這次我要對(duì)付的軟件是一個(gè)比較好用的代理軟件(我不知道這樣文章要不要隱藏文件名稱(chēng)),算法大家已經(jīng)分析很多次了,我就不再重復(fù)了. 我這里來(lái)討論一個(gè)實(shí)際應(yīng)用的問(wèn)題:如果你想用別人的機(jī)器上網(wǎng)而又不想讓他輕易的發(fā)現(xiàn)(好像這樣的想法大家都有吧?).而這個(gè)軟件在啟動(dòng)之后 會(huì)在任務(wù)欄加載一個(gè)圖標(biāo),這樣就比較矛盾了啊!所以我才要解決他啊! 首先我們先來(lái)點(diǎn)思路: 要向系統(tǒng)托盤(pán)中加入和刪除圖標(biāo)必須要用到SHELL32.Shell_NotifyIconA這個(gè)函數(shù),也就是說(shuō)當(dāng)軟件啟動(dòng)的時(shí)候一定是調(diào)用這個(gè)函數(shù)將自己的圖 標(biāo)加入到系統(tǒng)托盤(pán)中;在關(guān)閉軟件的時(shí)候他也是調(diào)用這個(gè)函數(shù)將圖標(biāo)刪除的. 我們來(lái)查一下WINAPI函數(shù)表來(lái)確定一下這個(gè)函數(shù)的使用方法和格式. Const NIM_ADD = &H0//這個(gè)就是向托盤(pán)加入圖標(biāo)的參數(shù) Const NIM_MODIFY = &H1 Const NIM_DELETE = &H2//這個(gè)就是從托盤(pán)中刪除圖標(biāo)的參數(shù) Const NIF_MESSAGE = &H1 Const NIF_ICON = &H2 Const NIF_TIP = &H4 Declare Function Shell_NotifyIcon Lib "shell32.dll" Alias " Shell_NotifyIconA" (ByVal dwMessage As Long, lpData As NOTIFYICONDATA) As Long 上面2個(gè)函數(shù)的參數(shù)一定要記下來(lái)下面有用啊! 我們用WINASM32來(lái)反匯編軟件,在函數(shù)中查找SHELL32.Shell_NotifyIconA這個(gè)函數(shù)看看系統(tǒng)中是怎樣調(diào)用他的,雙擊幾次我們發(fā)現(xiàn)軟件一共有3 處調(diào)用這個(gè)函數(shù). 我們先來(lái)分析一下這個(gè)軟件調(diào)用的這3處的作用:首先,軟件啟動(dòng)會(huì)向系統(tǒng)的任務(wù)欄中添加一個(gè)圖標(biāo);然后,要完成圖標(biāo)的動(dòng)畫(huà)作用(寫(xiě)過(guò)程序的人 應(yīng)該知道,做動(dòng)畫(huà)比較簡(jiǎn)單的方法就是來(lái)回切換圖標(biāo)就可以完成了啊);最后,在退出軟件的時(shí)候要?jiǎng)h除任務(wù)欄的圖標(biāo).大概就是這3處. 這只是初步分析了下面我們進(jìn)行動(dòng)態(tài)跟蹤: 為了分析清楚軟件是怎樣調(diào)用的就必須使用TRW2000或SICE動(dòng)態(tài)跟蹤了,我們下BPX Shell_NotifyIconA 斷點(diǎn),攔斷后用F12跳出看看軟件是如果 調(diào)用,和使用參數(shù)的! 首先來(lái)到下面: 這里是軟件啟動(dòng)時(shí)調(diào)用的地方 * Possible Reference to String Resource ID=00114: "CCProxy" | :00408770 6A72 push 00000072 :00408772 51 push ecx :00408773 C68424F424000005 mov byte ptr [esp+000024F4], 05 :0040877B E8C0890100 call 00421140 :00408780 83C408 add esp, 00000008 :00408783 50 push eax :00408784 8D4C2414 lea ecx, dword ptr [esp+14] :00408788 C68424F024000006 mov byte ptr [esp+000024F0], 06 :00408790 E818910300 call 004418AD :00408795 8D4C2414 lea ecx, dword ptr [esp+14] :00408799 C68424EC24000005 mov byte ptr [esp+000024EC], 05 :004087A1 E8CE8F0300 call 00441774 :004087A6 8B7C2410 mov edi, dword ptr [esp+10] :004087AA 83C9FF or ecx, FFFFFFFF :004087AD 33C0 xor eax, eax :004087AF 8D95F8090000 lea edx, dword ptr [ebp+000009F8] :004087B5 F2 repnz :004087B6 AE scasb :004087B7 F7D1 not ecx :004087B9 2BF9 sub edi, ecx :004087BB 53 push ebx :004087BC 8BC1 mov eax, ecx :004087BE 8BF7 mov esi, edi :004087C0 8BFA mov edi, edx :004087C2 6A00 push 00000000//看到了嗎這里是0 :004087C4 C1E902 shr ecx, 02 //這里改沒(méi)有作用因?yàn)榧词垢牧嗽谙旅?:004087C7 F3 repz //系統(tǒng)切換圖標(biāo)時(shí)又會(huì)產(chǎn)生所以要改下面的 :004087C8 A5 movsd :004087C9 8BC8 mov ecx, eax :004087CB 83E103 