[Ô­´´](¹ÂÕíÄÑÃß)½«¶íÂÞ˹Æƽâ¼ÓÈëWIN-XP°²×°ÅÌ

---

¾«»ªÐòºÅ£º129
À´×ÔÂÛ̳£ºÐ¡ÐÜÔÚÏß ¡¶Èí¼þÂÛ̳¡·
ÄÚÈÝ˵Ã÷£º[Ô­´´]½«¶íÂÞ˹×îеÄ401111µç»°¼¤»îÆƽâÕûºÏ½øÒѼ¯³ÉSP1aµÄWindows XP°²×°¹âÅÌÖС£*****תÌùÇë×¢Ã÷ת×

---

• ¡ò [Ô­´´]½«¶íÂÞ˹×îеÄ401111µç»°¼¤»îÆƽâÕûºÏ½øÒѼ¯³ÉSP1aµÄWindows XP°²×°¹âÅÌÖÐ(3374×Ö) (¹ÂÕíÄÑÃß) (208291)ÓÚ2003/03/13(23:11:04)..

[Ô­´´]½«¶íÂÞ˹×îеÄ401111µç»°¼¤»îÆƽâÕûºÏ½øÒѼ¯³ÉSP1aµÄWindows XP°²×°¹âÅÌÖС£
*****תÌùÇë×¢Ã÷ת×Ô¡¶Ð¡ÐÜÂÛ̳--Èí¼þÂÛ̳¡·http://www2.beareyes.com.cn/bbs/2.htm ÓÉÐÜÓÑ ¹ÂÕÆÄÑÃù Ô­´´*****
1¡¢Ê×ÏÈ×¼±¸ºÃÔ­°æµÄWindows XP°²×°¹âÅÌ£¬È¥Î¢ÈíµÄÍøÕ¾ÏÂÔØÏÖÓеÄ×îеÄSP1aµÄ²¹¶¡³ÌÐòxpsp1a_cn_86.exe¡£
2¡¢ÏÈ°²×°ºÃûÓÐÆƽâµÄWindows XP£¬È»ºó°²×°SP1a²¹¶¡¡££¨ÓÉÓÚаæµÄµç»°¼¤»îÆƽâºÍSAD TEAMµÄÄǸöV4°æÆƽâ½è¼øµÄÆƽâ³ÌÐò·½Ê½²»Í¬£¬Ëü±ØÐëÔÚÔ­ÓÐÎļþµÄ»ù´¡ÉϽøÐÐÐ޸ģ¬ËùÒÔ±ØÐëÏÈÉý¼¶¡££©
3¡¢½«Ô­°æWindows XP¹âÅÌÉÏËùÓеÄÎļþºÍÎļþ¼Ð¿½µ½Ó²ÅÌÉϵÄÒ»¸öÎļþ¼ÐÀïÃ棬¼ÙÉèΪE:\WINXP
½«xpsp1a_cn_86.exeÒ²·ÅÖÃÔÚÓ²ÅÌÉÏ£¬¼ÙÉèΪE:\xpsp1a_cn_86.exe¡££¨·ÅÔÚ²»Í¬·ÖÇøÓ¦¸ÃÒ²¿ÉÒÔ£¬²»¹ýÎÒºÃÏóҲûÓÐÊÔ¹ý¡££©
4¡¢ÔÚ¡°¿ªÊ¼¡±£­¡°ÔËÐС±µÄÀïÊäÈë¡°E:\xpsp1a_cn_86 /s:E:\WINXP¡±£¬¼¸·ÖÖӺ󼯳ÉÍê±Ï¡££¨Ò²ÓÐÆäËû¼¯³É·½·¨£¬µ«Ïà¶Ô¶øÑÔÕâÖÖ×î¼òµ¥¡££©
5¡¢½«X:\WINDOWS\SYSTEM32£¨XΪXPϵͳËù°²×°µÄÅÌ£©½«WINLOGON.EXEºÍLICDLL.DLL¿½±´³öÀ´¡££¨ÕâÊÇΪÁ˱£ÁôԭʼµÄÎļþ£¬Èç¹ûÄã¶ÔÆƽâ¹ý³Ì²»¸ÐÐËȤµÄ»°£¬´Ë²½ÇëÂÔ¹ý²»¿´¡££©
6¡¢ÏÖÔÚ½øÐ줻îÆƽ⣺
Æô¶¯Ê±°´ÏÂF8½øÈ밲ȫģʽ£¬ÒÔAdministratorÉí·ÝÔËÐÐÆƽ⹤¾ß winxp_crk.exe £¬ÖØÆô½øÈëÕý³£Ä£Ê½¡££¨´ËʱÒÑ¿ÉÒÔÓÃ401111µç»°¼¤»î£¬°´Îҵľ­Ñ飬ÔÚFAT32µÄ·ÖÇø¸ñʽÏ£¬ÕâЩ¶¼ÊÇÀË·Ñ£¬ÔÚÕý³£Ä£Ê½ÏÂÒÔAdministratorÉí·ÝÔËÐÐÆƽ⹤¾ß winxp_crk.exe Ò»Ñù¿ÉÒÔ£¬ÏµÍ³±¨¸æÖØÒªÎļþ±»¸Äд£¬²»ÀíËü¾ÍÐÐÁË£¬²»ÓÃÖØÆô¾Í¿ÉÒÔÓÃ401111½øÐе绰¼¤»îÁË¡££©
7¡¢½«X:\WINDOWS\SYSTEM32£¨XΪXPϵͳËù°²×°µÄÅÌ£©½«WINLOGON.EXEºÍLICDLL.DLL¿½±´³öÀ´¡££¨ÏÂÃæµÄÆƽâ¾ÍÔÚÕâÁ½¸öÎļþÉÏÏÂÊÖÁË¡£
