= 72¡¢Cookie Pal 1.1b for Win95 ===========================================================
£

Cookie Pal ÊÇÒ»¸öÍêÕûµÄÍøÂç Cookie 
¹ÜÀíÈí¼þ¡£Ëü¿ÉÓ¦ÓÃÓëä¯ÀÀÆ÷Ìṩ¿ØÖƶԴ洢ÒÔ¼°½ÓÊÕ cookie 
ÔÚÄãµÄµçÄÔϵͳ¡£ÉõÖÁ¿ÉÒÔɾ³ý´æ´¢ÔÚµçÄÔÓ²ÅÌµÄ 
cookies¡£ËüÒ²¿ÉÒÔ×Ô¶¯µØÓëä¯ÀÀÆ÷Ò»ÆðÖ´ÐУ¬ÊÇÒ»¸ö·Ç³£ºÃÓõÄÈí¼þ£¡

1£©°´ Register£¬Ìîд¸öÈË×ÊÁÏÈçÏ£º

   Name: Filler
   Registration Number: 24469   £¨Ï°¹ßÐԵģ©

2£©°´ CTRL-D ÇÐÈë Softice£¬Ï bpx getdlgitemtexta È»ºó°´ CTRL-D ÇÐ»Ø Cookie 
Pal¡£°´Ï Enter ºó¡£ÂíÉϱ» Softice À¹Ï¡£

3£©À¹Ïºó£¬Ï BD * £¨ÁÙʱÐÔÇåµôÖжϹ¦ÄÜ£©¡£ÔÙ°´ F12 Ò»´Î£¬¾Í½øÈë CPal 
ÁË£¡¼ÌÐø°´ F10 Ö±ÖÁ¼ýÍ·ËùÖ¸£º

   xxxx:0040762B  CALL  004071B6
   xxxx:00407630  JMP   0040765C                <-- ¿ÉÒÔÌø¹ý CALL 0041C1DA
   xxxx:00407632  PUSH  FF                      <-- ³ÌÐòÖ´ÐÐÖÁ´ËÐÐ
   xxxx:00407634  PUSH  EBX
   xxxx:00407635  PUSH  DWORD PTR [EBP-04]
   xxxx:00407638  CALL  0041C1DA                <-- Ðã³ö´íÎóµÄÐÅÏ¢
   xxxx:0040763D  PUSH  FF

   µ±³ÌÐòÖ´Ðе½ CALL 0041C1DA ʱ£¬¾ÍÍêµ°ÁË£¡Çë×¢Òâ xxxx:00407630 ÊÇ¿ÉÒÔÌø¹ý CALL 
0041C1DA¡£µ«ÊÇÒѾ­±»Ìø¹ýÁË£¬Òò´ËÎÒÃÇÍùÉÏÕÒ¿´ÄÇÒ»ÐÐÁî³ÌÐòÖ´ÐÐÌøÖÁ 
xxxx:00407632¡£

4£©OK£¡ÎÒÃÇÍùÉÏËÑË÷£¨CTRL-UP ARROW KEY£©¡£Ö±ÖÁÈçÏ£º

   xxxx:004075AB  PUSH  EAX
   xxxx:004075AC  CALL  00407CD2        <-- Ê®·Ö¿ÉÒÉ£¡ÉèÏÂÖжϵ㣨Breakpoint£©
   xxxx:004075B1  TEST  EAX,EAX
   xxxx:004075B3  JNZ   004075C7
   xxxx:004075B5  MOV   DWORD PTR [EBP-04],00004F51
   xxxx:004075BC  JMP   004075CA
   xxxx:004075BE  MOV   DWORD PTR [EBP-04],00004F4E
   xxxx:004075C5  JMP   004075CA
   xxxx:004075C7  MOV   ESI,[EBP-08]
   xxxx:004075CA  XOR   EBX,EBX
   xxxx:004075CC  CMP   [EBP-04],EBX    <-- ±È½Ï EBX Óë [EBP-04]
   xxxx:004075CF  JNZ   00407632        <-- ²»Ò»Ñù¾ÍÌøÖÁ´íÎóÐÅÏ¢£¡

