屏保密码全攻略

              屏保密码全攻略

* Reference To: USER32.GetDlgItemTextA, Ord:00FDh
                                  |
:78054201 FF15DC720578            Call dword ptr [780572DC]
:78054207 85FF                    test edi, edi  file://-－－－由此出来
:78054209 751B                    jne 78054226
:7805420B 8D45FC                  lea eax, dword ptr [ebp-04]
:7805420E 8D8D78FFFFFF            lea ecx, dword ptr [ebp+FFFFFF78]
:78054214 50                      push eax
:78054215 51                      push ecx

* Reference To: MPR.WNetVerifyPasswordA, Ord:004Eh
                                  |
:78054216 E87F020000              Call 7805449A
:7805421B 85C0                    test eax, eax
:7805421D 7440                    je 7805425F
:7805421F B801000000              mov eax, 00000001
:78054224 EB79                    jmp 7805429F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:78054209(C)
|
:78054226 8D8574FEFFFF            lea eax, dword ptr [ebp+FFFFFE74]
:7805422C 8D8D78FFFFFF            lea ecx, dword ptr [ebp+FFFFFF78]
:78054232 50                      push eax
:78054233 51                      push ecx

* Reference To: KERNEL32.lstrlenA, Ord:02E7h
                                  |
:78054234 FF1558720578            Call dword ptr [78057258]
:7805423A 50                      push eax
:7805423B 8D8D78FFFFFF            lea ecx, dword ptr [ebp+FFFFFF78]
:78054241 51                      push ecx
:78054242 E89A010000              call 780543E1
:78054247 57                      push edi       file://这里是加密后你输入的假密码
:78054248 8D8D74FEFFFF            lea ecx, dword ptr [ebp+FFFFFE74]
:7805424E 51                      push ecx       file://这里是加密后的密文

* Reference To: KERNEL32.lstrcmpiA, Ord:02DEh
                                  |
:7805424F FF1554720578            Call dword ptr [78057254]
:78054255 83F801                  cmp eax, 00000001
:78054258 1BC0                    sbb eax, eax
:7805425A F7D8                    neg eax
:7805425C 8945FC                  mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:7805421D(C)
|
:7805425F 33FF                    xor edi, edi
:78054261 B801000000              mov eax, 00000001
:78054266 397DFC                  cmp dword ptr [ebp-04], edi
:78054269 7534                    jne 7805429F    file://**********关键跳跃的地方***********

原文链接： http://blog.csdn.net/jaminwm/article/details/90402