*****תÌùÇë×¢Ã÷ת×Ô¡¶Ð¡ÐÜÂÛ̳--Èí¼þÂÛ̳¡·http://www2.beareyes.com.cn/bbs/2.htm ÓÉÐÜÓÑ ¹ÂÕÆÄÑÃù Ô­´´*****
8¡¢£¨ÕâÒ»²½Ïêϸ½éÉÜÆƽâ¹ý³Ì£¬²»¸ÐÐËȤµÄ»°£¬ÇëÂÔ¹ý²»¿´¡££©
±È½ÏÆƽâÇ°ºóµÄWINLOGON.EXE£¬µÃµ½ÈçϽá¹û£º
0006263B: 77 90
0006263C: 0C 90
00062699: 74 90
0006269A: 0C 90
000626C4: 74 90
000626C5: 0C 90
00062701: 74 90
00062702: 0C 90
00062741: 74 90
00062742: 0C 90
0006277E: 74 90
0006277F: 0C 90
000628EF: 77 90
000628F0: 0C 90
000628FB: EB BB
000628FC: 0A 01
000628FD: C7 00
000628FE: 85 00
000628FF: 94 00
00062900: FE 90
00062901: FF 90
00062902: FF 90
00062903: 00 90
00062904: 00 90
00062905: 00 90
00062906: 00 90
00063346: 74 90
00063347: 0C 90
00063393: 74 90
00063394: 0C 90
0006345A: 74 90
0006345B: 0C 90
000634C1: 74 90
000634C2: 0C 90
±È½ÏÆƽâÇ°ºóµÄLICDLL.DLL£¬µÃµ½ÈçϽá¹û£º
000403C9: 77 90
000403CA: 0C 90
00040427: 74 90
00040428: 0C 90
00040452: 74 90
00040453: 0C 90
0004048F: 74 90
00040490: 0C 90
000404CF: 74 90
000404D0: 0C 90
0004050C: 74 90
0004050D: 0C 90
0004067D: 77 90
0004067E: 0C 90
00040689: EB BB
0004068A: 0A 01
0004068B: C7 00
0004068C: 85 00
0004068D: 94 00
0004068E: FE 90
0004068F: FF 90
00040690: FF 90
00040691: 00 90
00040692: 00 90
00040693: 00 90
00040694: 00 90
000410D4: 74 90
000410D5: 0C 90
00041121: 74 90
00041122: 0C 90
000411E8: 74 90
000411E9: 0C 90
0004124F: 74 90
00041250: 0C 90
¿ÉÒÔ¿´µ½³ýλÖò»Í¬Í⣬±»ÆƽâµÄÄÚÈÝ¿ÉÒÔ˵ÊÇһģһÑù¡£
Èç¹ûÄã²»×ö¸ü½øÒ»²½µÄ¹¤×÷£¬Ö±½ÓÌøµ½µÚ10²½£¬ÔÚÄã×îºó°²×°µÄʱºò£¬XPµÄ°²×°³ÌÐò»á·¢ÏÖÄãÐÞ¸ÄÁËÕâÁ½¸öÎļþ£¬²¢±¨´íÍ£ÏÂÀ´£¬Èç¹ûÄã°´ESCÌø¹ý£¬µ¹ÊÇ¿ÉÒÔÕý³£×°µ½½áÊø£¬²¢Õý³£ÓÃ401111Æƽ⼤»î£¬²»¹ýÎÒÏëË­¶¼²»»á¿Ï³ÐÈÏÕâÊÇÍêÃÀµÄÆƽ⡣ÒýÓÃÔ­À´V4°æÆƽⷽ·¨ÀïµÄÒ»¶Î½éÉÜ£º
*****תÌùÇë×¢Ã÷ת×Ô¡¶Ð¡ÐÜÂÛ̳--Èí¼þÂÛ̳¡·http://www2.beareyes.com.cn/bbs/2.htm ÓÉÐÜÓÑ ¹ÂÕÆÄÑÃù Ô­´´*****
[ÒýÓÃ]
ÓÃUltraEdit-32´ò¿ªwinlogon.exe£¨ÒªÔ­°æ£©
