               mov       d,[esi][00060],00001

        p⨬   pp.    p⠫!  H    p諮  
 p  p  .   ⮫쪮   (p-䫠)
 ⠫쭮          ᠬ  . H   砥 
 ᪠,      p    p  . 㬥 .
      p⭮ 㭪樮p.
     ,    䫠,          㦤   ⠢ 
 p   ppp묨   짮⥫ﬨ.  쭮 㭨pᠫ
   p  pp⠭ ᯮᮡ. p  p  
 夭  ,  祬   p          ᪠  
 p⮢, ppᠭ  ᥩ pp.
     p祬,  pp稪      ᥣ p稢  䫠.
  p   ᪮쪮,    易⥫쭮 㤥 易 
 p㣮.   ᫮  騪, ᮡ ᫨  pp, 
     䫠  뫨 .   ⠥ 祣, p ⥫쭮
 .   p 뢠,  ᮮ⢥⢨ 䫠 pp樨
   p    맮  ᮮ饭  訡,  ᪠ p⬠ p
 ⠪  p,    pp  譥  p⠥,  p⠥ p쭮.
   룫拉 ⠪.

      return SomeResult*(!FlagReg1 ^ FlagReg2);

     ᫨    䫠    p  p p,   p  !
 㭪   p  p  p.  ᫨  ⠪,  pp,   
 pp  p  p,   ᫥⢨  ⠢ ᥡ . 
 砫쭮,    䫠  pp樨    p   p稬
 p묨  pp.  筮  p ⮬ 䫠 뤥 訩 ,  
 ⠫쭮    㦤  -  㭪樨.   ⥫쭮 
 ᥣ    㢥p, p 㭪樮p p⭮.
       ,  pp      ᫨誮  ,    
 ⠫쭮   pp    p⥪p.    p  p  ⨯  Crack0F.
 ᬮp     堭. p   p .
 祢,  樨 , 㦭  맮 EnableWindow.

  j_?EnableWindow@CWnd@@QAEHH@Z proc near ; CODE XREF: sub_0_401360+D4.p
                                          ; .text:004015CF.p
                jmp     ds:?EnableWindow@CWnd@@QAEHH@Z
  j_?EnableWindow@CWnd@@QAEHH@Z endp

   ᥣ  .    p      ⮢  㯠.    
 p頥 祣 筮    룫廊  ⨯筮:

     .text:0040142A                 mov     eax, [esi+68h]
     .text:0040142D                 lea     ecx, [esi+0ACh]
     .text:00401433                 push    eax
     .text:00401434                 call    j_?EnableWindow@CWnd@@QAEHH@Z ;

  筮 p㣮 p:

     .text:004015C8                 mov     eax, [esi+60h]
     .text:004015CB                 lea     ecx, [esi+6Ch]
     .text:004015CE                 push    eax
     .text:004015CF                 call    j_?EnableWindow@CWnd@@QAEHH@Z ;

 p㥬  ,   㦥 뫮  , '46 60', .. [esi+60]  '46
 68'- [esi+68]. 祭 p  룫拉 ᫥騬 p -

 .00401385: C7466001000000               mov       d,[esi][00060],000000000

 

 .004012CC: C7466801000000               mov       d,[esi][00068],000000000

     ,    ᯮ  ᨬ 䫠.  p 鸞
   p㤭     㫥 祭. ,   ⠢
  p.  ⮦, ⠥  ᤥ.
       -   p⠥,  p-? H p   
 :

                         Ŀ
                                            
                                            
                                            
                                            
                                            
                                            
                                            
                             p㭮 pe     
                         

     ⮩   룫廊 p,  ⠪ ? 宦,   
 p⭮    p  p⠥  p.      ⮫쪮  ⮬, 
 ᫮      ,      ᥡ p쭮 (  ⠪  
 p筮       讬   ).      ᫮   㡥 
 pᯮᮡ  (pᯮᮡ  pp).     pp 
 p쭠 ,    㤥 ⠪  ᪨, , p
 p.  ᫨ p쭮 p⠥ ⮫쪮  p 뢠 ⪠,
  p  p  .
     ,  pp稪    ᪠  ,  p 
 pᯮ    䫠     p p㣠, ⥫쭮 p pp
 .  ᠬ ,  襬 pp 䨣pp  p ⨯ DWORD -
 [esi+60]  [esi+68]. Hp㤭 ,    p "p"
 p      ᫮.    p -   䫠 ?
 p㥬  '46 64':

 .004015B3: C7466400000000               mov       d,[esi][00064],000000000

       㤥  ᫨      ? p㥬, ... p⠫!
   ⮩  ⥯p p  "Hell0, Sailor!".  !
 祢,      pp稪  ᯮ짮    p  p  p  䫠 
 p ⨯:

        s0.SetAt(0,s0[0]*(!RegFlag_1 ^ RegFlag_3));

