对彗星DNS加速器的分析（一）

元始天尊 · 发表于 2015-2-22 13:52:43

欢迎访问技术宅的结界，请注册或者登录吧。

您需要登录才可以下载或查看，没有账号？立即注册→加入我们

×

FASTDNS作者是张慧星，该软件能很好地测试dns并自动设置系统，一直以来都在用却不知道原理，这2天我做了逆向分析，并打算将delphi的移植为vc++的源码，如果有可能以后会兼容ipv6 dns。

提前声明：手动标注是逆向分析的重要步骤，下面代码中有些是API名，其余大部分有名称的都是分析了函数以后手动做的命名，为分析结构方便，以下汇集了我3天的成果，目的就是为了用VC++完成同样的功能，并期盼以后可以改进，比如兼容Ipv6和结合代理软件。

看到设置界面发现可以设置多线程的，因此从这里入手，bp CreateThread，发现断不下来，于是bm *!CreateThread*，断到这里：

ecx=param0;edx=dwStackSize;eax=lpThreadAttributes;param1=lpThreadId,param2=dwCreationFlags,param3
.text:0043D348 push ebp
.text:0043D349 mov ebp, esp
.text:0043D34B push ebx
.text:0043D34C push esi
.text:0043D34D push edi
.text:0043D34E mov edi, ecx//edi=param1
.text:0043D350 mov esi, edx//esi=dwStackSize
.text:0043D352 mov ebx, eax//ebx=lpThreadAttributes
.text:0043D354 mov eax, 8//DWORD[2]
.text:0043D359 call sub_43B5C0
.text:0043D35E mov [eax], edi//DWORD[0]=param0;FARPROC
.text:0043D360 mov edx, [ebp+arg_8]
.text:0043D363 mov [eax+4], edx//DWORD[1]=param3;PARAM
.text:0043D366 mov byte_4B9C2D, 1
.text:0043D36D mov edx, [ebp+dwCreationFlags_1]
.text:0043D370 push edx ; lpThreadId
.text:0043D371 mov edx, [ebp+dwCreationFlags]
.text:0043D374 push edx ; dwCreationFlags
.text:0043D375 push eax ; lpParameter
.text:0043D376 mov eax, offset SpeedTest
.text:0043D37B push eax ; lpStartAddress
.text:0043D37C push esi ; dwStackSize
.text:0043D37D push ebx ; lpThreadAttributes
.text:0043D37E call CreateThread
.text:0043D383 pop edi
.text:0043D384 pop esi
.text:0043D385 pop ebx
.text:0043D386 pop ebp
.text:0043D387 retn 0Ch

复制代码

可以看到实际只执行了参数中的函数指针部分，现在我们来找CreateThread的StartAddress和Param部分，往上层找到StartAddress的值为Classes::_17197

.text:004254A4 ; __fastcall Classes::TThread::TThread(bool)
.text:004254A4 @Classes@TThread@$bctr$qqro proc near ; CODE XREF: sub_40E908+33p
text:004254E6 push esi ; param3
.text:004254E7 push 4 ; dwCreationFlags
.text:004254E9 lea eax, [esi+8]
.text:004254EC push eax ; lpThreadId
.text:004254ED mov ecx, offset @Classes@_17197 ; a3
.text:004254F2 xor edx, edx ; dwStackSize
.text:004254F4 xor eax, eax ; lpThreadAttributes
.text:004254F6 call @BeginThread

复制代码

来看该函数

text:00425404 ; Classes::_17197
.text:00425404 @Classes@_17197 proc near ; DATA XREF: Classes::TThread::TThread(bool)+49o
.text:00425404
.text:00425404 var_4= dword ptr -4
.text:00425404
.text:00425404 push ebp
.text:00425405 mov ebp, esp
.text:00425407 push ecx
.text:00425408 push ebx
.text:00425409 push esi
.text:0042540A push edi
.text:0042540B mov [ebp+var_4], eax
.text:0042540E xor eax, eax
.text:00425410 push ebp
.text:00425411 push offset j_@@HandleFinally_0 ; __linkproc__ HandleFinally
.text:00425416 push dword ptr fs:[eax]
.text:00425419 mov fs:[eax], esp
.text:0042541C mov eax, [ebp+var_4]
.text:0042541F cmp byte ptr [eax+0Dh], 0
.text:00425423 jnz short loc_42545A
.text:00425425 xor eax, eax
.text:00425427 push ebp
.text:00425428 push offset loc_425445
.text:0042542D push dword ptr fs:[eax]
.text:00425430 mov fs:[eax], esp
.text:00425433 mov eax, [ebp+var_4]
.text:00425436 mov edx, [eax]
.text:00425438 call dword ptr [edx+4]
.text:0042543B xor eax, eax
.text:0042543D pop edx
.text:0042543E pop ecx
.text:0042543F pop ecx
.text:00425440 mov fs:[eax], edx
.text:00425443 jmp short loc_42545A
.text:00425445 ; ---------------------------------------------------------------------------
.text:00425445
.text:00425445 loc_425445: ; DATA XREF: Classes::_17197+24o
.text:00425445 jmp @@HandleAnyException ; __linkproc__ HandleAnyException
.text:0042544A ; ---------------------------------------------------------------------------
.text:0042544A call @AcquireExceptionObject
.text:0042544F mov edx, [ebp+var_4]
.text:00425452 mov [edx+2Ch], eax
.text:00425455 call @@DoneExcept ; __linkproc__ DoneExcept
.text:0042545A
.text:0042545A loc_42545A: ; CODE XREF: Classes::_17197+1Fj
.text:0042545A ; Classes::_17197+3Fj
.text:0042545A xor eax, eax
.text:0042545C pop edx
.text:0042545D pop ecx
.text:0042545E pop ecx
.text:0042545F mov fs:[eax], edx
.text:00425462 push offset unk_42549C
.text:00425467
.text:00425467 loc_425467: ; CODE XREF: .text:0042549Aj
.text:00425467 mov eax, [ebp+var_4]
.text:0042546A mov bl, [eax+0Fh]
.text:0042546D mov eax, [ebp+var_4]
.text:00425470 mov esi, [eax+14h]
.text:00425473 mov eax, [ebp+var_4]
.text:00425476 mov byte ptr [eax+10h], 1
.text:0042547A mov eax, [ebp+var_4]
.text:0042547D mov edx, [eax]
.text:0042547F call dword ptr [edx]
.text:00425481 test bl, bl
.text:00425483 jz short loc_42548D
.text:00425485 mov eax, [ebp+var_4]
.text:00425488 call @TObject@Free ; TObject::Free
.text:0042548D
.text:0042548D loc_42548D: ; CODE XREF: Classes::_17197+7Fj
.text:0042548D mov eax, esi ; dwExitCode
.text:0042548F call @EndThread

复制代码

实际执行的又是参数中的函数指针；先执行*(param+4)(param) 在执行*(param(param),
（感觉delphi的这个结构构造的很巧妙，传入CreateThread的param之前在堆上分配，而进了startaddress后自动释放，param里面也是StartAddress+Param的结构^_^可以无限这么套下去）
而param的值需要再往上找，

.text:004254A4 ; __fastcall Classes::TThread::TThread(bool)
.text:004254A4 @Classes@TThread@$bctr$qqro proc near ; CODE XREF: sub_40E908+33p
.text:004254A4
.text:004254A4 var_10= dword ptr -10h
.text:004254A4 var_C= dword ptr -0Ch
.text:004254A4 var_8= byte ptr -8
.text:004254A4 var_1= byte ptr -1
.text:004254A4
.text:004254A4 push ebp
.text:004254A5 mov ebp, esp
.text:004254A7 add esp, 0FFFFFFF0h
.text:004254AA push ebx
.text:004254AB push esi
.text:004254AC xor ebx, ebx
.text:004254AE mov [ebp+var_10], ebx
.text:004254B1 test dl, dl
.text:004254B3 jz short loc_4254BD
.text:004254B5 add esp, 0FFFFFFF0h
.text:004254B8 call @@ClassCreate ; __linkproc__ ClassCreate
.text:004254BD
.text:004254BD loc_4254BD: ; CODE XREF: Classes::TThread::TThread(bool)+Fj
.text:004254BD mov ebx, ecx
.text:004254BF mov [ebp+var_1], dl
.text:004254C2 mov esi, eax
.text:004254C4 xor eax, eax
.text:004254C6 push ebp
.text:004254C7 push offset loc_42554E
.text:004254CC push dword ptr fs:[eax] ; lpThreadIda
.text:004254CF mov fs:[eax], esp
.text:004254D2 xor edx, edx
.text:004254D4 mov eax, esi
.text:004254D6 call @TObject@$bctr_0 ; TObject::`...'
.text:004254DB call sub_42522C
.text:004254E0 mov [esi+0Eh], bl
.text:004254E3 mov [esi+0Ch], bl
.text:004254E6 push esi ; param3
.text:004254E7 push 4 ; dwCreationFlags
.text:004254E9 lea eax, [esi+8]
.text:004254EC push eax ; lpThreadId
.text:004254ED mov ecx, offset @Classes@_17197 ; a3
.text:004254F2 xor edx, edx ; dwStackSize
.text:004254F4 xor eax, eax ; lpThreadAttributes
.text:004254F6 call @BeginThread

