﻿<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>C++博客-小明思考-随笔分类-Debug</title><link>http://www.cppblog.com/sandy/category/7683.html</link><description>高性能服务器端计算</description><language>zh-cn</language><lastBuildDate>Wed, 06 Jun 2012 04:34:50 GMT</lastBuildDate><pubDate>Wed, 06 Jun 2012 04:34:50 GMT</pubDate><ttl>60</ttl><item><title>逆向三国群英2</title><link>http://www.cppblog.com/sandy/archive/2012/05/31/176971.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Thu, 31 May 2012 13:53:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2012/05/31/176971.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/176971.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2012/05/31/176971.html#Feedback</comments><slash:comments>1</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/176971.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/176971.html</trackback:ping><description><![CDATA[<div><div style="layout-grid:15.6000pt; "><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">闲来无事，搞搞逆向工程分析一下三国群英</span><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">2，今天的目标是去掉光盘提示,并让游戏正常进行。因为我玩的是原版，所以每当直接运行sango2.exe会弹出如下对话框:</span></p><p style="margin-bottom: 0pt; margin-top: 0pt;"><img src="file:///C:/DOCUME%7E1/qiqi/LOCALS%7E1/Temp/ksohtml/wps_clip_image-28588.png" alt="" height="3" width="2" /></p><p style="margin-bottom:0pt; margin-top:0pt; "><img src="http://www.cppblog.com/images/cppblog_com/sandy/s1.png" alt="" border="0" height="112" width="243" /><br /></p><p style="margin-bottom: 0pt; margin-top: 0pt;"><span style="font-size: 10.5pt; font-family: '宋体';"><br /></span></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">我使用的工具是大名鼎鼎的OllyDBG。</span></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">首先，打开OD,打开sango2.exe,&nbsp;运行程序，当出现对话框时暂时程序，发现停在此处：</span></p><p style="margin-bottom: 0pt; margin-top: 0pt;"><img src="http://www.cppblog.com/images/cppblog_com/sandy/s2.png" alt="" border="0" height="162" width="554" /></p><p style="margin-bottom:0pt; margin-top:0pt; "><br /></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">仔细看以下几行代码，可以看出在40B207处有一个判断，如果EAX=0，则不显示对话框，并跳转到40B21F，那如果我们把B207的&#8220;JE&nbsp;SHORT&nbsp;0040B21F&#8221;改为&#8220;JNE&nbsp;SHORT&nbsp;0040B21F&#8221;,是否就可以不显示对话框呢？经测试，确实不显示了，但是游戏也直接退出了，并没有达到我们要的效果。看来这个地方只是出错后的程序处理，我们要找到更深的源头，才能解决这个问题。</span></p><p style="margin-bottom:0pt; margin-top:0pt; "><img src="http://www.cppblog.com/images/cppblog_com/sandy/s3.png" alt="" border="0" height="147" width="526" /><br /></p><p style="margin-bottom: 0pt; margin-top: 0pt;"><span style="font-size: 10.5pt; font-family: '宋体';"><br /></span></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">上断点！我们要结合单步调试来理解程序的运行逻辑才能发现真正的解决方案。</span></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">观察对话框出现的时候，程序的堆栈如下：</span></p><p style="margin-bottom:0pt; margin-top:0pt; "><img src="http://www.cppblog.com/images/cppblog_com/sandy/s4.png" alt="" border="0" height="151" width="554" /><br /></p><p style="margin-bottom: 0pt; margin-top: 0pt;"><span style="font-size: 10.5pt; font-family: '宋体';"><br /></span></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">发现这个函数的入口在</span><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">40B00A，我们在此设置断点开始单步调试，会发现在调用4300F0出现对话框，跟踪进去。</span></p><p style="margin-bottom:0pt; margin-top:0pt; "><img src="http://www.cppblog.com/images/cppblog_com/sandy/s5.png" alt="" border="0" height="168" width="489" /><br /></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">用这样的方法跟踪进去，保持耐心和清醒的头脑，最终会发现</span><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">4302C8会进行错误处理，导致对话框的出现，只要跳过即可。我们修改4302C1的代码为"JZ&nbsp;short&nbsp;004302D1"，即可跳过对话框，直接进行游戏。</span></p><p style="margin-bottom:0pt; margin-top:0pt; "><img src="http://www.cppblog.com/images/cppblog_com/sandy/s6.png" alt="" border="0" height="174" width="500" /><br /></p><p style="margin-bottom: 0pt; margin-top: 0pt;"><span style="font-size: 10.5pt; font-family: '宋体';"><br /></span></p><p style="margin-bottom:0pt; margin-top:0pt; "><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">最后一步，出补丁。使用右键功能【</span><span style="mso-spacerun:'yes'; font-size:10.5000pt; font-family:'宋体'; ">copy&nbsp;to&nbsp;executable】，然后另存为可执行文件就可以了。