1¡¢ÓÃÈȼü Ctrl+G
¡¡¡¡¡¡¡¡¡¡ÊäÈë 0x39662h
¡¡¡¡¡¡¡¡¡¡enter(»Ø³µ)
¡¡¡¡¡¡¡¡¡¡ÐÞ¸Ä ÒÔÏ嵀 16½øÖÆ ´úÂë¡¡
¡¡¡¡¡¡¡¡¡¡°Ñ¡¡¡¡ 8B D1 57 33 C0 89 02 89 42 08
¡¡¡¡¡¡¡¡¡¡¸ÄΪ¡¡ C7 06 01 00 00 00 83 EE 04 C3¡¡¼´¿É
2¡¢ÐÞÕýchecksum£¬ÔÚµØÖ·0x158h£¨Ê®½øÖÆ344£©´¦
¡¡¡¡¡¡¡¡¡¡°Ñ¡¡¡¡ D2 6E
¡¡¡¡¡¡¡¡¡¡¸Ä³É¡¡ 3B 07
¹ØÓÚChecksum£º
ÔÚwinnt.hÖйØÓÚPEÎļþÍ·µÄ¶¨Ò壺
typedef struct _IMAGE_NT_HEADERS
{
¡¡¡¡DWORD Signature;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//PEÎļþÍ·±êÖ¾ £º¡°PE\0\0¡±¡£ÔÚ¿ªÊ¼DOS headerµÄÆ«ÒÆ3CH´¦ËùÖ¸ÏòµÄµØÖ·¿ªÊ¼
¡¡¡¡IMAGE_FILE_HEADER FileHeader;¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //PEÎļþÎïÀí·Ö²¼µÄÐÅÏ¢
¡¡¡¡IMAGE_OPTIONAL_HEADER32 OptionalHeader;¡¡¡¡ //PEÎļþÂß¼­·Ö²¼µÄÐÅÏ¢
}IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
typedef struct _IMAGE_FILE_HEADER
{
¡¡¡¡WORD¡¡¡¡Machine;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//¸ÃÎļþÔËÐÐËùÐèÒªµÄCPU£¬¶ÔÓÚIntelƽ̨ÊÇ14Ch
¡¡¡¡WORD¡¡¡¡NumberOfSections;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //ÎļþµÄ½ÚÊýÄ¿
¡¡¡¡DWORD¡¡ TimeDateStamp;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//Îļþ´´½¨ÈÕÆÚºÍʱ¼ä
¡¡¡¡DWORD¡¡ PointerToSymbolTable;¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //ÓÃÓÚµ÷ÊÔ
¡¡¡¡DWORD¡¡ NumberOfSymbols;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//·ûºÅ±íÖзûºÅ¸öÊý
¡¡¡¡WORD¡¡¡¡SizeOfOptionalHeader;¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //OptionalHeader ½á¹¹´óС
¡¡¡¡WORD¡¡¡¡Characteristics;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//ÎļþÐÅÏ¢±ê¼Ç£¬Çø·ÖÎļþÊÇexe»¹ÊÇdll
}IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
typedef struct _IMAGE_OPTIONAL_HEADER
{
¡¡¡¡WORD¡¡¡¡Magic;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//±êÖ¾×Ö(×ÜÊÇ010bh)