复制代码

看到004254E6处push的第一个参数位esi，往上看到004254C2处eax做了赋值，往前再没给eax赋值的，因此eax是传入参数，还要往调用者找，（delphi程序喜欢用ecx eax edx传值，不过这样的话在调用系统api前后，要做栈<-->寄存器参数变换）

.text:0040E908 sub_40E908 proc near ; CODE XREF: sub_4094B4+46p
.text:0040E908
.text:0040E908 var_2A= byte ptr -2Ah
.text:0040E908 var_29= byte ptr -29h
.text:0040E908 var_28= dword ptr -28h
.text:0040E908 var_18= word ptr -18h
.text:0040E908 var_C= dword ptr -0Ch
.text:0040E908 var_8= byte ptr -8
.text:0040E908 var_4= dword ptr -4
.text:0040E908 arg_0= dword ptr 8
.text:0040E908 arg_4= dword ptr 0Ch
.text:0040E908 arg_8= dword ptr 10h
.text:0040E908 arg_C= dword ptr 14h
.text:0040E908 arg_10= dword ptr 18h
.text:0040E908
.text:0040E908 push ebp
.text:0040E909 mov ebp, esp
.text:0040E90B add esp, 0FFFFFFD4h
.text:0040E90E mov [ebp+var_8], dl
.text:0040E911 test dl, dl
.text:0040E913 jle short loc_40E91A
.text:0040E915 call __ClassCreate
.text:0040E91A
.text:0040E91A loc_40E91A: ; CODE XREF: sub_40E908+Bj
.text:0040E91A mov [ebp+var_2A], cl
.text:0040E91D mov [ebp+var_29], dl
.text:0040E920 mov [ebp+var_4], eax
.text:0040E923 mov eax, offset unk_4B3C0C
.text:0040E928 call @__InitExceptBlockLDTC
.text:0040E92D mov [ebp+var_18], 8
.text:0040E933 mov cl, [ebp+var_2A]
.text:0040E936 xor edx, edx
.text:0040E938 mov eax, [ebp+var_4]
.text:0040E93B call @Classes@TThread@$bctr$qqro ; Classes::TThread::TThread(bool)

复制代码

看到0040E938处var_4对eax赋值，而往上0040E920处eax又赋值给var_4，之前eax再没有赋值行为，同样eax也是该函数参数，继续往调用者走

text:004094B4 push ebp
.text:004094B5 mov ebp, esp
.text:004094B7 add esp, 0FFFFFFD4h
.text:004094BA push ebx
.text:004094BB push esi
.text:004094BC push edi
.text:004094BD mov [ebp+var_8], dl
.text:004094C0 test dl, dl
.text:004094C2 jle short loc_4094C9
.text:004094C4 call __ClassCreate
.text:004094C9
.text:004094C9 loc_4094C9: ; CODE XREF: sub_4094B4+Ej
.text:004094C9 mov ebx, ecx
.text:004094CB mov [ebp+var_29], dl
.text:004094CE mov [ebp+var_4], eax
.text:004094D1 mov eax, offset unk_4B24D0
.text:004094D6 call @__InitExceptBlockLDTC
.text:004094DB mov [ebp+var_18], 8
.text:004094E1 mov edx, [ebp+arg_10]
.text:004094E4 mov ecx, ebx
.text:004094E6 push edx
.text:004094E7 push [ebp+arg_C]
.text:004094EA push [ebp+arg_8]
.text:004094ED mov eax, [ebp+arg_4]
.text:004094F0 push eax
.text:004094F1 mov edx, [ebp+arg_0]
.text:004094F4 push edx
.text:004094F5 xor edx, edx
.text:004094F7 mov eax, [ebp+var_4]
.text:004094FA call sub_40E908

复制代码

该层同理

text:00402748 push ebp
.text:00402749 mov ebp, esp
.text:0040274B add esp, 0FFFFFF98h
.text:0040274E mov eax, offset unk_4A2608
.text:00402753 push ebx
.text:00402754 push esi
.text:00402755 push edi
.text:00402756 mov esi, [ebp+arg_0]
.text:00402759 call @__InitExceptBlockLDTC
.text:0040275E mov ebx, [ebp+arg_4]
.text:00402761 cmp byte ptr [ebx+10h], 1
.text:00402765 jnz loc_4028A0
.text:0040276B mov [ebp+var_34], 8
.text:00402771 push ebx
.text:00402772 lea eax, [ebp+var_4C]
.text:00402775 mov [ebp+var_4C], offset sub_402990
.text:0040277C mov [ebp+var_48], esi
.text:0040277F mov dl, 1
.text:00402781 push dword ptr [eax+4]
.text:00402784 push dword ptr [eax]
.text:00402786 mov ecx, [esi+3ECh]
.text:0040278C push ecx
.text:0040278D mov cl, 1
.text:0040278F mov eax, [esi+3F0h]
.text:00402795 push eax
.text:00402796 mov eax, off_4B2618
.text:0040279B call sub_4094B4

复制代码

最后找到这里，发现eax是4B2618，来看该处2个函数指针(应该说是虚函数表，从后面可以看到param其实是个类)：
.data:004B2618 off_4B2618 dd offset _cls_DNSSpending_TDNSSpending//虚表
。。。。。。。。。。。//类成员

.data:004B2664 _cls_DNSSpending_TDNSSpending dd offset @TThread@DoTerminate
.data:004B2664 ; DATA XREF: .text:00409906o
.data:004B2664 ; .data

ff_4B2618o
.data:004B2664 ; TThread:

oTerminate
.data:004B2668 dd offset sub_40EA3C
.data:004B266C dd offset sub_40970C

再往上走可以看到程序按照分的线程数创建线程：

.text:00402940 sub_402940 proc near ; CODE XREF: showstatus+43p
.text:00402940 ; _TfrmFastDNS_actTestSpendingExecute+138p
.text:00402940
.text:00402940 var_8 = dword ptr -8
.text:00402940 var_4 = dword ptr -4
.text:00402940 arg_0 = dword ptr 8
.text:00402940 arg_4 = dword ptr 0Ch
.text:00402940
.text:00402940 push ebp
.text:00402941 mov ebp, esp
.text:00402943 add esp, 0FFFFFFF8h
.text:00402946 push ebx
.text:00402947 push esi
.text:00402948 push edi
.text:00402949 mov edi, [ebp+arg_4]
.text:0040294C mov ebx, [ebp+arg_0]
.text:0040294F cmp dword ptr [ebx+400h], 0
.text:00402956 jz short loc_402988
.text:00402958 xor esi, esi
.text:0040295A cmp edi, esi
.text:0040295C jle short loc_402988
.text:0040295E
.text:0040295E loc_40295E: ; CODE XREF: sub_402940+46j
.text:0040295E push 0
.text:00402960 push 0
.text:00402962 mov [ebp+var_8], offset sub_402748
.text:00402969 mov [ebp+var_4], ebx
.text:0040296C lea eax, [ebp+var_8]
.text:0040296F push dword ptr [eax+4]
.text:00402972 push dword ptr [eax]
.text:00402974 mov ecx, [ebx+400h]
.text:0040297A push ecx
.text:0040297B call sub_40C400
.text:00402980 add esp, 14h
.text:00402983 inc esi
.text:00402984 cmp edi, esi
.text:00402986 jg short loc_40295E
.text:00402988
.text:00402988 loc_402988: ; CODE XREF: sub_402940+16j
.text:00402988 ; sub_402940+1Cj
.text:00402988 pop edi
.text:00402989 pop esi
.text:0040298A pop ebx
.text:0040298B pop ecx
.text:0040298C pop ecx
.text:0040298D pop ebp
.text:0040298E retn
.text:0040298E sub_402940 endp
.