     H      pp,    ⢥p⮣  ⮣ 䫠? H
 ᠬ   ,   ᫮   p     p祭      ⠪  p㤭
 pp      .  p  ⮣,  筮  䫠  pp樨  
  p. ᫥   p⭮ pp pp 
 ꥪ⨢-pp 몥 祭  祭 .
     筮,    孮   p  饭 
 pp稪   .   ⥫쭮   p㬠        ⨯
 p᪨     p㦨    p ⠫쭮  . H,
 ⠪ 砨   ⨪    p.
     p   ⮢   p    ⥭  p.
   樮 p p ⪥ 믮 p p樨
 (pp,       䠩)  뤠    ,  pp騥  
 ⢨            p祭  pᨨ.    
    (p   ,   p騩   )   ⢨⥫쭮  䨧᪨
 ,    p   p.
     p  p    pᬠp   ,   
 p.    ᫨誮 p  p . p p᭥
 ᪠    室   樨,  , p饣  p
 -p  .  筮,   p pp  ,
 祬   pp    ⢨  騬 ,  ᮧ .
    ⮫쪮   ᫮  ⥬,    p        p뢠騥
 pᬮp  p  .
     ᬮp   筮   p⮩   pp      :   fiel:
 //CD/SRC/CRACK10/Crack10.exe     p⮩  ⥪⢮ pp, p p
 p  ⪥  p  pp  䠩 뢮  ,
 pp騥  ⢨ ⠪   -pᨨ.
     H  맮  ᥬp㥬 :

     .text:00401440
o
     .text:00401440                 push    0
     .text:00401442                 push    0
     .text:00401444                 push    offset unk_0_404090
     .text:00401449                 call    j_?AfxMessageBox@@YGHPBDII@Z
     .text:0040144E                 xor     eax, eax
     .text:00401450                 retn    4
     .text:0040144E NagScreen       endp
     .text:0040144E

 ⨬,  㤠 맮 j_?AfxMessageBox@@YGHPBDII@Z,  祣  ⨬
 ꥬ?   筮,    ,  p뢠騩    䠩    
 .  p祬,    㫥 p⭮,   室 p
 ᫥ retn  - .  p室  砥 ᯮ짮
 ᫥ p権:

 BOOL CCRACK10Doc::OnSaveDocument(LPCTSTR lpszPathName)
 {
  AfxMessageBox(" p祭 p. , pp⠩ ");
  return 0;
  return CCRACK10Doc::OnSaveDocument(lpszPathName);
 }



     ,  ⨬p騥  p    ⠪  砥  p  㤠
 ᯮ㥬  .    p,  p⭮,   p , 
 騩  p      .  p  pp稪
 ,  砫쭮  pp.
     p祬,    襩  樨    騩  .  
   㪠⥫  ⥪⢮ p  p p   ᪥. 
   㪫뢠  ⮪ p    ᠭ  ᪮쪮 .
 p  pp  㧭 ᫨ ⠭   p楤p 
 ⠭   ⫠稪  p設 ⥪. ᫠  ⥪ 祭
 祭 宦  㪠⥫ ( 祬     ⠪ 讥 ᫮?
 )      ⢨⥫쭮  㪠⥫   䠩,   
 pp,        ,  pᯮ   ⮬ p.
     ,  p  襩 p ⠭  ᠭ ᢮ , 
   p    㦥 ⪮p exe-䠩.  MS-DOS  p
 㦥  뫠  p  祭,    Windows  業   p諮
 . 誮   p  p   p. 
 p㣮  p  windows  p᫠      ⠪ 䨪樨.
 Hpp,  饭      DLL    p⮩  맮  㤠. p
 pᬮp   ⠪   pp   p  楫  ⤥쭮  , ⮬
 pᬠp  p  p饭.
     p   . p  ⢥ pp⭮ 뫥,  
 㧭  뢠  .

  .rdata:00403644                 dd offset j_?OnOpenDocument@CDocument
  .rdata:00403648                 dd offset sub_0_401440
                                     ^^^^^^^^^^^^^^^^^^^
  .rdata:0040364C                 dd offset j_?OnCloseDocument@CDocument

   p⢠  ᮡ  p᫥ ᬥ饭? pp,  
 MFC,  訡筮  㧭      p    CDocumnet.   
 ⢥p, ᫨ pp p  p  p    
 pp 뫮, ᬮ  ᫥騩 p:

  401390 sub_0_401390    proc near
  401390                 push    esi
  401391                 mov     esi, ecx
  401393                 call    j_??0CDocument@@QAE@XZ
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  401398                 mov     dword ptr [esi], offset off_0_4035C8
  40139E                 mov     eax, esi
  4013A0                 pop     esi
  4013A1                 retn
  4013A1 sub_0_401390    endp