¡¡¡¡BYTE¡¡¡¡MajorLinkerVersion;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //Á¬½ÓÆ÷°æ±¾ºÅ
¡¡¡¡BYTE¡¡¡¡MinorLinkerVersion;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //
¡¡¡¡DWORD¡¡ SizeOfCode;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //´úÂë¶Î´óС
¡¡¡¡DWORD¡¡ SizeOfInitializedData;¡¡¡¡¡¡¡¡¡¡¡¡¡¡//Òѳõʼ»¯Êý¾Ý¿é´óС
¡¡¡¡DWORD¡¡ SizeOfUninitializedData;¡¡¡¡¡¡¡¡¡¡¡¡//δ³õʼ»¯Êý¾Ý¿é´óС
¡¡¡¡DWORD¡¡ AddressOfEntryPoint;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//PE×°ÔØÆ÷×¼±¸ÔËÐеÄPEÎļþµÄµÚÒ»¸öÖ¸ÁîµÄRVA
¡¡¡¡DWORD¡¡ BaseOfCode;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //´úÂë¶ÎÆðʼRVA
¡¡¡¡DWORD¡¡ BaseOfData;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //Êý¾Ý¶ÎÆðʼRVA
¡¡¡¡DWORD¡¡ ImageBase;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//PEÎļþµÄ×°ÔصØÖ·
¡¡¡¡DWORD¡¡ SectionAlignment;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //¿é¶ÔÆë
¡¡¡¡DWORD¡¡ FileAlignment;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//Îļþ¿é¶ÔÆë
¡¡¡¡WORD¡¡¡¡MajorOperatingSystemVersion;¡¡¡¡¡¡¡¡//ËùÐè²Ù×÷ϵͳ°æ±¾ºÅ
¡¡¡¡WORD¡¡¡¡MinorOperatingSystemVersion;¡¡¡¡¡¡¡¡//
¡¡¡¡WORD¡¡¡¡MajorImageVersion;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//Óû§×Ô¶¨Òå°æ±¾ºÅ
¡¡¡¡WORD¡¡¡¡MinorImageVersion;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//
¡¡¡¡WORD¡¡¡¡MajorSubsystemVersion;¡¡¡¡¡¡¡¡¡¡¡¡¡¡//win32×Óϵͳ°æ±¾¡£ÈôPEÎļþÊÇרÃÅΪWin32Éè¼ÆµÄ
¡¡¡¡WORD¡¡¡¡MinorSubsystemVersion;¡¡¡¡¡¡¡¡¡¡¡¡¡¡//¸Ã×Óϵͳ°æ±¾±Ø¶¨ÊÇ4.0·ñÔò¶Ô»°¿ò²»»áÓÐ3άÁ¢Ìå¸Ð
¡¡¡¡DWORD¡¡ Win32VersionValue;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//±£Áô
¡¡¡¡DWORD¡¡ SizeOfImage;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//ÄÚ´æÖÐÕû¸öPEÓ³ÏñÌåµÄ³ß´ç