复制代码

再往上走就是TfrmFastDNS_actTestSpendingExecute，也就是点击了测试按钮之后的回调函数

.text:004033D4 _TfrmFastDNS_actTestSpendingExecute proc near
.text:004033D4 ; DATA XREF: .data:fastdns___CPPdebugHook+13E3o
.text:004033D4
.text:004033D4 var_38 = dword ptr -38h
.text:004033D4 var_34 = dword ptr -34h
.text:004033D4 var_30 = dword ptr -30h
.text:004033D4 var_20 = word ptr -20h
.text:004033D4 var_14 = dword ptr -14h
.text:004033D4 var_C = byte ptr -0Ch
.text:004033D4 var_8 = byte ptr -8
.text:004033D4 var_4 = byte ptr -4
.text:004033D4
.text:004033D4 push ebp
.text:004033D5 mov ebp, esp
.text:004033D7 add esp, 0FFFFFFC8h
.text:004033DA push ebx
.text:004033DB mov ebx, eax
.text:004033DD mov eax, offset unk_4A2954
.text:004033E2 call @__InitExceptBlockLDTC
.text:004033E7 xor edx, edx
.text:004033E9 mov eax, [ebx+304h]
.text:004033EF call sub_443028
.text:004033F4 xor edx, edx
.text:004033F6 mov eax, [ebx+364h]
.text:004033FC call sub_443028
.text:00403401 mov byte ptr [ebx+404h], 0
.text:00403408 call @GetCurrentTime
.text:0040340D mov [ebx+3E8h], eax
.text:00403413 mov edx, 8000000Fh
.text:00403418 mov eax, [ebx+350h]
.text:0040341E call @TControl@SetColor ; TControl::SetColor
.text:00403423 mov [ebp+var_20], 8
.text:00403429 mov edx, offset unk_4A22AA
.text:0040342E lea eax, [ebp+var_4]
.text:00403431 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:00403436 inc [ebp+var_14]
.text:00403439 mov edx, [eax]
.text:0040343B mov eax, [ebx+350h]
.text:00403441 call @TControl@SetText ; TControl::SetText
.text:00403446 dec [ebp+var_14]
.text:00403449 lea eax, [ebp+var_4]
.text:0040344C mov edx, 2
.text:00403451 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00403456 mov dl, 1
.text:00403458 mov eax, [ebx+35Ch]
.text:0040345E call unknown_libname_1860 ; Delphi2006/BDS2006 Visual Component Library
.text:0040345E ; BDS 4.0 RTL and VCL
.text:00403463 mov [ebp+var_20], 14h
.text:00403469 mov edx, offset unk_4A22AB
.text:0040346E lea eax, [ebp+var_8]
.text:00403471 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:00403476 inc [ebp+var_14]
.text:00403479 mov edx, [eax]
.text:0040347B mov eax, [ebx+34Ch]
.text:00403481 call @TControl@SetText ; TControl::SetText
.text:00403486 dec [ebp+var_14]
.text:00403489 lea eax, [ebp+var_8]
.text:0040348C mov edx, 2
.text:00403491 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00403496 xor edx, edx
.text:00403498 mov eax, [ebx+30Ch]
.text:0040349E call sub_443028
.text:004034A3 mov eax, [ebx+400h]
.text:004034A9 test eax, eax
.text:004034AB jz short loc_4034CC
.text:004034AD push 0
.text:004034AF push 0
.text:004034B1 mov [ebp+var_38], offset sub_4033B0
.text:004034B8 mov [ebp+var_34], ebx
.text:004034BB lea edx, [ebp+var_38]
.text:004034BE push dword ptr [edx+4]
.text:004034C1 push dword ptr [edx]
.text:004034C3 push eax
.text:004034C4 call sub_40C400
.text:004034C9 add esp, 14h
.text:004034CC
.text:004034CC loc_4034CC: ; CODE XREF: _TfrmFastDNS_actTestSpendingExecute+D7j
.text:004034CC xor eax, eax
.text:004034CE xor edx, edx
.text:004034D0 mov [ebx+37Ch], eax
.text:004034D6 lea eax, [ebp+var_C]
.text:004034D9 mov [ebp+var_20], 20h
.text:004034DF call unknown_libname_1523 ; CBuilder 4 and Delphi 4 VCL
.text:004034DF ; CBuilder 5 runtime
.text:004034E4 inc [ebp+var_14]
.text:004034E7 mov edx, [eax]
.text:004034E9 mov eax, [ebx+358h]
.text:004034EF call @TControl@SetText ; TControl::SetText
.text:004034F4 dec [ebp+var_14]
.text:004034F7 lea eax, [ebp+var_C]
.text:004034FA mov edx, 2
.text:004034FF call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00403504 mov ecx, [ebx+3F4h]
.text:0040350A push ecx
.text:0040350B push ebx
.text:0040350C call sub_402940
.text:00403511 add esp, 8
.text:00403514 mov eax, [ebp+var_30]
.text:00403517 mov large fs:0, eax
.text:0040351D pop ebx
.text:0040351E mov esp, ebp
.text:00403520 pop ebp
.text:00403521 retn
.text:00403521 _TfrmFastDNS_actTestSpendingExecute endp
.text:00403521

复制代码

.

可知以下3个函数为关键函数，下断点：
0:000> bp 425690 =>STOP
0:000> bp 40ea3c =>FUNC1
0:000> bp 40970c =>FUNC2

发现正如上面分析那样，调用顺序为FUNC1 -> FUNC2 -> STOP FUNC2通过调用堆栈可以得知是在FUNC1中调用的
先来分析三个函数类型：前面425404已经得知第一个和第二个
先断在425690，看调用栈：
0:001> k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
0273ff74 0043d33a FastDNS!Rtflabelinitialization$qqrv+0xd7d8
0273ff88 76b2919f FastDNS!Rtflabelinitialization$qqrv+0x25482
0273ff94 7745b5af KERNEL32!BaseThreadInitThunk+0xe
0273ffdc 7745b57a ntdll!__RtlUserThreadStart+0x2f
0273ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
通过在上层函数中查看当前函数调用之前的状况粗略分析类型：

.text:0043D310 push ebp
.text:0043D311 mov ebp, esp
.text:0043D313 call @System@_16542 ; System::_16542
.text:0043D318 push ebp
.text:0043D319 xor ecx, ecx
.text:0043D31B push offset @System@_16754 ; System::_16754
.text:0043D320 mov edx, fs:[ecx]
.text:0043D323 push edx
.text:0043D324 mov fs:[ecx], esp
.text:0043D327 mov eax, [ebp+arg_0]
.text:0043D32A mov ecx, [eax+4]
.text:0043D32D mov edx, [eax]
.text:0043D32F push ecx
.text:0043D330 push edx
.text:0043D331 call sub_43B5E0
.text:0043D336 pop edx
.text:0043D337 pop eax
.text:0043D338 call edx
.text:0043D33A xor edx, edx
.text:0043D33C pop ecx
.text:0043D33D mov fs:[edx], ecx
.text:0043D340 pop ecx
.text:0043D341 pop ebp
.text:0043D342 pop ebp
.text:0043D343 retn 4

复制代码

根据栈平衡，同时
call edx处可能传递的参数应该在当前call之前，上个call之后，加上调用者代码可以推断使用了eax，没有用到栈参数，其他2函数同理
再到STOP中看：（显然这是终止线程之类的收尾工作，所以这里我取名STOP）
.text:00425690 ; TThread:

oTerminate
.text:00425690 @TThread@DoTerminate proc near       ; DATA XREF: .text:_cls_Classes_TThreado
.text:00425690                                        ; .data:_cls_CalcSpendingThread_TCalcSpendingThreado
.text:00425690 cmp    word ptr [eax+1Ah], 0
.text:00425695 jz    short locret_4256A2
.text:00425697 push eax
.text:00425698 push offset @Controls@TSizeConstraints@Change$qqrv ; Delphi 5 Visual Component Library
.text:00425698                                        ; Delphi2006/BDS2006 Visual Component Library
.text:0042569D call terminate
.text:004256A2
.text:004256A2 locret_4256A2:                         ; CODE XREF: TThread:

oTerminate+5j
.text:004256A2 retn

来到这里：

.text:0040EA3C sub_40EA3C proc near ; DATA XREF: .data:fastdns___CPPdebugHook+105D0o
.text:0040EA3C ; .data:fastdns___CPPdebugHook+11C3Co
.text:0040EA3C
.text:0040EA3C var_14 = dword ptr -14h
.text:0040EA3C var_10 = dword ptr -10h
.text:0040EA3C pertime = dword ptr -0Ch
.text:0040EA3C var_8 = dword ptr -8
.text:0040EA3C a1 = dword ptr -4
.text:0040EA3C
.text:0040EA3C push ebp
.text:0040EA3D mov ebp, esp
.text:0040EA3F add esp, 0FFFFFFECh
.text:0040EA42 mov [ebp+a1], eax
.text:0040EA45 mov eax, [ebp+a1]
.text:0040EA48 mov byte ptr [eax+0Fh], 1
.text:0040EA4C lea edx, [ebp+pertime]
.text:0040EA4F push edx
.text:0040EA50 mov ecx, [ebp+a1]
.text:0040EA53 push dword ptr [ecx+30h]
.text:0040EA56 push [ebp+a1]
.text:0040EA59 call sub_40EAE0
.text:0040EA5E add esp, 0Ch
.text:0040EA61 test al, al
.text:0040EA63 jz short loc_40EA8B
.text:0040EA65 push [ebp+var_8]
.text:0040EA68 push [ebp+pertime]
.text:0040EA6B mov edx, [ebp+a1]
.text:0040EA6E push dword ptr [edx+30h]
.text:0040EA71 call sub_40EABC
.text:0040EA76 add esp, 0Ch
.text:0040EA79 push 0
.text:0040EA7B mov ecx, [ebp+a1]
.text:0040EA7E push dword ptr [ecx+30h]
.text:0040EA81 call sub_40EAD0
.text:0040EA86 add esp, 8
.text:0040EA89 jmp short loc_40EA9B
.text:0040EA8B ; ---------------------------------------------------------------------------
.text:0040EA8B
.text:0040EA8B loc_40EA8B: ; CODE XREF: sub_40EA3C+27j
.text:0040EA8B push 3
.text:0040EA8D mov eax, [ebp+a1]
.text:0040EA90 push dword ptr [eax+30h]
.text:0040EA93 call sub_40EAD0
.text:0040EA98 add esp, 8
.text:0040EA9B
.text:0040EA9B loc_40EA9B: ; CODE XREF: sub_40EA3C+4Dj
.text:0040EA9B mov [ebp+var_14], offset sub_40EA10
.text:0040EAA2 mov edx, [ebp+a1]
.text:0040EAA5 mov [ebp+var_10], edx
.text:0040EAA8 lea ecx, [ebp+var_14]
.text:0040EAAB push dword ptr [ecx+4] ; a5
.text:0040EAAE push dword ptr [ecx] ; a4
.text:0040EAB0 mov eax, [ebp+a1] ; a1
.text:0040EAB3 call terminate
.text:0040EAB8 mov esp, ebp
.text:0040EABA pop ebp
.text:0040EABB retn

复制代码

.

text:0040EAE0 sub_40EAE0 proc near ; CODE XREF: sub_40EA3C+1Dp
.text:0040EAE0
.text:0040EAE0 var_40 = qword ptr -40h
.text:0040EAE0 var_38 = dword ptr -38h
.text:0040EAE0 usedtime = qword ptr -34h
.text:0040EAE0 totoaltime = dword ptr -2Ch
.text:0040EAE0 var_28 = dword ptr -28h
.text:0040EAE0 var_18 = word ptr -18h
.text:0040EAE0 var_C = dword ptr -0Ch
.text:0040EAE0 var_4 = byte ptr -4
.text:0040EAE0 arg_0 = dword ptr 8
.text:0040EAE0 arg_4 = dword ptr 0Ch
.text:0040EAE0 arg_8 = dword ptr 10h
.text:0040EAE0
.text:0040EAE0 push ebp
.text:0040EAE1 mov ebp, esp
.text:0040EAE3 add esp, 0FFFFFFC0h
.text:0040EAE6 mov eax, offset unk_4B3C64
.text:0040EAEB call @__InitExceptBlockLDTC
.text:0040EAF0 mov edx, [ebp+arg_0]
.text:0040EAF3 push dword ptr [edx+40h]
.text:0040EAF6 push [ebp+arg_4]
.text:0040EAF9 call unknown_libname_1142 ; CBuilder 5 runtime
.text:0040EAFE add esp, 8
.text:0040EB01 mov [ebp+var_18], 8
.text:0040EB07 lea eax, [ebp+var_4]
.text:0040EB0A call unknown_libname_1128 ; CBuilder 5 runtime
.text:0040EB0F inc [ebp+var_C]
.text:0040EB12 mov [ebp+var_18], 14h
.text:0040EB18 xor edx, edx
.text:0040EB1A mov [ebp+totoaltime], edx
.text:0040EB1D xor ecx, ecx
.text:0040EB1F mov dword ptr [ebp+usedtime+4], ecx
.text:0040EB22 jmp short loc_40EB61
.text:0040EB24 ; ---------------------------------------------------------------------------
.text:0040EB24
.text:0040EB24 loc_40EB24: ; CODE XREF: sub_40EAE0+8Aj
.text:0040EB24 lea eax, [ebp+usedtime]
.text:0040EB27 push eax
.text:0040EB28 mov edx, [ebp+arg_0]
.text:0040EB2B push edx
.text:0040EB2C mov ecx, [edx]
.text:0040EB2E call dword ptr [ecx+8]
.text:0040EB31 add esp, 8
.text:0040EB34 test al, al
.text:0040EB36 jz short loc_40EB54
.text:0040EB38 mov eax, dword ptr [ebp+usedtime]
.text:0040EB3B add [ebp+totoaltime], eax
.text:0040EB3E push [ebp+arg_4]
.text:0040EB41 call @AspHlpr@TMTSASPObject@getObjectContext$qv_4 ; CBuilder 5 runtime
.text:0040EB41 ; BCC v4.x/5.x class library 32 bit
.text:0040EB46 pop ecx
.text:0040EB47 dec eax
.text:0040EB48 push eax
.text:0040EB49 push [ebp+arg_4]
.text:0040EB4C call unknown_libname_1142 ; CBuilder 5 runtime
.text:0040EB51 add esp, 8
.text:0040EB54
.text:0040EB54 loc_40EB54: ; CODE XREF: sub_40EAE0+56j
.text:0040EB54 mov eax, 64h ; dwMilliseconds
.text:0040EB59 call @Sleep
.text:0040EB5E inc dword ptr [ebp+usedtime+4]
.text:0040EB61
.text:0040EB61 loc_40EB61: ; CODE XREF: sub_40EAE0+42j
.text:0040EB61 mov edx, dword ptr [ebp+usedtime+4]
.text:0040EB64 mov ecx, [ebp+arg_0]
.text:0040EB67 cmp edx, [ecx+40h]
.text:0040EB6A jl short loc_40EB24
.text:0040EB6C push [ebp+arg_4]
.text:0040EB6F call @AspHlpr@TMTSASPObject@getObjectContext$qv_4 ; CBuilder 5 runtime
.text:0040EB6F ; BCC v4.x/5.x class library 32 bit
.text:0040EB74 pop ecx
.text:0040EB75 mov edx, [ebp+arg_0]
.text:0040EB78 cmp eax, [edx+40h]
.text:0040EB7B jz short loc_40EBC9
.text:0040EB7D push [ebp+arg_4]
.text:0040EB80 call @AspHlpr@TMTSASPObject@getObjectContext$qv_4 ; CBuilder 5 runtime
.text:0040EB80 ; BCC v4.x/5.x class library 32 bit
.text:0040EB85 pop ecx
.text:0040EB86 mov ecx, [ebp+arg_0]
.text:0040EB89 mov edx, [ecx+40h]
.text:0040EB8C sub edx, eax
.text:0040EB8E mov [ebp+var_38], edx
.text:0040EB91 fild [ebp+var_38]
.text:0040EB94 mov eax, [ebp+totoaltime]
.text:0040EB97 mov dword ptr [ebp+var_40], eax
.text:0040EB9A xor ecx, ecx
.text:0040EB9C mov dword ptr [ebp+var_40+4], ecx
.text:0040EB9F fild [ebp+var_40]
.text:0040EBA2 fdivrp st(1), st
.text:0040EBA4 mov eax, [ebp+arg_8]
.text:0040EBA7 fstp qword ptr [eax]
.text:0040EBA9 mov al, 1
.text:0040EBAB push eax
.text:0040EBAC dec [ebp+var_C]
.text:0040EBAF lea eax, [ebp+var_4]
.text:0040EBB2 mov edx, 2
.text:0040EBB7 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040EBBC pop eax
.text:0040EBBD mov edx, [ebp+var_28]
.text:0040EBC0 mov large fs:0, edx
.text:0040EBC7 jmp short loc_40EBE7
.text:0040EBC9 ; ---------------------------------------------------------------------------
.text:0040EBC9
.text:0040EBC9 loc_40EBC9: ; CODE XREF: sub_40EAE0+9Bj
.text:0040EBC9 xor eax, eax
.text:0040EBCB push eax
.text:0040EBCC dec [ebp+var_C]
.text:0040EBCF lea eax, [ebp+var_4]
.text:0040EBD2 mov edx, 2
.text:0040EBD7 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040EBDC pop eax
.text:0040EBDD mov edx, [ebp+var_28]
.text:0040EBE0 mov large fs:0, edx
.text:0040EBE7
.text:0040EBE7 loc_40EBE7: ; CODE XREF: sub_40EAE0+E7j
.text:0040EBE7 mov esp, ebp
.text:0040EBE9 pop ebp
.text:0040EBEA retn
.text:0040EBEA sub_40EAE0 endp

