<5>.
09号patch
似乎是一个check模块
检查3721部件是否正常(校验码是否正确)
否则会从3721的网站download安装程序重新安装
(url=http://user.3721.com/soft/patch09.htm?fb=0
和http://user.3721.com/soft/patch09.htm?fb=1
)
(可能针对某些清理软件的破坏)
<6>.
10号patch
日期 12/10/04 11:07:21
同样是一个check模块
会检查3721的组件是否正常,若被破坏,则自动释放出patch10.exe(包含在DLL资源中)并执行
部分代码:
push offset s_SAssist3721 ; "%sassist3721"
lea eax, [ebp+var_568]
push edi ; size_t
push eax ; char *
call ebx ; _snprintf
push esi
push offset s_SAssistRepair ; "%sassistrepair.dll"
lea eax, [ebp+pszPath]
push edi ; size_t
push eax ; char *
call ebx ; _snprintf
add esp, 20h
lea eax, [ebp+pszPath]
push eax ; pszPath
call ds:PathFileExistsA
;检查上面几个dll是否存在
test eax, eax
jz loc_100022D3
lea eax, [ebp+Buffer]
push eax
push offset s_SPatch10_exe ; "%spatch10.exe"
lea eax, [ebp+FileName]
push edi ; size_t
push eax ; char *
call ebx ; _snprintf
add esp, 10h
lea eax, [ebp+FileName]
push eax ; lpFileName
...............
................
lea eax, [ebp+hObject]
push eax ; lpProcessInformation
lea eax, [ebp+StartupInfo]
push eax ; lpStartupInfo
push esi ; lpCurrentDirectory
push esi ; lpEnvironment
push esi ; dwCreationFlags
push esi ; bInheritHandles
push esi ; lpThreadAttributes
lea eax, [ebp+CommandLine]
push esi ; lpProcessAttributes
push eax ; lpCommandLine
push esi ; lpApplicationName
call ds:CreateProcessA
;执行patch10.exe
cmp [ebp+hObject], esi
mov edi, ds:CloseHandle
jz short loc_100022C9
;释放并执行patch10.exe
patch10.exe实际上是一个downloader(下载者),会从
http://download.3721.com/download/asrepair.cab?t=%d
下载3721恢复包 恢复被清除的3721
网友评论