   ÎÒÊÔͼ°Ñ JNZ 00407632 ¸Ä³É JZ 
00407632£¬ÈÔÈ»²»ÐУ¬²¢ÇÒÿһ´Î¶¼¸Ä»úеÂ룬ÓÐЩÑá¾ëÁË£¡ºÃ£¬Õâ´Î¾Í¾ö¶¨×·×¢²áX°É£¡
   CALL 00407CD2 Ê®·Ö¿ÉÒÉ£¬ÓпÉÄÜÊǼÆËã EBX ºÍ [EBP-04] ÖµµÄ¡£ÉèÏÂÖжϵ㣨Óû¬Êó 
Double Click »òÕß°´ F9£©ºó£¬È»ºóÖØÐÂÖ´ÐгÌÐòÒ»´Î¡£

6£©ÖØÐÂÖ´ÐгÌÐòºó£¬Äã»á·¢ÏÖ CALL 00407CD2 ÒѾ­±»Ìø¹ýÁË¡£³ÌÐò½«»áÌøÖÁ 
xxxx:004075BE¡£Ã»¹Øϵ£¬ÔÙÍùÉÏÕÒ¿´ÄÇÒ»ÐÐÌøÖÁ xxxx:004075BE¡£ÈçÏ£º

   xxxx:00407579  PUSH  EAX
   xxxx:0040757A  CALL  00407A15         <-- ·Ç³£µÄ½Ó½üÁË£¬¸Ï¿ìÉèÏÂÖжϵã°É£¡
   xxxx:0040757F  TEST  AX,AX
   xxxx:00407582  JZ    004075BE         <-- ÕâÐоÍÊÇÌøÖÁµÚÎå²½ÖèµÄÁË
   xxxx:00407584  CMP   DWORD PTR [EBP-08],00

   È»ºóÔÙÖØÐÂ×¢²á³ÌÐò¡£

7£©À¹Ïºó£¬Ï BD * £¬°´ F8 Ò»´Î×·Èë CALL 00407A15¡£Ð¡Ðĵİ´ F10 Ö±ÖÁ¼ýÍ·ËùÖ¸£º
   xxxx:00407ACE  CALL  0040C4D0
   xxxx:00407AD3  ADD   ESP,0C
   xxxx:00407AD6  CMP   EAX,[EBP+14]    <-- ÔÚÕâÐÐÍ£Ö¹°´ F10£¬ÒòΪĿ±êµ½´ïÁË£¡
   xxxx:00407AD9  JNZ   00407C40

   Ö´ÐÐÖÁ xxxx:00407AD6 ʱ£¬×¢ÒâÓÒÉϽǣ¨Register Window£©Ç³À¶É«µÄÊý×Ö 
ss:0066F338:00398DF4¡£ºÃ£¡Ö»ÒªÓà ? 00398DF4£¬¾Í¿ÉÒÔ¿´µ½ÕæÕýµÄ×¢²áÂëÀ²£¡

   »òÕßÊÇÓà d ebp+14£¬È»ºó×¢Òâ Code Window µÄÖµ£¬ÈçÏ£º

   xxxx:0066F338  F4 8D 39 00 10 F4 ?? ??-?? ?? ?? ?? ?? ?? ?? ??

   °Ñ 00 ÒÔÇ°µÄÊý×Ö·­×ª¹ýÀ´£¬ÔÙÓà ? 398DF4£¬Ò²¿ÉÒÔ¼ÆËã³ö×¢²áÂë¡£:)

   PS: [EBP+14] ÊÇÖ¸ EBP+14 µÄÖµ£¬Ã»ÓÐ [] µÄ EBP+14 ÊÇÖ¸ address¡£

8£©×îááÕûÀíÒ»ÏÂ×¢²áÂ룺
  Èí¼þ£ºCookie Pal v1.1b
  Ãû×Ö£ºFiller
  ϵºÅ£º3771892

---------------------------------------------
ÆƽâÐÂÊÖ
Filler  -  cpy@geocities.com
---------------------------------------------