¡¡¡¡DWORD¡¡ SizeOfHeaders;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//ËùÓÐÍ·+½Ú±íµÄ´óС
¡¡¡¡DWORD¡¡ CheckSum;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //УÑéºÍ
¡¡¡¡WORD¡¡¡¡Subsystem;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡//NTÓÃÀ´Ê¶±ðPEÎļþÊôÓÚÄĸö×Óϵͳ
¡¡¡¡WORD¡¡¡¡DllCharacteristics;¡¡¡¡
¡¡¡¡DWORD¡¡ SizeOfStackReserve;¡¡¡¡
¡¡¡¡DWORD¡¡ SizeOfStackCommit;¡¡¡¡¡¡
¡¡¡¡DWORD¡¡ SizeOfHeapReserve;¡¡¡¡¡¡
¡¡¡¡DWORD¡¡ SizeOfHeapCommit;¡¡¡¡¡¡
¡¡¡¡DWORD¡¡ LoaderFlags;¡¡¡¡¡¡¡¡¡¡¡¡
¡¡¡¡DWORD¡¡ NumberOfRvaAndSizes;¡¡¡¡
¡¡¡¡IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
}IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
typedef struct _IMAGE_DATA_DIRECTORY
{
¡¡¡¡DWORD¡¡ VirtualAddress;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //±íµÄRVAµØÖ·
¡¡¡¡DWORD¡¡ Size;¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ //´óС
}IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
[ÒýÓýáÊø]
*****תÌùÇë×¢Ã÷ת×Ô¡¶Ð¡ÐÜÂÛ̳--Èí¼þÂÛ̳¡·http://www2.beareyes.com.cn/bbs/2.htm ÓÉÐÜÓÑ ¹ÂÕÆÄÑÃù Ô­´´*****
¿ÉÒÔ¿´µ½PEÎļþÍ·Öм䶨ÒåÁËÎļþУÑéºÍ£¬Èç¹ûÐÞ¸ÄÎļþÄÚ²¿×Ö½ÚµÄͬʱ²»ÐÞ¸ÄУÑéºÍµÄÖµ£¬WINDOWSµÄ°²×°³ÌÐò¾Í»á·¢ÏÖÎļþ±»·Ç·¨¸Äд¡£
ÓÉÓÚ²»ÖªµÀУÑéºÍµÄËã·¨£¬ÎÒÖ»ÄÜÔÚÔ­ÓÐУÑéºÍµÄÖµÉϸù¾Ý²îÁ¿½øÐÐÐÞÕýÐÔ¼ÆËã¡£ÓÉÓÚÁ½ÕßÖ®¼ä²îÁ¿¹ý´ó£¨ÔÚ16½øÖÆÏÂÓÐÎåλÊý£©£¬ÎÒ»¨ÁË6¸ö¶àСʱ£¬ÓÃÁ˲»ÏÂÊ®ÖÖ¿ÉÄܵÄËã·¨£¬Ëã³ö¸÷ÖÖ½á¹û£¬ÐÞ¸ÄÖ®ºóÔÙ°²×°£¬×ÜÊÇûÓа취ƭ¹ýXPµÄ°²×°³ÌÐò¡£
×îºóÔÚ½üºõ¾øÍûµÄÇé¿öÏ£¬ÎÒͨ¹ýexeScopeÕâ¸öÈí¼þ·¢ÏÖÓÐЩÆäËû³ÌÐòÎļþµÄУÑéºÍ¾¹È»ÊÇ0£¬ÎÒÁé¹âÒ»ÉÁ£¬½«ÕâÁ½¸öÎļþµÄУÑéºÍλȫ²¿Çå0£¬È»ºó×öµÚ10²½²¢¼ÌÐø£¬ÖÕÓÚÆæ¼£³öÏÖÁË£¬ÎÒÆ­¹ýÁË΢ÈíµÄ°²×°³ÌÐò£¬Ë³ÀûµÄ²»±¨´íµÄ°²×°ºÃÁËXP£¬²¢ÇÒÕý³£µÄͨ¹ý401111¼¤»îÁË¡£
WINLOGON.EXE µÄУÑéºÍλÊÇ0x150h¿ªÊ¼µÄÈý¸ö×Ö½Ú¡£
LICDLL.DLL µÄУÑéºÍλÊÇ0x160h¿ªÊ¼µÄÈý¸ö×Ö½Ú¡£
¾ßÌåµÄÐ޸ķ½·¨ÈçµÚ9²½Ëù˵¡£