复制代码

.t
可以得知该函数循环执行指定次数的dns连接，使用的时间累加到totaltime中，后面使用该时间计算平均用时，整个程序精华在于 (unsigned __int8)(*(int (__cdecl **)(int, int *))(*(_DWORD *)a1 + 8))(a1, &usedtime)这个call，实际上是FUNC2，而sub_40EA3C中可以解释为：

.text:0040EA3C sub_40EA3C proc near ; DATA XREF: .data:fastdns___CPPdebugHook+105D0o
.text:0040EA3C ; .data:fastdns___CPPdebugHook+11C3Co
.text:0040EA3C
.text:0040EA3C var_14 = dword ptr -14h
.text:0040EA3C var_10 = dword ptr -10h
.text:0040EA3C pertime = dword ptr -0Ch
.text:0040EA3C var_8 = dword ptr -8
.text:0040EA3C a1 = dword ptr -4
.text:0040EA3C
.text:0040EA3C push ebp
.text:0040EA3D mov ebp, esp
.text:0040EA3F add esp, 0FFFFFFECh
.text:0040EA42 mov [ebp+a1], eax
.text:0040EA45 mov eax, [ebp+a1]
.text:0040EA48 mov byte ptr [eax+0Fh], 1
.text:0040EA4C lea edx, [ebp+pertime]
.text:0040EA4F push edx
.text:0040EA50 mov ecx, [ebp+a1]
.text:0040EA53 push dword ptr [ecx+30h]
.text:0040EA56 push [ebp+a1]
.text:0040EA59 call sub_40EAE0
.text:0040EA5E add esp, 0Ch
.text:0040EA61 test al, al
.text:0040EA63 jz short loc_40EA8B
.text:0040EA65 push [ebp+var_8]
.text:0040EA68 push [ebp+pertime]
.text:0040EA6B mov edx, [ebp+a1]
.text:0040EA6E push dword ptr [edx+30h]
.text:0040EA71 call sub_40EABC
.text:0040EA76 add esp, 0Ch
.text:0040EA79 push 0
.text:0040EA7B mov ecx, [ebp+a1]
.text:0040EA7E push dword ptr [ecx+30h]
.text:0040EA81 call sub_40EAD0
.text:0040EA86 add esp, 8
.text:0040EA89 jmp short loc_40EA9B
.text:0040EA8B ; ---------------------------------------------------------------------------
.text:0040EA8B
.text:0040EA8B loc_40EA8B: ; CODE XREF: sub_40EA3C+27j
.text:0040EA8B push 3
.text:0040EA8D mov eax, [ebp+a1]
.text:0040EA90 push dword ptr [eax+30h]
.text:0040EA93 call sub_40EAD0
.text:0040EA98 add esp, 8
.text:0040EA9B
.text:0040EA9B loc_40EA9B: ; CODE XREF: sub_40EA3C+4Dj
.text:0040EA9B mov [ebp+var_14], offset sub_40EA10
.text:0040EAA2 mov edx, [ebp+a1]
.text:0040EAA5 mov [ebp+var_10], edx
.text:0040EAA8 lea ecx, [ebp+var_14]
.text:0040EAAB push dword ptr [ecx+4] ; a5
.text:0040EAAE push dword ptr [ecx] ; a4
.text:0040EAB0 mov eax, [ebp+a1] ; a1
.text:0040EAB3 call terminate
.text:0040EAB8 mov esp, ebp
.text:0040EABA pop ebp
.text:0040EABB retn
.

复制代码

现在同时推测param类结构，可知
+00h virtualtable
   +0 STOP
   +4 FUNC1
   +8 FUNC2
+04h HANDLE hthread ??
+0Fh bool Initaled ??
+10h
+18h FARPROC func0
+1Ch LPVOID param0
+20h FARPROC func1//OnIdle处理函数
+24h LPVOID param1
+28h BOOL IsMainthread??
+30h struct*
+00h int leftTime//剩余次数
+08h double pertime//平均消耗时间
+10h flag statu  //成功0 失败3
+38h FARPROC func2
+3Ch DWORD param2
+40h int repeatTime//取样次数
+44h int timeout//超时

