|
@@ -0,0 +1,114 @@
|
|
|
|
|
+一、未接任何设备打开软件时，会提示：Initial communication failed!
|
|
|
|
|
+汇编段：
|
|
|
|
|
+00401E9E |. /74 5C je short 00401EFC
|
|
|
|
|
+00401EA0 |. 66:C745 C0 38>mov word ptr [ebp-40], 38
|
|
|
|
|
+00401EA6 |. BA 333D5300 mov edx, 00533D33 ; initial communication failed!
|
|
|
|
|
+...
|
|
|
|
|
+00401EB8 |. E8 7BCB0C00 call 004CEA38 ; 弹出Initial communication failed!提示框;
|
|
|
|
|
+
|
|
|
|
|
+提示语所在内存地址：
|
|
|
|
|
+00533D33=00533D33 (ASCII "Initial Communication failed!")
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+// 需要在程序启动时注入;
|
|
|
|
|
+// 将ax的值存入变量[ebp-5A]，然后cmp比较该值是否为0,不为0则je跳转;
|
|
|
|
|
+00401E95 | 66:8945 A6 | mov word ptr ss:[ebp-5A],ax |
|
|
|
|
|
+00401E99 | 66:837D A6 00 | cmp word ptr ss:[ebp-5A],0 |
|
|
|
|
|
+00401E9E | 74 5C | je demo.401EFC |
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+二、Go按钮函数地址
|
|
|
|
|
+00417A84 /$ 55 push ebp
|
|
|
|
|
+...
|
|
|
|
|
+00417B66 |. E8 B99F0E00 call 00501B24 ; 弹出please check sn digit提示框;
|
|
|
|
|
+
|
|
|
|
|
+Demo.exe+17B25 - E8 FA9F0E00 - call Demo.exe+101B24 = call 00501B24
|
|
|
|
|
+
|
|
|
|
|
+// 1、弹出Set Communication Error对话框;
|
|
|
|
|
+00417FB5 | BA 4D455300 | mov edx,demo.53454D | 53454D:"Set Communication Error!"
|
|
|
|
|
+00417FCD | E8 666A0B00 | call demo.4CEA38 | # 弹出提示框：Set Communication Error!
|
|
|
|
|
+
|
|
|
|
|
+// 2、弹出提示框：Communication Error
|
|
|
|
|
+00404408 | E8 2BA60C00 | call demo.4CEA38 | # 弹出提示框：Communication Error
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+三、DisConnect按钮函数地址
|
|
|
|
|
+004378B0 /. 55 push ebp
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+四、Connect按钮函数地址
|
|
|
|
|
+00415DFC | 55 | push ebp | # Connect按钮
|
|
|
|
|
+00415A50 /$ 55 push ebp
|
|
|
|
|
+
|
|
|
|
|
+// 异常弹框处理：当CA310开机后，用户正常Connect一次后，Disconnect一次，然后设备断电，再Connect此时会弹异常框。
|
|
|
|
|
+// 若设备原来处理断电状态，程序重启，Connect时不会有异常弹框.
|
|
|
|
|
+043C50D7 | 0F85 51010000 | jne ca210ctrl.43C522E | # 出现异常（弹出External expection Exxx），跳转到522E
|
|
|
|
|
+
|
|
|
|
|
+注意,以下异常：Connect、Disconnect、Go均会产生,在Go时会导致按钮一直无法恢复！总之，出现异常需要重启程序！
|
|
|
|
|
+044D677C | FF15 78645404 | call dword ptr ds:[<&RaiseException>] | # 当设备断电后，再Connect时就报异常，此时程序需要重启
|
|
|
|
|
+
|
|
|
|
|
+五、完成调试时显示Finish!的内存地址
|
|
|
|
|
+004376A0 |. BA CE585300 mov edx, 005358CE ; finish!
|
|
|
|
|
+
|
|
|
|
|
+完成调试所需时间显示的内存地址：
|
|
|
|
|
+00437315 |. B8 6E585300 mov eax, 0053586E ; time is:
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+0052DF54为调试用时基址
|
|
|
|
|
+00418069 - 89 0D 54DF5200 - mov [0052DF54],ecx ;此处ecx=0,重置时间;
|
|
|
|
|
+004372D0 - A3 54DF5200 - mov [0052DF54],eax ;此处eax为实际用时,赋值给基址;
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+六、Save As Output Data 复选框单击函数地址
|
|
|
|
|
+004AB3FC /$ 53 push ebx
|
|
|
|
|
+
|
|
|
|
|
+004A6401 全局变量
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+七、Check FW按钮函数地址：
|
|
|
|
|
+00404238 $ 55 push ebp
|
|
|
|
|
+004043AB | E8 50F70400 | call demo.453B00 | # 可能进行I2C通讯，获取显示器的版本号
|
|
|
|
|
+
|
|
|
|
|
+ # 变量：ebp-80 存储版本相关的结果
|
|
|
|
|
+ 004043EA | 837D 80 00 | cmp dword ptr ss:[ebp-80],0
|
|
|
|
|
+ 004043EE | 74 3E | je demo.40442E |
|
|
|
|
|
+ 00404408 . E8 2BA60C00 call 004CEA38 ; 弹出Communication error!提示框;
|
|
|
|
|
+
|
|
|
|
|
+ Comm_realteksub.dll模块中:0019EDDC->此处多次调用，都存储着I2CRead结果;
|
|
|
|
|
+
|
|
|
|
|
+八、生成Output数据时出错
|
|
|
|
|
+004567EA | BA 539F5500 | mov edx,demo.559F53 | 559F53:"Copy Output Data Fail!!"
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+九、所有按钮事件函数
|
|
|
|
|
+004D5864 | FF93 20010000 | call dword ptr ds:[ebx+120] | # 所有按钮事件
|
|
|
|
|
+
|
|
|
|
|
+DisConnect寄存器值：
|
|
|
|
|
+EAX 0x02393F78
|
|
|
|
|
+EBX 0x024156CC
|
|
|
|
|
+ECX 0x004AB16C
|
|
|
|
|
+EDX 0x024156CC
|
|
|
|
|
+EBP 0x0019F500
|
|
|
|
|
+ESP 0x0019F3C8
|
|
|
|
|
+ESI 0x004AB068
|
|
|
|
|
+EDI 0x0019F53C
|
|
|
|
|
+
|
|
|
|
|
+Call demo.004378B0
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+十、异常弹框
|
|
|
|
|
+1、当设备断电后，再Connect时就报异常，此时程序需要重启
|
|
|
|
|
+0458677C | FF15 78645F04 | call dword ptr ds:[<&RaiseException>] |
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+十一、相关特征码：
|
|
|
|
|
+SetText的特征码分析：
|
|
|
|
|
+E8 C2 E0 0B 00
|
|
|
|
|
+E8 BD C4 0B 00
|
|
|
|
|
+E8 DC C5 0B 00
|
|
|
|
|
+E8 56 E0 0B 00
|
|
|
|
|
+总结特征码为：E8 ?? ?? 0B 00
|
|
|
|
|
+
|