• ¡ò ¼ÌÐø(1085×Ö) (¹ÂÕíÄÑÃß) (208292)ÓÚ2003/03/13(23:11:47)..


9¡¢ÓÃUltraEdit-32´ò¿ªwinlogon.exe£¨¾ÍÊÇÆƽâºóµÄÄǸö£©
ÔÚµØÖ·0x150h£¨Ê®½øÖÆ336£©´¦
¡¡¡¡¡¡¡¡¡¡°Ñ¡¡¡¡ 29 77 08
¡¡¡¡¡¡¡¡¡¡¸Ä³É¡¡ 00 00 00
±£´æ
ÓÃUltraEdit-32´ò¿ªlicdll.dll£¨Ò²ÊÇÆƽâºóµÄÄǸö£©
ÔÚµØÖ·0x160h£¨Ê®½øÖÆ352£©´¦
¡¡¡¡¡¡¡¡¡¡°Ñ¡¡¡¡ E9 63 06
¡¡¡¡¡¡¡¡¡¡¸Ä³É¡¡ 00 00 00
±£´æ
²»ÒªÐ¡¿´Õâ12¸ö0£¬Ëû¿É»¨·ÑÁËÎÒÁù¸ö¶àСʱµÄʱ¼ä°¡
*****תÌùÇë×¢Ã÷ת×Ô¡¶Ð¡ÐÜÂÛ̳--Èí¼þÂÛ̳¡·http://www2.beareyes.com.cn/bbs/2.htm ÓÉÐÜÓÑ ¹ÂÕÆÄÑÃù Ô­´´*****
10¡¢ÓÃcabarc.exe°ÑÐ޸ĹýµÄÁ½¸öÎļþѹËõ³ÉWINLOGON.EX_ºÍLICDLL.DL_¡£
¾ßÌåÃüÁîÈçÏÂ
cabarc -m lzx:21 n winlogon.ex_ winlogon.exe
cabarc -m lzx:21 n licdll.dl_ licdll.dll
cabarc.exe³ÌÐò¿ÉÒÔÔÚWindows XPµÄ¹âÅÌϵÄSUPPORT\TOOLS\SUPPORT.CABÕâ¸öѹËõ°üÀïÕÒµ½¡£
11¡¢°ÑѹËõºÃµÄÕâÁ½¸öÎļþ¿½±´µ½E:\WINXP\I386Îļþ¼ÐÏ£¬Ìæ»»µôÏàÓ¦µÄÎļþ¡£
12¡¢Èç¹û´ÓÓ²ÅÌ°²×°ÕâÑù¾Í¿ÉÒÔÁË£¬ÔÚDOSÔËÐйýSMARTDRV.EXEÖ®ºóÔËÐÐE:\WINXP\I386Îļþ¼ÐϵÄWINNT.EXE£¬Ö±µ½°²×°½áÊø°²×°³ÌÐò²»»á±¨´í£¬°²×°Íê±ÏºóÑ¡Ôñµç»°¼¤»î£¬ÊäÈë401111Ö±½Ó¼¤»î³É¹¦¡£
Èç¹ûÒª¿Ì³É¹âÅÌ£¬Ç¿ÁÒ½¨ÒéʹÓÃCDIMAGEÖÆ×÷¹âÅ̾µÏñÎļþºóÔÙ¿Ì¡£ÄãÃÇÒ²¿ÉÒÔÓÃCDIMAGEGUIÀ´×ö£¬²»¹ýÎҾͲ»ºÃ½âÊÍÁË£¬ËùÒÔÎÒ»¹ÊÇÓÃÕâ¸öÀ´½éÉÜ¡£ÃüÁîÈçÏ£º
cdimage.exe -l"WXPFPPSP1A_CN" -t09/20/2001,20:00:00 -h -n -b"E:\XPBOOT.BIN" -o -y5 -m "E:\WINXP" "E:\WINXP.ISO"
ÆäÖÐE:\XPBOOT.BINΪWindows XP¹âÅ̵ÄÒýµ¼ÐÅÏ¢Îļþ£¬Èç¹ûÄã²»ÖªµÀÔõÑù´Ó¹âÅÌÖлñÈ¡µÄ»°£¬ºóÃæÎÒ¿ÉÒÔÌṩÕâ¸öÎļþ£¬¾ßÌå´Ó¹âÅÌÖлñÈ¡µÄ·½·¨¾Í²»¶à˵ÁË¡£
×öºÃµÄ¹âÅ̾µÏñÎļþÊÇE:\WINXP.ISO£¬ÓùâÅ̼̿³ÌÐò°ÑËû¿Ìµ½¹âÅÌÉϾ͸㶨ÁË£¬²»¹ý¿Ì¼µÄʱºò¼ÇµÃÑ¡Ôñ¡°DAO£¨¹âÅÌÒ»´ÎÉÕ¼£©·½Ê½¡±£¬²»È»ÓÐЩÎļþ²»ºÃ¶Á²»ÒªÕÒÎÒ¡£×îºÃÊÇÓÃNERO¿Ì£¬·´ÕýÎÒÊÇÓÃËû¿ÌµÄ¡£
ÎÒ½«ÌṩÒÔÏÂÎļþ
WINLOGON.EX_
LICDLL.DL_ £¨ÉÏÃæÁ½¸öÎļþ¿½ÈëÒѼ¯³ÉSP1AµÄXPµÄ°²×°Îļþ¼ÐµÄI386Îļþ¼ÐÏ£©
XPBOOT.BIN £¨Õâ¸öÎļþÊǿ̹âÅÌʱҪÓõ½µÄXP°²×°¹âÅ̵ÄÆô¶¯ÐÅÏ¢Îļþ£©
WINNT.NIF £¨ÕâÊÇÒ»¸ö×Ô¶¯°²×°µÄÓ¦´ðÎļþ£¬Äã¿ÉÒÔ°ÑËû¿½ÈëI386Ŀ¼²¢¿ÌÈë¹âÅÌ£¬Óñ¾¹âÅÌÆô¶¯ºó¾ÍÄÜ×Ô¶¯°²×°£¬Ò²¿ÉÒÔ¿½ÈëÒ»ÕÅÈíÅ̵ĸùĿ¼£¬Óñ¾¹âÅÌÆô¶¯°²×°Ê±£¬°ÑÈíÅÌ·ÅÔÚÈíÇýÀïÒ²Äܹ»×Ô¶¯°²×°£¬²»Ïë×Ô¶¯°²×°Ê±²»°ÑÈíÅÌ·ÅÈë¾Í¿ÉÒÔÁË£©
³õ²½×¼±¸ÏÈ·ÅÔÚ³£À´ÐÖµÄFTPÉÏ£¬»¶Ó­ÆäËûÐÜÓÑ·ÖÁ÷£¬ÍêÕûµÄ¹âÅ̾µÏñÓÉÓÚÉÏ´«ÐèҪʱ¼ä£¬¿´À´µÃµÈÒ»Á½ÌìÁË¡£»¹ÓÐһЩϸ֦ĩ½ÚµÄÎÊÌâûÓÐ̸µÄºÜ×Ðϸ£¬¿´²»¶®µÄ»°ÔÙÎÊ¡£
*****תÌùÇë×¢Ã÷ת×Ô¡¶Ð¡ÐÜÂÛ̳--Èí¼þÂÛ̳¡·http://www2.beareyes.com.cn/bbs/2.htm ÓÉÐÜÓÑ ¹ÂÕÆÄÑÃù Ô­´´*****