设置DNS：
通过字符串搜索，可以定位到TfrmSetDNS_btnConfirmClick函数为点击了设置dns窗口的“设置”按钮后回调函数

.text:004074B4 _TfrmSetDNS_btnConfirmClick proc near ; DATA XREF: .data:fastdns___CPPdebugHook+1E4Co
.text:004074B4
.text:004074B4 var_164 = dword ptr -164h
.text:004074B4 var_160 = dword ptr -160h
.text:004074B4 var_15C = byte ptr -15Ch
.text:004074B4 var_154 = dword ptr -154h
.text:004074B4 var_150 = dword ptr -150h
.text:004074B4 var_14C = byte ptr -14Ch
.text:004074B4 var_144 = dword ptr -144h
.text:004074B4 var_140 = dword ptr -140h
.text:004074B4 var_13C = dword ptr -13Ch
.text:004074B4 var_138 = byte ptr -138h
.text:004074B4 var_130 = dword ptr -130h
.text:004074B4 var_12C = dword ptr -12Ch
.text:004074B4 var_128 = dword ptr -128h
.text:004074B4 var_124 = dword ptr -124h
.text:004074B4 var_120 = byte ptr -120h
.text:004074B4 var_118 = dword ptr -118h
.text:004074B4 var_114 = dword ptr -114h
.text:004074B4 var_110 = dword ptr -110h
.text:004074B4 var_10C = dword ptr -10Ch
.text:004074B4 var_108 = dword ptr -108h
.text:004074B4 var_104 = byte ptr -104h
.text:004074B4 var_FC = dword ptr -0FCh
.text:004074B4 var_F8 = dword ptr -0F8h
.text:004074B4 var_F4 = dword ptr -0F4h
.text:004074B4 var_F0 = byte ptr -0F0h
.text:004074B4 var_E8 = dword ptr -0E8h
.text:004074B4 var_E4 = dword ptr -0E4h
.text:004074B4 var_E0 = dword ptr -0E0h
.text:004074B4 var_DC = byte ptr -0DCh
.text:004074B4 var_D4 = dword ptr -0D4h
.text:004074B4 var_D0 = byte ptr -0D0h
.text:004074B4 var_C8 = dword ptr -0C8h
.text:004074B4 var_C4 = dword ptr -0C4h
.text:004074B4 var_C0 = dword ptr -0C0h
.text:004074B4 var_BC = dword ptr -0BCh
.text:004074B4 var_AC = word ptr -0ACh
.text:004074B4 var_A0 = dword ptr -0A0h
.text:004074B4 var_98 = dword ptr -98h
.text:004074B4 var_94 = dword ptr -94h
.text:004074B4 var_90 = dword ptr -90h
.text:004074B4 var_80 = dword ptr -80h
.text:004074B4 var_78 = byte ptr -78h
.text:004074B4 handle = dword ptr -70h
.text:004074B4 var_60 = dword ptr -60h
.text:004074B4 var_58 = byte ptr -58h
.text:004074B4 var_50 = dword ptr -50h
.text:004074B4 var_4C = dword ptr -4Ch
.text:004074B4 var_48 = byte ptr -48h
.text:004074B4 var_40 = dword ptr -40h
.text:004074B4 addrstring = dword ptr -3Ch
.text:004074B4
.text:004074B4 push ebp
.text:004074B5 mov ebp, esp
.text:004074B7 add esp, 0FFFFFE9Ch
.text:004074BD push ebx
.text:004074BE push esi
.text:004074BF push edi
.text:004074C0 mov [ebp+var_C4], edx
.text:004074C6 mov [ebp+var_C0], eax
.text:004074CC mov eax, offset unk_4A3BBC
.text:004074D1 call @__InitExceptBlockLDTC
.text:004074D6 mov [ebp+var_AC], 14h
.text:004074DF inc [ebp+var_A0]
.text:004074E5 lea edx, [ebp-38h]
.text:004074E8 mov [ebp+var_C8], edx
.text:004074EE xor ecx, ecx
.text:004074F0 xor eax, eax
.text:004074F2 mov [ebp-18h], ecx
.text:004074F5 mov [ebp-14h], eax
.text:004074F8 xor edx, edx
.text:004074FA inc [ebp+var_A0]
.text:00407500 mov [ebp-8], edx
.text:00407503 inc [ebp+var_A0]
.text:00407509 inc [ebp+var_A0]
.text:0040750F inc [ebp+var_A0]
.text:00407515 dec [ebp+var_A0]
.text:0040751B mov [ebp+var_AC], 8
.text:00407524 xor ebx, ebx
.text:00407526 jmp loc_4075C0
.text:0040752B ; ---------------------------------------------------------------------------
.text:0040752B
.text:0040752B loc_40752B: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+127j
.text:0040752B mov [ebp+var_AC], 2Ch
.text:00407534 mov eax, [ebp+var_C0]
.text:0040753A xor edx, edx
.text:0040753C lea ecx, [ebp+addrstring]
.text:0040753F mov eax, [eax+304h]
.text:00407545 mov [ebp+addrstring], edx
.text:00407548 add eax, 218h
.text:0040754D inc [ebp+var_A0]
.text:00407553 mov edx, ebx
.text:00407555 mov eax, [eax]
.text:00407557 mov esi, [eax]
.text:00407559 call dword ptr [esi+0Ch]
.text:0040755C mov esi, [ebp-14h]
.text:0040755F cmp esi, [ebp-8]
.text:00407562 jz short loc_407590
.text:00407564 mov edi, esi
.text:00407566 mov [ebp+var_40], edi
.text:00407569 test edi, edi
.text:0040756B jz short loc_40758A
.text:0040756D mov [ebp+var_AC], 38h
.text:00407576 lea edx, [ebp+addrstring]
.text:00407579 mov eax, [ebp+var_40]
.text:0040757C call @System@AnsiString@$bctr$qqrrx17System@AnsiString ; System::AnsiString::AnsiString(System::AnsiString &)
.text:00407581 mov [ebp+var_AC], 2Ch
.text:0040758A
.text:0040758A loc_40758A: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+B7j
.text:0040758A add dword ptr [ebp-14h], 4
.text:0040758E jmp short loc_4075AC
.text:00407590 ; ---------------------------------------------------------------------------
.text:00407590
.text:00407590 loc_407590: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+AEj
.text:00407590 push 1
.text:00407592 lea ecx, [ebp+var_D0]
.text:00407598 push 1
.text:0040759A push ecx
.text:0040759B lea eax, [ebp+addrstring]
.text:0040759E lea edx, [ebp-18h]
.text:004075A1 push eax
.text:004075A2 push esi
.text:004075A3 push edx
.text:004075A4 call sub_403C34
.text:004075A9 add esp, 18h
.text:004075AC
.text:004075AC loc_4075AC: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+DAj
.text:004075AC dec [ebp+var_A0]
.text:004075B2 lea eax, [ebp+addrstring]
.text:004075B5 mov edx, 2
.text:004075BA call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004075BF inc ebx
.text:004075C0
.text:004075C0 loc_4075C0: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+72j
.text:004075C0 mov ecx, [ebp+var_C0]
.text:004075C6 mov esi, [ecx+304h]
.text:004075CC add esi, 218h
.text:004075D2 mov eax, [esi]
.text:004075D4 mov edx, [eax]
.text:004075D6 call dword ptr [edx+14h]
.text:004075D9 cmp ebx, eax
.text:004075DB jl loc_40752B
.text:004075E1 mov [ebp+var_AC], 44h
.text:004075EA inc [ebp+var_A0]
.text:004075F0 lea ecx, [ebp+var_48]
.text:004075F3 mov [ebp+var_D4], ecx
.text:004075F9 xor eax, eax
.text:004075FB xor edx, edx
.text:004075FD mov [ebp-30h], eax
.text:00407600 mov [ebp-2Ch], edx
.text:00407603 xor ecx, ecx
.text:00407605 inc [ebp+var_A0]
.text:0040760B mov [ebp-20h], ecx
.text:0040760E inc [ebp+var_A0]
.text:00407614 inc [ebp+var_A0]
.text:0040761A inc [ebp+var_A0]
.text:00407620 dec [ebp+var_A0]
.text:00407626 mov [ebp+var_AC], 8
.text:0040762F xor ebx, ebx
.text:00407631 jmp loc_4076E6
.text:00407636 ; ---------------------------------------------------------------------------
.text:00407636
.text:00407636 loc_407636: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+24Dj
.text:00407636 mov eax, [ebp+var_C0]
.text:0040763C mov edx, ebx
.text:0040763E mov eax, [eax+300h]
.text:00407644 call @TCheckListBox@GetChecked ; TCheckListBox::GetChecked
.text:00407649 test al, al
.text:0040764B jz loc_4076E5
.text:00407651 mov [ebp+var_AC], 5Ch
.text:0040765A mov ecx, [ebp+var_C0]
.text:00407660 xor edx, edx
.text:00407662 mov eax, [ecx+300h]
.text:00407668 mov [ebp+var_4C], edx
.text:0040766B add eax, 218h
.text:00407670 mov edx, ebx
.text:00407672 inc [ebp+var_A0]
.text:00407678 lea ecx, [ebp+var_4C]
.text:0040767B mov eax, [eax]
.text:0040767D mov esi, [eax]
.text:0040767F call dword ptr [esi+0Ch]
.text:00407682 mov esi, [ebp-2Ch]
.text:00407685 cmp esi, [ebp-20h]
.text:00407688 jz short loc_4076B6
.text:0040768A mov edi, esi
.text:0040768C mov [ebp+var_50], edi
.text:0040768F test edi, edi
.text:00407691 jz short loc_4076B0
.text:00407693 mov [ebp+var_AC], 68h
.text:0040769C lea edx, [ebp+var_4C]
.text:0040769F mov eax, [ebp+var_50]
.text:004076A2 call @System@AnsiString@$bctr$qqrrx17System@AnsiString ; System::AnsiString::AnsiString(System::AnsiString &)
.text:004076A7 mov [ebp+var_AC], 5Ch
.text:004076B0
.text:004076B0 loc_4076B0: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+1DDj
.text:004076B0 add dword ptr [ebp-2Ch], 4
.text:004076B4 jmp short loc_4076D2
.text:004076B6 ; ---------------------------------------------------------------------------
.text:004076B6
.text:004076B6 loc_4076B6: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+1D4j
.text:004076B6 push 1
.text:004076B8 lea ecx, [ebp+var_DC]
.text:004076BE push 1
.text:004076C0 push ecx
.text:004076C1 lea eax, [ebp+var_4C]
.text:004076C4 lea edx, [ebp-30h]
.text:004076C7 push eax