运行修改过后的sango2.exe，就会发现已经破解成功了。</span></p><p style="margin-bottom:0pt; margin-top:0pt; "><img src="http://www.cppblog.com/images/cppblog_com/sandy/s7.png" alt="" border="0" height="177" width="554" /><br /></p></div></div><img src ="http://www.cppblog.com/sandy/aggbug/176971.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2012-05-31 21:53 <a href="http://www.cppblog.com/sandy/archive/2012/05/31/176971.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>debug to fix crash</title><link>http://www.cppblog.com/sandy/archive/2012/04/27/172918.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Fri, 27 Apr 2012 07:34:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2012/04/27/172918.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/172918.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2012/04/27/172918.html#Feedback</comments><slash:comments>4</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/172918.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/172918.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 最近遇到一个Windows Office Communicator 2007 崩溃的问题，有些意思，写下来跟大家分享。【现象】我们公司内部使用office communicator来做内部人员的IM工具，使用的是一个定制版本(plugin), 可以跟公司内部的组织架构做整合。我使用的OS是Windows 7 32bit,一开始使用并无问题，在某次windows update之后，发现没法添加好友，...&nbsp;&nbsp;<a href='http://www.cppblog.com/sandy/archive/2012/04/27/172918.html'>阅读全文</a><img src ="http://www.cppblog.com/sandy/aggbug/172918.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2012-04-27 15:34 <a href="http://www.cppblog.com/sandy/archive/2012/04/27/172918.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>When program crashed (windows)</title><link>http://www.cppblog.com/sandy/archive/2008/11/17/67108.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Mon, 17 Nov 2008 05:54:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2008/11/17/67108.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/67108.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2008/11/17/67108.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/67108.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/67108.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: When program crashed ...&nbsp;&nbsp;<a href='http://www.cppblog.com/sandy/archive/2008/11/17/67108.html'>阅读全文</a><img src ="http://www.cppblog.com/sandy/aggbug/67108.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2008-11-17 13:54 <a href="http://www.cppblog.com/sandy/archive/2008/11/17/67108.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>使用Gflags来检测heap问题</title><link>http://www.cppblog.com/sandy/archive/2008/09/27/62877.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Sat, 27 Sep 2008 02:59:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2008/09/27/62877.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/62877.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2008/09/27/62877.html#Feedback</comments><slash:comments>3</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/62877.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/62877.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 如何让char *p=new char[10];p[10]=10;报错？&nbsp;&nbsp;<a href='http://www.cppblog.com/sandy/archive/2008/09/27/62877.html'>阅读全文</a><img src ="http://www.cppblog.com/sandy/aggbug/62877.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2008-09-27 10:59 <a href="http://www.cppblog.com/sandy/archive/2008/09/27/62877.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>LeakDiag使用手记</title><link>http://www.cppblog.com/sandy/archive/2008/08/18/59260.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Mon, 18 Aug 2008 11:12:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2008/08/18/59260.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/59260.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2008/08/18/59260.html#Feedback</comments><slash:comments>4</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/59260.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/59260.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: LeakDiag是微软一款检测memory leak的工具&nbsp;&nbsp;<a href='http://www.cppblog.com/sandy/archive/2008/08/18/59260.html'>阅读全文</a><img src ="http://www.cppblog.com/sandy/aggbug/59260.