QQ Game 游戏多开破解
我很少写逆向方面的文章。今天也科普一把。很简单的。
目标：QQ 2006 正式版中捆绑的QQ game ，使它能开多个。
一边斗地主，一边双扣， 不亦乐乎。
OD 载入。跟了一段，发现目标代码在 Utility.dll 里
011B1C2A |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; /MutexName = "QQGame_Mutex03/01/2003"
011B1C2D |. 6A 01 PUSH 1 ; |
011B1C2F |. 5F POP EDI ; |
011B1C30 |. 57 PUSH EDI ; |InitialOwner => TRUE
011B1C31 |. 6A 00 PUSH 0 ; |pSecurity = NULL
011B1C33 |. FF15 08401B01 CALL DWORD PTR DS:[<&KERNEL32.CreateMute>; CreateMutexA
011B1C39 |. 85C0 TEST EAX,EAX
011B1C3B |. 8946 44 MOV DWORD PTR DS:[ESI+44],EAX
011B1C3E |. 74 24 JE SHORT Utility.011B1C64
011B1C40 |. FF15 24401B01 CALL DWORD PTR DS:[<&KERNEL32.GetLastErr>; [GetLastError
011B1C46 3D B7000000 CMP EAX,0B7
011B1C4B |. 8BCE MOV ECX,ESI
011B1C4D |. 75 07 JNZ SHORT Utility.011B1C56
011B1C4F |. E8 60000000 CALL Utility.011B1CB4 ;
|
|
|
011B1CB4 /$ 53 PUSH EBX ;|<-----------|
011B1CB5 |. 56 PUSH ESI
011B1CB6 |. 8BF1 MOV ESI,ECX
011B1CB8 |. 33DB XOR EBX,EBX
011B1CBA |. 57 PUSH EDI
011B1CBB |. 53 PUSH EBX ; /Title => NULL
011B1CBC |. 8D86 50010000 LEA EAX,DWORD PTR DS:[ESI+150] ; |
011B1CC2 |. 50 PUSH EAX ; |Class
011B1CC3 |. 53 PUSH EBX ; |hAfterWnd => NULL
011B1CC4 |. 53 PUSH EBX ; |hParent => NULL
011B1CC5 |. FF15 88401B01 CALL DWORD PTR DS:[<&USER32.FindWindowEx>; FindWindowExA
011B1CCB |. 8BF8 MOV EDI,EAX
011B1CCD |. 57 PUSH EDI ; /hWnd
011B1CCE |. FF15 A8401B01 CALL DWORD PTR DS:[<&USER32.IsWindow>] ; IsWindow
011B1CD4 |. 85C0 TEST EAX,EAX
011B1CD6 74 0E JE SHORT Utility.011B1CE6
011B1CD8 |. 53 PUSH EBX ; /lParam => 0
011B1CD9 |. 53 PUSH EBX ; |wParam => 0
011B1CDA |. FF76 48 PUSH DWORD PTR DS:[ESI+48] ; |Message
011B1CDD |. 57 PUSH EDI ; |hWnd
011B1CDE |. FF15 AC401B01 CALL DWORD PTR DS:[<&USER32.PostMessageA>; PostMessageA
011B1CE4 |. EB 10 JMP SHORT Utility.011B1CF6
011B1CE6 |> 83C6 14 ADD ESI,14
011B1CE9 |. 68 48511B01 PUSH Utility.011B5148
011B1CEE |. 56 PUSH ESI
011B1CEF |. E8 580C0000 CALL Utility.011B294C
011B1CF4 |. 59 POP ECX
011B1CF5 |. 59 POP ECX
011B1CF6 |> 5F POP EDI
011B1CF7 |. 5E POP ESI
011B1CF8 |. 5B POP EBX
011B1CF9 . C3 RETN
类c代码如下：
function 011B1CB4{
HWND hQQGame = FindWindowEx(NULL, NULL, "QQGame_MainFrame", NULL);
if (IsWindow(hQQGame))
PostMessageA(hQQGame,1F86, 0, 0);
}
HANDLE hMutex = CreateMutexA(NULL, TRUE, "QQGame_Mutex03/01/2003");
if (hMutex == NULL)
{
jmp SHORT Utility.011B1C64
}
else
{
if (GetLastError() == ERROR_ALREADY_EXISTS)
CALL Utility.011B1CB4
else jmp Utility.011B1C56
}
破解：011B1C46 3D B7000000 CMP EAX,0B7 把这里的0B7 随便改个值就可以了