.text:004076C8 push esi
.text:004076C9 push edx
.text:004076CA call sub_403C34
.text:004076CF add esp, 18h
.text:004076D2
.text:004076D2 loc_4076D2: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+200j
.text:004076D2 dec [ebp+var_A0]
.text:004076D8 lea eax, [ebp+var_4C]
.text:004076DB mov edx, 2
.text:004076E0 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004076E5
.text:004076E5 loc_4076E5: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+197j
.text:004076E5 inc ebx
.text:004076E6
.text:004076E6 loc_4076E6: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+17Dj
.text:004076E6 mov ecx, [ebp+var_C0]
.text:004076EC mov esi, [ecx+300h]
.text:004076F2 add esi, 218h
.text:004076F8 mov eax, [esi]
.text:004076FA mov edx, [eax]
.text:004076FC call dword ptr [edx+14h]
.text:004076FF cmp ebx, eax
.text:00407701 jl loc_407636
.text:00407707 mov ecx, [ebp-14h]
.text:0040770A sub ecx, [ebp-18h]
.text:0040770D test ecx, ecx
.text:0040770F jns short loc_407714
.text:00407711 add ecx, 3
.text:00407714
.text:00407714 loc_407714: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+25Bj
.text:00407714 sar ecx, 2
.text:00407717 cmp ecx, 32h
.text:0040771A jbe loc_4078FA
.text:00407720 mov [ebp+var_AC], 74h
.text:00407729 lea eax, [ebp+var_58]
.text:0040772C lea edx, [ebp+handle]
.text:0040772F push eax
.text:00407730 inc [ebp+var_A0]
.text:00407736 push offset aBDns ; "选中的DNS地址数量过多。\n只允许选择不超"...
.text:0040773B push edx ; _DWORD
.text:0040773C call FormatString
.text:00407741 add esp, 0Ch
.text:00407744 lea ecx, [ebp+handle]
.text:00407747 add [ebp+var_A0], 4
.text:0040774E push ecx
.text:0040774F call MessageBox
.text:00407754 pop ecx
.text:00407755 dec [ebp+var_A0]
.text:0040775B mov [ebp+var_AC], 8
.text:00407764 dec [ebp+var_A0]
.text:0040776A mov eax, [ebp+var_60]
.text:0040776D sub eax, [ebp+handle]
.text:00407770 mov [ebp+var_E0], eax
.text:00407776 mov ebx, [ebp+handle]
.text:00407779 test ebx, ebx
.text:0040777B jz short loc_4077A2
.text:0040777D cmp [ebp+var_E0], 80h
.text:00407787 jbe short loc_407792
.text:00407789 push ebx ; handle
.text:0040778A call __rtl_close
.text:0040778F pop ecx
.text:00407790 jmp short loc_4077A2
.text:00407792 ; ---------------------------------------------------------------------------
.text:00407792
.text:00407792 loc_407792: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+2D3j
.text:00407792 mov eax, [ebp+var_E0]
.text:00407798 push eax
.text:00407799 push ebx
.text:0040779A call sub_4A0CA4
.text:0040779F add esp, 8
.text:004077A2
.text:004077A2 loc_4077A2: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+2C7j
.text:004077A2 ; _TfrmSetDNS_btnConfirmClick+2DCj
.text:004077A2 dec [ebp+var_A0]
.text:004077A8 dec [ebp+var_A0]
.text:004077AE dec [ebp+var_A0]
.text:004077B4 mov edx, [ebp+var_C0]
.text:004077BA mov eax, [edx+2FCh]
.text:004077C0 mov edx, [eax]
.text:004077C2 call dword ptr [edx+0C0h]
.text:004077C8 dec [ebp+var_A0]
.text:004077CE lea edx, [ebp+var_F0]
.text:004077D4 mov ecx, [ebp-2Ch]
.text:004077D7 mov [ebp+var_E4], ecx
.text:004077DD mov eax, [ebp-30h]
.text:004077E0 mov [ebp+var_E8], eax
.text:004077E6 push edx
.text:004077E7 mov ecx, [ebp+var_E4]
.text:004077ED push ecx
.text:004077EE mov eax, [ebp+var_E8]
.text:004077F4 push eax
.text:004077F5 call sub_403254
.text:004077FA add esp, 0Ch
.text:004077FD dec [ebp+var_A0]
.text:00407803 mov edx, [ebp-20h]
.text:00407806 sub edx, [ebp-30h]
.text:00407809 test edx, edx
.text:0040780B jns short loc_407810
.text:0040780D add edx, 3
.text:00407810
.text:00407810 loc_407810: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+357j
.text:00407810 sar edx, 2
.text:00407813 mov [ebp+var_F4], edx
.text:00407819 mov ebx, [ebp-30h]
.text:0040781C test ebx, ebx
.text:0040781E jz short loc_407844
.text:00407820 mov edi, [ebp+var_F4]
.text:00407826 shl edi, 2
.text:00407829 cmp edi, 80h
.text:0040782F jbe short loc_40783A
.text:00407831 push ebx ; handle
.text:00407832 call __rtl_close
.text:00407837 pop ecx
.text:00407838 jmp short loc_407844
.text:0040783A ; ---------------------------------------------------------------------------
.text:0040783A
.text:0040783A loc_40783A: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+37Bj
.text:0040783A push edi
.text:0040783B push ebx
.text:0040783C call sub_4A0CA4
.text:00407841 add esp, 8
.text:00407844
.text:00407844 loc_407844: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+36Aj
.text:00407844 ; _TfrmSetDNS_btnConfirmClick+384j
.text:00407844 dec [ebp+var_A0]
.text:0040784A dec [ebp+var_A0]
.text:00407850 dec [ebp+var_A0]
.text:00407856 lea ecx, [ebp+var_104]
.text:0040785C mov eax, [ebp-14h]
.text:0040785F mov [ebp+var_F8], eax
.text:00407865 mov edx, [ebp-18h]
.text:00407868 mov [ebp+var_FC], edx
.text:0040786E push ecx
.text:0040786F mov eax, [ebp+var_F8]
.text:00407875 push eax
.text:00407876 mov edx, [ebp+var_FC]
.text:0040787C push edx
.text:0040787D call sub_403254
.text:00407882 add esp, 0Ch
.text:00407885 dec [ebp+var_A0]
.text:0040788B mov ecx, [ebp-8]
.text:0040788E sub ecx, [ebp-18h]
.text:00407891 test ecx, ecx
.text:00407893 jns short loc_407898
.text:00407895 add ecx, 3
.text:00407898
.text:00407898 loc_407898: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+3DFj
.text:00407898 sar ecx, 2
.text:0040789B mov [ebp+var_108], ecx
.text:004078A1 mov esi, [ebp-18h]
.text:004078A4 test esi, esi
.text:004078A6 jz short loc_4078DC
.text:004078A8 mov eax, [ebp+var_108]
.text:004078AE shl eax, 2
.text:004078B1 mov [ebp+var_10C], eax
.text:004078B7 cmp [ebp+var_10C], 80h
.text:004078C1 jbe short loc_4078CC
.text:004078C3 push esi ; handle
.text:004078C4 call __rtl_close
.text:004078C9 pop ecx
.text:004078CA jmp short loc_4078DC
.text:004078CC ; ---------------------------------------------------------------------------
.text:004078CC
.text:004078CC loc_4078CC: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+40Dj
.text:004078CC mov edx, [ebp+var_10C]
.text:004078D2 push edx
.text:004078D3 push esi
.text:004078D4 call sub_4A0CA4
.text:004078D9 add esp, 8
.text:004078DC
.text:004078DC loc_4078DC: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+3F2j
.text:004078DC ; _TfrmSetDNS_btnConfirmClick+416j
.text:004078DC dec [ebp+var_A0]
.text:004078E2 dec [ebp+var_A0]
.text:004078E8 mov ecx, [ebp+var_BC]
.text:004078EE mov large fs:0, ecx
.text:004078F5 jmp loc_407D02
.text:004078FA ; ---------------------------------------------------------------------------
.text:004078FA
.text:004078FA loc_4078FA: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+266j
.text:004078FA mov eax, [ebp-2Ch]
.text:004078FD sub eax, [ebp-30h]
.text:00407900 test eax, eax
.text:00407902 jns short loc_407907
.text:00407904 add eax, 3
.text:00407907
.text:00407907 loc_407907: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+44Ej
.text:00407907 sar eax, 2
.text:0040790A test eax, eax
.text:0040790C jnz loc_407B07
.text:00407912 mov [ebp+var_AC], 0C8h
.text:0040791B lea edx, [ebp+var_78]
.text:0040791E lea ecx, [ebp+var_90]
.text:00407924 push edx
.text:00407925 inc [ebp+var_A0]
.text:0040792B push offset aIB ; "请至少选择一个连接。basic_string"
.text:00407930 push ecx ; _DWORD
.text:00407931 call FormatString
.text:00407936 add esp, 0Ch
.text:00407939 lea eax, [ebp+var_90]
.text:0040793F add [ebp+var_A0], 4
.text:00407946 push eax
.text:00407947 call MessageBox
.text:0040794C pop ecx
.text:0040794D dec [ebp+var_A0]
.text:00407953 mov [ebp+var_AC], 8
.text:0040795C dec [ebp+var_A0]
.text:00407962 mov edx, [ebp+var_80]
.text:00407965 sub edx, [ebp+var_90]
.text:0040796B mov [ebp+var_110], edx
.text:00407971 mov ebx, [ebp+var_90]
.text:00407977 test ebx, ebx
.text:00407979 jz short loc_4079A0
.text:0040797B cmp [ebp+var_110], 80h
.text:00407985 jbe short loc_407990
.text:00407987 push ebx ; handle
.text:00407988 call __rtl_close
.text:0040798D pop ecx
.text:0040798E jmp short loc_4079A0
.text:00407990 ; ---------------------------------------------------------------------------
.text:00407990
