关于【CSDN免积分下载器】的分析

刚开始以为是CSDN爆出后门了啥的，免积分，那不是越权XX啥都有了，后来才看到这个帖子：http://topic.csdn.net/u/20111021/14/1fc7f1d7-2cd5-49e1-9750-530e99f90129.html

切入正题：

1，PEID查为Microsoft Visual C++ 6.0

2，字符串搜索：

超级字串参考
地址 反汇编 文本字串
00401092 push 13222453.00407AA8 开始执行程序执，共6步,目前执行第1步...
004010BB push 13222453.00407AA0 错误
004010C0 push 13222453.00407A90 请输入资源ID!
004010F5 mov edi,13222453.004079D8 GET /csdn_action2.php?act=reg HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0E; .NET4.0C)\r\nHost: www.itziy.com\r\n\r\n
0040112D push 13222453.004079C8 www.itziy.com
00401140 push 13222453.00407AA0 错误
00401145 push 13222453.00407984 发送下载请求后程序发生错误，可能是您的网络有问题或者服务器繁忙！
0040116A push 13222453.00407978 Location:
0040117F push 13222453.00407AA0 错误
00401184 push 13222453.0040793C 您的网络状态不稳定，下载请求发送失败，请稍后重试！error：1
004011A2 push 13222453.0040791C 程序执行第1步操作完成，共6步...
004011BA push 13222453.00407918
00401242 mov edi,13222453.004078F0 GET /ajax/accounthandler.ashx?t=reg&un=
004012A3 mov edi,13222453.004078E0 &pwd=wrr717&em=
00401303 mov edi,13222453.00407860 @nepwk.com&ct=%u5317%u4EAC&sex=%u7537&job=CTO&hy=%u79FB%u52A8%u4E0E%u624B%u673A%u5E94%u7528&jy=%u5B66%u751F&cd=4bb9e HTTP/1.1\r\n
00401332 mov edi,13222453.0040783C x-requested-with: XMLHttpRequest\r\n
0040135E mov edi,13222453.00407804 Referer: http://passport.csdn.net/account/register\r\n
0040138D mov edi,13222453.004077D0 Content-Type: application/x-www-form-urlencoded\r\n
004013BC mov edi,13222453.004077AC Accept-Encoding: gzip, deflate\r\n
004013EE mov edi,13222453.00407734 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0E; .NET4.0C)\r\n
0040141A mov edi,13222453.00407718 Host: passport.csdn.net\r\n
00401449 mov edi,13222453.004076E4 Cookie: pp_vc=ZUOc76Ah2sA9PwJB%2bXwoug%3d%3d\r\n\r\n
00401481 push 13222453.004076D0 passport.csdn.net
00401494 push 13222453.00407AA0 错误
00401499 push 13222453.004076A0 发送下载请求后程序发生错误，可能是你网络问题！
004014BE push 13222453.00407698 false
004014D2 push 13222453.00407AA0 错误
004014D7 push 13222453.00407624 对不起，您的IP已经被封，请断开宽带，过会儿重先链接改变外网IP!\n如果更换IP还是不可以请上www.itziy.com看是否有更新！
004014FB push 13222453.00407604 程序执行第2步操作完成，共6步...
00401537 mov edi,13222453.004075DC GET /ajax/accounthandler.ashx?t=act&un=
00401591 mov edi,13222453.004075D0 HTTP/1.1\r\n
004015C0 mov edi,13222453.0040783C x-requested-with: XMLHttpRequest\r\n
004015F2 mov edi,13222453.0040759C Referer: http://passport.csdn.net/account/active\r\n
00401621 mov edi,13222453.004077D0 Content-Type: application/x-www-form-urlencoded\r\n
0040164D mov edi,13222453.00407734 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0E; .NET4.0C)\r\n
0040167C mov edi,13222453.00407718 Host: passport.csdn.net\r\n
004016AB mov edi,13222453.00407590 Cookie: UN=
00401708 mov edi,13222453.00407564 ; pp_vc=ZUOc76Ah2sA9PwJB%2bXwoug%3d%3d\r\n\r\n
00401740 push 13222453.004076D0 passport.csdn.net
00401753 push 13222453.00407AA0 错误
00401758 push 13222453.00407524 发送下载请求后程序发生错误，最大可能是您的网络不稳定等问题！
004017A2 mov edi,13222453.004074FC GET /csdn_action2.php?act=chk&e_addr=
00401805 mov edi,13222453.004074F0 &e_cookie=
0040185E mov edi,13222453.00407458 HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0E; .NET4.0C)\r\nHost: www.itziy.com\r\n\r\n
0040189D push 13222453.004079C8 www.itziy.com
004018B0 push 13222453.00407AA0 错误
004018B5 push 13222453.00407984 发送下载请求后程序发生错误，可能是您的网络有问题或者服务器繁忙！
004018DA push 13222453.00407978 Location:
004018EF push 13222453.00407AA0 错误
004018F4 push 13222453.0040741C 您的网络状态不稳定，下载请求发送失败，请稍后重试！error：2
00401912 push 13222453.004073FC 程序执行第3步操作完成，共6步...
00401926 push 13222453.00407918
0040198A mov edi,13222453.004073F4 GET
004019EE mov edi,13222453.004075D0 HTTP/1.1\r\n
00401A1D mov edi,13222453.00407734 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0E; .NET4.0C)\r\n
00401A4C mov edi,13222453.004073D8 Host: passport.csdn.net\r\n\r\n
00401A84 push 13222453.004076D0 passport.csdn.net
00401A99 push 13222453.004073B8 程序执行4步操作完成，共6步...
00401AD5 mov edi,13222453.00407390 GET /ajax/accounthandler.ashx?t=log&u=
00401B2F mov edi,13222453.0040734C &p=wrr717&c=&remember=0&f=http%3A//passport.csdn.net/account/login