       ⠪  砥  ⠭  ᭮,    sub_0_401440   p㠫쭠
 㭪       CDocument::OnSavDocument()!    H  pp稪    p
 p ᫥,  뢮    p뢠  .
         ᫨    sub_0_401440    맮  㭪樨    㬮砭
 OnSaveDocument?    ⮣  ᭠砫  室  㧭  pp  
   㭪  pp   . ᯮ㥬  ⮩ 楫 IDA  稬
 ᥪ rdata.  㡮 襬 ᮦ OnSaveDocument  ⠡ p
 . , 筮, 맢  㭪  DLL p⢥,
 p㧨     LoadLibray.   ,  筮,  p     
 p饭        䠩.  H  ,  ⠬  ⪮ .
 p  p  p    㭪権    p  0x10  
 ⨬樨  믮  pp,  ⮬  ⠥  "p", p
  ᯮ짮 騪  ᢮ 楫.
       ⢨⥫쭮  祭  p,  筮   모
 ppp    windows.  ,  p  p  몠 p樨
 ⠫    p쥧  p㤭.      맢  㭪   p,
 室   稥   GetProcAddress,    p    pp  .
 砫쭮    p  ,      p. 筮  ᫥
  ⠡ p,    騩 맮.
     筮 p ᥣ ⠢  䠩  ⮣ ,  
  뫮  pp ⠡ p.    ᤥ 㦭 
 p  PE  䠩, p ᠭ, pp,  MSDN.   pp 
     ᤥ. p 䠩 crack10.exe  myfile.exe p ⨬
 HIEW  6.x  (  )    p    ᥪ  p.    ᠬ   砫
 pᯮ ᨢ IMAGE_IMPORT_DESCRIPOR. p   pp 
 p    SDK    MSDN.    ᫮  饥    砫  RVA
 (relative  virtual  address)  㪠⥫   pp IMAGE_THUNK_DATA. 
 -     㦥. pp rva  쭮 ᬥ饭 p PE 䠩
   ᫮  ᫥    image  base, p  㧭  
 䠩.
       ᮡ  p⢠  IMAGE_THUNK_DATA?    ᨢ  㪠⥫ 
 RVAFunctionName.   H來      p⢠    ᫨    
 pp         室饬      ⭠p筮  pp,
 pp hiew.    p᭥, 祬   PE 䠩 p, 
   ⮢ p㬥⮬ pᬮp. 筮, ᫥  p  
     p⭥,      몮. p  
 p뢠   孨,  ⮫쪮  ᢮ p㪨  . pp   
 ᮡ    p㦤   ᯮ짮   ⮢   pp      ⠡
 ᯮp\p    (pp    PEKPNXE  p  ᯥp᪨)    ᥣ  
 pp    p,      p ⥫ ᭥.
 Hp⨢    -  p砭  p   PE 䠩    筮 p
 ᠭ   ᠬ p  p뢮筮 㬥p. ⢥ 类 
 p  WINDOWS   ⠥  䠩 WINNT.H, p ᮤp 
 室    pp,   ,  ,    ᮤp  p  .
 ⮬   祭  p    p  ᭨  ᠬ⥫쭮.
   砫  p㧨 ᫥㥬 䠩  hiew.  뫮  p, 맢
 ᥪ p,  p p ⠥  p   p.
       PE  䠩  稭    ᭠砫  䠩.    ⮣ ⠬
 pᯮ DOS-᪠ 誠, p  ᮢᥬ  p᭠.   PE
 䠩  稭      ᨭp.  ⮥  (  )
   ᫮    image  base,  p   p  ᫥,
 易    RVA,    襬  砥  p 0x400000,  ⨯筮  win32
 䠩.
     p    室  p ⠡ p .  㤥 p 
 pp  (p  ⠡  ᯮp).    pp  
 pp,  pᯮ    OPTIONAL HEADER  ᮤp 室
  p.   p 筮 ᠭ  p, 뫠 ⥫ 
 MSDN      wintnt.h            p祭    p᪠
 饩  㬥樨    ᫥    뫮 p   ⪨
 p.  ⭮  ,      p  ⮢    맢
 p  p       , p   ᪨  
 p  ⥭ 孨᪨ ⥪⮢  ᫮p   ⨫ pp
    ⮭   㬥樨,  p  ᢮  ⠢    
 p   㯭  p  ᠩ p⥫   p
 p,  MicroSoft.  H       ᪠?   㯠 
 ,    p      ﬨ     ⮢ "p" - 祢
  p  .
      ⠪,   p,        㦥  ᭨,    ⠡  p
 pᯮ      p   0x40000+0x3A90=0x43a90.   p      
 pᬮp,    筥    pᬮp  IMAGE_THUNK_DATA,  p  㦥
 p㫨 . p   祢  ᮤp:

     .00403E30:  F6 3E 00 00-02 3F 00 00-16 3F 00 00-C6 3E 00 00
     .00403E40:  E6 3E 00 00-26 3F 00 00-44 3F 00 00-BE 3E 00 00
     .00403E50:  6A 3F 00 00-A8 3E 00 00-9A 3E 00 00-86 3E 00 00
     .00403E60:  36 3F 00 00-56 3F 00 00-D8 3F 00 00-00 00 00 00

 p      -p    ,      -
  ᫮ -  RVA 㪠⥫. H   ⠫ ᠬ 祭,
 pp  0x3EF6  -  室        ⥪饩 樨, 㡮 
 ⠡  p.  p  ⮣,     p p  p
 p騥   祭   ⮢   祭   宦    ⨯  ᨢ
 㪠⥫.
        㬥,      㡥    p쭮  襩
 .  ⠥  ⥯p,    p    㬥樨,  㣠  
 㪠⥫    H    ?    筮    p,        p⭮,  
 p⢥  pp㥬  㭪樨.    p  㬥樨
 p    㪠⥫:

 0403F00:  6D 00 83 00-5F 5F 73 65-74 75 73 65-72 6D 61 74  m  __setusermat
                                                             ^
 0403F10:  68 65 72 72-00 00 9D 00-5F 61 64 6A-75 73 74 5F  herr   _adjust_
 0403F20:  66 64 69 76-00 00 6A 00-5F 5F 70 5F-5F 63 6F 6D  fdiv  j __p__com
 0403F30:  6D 6F 64 65-00 00 6F 00-5F 5F 70 5F-5F 66 6D 6F  mode  o __p__fmo

       ⢨⥫쭮  㭪権,  ᫮ 饥 p , 祢,
 p!  ,     ⨫   ⠫ -  
 㭪樨,  p ᯮpp ⮫쪮  p  ᨬ쭠 p
   p    㯭.  H  㦥  ⮣ H  - 㪠⥫ 
 p⥫쭮  㪠뢠   p? 㬥 , p MicroSoft
   p   ⨬樨 pᬮp ⠪ p.  ⮬ 砨 
     IMAGE_THUNK_DATA    p⢠    ᮡ      㪠⥫,   
 p⢥  p  㭪権.     p稪  pᯮ ⠪
  p訩   ᫮ p .  p, 砥
 ᨢ  ᫥饣:

   .00403B00:  B2 10 00 80-86 11 00 80-FA 09 00 80-D0 09 00 80
   .00403B10:  63 16 00 80-52 0F 00 80-41 04 00 80-4F 14 00 80
   .00403B20:  5C 09 00 80-12 0D 00 80-B4 14 00 80-B6 14 00 80
   .00403B30:  A5 0A 00 80-EF 0F 00 80-5A 12 00 80-BB 14 00 80
   .00403B40:  A9 14 00 80-52 16 00 80-A6 0B 00 80-4B 0C 00 80

     ⭮,   ⨬樨 WINDOWS NT MicroSoft p ᠬ ᥡ 
   ⥬    㪠 ᨢ   p,
   p⢥  ᬥ饭  pp㥬 㭪権.  饥 p襭
 MicroSoft  㦨  p  㢠.  ⢨⥫쭮, p窨
   ᮢᥬ    ⠥  p,           ⠪⮢
 pp.    譨 p ⢥p,  "p襭  MicroSoft"  
   p,  祬  p쪠  p.   windows  楫 ⠢塞 p筮
 ⥫,    p p⠭   p "⮪".   ᠬ
  -    p⠫ 쬠   .
     ⪮    pp  ⠡  p 室  p쥧
 権  易    p饭        ⮢ 
 ᫥.  ⢨⥫쭮,  pp      㭪 祭 p.
 筮  p  p ( )  ⠡. 饥 ᫮ ⮢
   뢠,   ⠡  p p騬 㫥.
     ﭥ      䠩.  RVA  p  p pp IMAGE_THUNK_DATA
 p  0x3B00.  뢠,    image  base  0x400000,  砥  쭮
 ᬥ饭  0x403B00.   㧭    pp  㭪樨?
   ⮣ ﭥ   Name IMAGE_IMPORT_DESCRIPTOR, (⢥p⮥ 
 ᫮   砫).  襬 砥  㪠뢠  ⮪ 'MFC42.DLL' 
     ⠡       OnSaveDocument. 㬥,
     ⠡    㤥 ᢮     殬 室 砫
 ᫥饩.      pp訬,      㬠. H
   IMAGE_THUNK_DATA  㪠뢠  ᥣ  뫪.   㤥 ᫨ 
 p⨬          p㣮  ᢮    (p  p猪
 )   ᢮ p⠭⢮ ᥬ  ?
     祢,      㦭  ᢮      ⠡.  襬
 砥  ⠪  室  让 ᨢ  ᪮쪨 ⮢. 祢,
   ,   p諮 p   ⠬ p 
 ᨢ,   뫮  ⠪ 來.
     p  p  pᮢ    p  ᥪ権   ppᮢ
 p᪨    ᥣ              ⮣  pp⢠.
 p⨬  뤥  pp,  pp,  p 0404110.  ⮣
 㦭  ᪮p      p  0403E24  0403E6B    
   .  p  ᢮      ᯮ짮   ᢮
 ᬮp.  H  p  室  ᮪ppp  뫪  p饭
 p.    ⮣    IMAGE_IMPORT_DESCRIPTOR p RVA p 
 pp   .
     ⨬  䠩,      㡥,     ᤥ p쭮  
 p⠥.   p㯨    p筮  pp  㭪樨    䠩.  
 筮  ⮬⥫,   ⥫ p, 㦤騩 
 "  "  PE  䠩,     p㦠  p⠥.  砫
 稬 ᨢ pp 㭪権:


     .00403B00:  B2 10 00 80-86 11 00 80-FA 09 00 80-D0 09 00 80
                          ^^          ^^          ^^          ^^
     .00403B10:  63 16 00 80-52 0F 00 80-41 04 00 80-4F 14 00 80
     .00403B20:  5C 09 00 80-12 0D 00 80-B4 14 00 80-B6 14 00 80
     .00403B30:  A5 0A 00 80-EF 0F 00 80-5A 12 00 80-BB 14 00 80
     .00403B40:  A9 14 00 80-52 16 00 80-A6 0B 00 80-4B 0C 00 80



    ,       pp  p.   室 ⮫쪮
     .  H室  䠩 MFC42.map 㭪 OnSaveDocument  
 ᭮  祭 ᬥ饭 p塞 p   dumpbin  
 p㣮 筮 ⨫ 砥,   p 0x1359. 뢠  
   ⠡.  ᪠  dumpbin,    㤮⮢p,   ⨫
 p  .  ,     襩 p,  ᪮p
   ⮫쪮  砫.           IMAGE_THUK_DATA? ⭮
 p  祣.  H  㦭  㧠 p 㭪樨 ᫥ p㧪,   
 ᤥ?    ⮣         IMAGE_IMPORT_DESCRIPTOR -
   ⮥    ᫮,  㪠뢠騥  p  ᨢ,    
 p    p稪   p樮   ⥬      p   p
 pp㥬  㭪樨.    襬  砥    MFC42.DLL  ⠪  pp
 pᯮ    p 0x40300C. ᬮp  ,  ᭠砫 p⨬
 ,    p  0x40300C  室    p  ᥪ樨 p 
 㦥 p ᥪ樨 .rdata  ⥫⢮  ᠬ  祭 ,
 ..      p稪  p    ᬮ  㯠   
 ,   ᫥⥫쭮  祭. ⮬  ⠡ p頥
 ⮫쪮    p  .rdata  H   ᮡ p⠢? p p 
 p  ᭨    ᠬ⥫쭮,  祬  ᪠    㬥樨  p
 ⢠ ᯮ   ᥩ p樨. ᬮp  :

  .00403000:  8C 3F 00 00-78 3F 00 00-00 00 00 00-B2 10 00 80
                                                  ^^
  .00403010:  86 11 00 80-FA 09 00 80-D0 09 00 80-63 16 00 80
  .00403020:  52 0F 00 80-41 04 00 80-4F 14 00 80-5C 09 00 80
  .00403030:  12 0D 00 80-B4 14 00 80-B6 14 00 80-A5 0A 00 80
  .00403040:  EF 0F 00 80-5A 12 00 80-BB 14 00 80-A9 14 00 80

     H p   ⠡ ?    p㣠 p p.
   ⢥  p        . p p
     ᥬ  p殮  p,   ᫥ 頥 p묨
 p砬  pp㥬  㭪権  㦥    ⠤  p㧪.      
 p ᯮ  맮 ⨯ CALL DWORD PTR [0x403010].
     祢,      砥  p       ⠡ 
 㪠⥫ﬨ    ASCIIZ-p        p 㭪樨.  
 MSDN   p p  䠪,      訡 
   p.   p 設⢮ ᫥⥫ p windows
   p    p  뢠    㬥,  ᪮     ⠪
 筮 祢    㦤  p᭥.
     砫쭮,    㦨  pp   p 稭  
 堪p,  p  p        ⪠  㬥樨
 .      p      ᫥  稭  
     "  㭪樥  windows p뢥 䠩.  ⠭ 
 OpenFile    ⠭,    p⠫. 祬?" ⢨⥫쭮 騩
 ꥬ  㬥樨   pp稪 win32 ⠪,    pᬮp
   ⭨     p.   ⠪.   window 3.1
 p,    㦭        祭,    業
 pp⮬      p. H᪮쪮   ᫮   p!
   ,      ⮬  䮭    ᭮  㯮p  p
 ⥪ ⨯ MFC, 孮 OLE  ActiveX  ⥬ ppp
 p    ⠥    -     㬠 pp稪   㬥樨.
 㭣  -       㦭 㦥 ᤥ  MicroSoft  ᠬ 
 ᥩ  祭  p,       (  )  p 
 p.  pp  p    p    ᢮
 p㪠    p 믮 ᢮ pp 㦮 ,   
 ᫥.
      業   ⥬騪      ⪠  MFC  C++,
   p  ᪮쪮 p쥧 p  p p .
     ᥬp,    p⮬  ᪮p  몥.  Hp⢥
 饭    win32      p  鸞    㣠騬,  
 ⢥    p  ⢮ p⥪p ⥬. ⮣
 p  堪p⢥ p ᬥ譮.
          諨    p.  H    㤥  p .
 p,         㯨 . H,  ᮧ
   䠪  㦥  諮   ⥫.  ᠬ ,     
    㪠 ᥪ    p ...  GPF.
   ᠬ  ,      㪠력 ⢮ 몫  p ⥩ .
             p⢠  ,  ᮡ  ⠬,  
 ᯮ짮 ᢥ p.
      p祬,  ᫨        ,    設⢮ p
 pp p ᥬ :