• ¡ò ÄѵÀÓÖÊÇ·þÎñÆ÷»Øµµ£¬ÔõôÎҵĸúÌù¶¼Ã»ÁË£¬ÐÞÕýÒ»¸öÎÞÉË´óÑŵÄС´íÎó(86×Ö) (¹ÂÕíÄÑÃß) (208322)ÓÚ2003/03/14(00:12:55)..

Èç¹ûÏëÈùâÅÌÉϵÄÎļþµÄʱ¼äºÍÔ­À´Ô­°æµÄXPÒ»ÑùµÄ»°µÚ12²½¸ÄÓÃÕâÒ»¾ä¡£
cdimage.exe -l"WXPFPPSP1A_CN" -t09/05/2001,12:00:00 -h -n -b"E:\XPBOOT.BIN" -o -y5 -m "E:\WINXP" "E:\WINXP.ISO"

• ÐÖÊÇÔõôÕÒµ½ÕâЩҪÐ޸ĵĵØÖ·µÄ£¿ÓÃʲô·ÖÎöµÄ£¬ÊDz»ÊÇ·´±àÒë¹ýÁË¡£(¿Õ) tti (208337)ÓÚ2003/03/14(00:43:08)..

• ¡ò ûÓУ¬ÕæµÄ·´±àÒëÁ˹ýÀ´£¬ÎÒÒ²¿´²»¶®¡£(125×Ö) (¹ÂÕíÄÑÃß) (208339)ÓÚ2003/03/14(01:15:55)..