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2008-08-18 19:12 <a href="http://www.cppblog.com/sandy/archive/2008/08/18/59260.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>远程调试技术-使用vs2005</title><link>http://www.cppblog.com/sandy/archive/2008/07/28/57351.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Mon, 28 Jul 2008 07:20:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2008/07/28/57351.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/57351.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2008/07/28/57351.html#Feedback</comments><slash:comments>3</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/57351.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/57351.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 介绍远程调试技术&nbsp;&nbsp;<a href='http://www.cppblog.com/sandy/archive/2008/07/28/57351.html'>阅读全文</a><img src ="http://www.cppblog.com/sandy/aggbug/57351.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2008-07-28 15:20 <a href="http://www.cppblog.com/sandy/archive/2008/07/28/57351.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>WinDBG(CDB)实践1-新手指南</title><link>http://www.cppblog.com/sandy/archive/2007/03/13/19723.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Tue, 13 Mar 2007 06:39:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2007/03/13/19723.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/19723.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2007/03/13/19723.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/19723.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/19723.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: Windbg(CDB) 新手指南&nbsp;&nbsp;<a href='http://www.cppblog.com/sandy/archive/2007/03/13/19723.html'>阅读全文</a><img src ="http://www.cppblog.com/sandy/aggbug/19723.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2007-03-13 14:39 <a href="http://www.cppblog.com/sandy/archive/2007/03/13/19723.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>GDB 和 CDB 基本命令比较</title><link>http://www.cppblog.com/sandy/archive/2007/03/08/19425.html</link><dc:creator>小明</dc:creator><author>小明</author><pubDate>Thu, 08 Mar 2007 06:33:00 GMT</pubDate><guid>http://www.cppblog.com/sandy/archive/2007/03/08/19425.html</guid><wfw:comment>http://www.cppblog.com/sandy/comments/19425.html</wfw:comment><comments>http://www.cppblog.com/sandy/archive/2007/03/08/19425.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/sandy/comments/commentRss/19425.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/sandy/services/trackbacks/19425.html</trackback:ping><description><![CDATA[<p>也许有人不知道CDB是什么，CDB是windbg的小兄弟，基于command line,对于我这个比较喜欢用command line的人,CDB比windbg更容易上手。<br><br>象GDB,CDB这些工具，命令都很多，但是我们只要熟记最常用的"三板斧"就可以工作了。<br><br>1.启动<br>&nbsp;&nbsp;&nbsp;1)直接调试:&nbsp;&nbsp;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<strong>gdb program [core]</strong><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<strong>cdb program</strong> or <strong>cdb -z DumpFile</strong><br>&nbsp;&nbsp;&nbsp;2)attach方式<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<strong>gdb attach pid</strong><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<strong>cdb -pn ExeName</strong> or <strong>cdb -p pid<br></strong><br>2.显示堆栈<br>&nbsp;&nbsp;&nbsp;GDB: bt<br>&nbsp;&nbsp;&nbsp;CDB: k<br><br>3. 设置断点<br>&nbsp;&nbsp;&nbsp;GDB: b [file:]line<br>&nbsp;&nbsp;&nbsp;CDB: bp 'file:line'<br><br>4. 运行/继续运行<br>&nbsp;&nbsp; GDB: run [arglist]&nbsp;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; c&nbsp;&nbsp; 继续运行&nbsp;<br>&nbsp;&nbsp;&nbsp;CDB: g<br><br>5. 单步<br>&nbsp;&nbsp;&nbsp;GDB&nbsp;:&nbsp;n (step over) s (step into)<br>&nbsp;&nbsp;&nbsp;CDB : p<br><br>6.&nbsp;打印变量的值<br>&nbsp;&nbsp;&nbsp; GDB : p expr<br>&nbsp;&nbsp;&nbsp; CDB: ? expr<br><br>说老实话,CDB过于复杂，学起来比GDB难.</p>
<p>BTW:用CDB之前设置一下symbol的path<br>set _NT_SYMBOL_PATH=srv*c:\symbols*http://msdl.microsoft.com/download/symbols<br>&nbsp;&nbsp;&nbsp;<br>&nbsp;&nbsp;&nbsp;</p><img src ="http://www.cppblog.com/sandy/aggbug/19425.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/sandy/" target="_blank">小明</a> 2007-03-08 14:33 <a href="http://www.cppblog.com/sandy/archive/2007/03/08/19425.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item></channel></rss>