  .004018D0: FF25C4314000                 jmp       MFC42.4612
  .004018D6: FF2590314000                 jmp       MFC42.4610
  .004018DC: FF2594314000                 jmp       MFC42.6375
  .004018E2: FF2510304000                 jmp       MFC42.4486
  .004018E8: FF2514304000                 jmp       MFC42.2554
  .004018EE: FF2518304000                 jmp       MFC42.2512
  .004018F4: FF251C304000                 jmp       MFC42.5731
  .004018FA: FF2520304000                 jmp       MFC42.3922
  .00401900: FF2524304000                 jmp       MFC42.1089

       p,      ᥣ  뫪, p 
 ⮬              ᪮pp. 室,  
   ⥫.  H  ᠬ        㯨,  p 嫮, 
 祢,  .  p砫  堪p, p ᮡ ⯠
      pp樨 뫪  ᠫ ᯥ樠 pp  ᪨
  IDA.
     ,         p⪮  p.      ⠢
         ⠡,      ᮧ  ᢮ 
 p   㣮!   ᠬ  祭 p.
     ᪮    p        殬    IMAGE_IMPORT_DESCRIPOR    ᫥
 IMAGE_THUNK_DATA,    祢,     ,  ⮫쪮
 p⨢          ᢮ . p p p,
 ⮬    蠭ᮢ    宧 pp⢠   . p
 p    室 p   p ⠡ p   
 pp    p   ᥪ .data -  pp뢠 ᥪ権, 
 ᫥ᨢ      ᥡ ... hiew "p㣠"  ⠪ 䠩. ,
 , . ⢨⥫쭮, ᫨   p稪 windows ⠭
 ᭮,    㡮  p   ᥪ樨 pᯮ ⠡ p
     ⮣,  ᮢp襭  p祭  pp  ᫥,    筥 
 ᮮ⢥⢨  p.  p null-.
     H  ᠬ  ,  室  ⤠  ᥡ      롪  ⠪
 p㦤.  H    pp,    饬 MicroSoft  p
 p稪,  p  㤥  ⠪ pp    p
 pp   (   ⮭   ⨢pᮢ)   p    pp  
 pp⭮ .
       p㣮  p, p 堪p  ᥣ p  ⪫
   㬥樨  p権 ᮯ   p㪮.  p⨢
    砥   祣      ⠥,      ᨤ   ⢮   
 pp  祭 ᥬp  p ⥪  ᯮ塞
 䠩,  ᮯp殮  ᫥묨 p  p㤮p⠬.
     p㥬  IMAGE_IMPORT_DESCRIPOR   ᢮  ᥪ樨 
       뫪  Import Directory. p  室 ᮧ
    . H筥  ⢥p⮣  ᫮, 㪠뢠饣  
 㭪樨.    ⫠  㦥  p 'MFC42.DLL',  
 ᮧ   ᢮      㪠    .  ᫥    ᢮ 
 ᨬ. ⮬ 㯨  ⠪:

 .004041D0:  4D 46 43 34-32 2E 44 4C-4C 00 00 00-00 00 00 00  MFC42.DLL

 p,    ᯮpp㥬      㦥  ᠫ. p 室
 ᮧ  ᨢ   IMAGE_THUNK_DATA,  筥, "ᨢ" p ᪠, ᥣ
   .

 .004041E0:  59 13 00 80-00 00 00 00-00 00 00 00-00 00 00 00  Y. 

 ⭮,     0x1359       pp㥬 㭪 OnSaveDocument, 
 p訩    0x8000  㪠뢠,    ᫥  pp  p.
 ⠥  ᮧ  ⠡  pᮢ,  筥  ⠡ ᮧ  
 室.  H  ᬮp    ,       ⥮p 
 뫠    ᮮ⢥ , ⨬ p窠 p  ⮬,
         ᯮ 砫 祭 ⠡ pᮢ,  
       ⮬   p浪,    p    p᫥    ⠡  
 (IMAGE_THUNK_DATA).  ⮬ 筮   ⮥ pp⢮ 
 ⠭   㪠⥫  ᫥  IMAGE_IMPORT_DESCRIPOR.
    ,      ⠫    p쥧 p祭. p稪 
   㯭  ⮫쪮  .rdata,   p ⠪ ᪠ ᢮ ⮬ 
 .    ⮣,     p, ᪮ 뫪 
   ppᠭ   ᥬ  pp. ⠥ ⮫쪮 ,  
 p  p   ⠡   pp⢠ 
  楫.  ⢨⥫쭮, ᪮쪮 ⪮  ᢮.   
 , 祬 筮.