ÔÚÎÒÉÏÃæÒýÓõIJ¿·ÖÀд³öÁËÄǸöÎļþµÄÎļþÒªÐ޸ĵÄλÖã¬ÎҾʹò¿ªÄǸöÎļþ¿´ÁË¿´à¶£¬ÔÚÒªÐ޸ĵÄλÖÃÏòÇ°20¸ö×Ö½Ú´¦ÓÐCS×ÖÑùµÄ×Ö·û£¬´ò¿ªÕâ¸öÎļþ·¢ÏÖͬÑùλÖõÄÊý¾ÝÏÔÈ»²»ÊÇУÑéºÍ£¬µ«ÊǸ½½üÓÖ¿´¼ûÁËCS×ÖÑùµÄ×Ö·û£¬ÄǾÍ˳×ÅÊý20¸ö×Ö·ûඡ£
ÓÐЩʱºò¾ÍÊÇ¿¿¹À²ÂµÄ¡£

• °²×°Ë³ÀûÍê³É£¡¼¤»î˳Àû£¡(20×Ö) Õã½­¿á¿á (208340)ÓÚ2003/03/14(01:22:57)..

Äܵ½Î¢ÈíÍøÕ¾Éý¼¶..²»¹ýÌýµ½·´±àÒë...¾Í...

• ¡ò ÎҰѾµÏñÎļþ´«µ½ÄãÄÇÀï°É£¬ºÃÂð£¿(¿Õ) (¹ÂÕíÄÑÃß) (208342)ÓÚ2003/03/14(01:49:34)..

• ¡ò ллÐֵIJâÊÔ£¬²»¹ýţţ»¹Ã»µÈ²âÊÔ¾ÍÒѾ­°ÑÎÒµÄÌû×Ó¼ÓÈ뾫»ªÇøÁË¡£(¿Õ) (¹ÂÕíÄÑÃß) (208341)ÓÚ2003/03/14(01:35:56)..

• STOP!(43×Ö) Õã½­¿á¿á (208343)ÓÚ2003/03/14(01:50:43)..

ÌáʾÎļþ±»Ìæ»»³ÉÎÞ·¨Ê¶±ðµÄ°æ±¾ÒªÇó²åÈëSP1¹âÅÌ.......tti£¡ÄãÄܲ»ÄÜÍê³É·´±àÒ빤×÷£¿£¿£¡£¡

• ¡ò Äã¸ÉÁËʲôÁË£¿£¿£¿(¿Õ) (¹ÂÕíÄÑÃß) (208345)ÓÚ2003/03/14(01:51:50)..

• Ö»²é¿´ÁËRUNDLLºÍLO...Á½¸öÎļþµÄÊôÐÔ£¡(¿Õ) Õã½­¿á¿á (208347)ÓÚ2003/03/14(01:53:04)..

• ¡ò ÄãÊÇ˵Äã²é¿´ÁËWINLOGON.EXEºÍLICDLL.DLLµÄÊôÐÔ£¿ÕâÎÒµÄȷûÓÐÊÔ¹ý£¬²»¹ýÎÒÏë²»ÀíËû²»»áÓÐʵġ£(¿Õ) (¹ÂÕíÄÑÃß) (208350)ÓÚ2003/03/14(01:55:46)..

• NO£¡ÒÔÇ°°²×°MAC²å¼þ£­×ÀÃæÖ÷Ì⣨Ìæ»»Á˴󲿷ֵÄÎļþ£©(42×Ö) Õã½­¿á¿á (208353)ÓÚ2003/03/14(02:00:57)..

ʱ²»Ê±µÄ»áÌáʾ²åÈëSP1ÒÔ»¹Ô­.DLL
ÎÒÏëÕâÓ¦¸ÃÒ²»áÌáʾ£¡µ«ÊÇ´ÎÊý²»¶à£¡²»»áºÜÂé·³£¡£¡

• ¡ò ¿´À´ÒªÓÃʱ¼äÀ´¿¼ÑéÁË¡£(¿Õ) (¹ÂÕíÄÑÃß) (208356)ÓÚ2003/03/14(02:03:45)..

• Ò²ÐíÊÇżȻ£¡ÄãÕÕ³£·¢²¼£¡(11×Ö) Õã½­¿á¿á (208360)ÓÚ2003/03/14(02:08:36)..

żÏȲâÊÔ1ÐÇÆÚÔÙ˵¡«£¡£¡

---

±¾ÂÛ̳ÓÉСÐÜÔÚÏߣ¨www.beareyes.com£©joytÖÆ×÷¼°Î¬»¤