and ecx, 00000003 :004087CE F3 repz :004087CF A4 movsb * Reference To: SHELL32.Shell_NotifyIconA, Ord:0079h//調(diào)用函數(shù) | :004087D0 FF1570E34400 Call dword ptr [0044E370]//調(diào)用過(guò)程成功返回1,失敗返回0 :004087D6 8D4C2410 lea ecx, dword ptr [esp+10] :004087DA C68424EC24000002 mov byte ptr [esp+000024EC], 02 :004087E2 E88D8F0300 call 00441774 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00408717(C) | :004087E7 55 push ebp :004087E8 E803920100 call 004219F0 :004087ED 83C404 add esp, 00000004 :004087F0 8D4C241C lea ecx, dword ptr [esp+1C] :004087F4 51 push ecx :004087F5 E878390300 call 0043C172 :004087FA 8B10 mov edx, dword ptr [eax] :004087FC 8D44241C lea eax, dword ptr [esp+1C] * Possible StringData Ref from Data Obj ->"%H:%M:%S" | :00408800 68BCD64500 push 0045D6BC :00408805 50 push eax :00408806 8D4C242C lea ecx, dword ptr [esp+2C] :0040880A 8954242C mov dword ptr [esp+2C], edx :0040880E E872390300 call 0043C185 :00408813 50 push eax :00408814 8D4C2424 lea ecx, dword ptr [esp+24] * Possible StringData Ref from Data Obj ->" " | :00408818 6828D14500 push 0045D128 :0040881D 51 push ecx :0040881E C68424F824000007 mov byte ptr [esp+000024F8], 07 :00408826 E8EC910300 call 00441A17 * Possible StringData Ref from Data Obj ->" " | :0040882B 6828D14500 push 0045D128 :00408830 8D542418 lea edx, dword ptr [esp+18] :00408834 50 push eax :00408835 52 push edx :00408836 C68424F824000008 mov byte ptr [esp+000024F8], 08 :0040883E E860910300 call 004419A3 :00408843 8B00 mov eax, dword ptr [eax] :00408845 8BCD mov ecx, ebp :00408847 50 push eax -------------------------------------------------------------------------- 這里是形成動(dòng)畫(huà)時(shí)的調(diào)用: :00409669 8D542414 lea edx, dword ptr [esp+14] * Possible Reference to String Resource ID=00114: "CCProxy" | :0040966D 6A72 push 00000072 :0040966F 52 push edx :00409670 C784243014000000000000 mov dword ptr [esp+00001430], 00000000 :0040967B E8C07A0100 call 00421140 :00409680 83C408 add esp, 00000008 :00409683 50 push eax :00409684 8D4C2414 lea ecx, dword ptr [esp+14] :00409688 C684242C14000001 mov byte ptr [esp+0000142C], 01 :00409690 E818820300 call 004418AD :00409695 8D4C2414 lea ecx, dword ptr [esp+14] :00409699 C684242814000000 mov byte ptr [esp+00001428], 00 :004096A1 E8CE800300 call 00441774 :004096A6 8B7C2410 mov edi, dword ptr [esp+10] :004096AA 83C9FF or ecx, FFFFFFFF :004096AD 33C0 xor eax, eax :004096AF 8D95F8090000 lea edx, dword ptr [ebp+000009F8] :004096B5 F2 repnz :004096B6 AE scasb :004096B7 F7D1 not ecx :004096B9 2BF9 sub edi, ecx :004096BB 53 push ebx :004096BC 8BC1 mov eax, ecx :004096BE 8BF7 mov esi, edi :004096C0 8BFA mov edi, edx :004096C2 6A00 push 00000000//這里雖然也是0但這里是為了形成動(dòng)畫(huà)的時(shí)候調(diào)用的 :004096C4 C1E902 shr ecx, 02 //如果不想讓他顯示就改變參數(shù)就行了6A00->6A02 :004096C7 F3 repz :004096C8 A5 movsd :004096C9 8BC8 mov ecx, eax :004096CB 83E103 and ecx, 00000003 :004096CE F3 repz :004096CF A4 movsb * Reference To: SHELL32.Shell_NotifyIconA, Ord:0079h | :004096D0 8B3570E34400 mov esi, dword ptr [0044E370] :004096D6 FFD6 call esi :004096D8 8B4D1C mov ecx, dword ptr [ebp+1C] * Possible StringData Ref from Data Obj ->"CCProxy System Tray Icon Message" | :004096DB 68C8D64500 push 0045D6C8 :004096E0 C70358000000 mov dword ptr [ebx], 00000058 :004096E6 898DE4090000 mov dword ptr [ebp+000009E4], ecx :004096EC C785E80900000A000000 mov dword ptr [ebp+000009E8], 0000000A :004096F6 C785EC09000002000000 mov dword ptr [ebp+000009EC], 00000002 * Reference To: USER32.RegisterWindowMessageA, Ord:0200h | :00409700 FF1578E54400 Call dword ptr [0044E578] :00409706 8985F0090000 mov dword ptr [ebp+000009F0], eax :0040970C 8B1564164600 mov edx, dword ptr [00461664] --------------------------------------------------------------------------- 這里是軟件退出時(shí),用來(lái)刪除圖標(biāo)的函數(shù)調(diào)用部分! :00409DAF 90 nop :00409DB0 A1484B4600 mov eax, dword ptr [00464B48] :00409DB5 56 push esi :00409DB6 85C0 test eax, eax :00409DB8 8BF1 mov esi, ecx :00409DBA 750F jne 00409DCB :00409DBC 8D86E0090000 lea eax, dword ptr [esi+000009E0] :00409DC2 50 push eax :00409DC3 6A02 push 00000002//看看這里和上面介紹的參數(shù)值進(jìn)行一下比較 * Reference To: SHELL32.Shell_NotifyIconA, Ord:0079h//調(diào)用函數(shù) | :00409DC5 FF1570E34400 Call dword ptr [0044E370]//調(diào)用如果成功則返回1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00409DBA(C) | :00409DCB 8B0DA8164600 mov ecx, dword ptr [004616A8] :00409DD1 E85A210000 call 0040BF30 :00409DD6 8B0DA8164600 mov ecx, dword ptr [004616A8] :00409DDC C7410400000000 mov [ecx+04], 00000000 :00409DE3 8BCE mov ecx, esi :00409DE5 C7059CD5450000000000 mov dword ptr [0045D59C], 00000000 :00409DEF E853410300 call 0043DF47 :00409DF4 5E pop esi :00409DF5 C3 ret ------------------------------------------------------------------------- 既然知道了這幾處調(diào)用的作用我們就來(lái)做一下修改,軟件在啟動(dòng)的時(shí)候會(huì)向任務(wù)欄加入一個(gè)圖標(biāo),改這里行不行回答是不行. 為什么?因?yàn)檐浖诩尤雸D標(biāo)之后會(huì)為了完成動(dòng)畫(huà)作用繼續(xù)使用這個(gè)函數(shù)來(lái)切換圖標(biāo),所以即使你修改了啟動(dòng)時(shí)的部分在切換 圖標(biāo)的時(shí)候也還會(huì)產(chǎn)生,因此改一下生成動(dòng)畫(huà)部分函數(shù)參數(shù)就行了啊! 查找字符串:8BC18BF78BFA6A00C1E902 改為: ........... 6A02...... 這樣修改之后軟件啟動(dòng)后就不會(huì)在任務(wù)欄產(chǎn)生圖標(biāo)了(遇到的問(wèn)題解決了) 小弟第一次寫(xiě)這樣的文章不免有思路和過(guò)程上的漏洞,請(qǐng)大家多多指點(diǎn)和幫助.

轉(zhuǎn)載于:https://www.cnblogs.com/QDuck/archive/2005/03/07/114589.html

總結(jié)

以上是生活随笔為你收集整理的去除任务栏的图标的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。