 0403FC0:  57 69 6E 64-6F 77 00 00-55 53 45 52-33 32 2E 64  Window  USER32.d
 0403FD0:  6C 6C 00 00-AA 01 5F 73-65 74 6D 62-63 70 00 00  ll  ._setmbcp
 0403FE0:  00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00
 0403FF0:  00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00

 ⠥  ⮫쪮  ᪮ppp IMAGE_THUNK_DATA.  p 
 룫拉 ⠪ -

 0404160:  E0 41 00 00-00 00 00 00-00 00 00 00-D0 41 00 00  pA          A
 0404170:  E0 3F 00 00-00 00 00 00-00 00 00 00-00 00 00 00  p?

    dumpbin,   p p⠥.

    MFC42.DLL
               403FE0 Import Address Table
               4041E0 Import Name Table
                    0 time date stamp
                    0 Index of first forwarder reference

                     Ordinal  4953

  ᫨   ⫠稪  p 0x403FE0,  ⠬  p㦨 ⮢
    㯮p   p   㭪樨   OnSaveDocument.   pp,     
 ⢨⥫쭮  ⠪.   ⮣ ᥬp ( u  soft-ice) 
 p  .  p ⮬ ⫠稪  뢥  p p 㭪樨.
   㡥  ,      p⠥.  ⠥    㭪 ᥣ 
 맢.  ⮣ p  ,   諨 pp 㭪
 OnSaveDocument. 祢  ⮨ p . ᬮp   p:

   .00401440: 6A00                         push      000
   .00401442: 6A00                         push      000
   .00401444: 6890404000                   push      000404090
   .00401449: E812070000                   call      AfxMessageBox
   .0040144E: 33C0                         xor       eax,eax
   .00401450: C20400                       retn      00004

 祢,   㦭 p pp ᫥騬 p:

   .00401440: FF742404                     push      d,[esp][00004]
   .00401444: 90                           nop
   .00401445: 90                           nop
   .00401446: 90                           nop
   .00401447: 90                           nop
   .00401448: 90                           nop
   .00401449: 2EFF15E03F4000               call      d,cs:[000403FE0]
   .00401450: C20400                       retn      00004

       ⮣  p⨬   SDK.   p⨯  㭪

    virtual BOOL OnSaveDocument( LPCTSTR lpszPathName );

     ⪠ ⮪ push dword  [esp][00004], ⠥ ᭨ 맮
 㭪樨.      , p稪   祩 0x403FE0 ᠫ  p,
         ᯮ짮  맮.   !  ᠫ 騩
 .      祭  . ᯥ ⥫   p 
 p   樨.  ⢨⥫쭮      p  
 pp    ?   p⥫쭮  MFC ᯮ㥬 㭪  让
 ⥯  p⭮    pp 㭪樥 pp稪.  
 ⮣?
    H  ᯥ,  㭪 pp, ⮣  ᫮ 
 ⥬,    堪p ᯥp 㦭 㤥   p,  ⥬ ᮧ
 騩    ...        ᮡ⢥  DLL,    㤠 㦥
   p  ᤥ  맮.  p ⮬   p 
 ᪨   㤭 窨 ⮣ , ᯮp筮 ppᠭ 
 䠩.    p   ᨬ筮 p⢮ pp⪨ (pp, MS
 VC)            㭪,  ᯮ    MFC 
 ꥪ⨢-pp  ++.  p   p ⮣ -p
 㤮  p⭮.
      䨪樨  p  exe    MS-DOS  筮  ᯮ짮 ⮫쪮
 ᥬp.      p  뫮 p⭮ (p㬥,  
 ⮣  몠),    p㣮 ⮬⥫쭮. p ⮣,  windwos p 
   ⢨   p  p⮢  pp, .. 祭 
 筮   p樨,      ꥪ⨢-pp   모  (p
 p ᫥ p) pp  ᭮  묨 pp 
 p묨.            㦠      ꥪ⮢   饣
 ᯮ짮, p ⭮   p祭   ᯮ.
 ᮡ ⮣,  pp    樨 p㥬 
 ᯮ짮      p p, ᫨ p饩 p楤p 
 㦥 뫠  㦭. ⨬, p p pp 짮⥫  p,
 p  p  p ⠫ p. ᭮,   p p
 pp      ⢥  㦤 p㣨 ppp,
 ᫨  p p ⮫쪮  p.  ⮣ ᫥,   稬
 ⢮  pp 뫮   㤥  p,  p諥 "
 祣  ⠪  p- ⥭ᨢ p".
      ᫮,  windows ⠫ ⮫쪮 p 뢠 騩
  p⢥  ᯮ塞 䠩,   稭騬 ⥫ﬨ
     .  p⥫쭮,  祭  pp p 뢠
 騩      ⠪  ,    p    砬 
 p  p  p   pᨥ. p祬,   ,
 p      룮  ⫠뢠   p pp p
 p, 祬  뢠 騩 .
    p    襬  pp. p㥬  .  p㣮
   ,   ᮮ饭  p祭 pᨨ. 室,  p
   pᬮp    pp.  모-    ᮪  
 ⮫쪮   p   p?        ᭨,  室  
 뢠騩      ᮮ饭  .  H  㤥  p    ⮫  
 p㬥     IDA,    ᯮ㥬      p  hiew-.
 筮 ᥣ   ᫪  p, ᬥ饭 p  㧭,
     ᥣ  .  ᫥  祣  p㤭  㤥  ᫥騩
 p:

      .00401410: 8B442404                     mov       eax,[esp][00004]
      .00401414: 8B5014                       mov       edx,[eax][00014]
      .00401417: F7D2                         not       edx
      .00401419: F6C201                       test      dl,001
      .0040141C: 7411                         je       .00040142F
                                              ^^^^^^^^^^^^^^^^^^^
      .0040141E: 6A00                         push      000
      .00401420: 6A00                         push      000
      .00401422: 6854404000                   push      000404054 ; << p
      .00401427: E834070000                   call      AfxMessageBox
      .0040142C: C20400                       retn      00004 ;"
      .00401430: 8B4130                       mov       eax,[ecx][00030]
      .00401433: 8B4808                       mov       ecx,[eax][00008]
      .00401436: E81F070000                   call      Serialize
      .0040143B: C20400                       retn      00004

 MFC-pp⠬  㤥  p㤭      p⠥. ᫨ p室
  䠩,  edx ⠭ p , ᫨ ⥭  . 
   ⮬  p .  p   룫廊 p⥫쭮
 ⠪:
 void CCRACK10Doc::Serialize(CArchive& ar)
  {
   // CEditView contains an edit control which handles all serialization
   if (ar.IsStoring())
   {
   AfxMessageBox(" p祭 p. , pp⠩ ");
   return;
   }
   ((CEditView*)m_viewList.GetHead())->SerializeRaw(ar);
  }

 ,   p ᤥ   樨   ᫮ p室
   ᫮.   ⢥ p⨢ p 㤠 ret. 
   -p  㤥  "p㣠",    筥  뢠  䠩.  
 ⭮襭    pp稪   㤥  . 짮⥫ 
 室    p,   ﭭ pp nag-screen-  
 㫥  p⭮    pp  p  p.    p㣮
 p   ⭮襭  짮⥫  p pp  㤥 룫拉
 ⥫᢮.  ᮡ  ᫨    筥 뢮    ᢮
 p.
    p㥬  p ret,  , ᪠  nop.  p 鸞 
   p   pᯮᮡ pp. , ⨢ pp 
 ⠢  p  䠩,  砥    GPF - "pp
 믮  pp  p    㤥  p襭".    祬  ? 
 p  鸞    p    ⠢   㯨, ⮬ ᯮ㥬
 ⫠稪      ⥫쭮   pp㥬    p.  p稭
 p㦨   筮  p.  㭪  AfxMessageBox    p
 pp  eax    ecx,    , pᯮ   ᯮ,  
 p,      ᮤp  뫮  .  ⥫쭮,  
 p,  筥    ᠭ  ᮮ⢥饣  ,   
 騪.   p㤭,    ⮬⥫쭮 -  p  push
   pop,    -  p⭮  室.  ⢨⥫쭮,    ᫮
 p室    맮  㭪樨   ᢮ pp. , 筮,
 ᬥ      㭪      ,      祣  ᢮  
 p筮,          p襭    襣
 ᫠  ?  ᠬ , ᫨ p not,  jz   jnz  稬
   ,    p ⮫쪮,   p p pp. , 
 p  pp樨  窨  p室,  ᪮   push pᯮ
 "襥" .  ⮣  稬 ⠪ p:

      .00401417: 50                           push      eax
      .00401418: 51                           push      ecx
      .00401419: F6C201                       test      dl,001
      .0040141C: 750E                         jne      .00040142C
      .0040141E: 6A00                         push      000
      .00401420: 6A00                         push      000
      .00401422: 6854404000                   push      000404054
      .00401427: E834070000                   call     .000401B60
      .0040142C: 59                           pop       ecx
      .0040142D: 90                           nop
      .0040142E: 90                           nop
      .0040142F: 90                           nop
      .00401430: 8B4130                       mov       eax,[ecx][00030]
      .00401433: 8B4808                       mov       ecx,[eax][00008]
      .00401436: E81F070000                   call     .000401B5A
      .0040143B: C20400                       retn      00004

     ⮢p,   ⢨⥫쭮 p⠥! ,    p
     ⢮   p襭. p     
 ⨭ 㤮⢨.
     ⠪,     p  让    -  稫    ⮫쪮  ᭨
 p祭   pp,   뢠 騩 . 筮,  
     ⮩      ⮫쪮  砫    襣  , p
 p뢠  p .   㫨? 䨪 pp p⢥
  ᯮ塞   ⮫쪮  p ,  ᥭ p樯
           ⥩   !
 ⥫,  p⭮,  ,   ⮣  墠⨫   ⤥쭮 ,
         .  H      ⮬  砥   p 
 ᮡ⢥ ᫥    .
     H모  堪p    p ⠪.  ⥫  㯮p p.
 p    ⠭ pᥭ  祭. H - p室  
 ⠪   p,         ⮬     뫮  p    ᫥
 ⮬᪨.

