From - Thu Jul 10 16:14:07 1997
X-POP3-Rcpt: s42049@mercury
Received: from bbs.csmc.edu.tw (bbs@bbs.csmc.edu.tw [140.128.136.11]) by mercury.csmc.edu.tw (8.6.12/8.6.12) with ESMTP id GAA11530 for <s42049@mercury.csmc.edu.tw>; Wed, 9 Jul 1997 06:54:34 +0800
From: yhq.bbs@bbs.csmc.edu.tw
Received: (from bbs@localhost) by bbs.csmc.edu.tw (8.7.5/8.6.9) id HAA21542 for s42049@mercury.csmc.edu.tw; Wed, 9 Jul 1997 07:23:01 +0800
Date: Wed, 9 Jul 1997 07:23:01 +0800
Message-Id: <199707082323.HAA21542@bbs.csmc.edu.tw>
X-Authentication-Warning: bbs.csmc.edu.tw: bbs set sender to yhq.bbs@bbs.csmc.edu.tw using -f
Reply-To: yhq.bbs@bbs.csmc.edu.tw
To: s42049@mercury.csmc.edu.tw
Subject: } UnMozify(H)
X-Forwarded-By: yhq (])
X-Disclaimer: sǰ|BBS -- p 糧HetdC
Precedence: junk
X-Mozilla-Status: 2001

oHH: heibow.bbs@bbs.cis.nctu.edu.tw (Ť), H: hacker
  D: } UnMozify
oH: j_BBS (Tue Jul  8 23:21:20 1997)
H: csmcbbs!news.cis.nctu!cis_nctu
Origin: 140.129.42.94

}UnMozify
oOiΨus@ǯx
ڥ\ڤ]OܲM
Хarchie unmoz_ns.exe

(1)楦->file->UnLock UnMozify
MHNJUX
Uctrl-d iJwinice   MUO bpx hmemcpy
(2)F5^win95AUok
M|QwinicedI,AƤUF12
Fcs:004515c1 mov edx,[ebp-0104]
    cs:004515c7 lea eax,[ebp-0100]
(3)ƤUF10Fcs:00451513   call 00433c10
F8iJƵ{
(4)AƤUF10Fcs:00433c2f  call [ecx+8]
 F8iJƵ{
(5))AƤUF10Fcs:0043415b  call xxxxxx
                   cs:00434160  cmp [esi+10c],0
                   cs:00434167  jz 0043416b
ɤUd esi+10c |ݨOܹs,ҥHɷ|D
|DܵUѤF,ҥHU code on
MX, cmp [esi+10c],0
令 inc byte ptr[esi+10c]

֤@buye ,令nopYi
ҥHUnMozify.exe
  80be0c01000000
  fe860c01000090
o˴NF
about
uݨ register to
ťժ...
ޥL...δNnF

--

  [36m Ť [0;37;40m Oݨgl
--
 * Origin:  qjǸTǨt BBS  <bbs.cis.nctu.edu.tw: 140.113.23.3>