00401B5E mov edi,13222453.004075D0 HTTP/1.1\r\n
00401B90 mov edi,13222453.0040783C x-requested-with: XMLHttpRequest\r\n
00401BBF mov edi,13222453.00407304 Referer: http://passport.csdn.net/account/loginbox?callback=logined\r\n
00401BEB mov edi,13222453.004077D0 Content-Type: application/x-www-form-urlencoded\r\n
00401C1A mov edi,13222453.00407734 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0E; .NET4.0C)\r\n
00401C49 mov edi,13222453.004073D8 Host: passport.csdn.net\r\n\r\n
00401C81 push 13222453.004076D0 passport.csdn.net
00401CA7 mov edi,13222453.00407590 Cookie: UN=
00401D08 mov edi,13222453.004072F8 ; UserName=
00401D65 mov edi,13222453.004072EC ; UserInfo=
00401D92 push 13222453.004072D4 Set-Cookie: UserInfo=
00401DA9 push 13222453.00407AA0 错误
00401DAE push 13222453.004072A4 对不起，服务器繁忙，请稍候重试!error:no active
00401DCC push 13222453.00407284 程序执行第5步操作完成，共6步...
00401DE0 push 13222453.00407280 =
00401E83 mov edi,13222453.00407264 download.csdn.net/source/
00401EF5 push 13222453.00407978 Location:
00401F08 push 13222453.00407AA0 错误
00401F0D push 13222453.00407224 您的网络状态不稳定，下载请求发送失败，请稍后重试！error：2_2
00401F2B push 13222453.00407918
00401F72 mov edi,13222453.00407208 download.csdn.net/download
00401FDA push 13222453.004071E8 /index.php/source/do_download
00401FFC push 13222453.00407AA0 错误
00402001 push 13222453.004071AC 您的网络状态不稳定，下载请求发送失败，请稍后重试！error：3
0040206C mov edi,13222453.004071A4 POST
004020CD mov edi,13222453.004075D0 HTTP/1.1\r\n
004020FC mov edi,13222453.00407178 Referer: http://download.csdn.net/download/
00402126 push 13222453.0040716C do_download
004021BA mov edi,13222453.00407168 /
00402214 mov edi,13222453.00407164 \r\n
00402243 mov edi,13222453.00407734 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0E; .NET4.0C)\r\n
00402275 mov edi,13222453.004077D0 Content-Type: application/x-www-form-urlencoded\r\n
004022A4 mov edi,13222453.00407148 Host: download.csdn.net\r\n
004022D0 mov edi,13222453.00407134 Content-Length: 5\r\n
00402330 mov edi,13222453.0040712C \r\n\r\n
0040235F mov edi,13222453.00407124 ds=dx
00402397 push 13222453.00407110 download.csdn.net
004023AA push 13222453.00407AA0 错误
004023AF push 13222453.004070F0 发送下载请求后程序发生错误！
004023D4 push 13222453.00407978 Location:
004023E7 push 13222453.00407AA0 错误
004023EC push 13222453.004070C0 对不起，服务器繁忙，过会儿重试!error:no cookie
004023F3 push 13222453.00407918
00402499 push 13222453.00407098 程序执行第6步操作完成，程序执行完成.
004024BB push 13222453.00407090 open
004024CA push 13222453.00407080 获取地址成功
004024CF push 13222453.00407048 下载地址已经复制到剪切板，请打开浏览器黏贴即可下载！
004024E6 push 13222453.00407044 1
004024F3 push 13222453.00407030 程序处于默认状态...
0040279E mov edi,13222453.004073F4 GET
00402807 mov edi,13222453.004075D0 HTTP/1.1\r\n
0040283B mov edi,13222453.00407B04 HOST:
00402898 mov edi,13222453.00407AEC \r\nConnection: Close\r\n\r\n
00402910 push 13222453.00407AD8 source/do_download/
0040292D push 13222453.00407AD0 [CSDN]
00402A8F push ebp (Initial CPU selection)
004035D9 push 13222453.0040612C __MSVCRT_HEAP_SELECT
00403618 push 13222453.00406114 __GLOBAL_HEAP_SELECTED
004039B6 push 13222453.00406418 <program name unknown>
004039F8 push 13222453.00406414 ...
00403A0C push 13222453.004063F8 Runtime Error!\n\nProgram:
00403A2A push 13222453.004063F4 \n\n
00403A52 push 13222453.004063CC Microsoft Visual C++ Runtime Library
00404F46 mov esi,13222453.00407D50 P}@
00404F46 mov esi,13222453.00407D50 P}@
00404F46 mov esi,13222453.00407D50 P}@
00404FA2 mov eax,13222453.00407D50 P}@
00404FA2 mov eax,13222453.00407D50 P}@
00404FA2 mov eax,13222453.00407D50 P}@
00405199 mov edx,13222453.00407D50 P}@
00405199 mov edx,13222453.00407D50 P}@
00405199 mov edx,13222453.00407D50 P}@
0040530C mov eax,13222453.00407D50 P}@
0040530C mov eax,13222453.00407D50 P}@
0040530C mov eax,13222453.00407D50 P}@
0040556A push 13222453.00406460 user32.dll
00405581 push 13222453.00406454 MessageBoxA
00405592 push 13222453.00406444 GetActiveWindow
0040559A push 13222453.00406430 GetLastActivePopup

得，不用分析封包了，连顺序都写的很规范。