.text:00407990 loc_407990: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+4D1j
.text:00407990 mov eax, [ebp+var_110]
.text:00407996 push eax
.text:00407997 push ebx
.text:00407998 call sub_4A0CA4
.text:0040799D add esp, 8
.text:004079A0
.text:004079A0 loc_4079A0: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+4C5j
.text:004079A0 ; _TfrmSetDNS_btnConfirmClick+4DAj
.text:004079A0 dec [ebp+var_A0]
.text:004079A6 dec [ebp+var_A0]
.text:004079AC dec [ebp+var_A0]
.text:004079B2 mov edx, [ebp+var_C0]
.text:004079B8 mov eax, [edx+300h]
.text:004079BE mov edx, [eax]
.text:004079C0 call dword ptr [edx+0C0h]
.text:004079C6 dec [ebp+var_A0]
.text:004079CC lea edx, [ebp+var_120]
.text:004079D2 mov ecx, [ebp-2Ch]
.text:004079D5 mov [ebp+var_114], ecx
.text:004079DB mov eax, [ebp-30h]
.text:004079DE mov [ebp+var_118], eax
.text:004079E4 push edx
.text:004079E5 mov ecx, [ebp+var_114]
.text:004079EB push ecx
.text:004079EC mov eax, [ebp+var_118]
.text:004079F2 push eax
.text:004079F3 call sub_403254
.text:004079F8 add esp, 0Ch
.text:004079FB dec [ebp+var_A0]
.text:00407A01 mov edx, [ebp-20h]
.text:00407A04 sub edx, [ebp-30h]
.text:00407A07 test edx, edx
.text:00407A09 jns short loc_407A0E
.text:00407A0B add edx, 3
.text:00407A0E
.text:00407A0E loc_407A0E: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+555j
.text:00407A0E sar edx, 2
.text:00407A11 mov [ebp+var_124], edx
.text:00407A17 mov ebx, [ebp-30h]
.text:00407A1A test ebx, ebx
.text:00407A1C jz short loc_407A52
.text:00407A1E mov ecx, [ebp+var_124]
.text:00407A24 shl ecx, 2
.text:00407A27 mov [ebp+var_128], ecx
.text:00407A2D cmp [ebp+var_128], 80h
.text:00407A37 jbe short loc_407A42
.text:00407A39 push ebx ; handle
.text:00407A3A call __rtl_close
.text:00407A3F pop ecx
.text:00407A40 jmp short loc_407A52
.text:00407A42 ; ---------------------------------------------------------------------------
.text:00407A42
.text:00407A42 loc_407A42: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+583j
.text:00407A42 mov eax, [ebp+var_128]
.text:00407A48 push eax
.text:00407A49 push ebx
.text:00407A4A call sub_4A0CA4
.text:00407A4F add esp, 8
.text:00407A52
.text:00407A52 loc_407A52: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+568j
.text:00407A52 ; _TfrmSetDNS_btnConfirmClick+58Cj
.text:00407A52 dec [ebp+var_A0]
.text:00407A58 dec [ebp+var_A0]
.text:00407A5E dec [ebp+var_A0]
.text:00407A64 lea eax, [ebp+var_138]
.text:00407A6A mov edx, [ebp-14h]
.text:00407A6D mov [ebp+var_12C], edx
.text:00407A73 mov ecx, [ebp-18h]
.text:00407A76 mov [ebp+var_130], ecx
.text:00407A7C push eax
.text:00407A7D mov edx, [ebp+var_12C]
.text:00407A83 push edx
.text:00407A84 mov ecx, [ebp+var_130]
.text:00407A8A push ecx
.text:00407A8B call sub_403254
.text:00407A90 add esp, 0Ch
.text:00407A93 dec [ebp+var_A0]
.text:00407A99 mov eax, [ebp-8]
.text:00407A9C sub eax, [ebp-18h]
.text:00407A9F test eax, eax
.text:00407AA1 jns short loc_407AA6
.text:00407AA3 add eax, 3
.text:00407AA6
.text:00407AA6 loc_407AA6: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+5EDj
.text:00407AA6 sar eax, 2
.text:00407AA9 mov [ebp+var_13C], eax
.text:00407AAF mov esi, [ebp-18h]
.text:00407AB2 test esi, esi
.text:00407AB4 jz short loc_407AEA
.text:00407AB6 mov edx, [ebp+var_13C]
.text:00407ABC shl edx, 2
.text:00407ABF mov [ebp+var_140], edx
.text:00407AC5 cmp [ebp+var_140], 80h
.text:00407ACF jbe short loc_407ADA
.text:00407AD1 push esi ; handle
.text:00407AD2 call __rtl_close
.text:00407AD7 pop ecx
.text:00407AD8 jmp short loc_407AEA
.text:00407ADA ; ---------------------------------------------------------------------------
.text:00407ADA
.text:00407ADA loc_407ADA: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+61Bj
.text:00407ADA mov ecx, [ebp+var_140]
.text:00407AE0 push ecx
.text:00407AE1 push esi
.text:00407AE2 call sub_4A0CA4
.text:00407AE7 add esp, 8
.text:00407AEA
.text:00407AEA loc_407AEA: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+600j
.text:00407AEA ; _TfrmSetDNS_btnConfirmClick+624j
.text:00407AEA dec [ebp+var_A0]
.text:00407AF0 dec [ebp+var_A0]
.text:00407AF6 mov eax, [ebp+var_BC]
.text:00407AFC mov large fs:0, eax
.text:00407B02 jmp loc_407D02
.text:00407B07 ; ---------------------------------------------------------------------------
.text:00407B07
.text:00407B07 loc_407B07: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+458j
.text:00407B07 xor edx, edx
.text:00407B09 mov eax, off_4A4404
.text:00407B0E mov [ebp+var_144], edx
.text:00407B14 mov dl, 1
.text:00407B16 mov [ebp+var_AC], 8
.text:00407B1F mov [ebp+var_AC], 11Ch
.text:00407B28 mov ecx, [ebp+var_C0]
.text:00407B2E call sub_407DCC
.text:00407B33 mov [ebp+var_144], eax
.text:00407B39 lea ecx, [ebp-18h]
.text:00407B3C push ecx
.text:00407B3D lea eax, [ebp-30h]
.text:00407B40 push eax
.text:00407B41 mov edx, [ebp+var_144]
.text:00407B47 push edx
.text:00407B48 call sub_407F6C
.text:00407B4D add esp, 0Ch
.text:00407B50 mov eax, [ebp+var_144]
.text:00407B56 mov edx, [eax]
.text:00407B58 call dword ptr [edx+0E8h]
.text:00407B5E mov ecx, [ebp+var_144]
.text:00407B64 xor eax, eax
.text:00407B66 mov al, [ecx+308h]
.text:00407B6C mov ecx, [ebp+var_C0]
.text:00407B72 cmp eax, 1
.text:00407B75 sbb edx, edx
.text:00407B77 neg edx
.text:00407B79 mov [ecx+308h], dl
.text:00407B7F mov [ebp+var_AC], 8
.text:00407B88 jmp short loc_407BA5
.text:00407B8A ; ---------------------------------------------------------------------------
.text:00407B8A
.text:00407B8A loc_407B8A: ; DATA XREF: .data:fastdns___CPPdebugHook+1A30o
.text:00407B8A mov eax, [ebp+var_C0]
.text:00407B90 mov byte ptr [eax+308h], 0
.text:00407B97 mov [ebp+var_AC], 124h
.text:00407BA0 call @_CatchCleanup$qv ; _CatchCleanup(void)
.text:00407BA5
.text:00407BA5 loc_407BA5: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+6D4j
.text:00407BA5 mov ebx, [ebp+var_144]
.text:00407BAB mov [ebp+var_98], ebx
.text:00407BB1 test ebx, ebx
.text:00407BB3 jz short loc_407BDF
.text:00407BB5 mov eax, [ebx]
.text:00407BB7 mov [ebp+var_94], eax
.text:00407BBD mov [ebp+var_AC], 134h
.text:00407BC6 mov edx, 3
.text:00407BCB mov eax, [ebp+var_98]
.text:00407BD1 mov ecx, [eax]
.text:00407BD3 call dword ptr [ecx-4]
.text:00407BD6 mov [ebp+var_AC], 128h
.text:00407BDF
.text:00407BDF loc_407BDF: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+6FFj
.text:00407BDF mov eax, [ebp+var_C0]
.text:00407BE5 call sub_466E84
.text:00407BEA dec [ebp+var_A0]
.text:00407BF0 lea ecx, [ebp+var_14C]
.text:00407BF6 mov eax, [ebp-2Ch]
.text:00407BF9 mov edx, [ebp-30h]
.text:00407BFC push ecx
.text:00407BFD push eax
.text:00407BFE push edx
.text:00407BFF call sub_403254
.text:00407C04 mov [ebp+var_AC], 8
.text:00407C0D dec [ebp+var_A0]
.text:00407C13 add esp, 0Ch
.text:00407C16 mov edx, [ebp-20h]
.text:00407C19 mov eax, [ebp-30h]
.text:00407C1C sub edx, eax
.text:00407C1E test edx, edx
.text:00407C20 jns short loc_407C25
.text:00407C22 add edx, 3
.text:00407C25
.text:00407C25 loc_407C25: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+76Cj
.text:00407C25 sar edx, 2
.text:00407C28 mov [ebp+var_150], edx
.text:00407C2E mov ebx, eax
.text:00407C30 test ebx, ebx
.text:00407C32 jz short loc_407C68
.text:00407C34 mov eax, [ebp+var_150]
.text:00407C3A shl eax, 2
.text:00407C3D mov [ebp+var_154], eax
.text:00407C43 cmp [ebp+var_154], 80h
.text:00407C4D jbe short loc_407C58
.text:00407C4F push ebx ; handle
.text:00407C50 call __rtl_close
.text:00407C55 pop ecx
.text:00407C56 jmp short loc_407C68
.text:00407C58 ; ---------------------------------------------------------------------------
.text:00407C58
.text:00407C58 loc_407C58: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+799j
.text:00407C58 mov edx, [ebp+var_154]
.text:00407C5E push edx
.text:00407C5F push ebx
.text:00407C60 call sub_4A0CA4
.text:00407C65 add esp, 8
.text:00407C68
.text:00407C68 loc_407C68: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+77Ej
.text:00407C68 ; _TfrmSetDNS_btnConfirmClick+7A2j
.text:00407C68 dec [ebp+var_A0]
.text:00407C6E dec [ebp+var_A0]
.text:00407C74 dec [ebp+var_A0]
.text:00407C7A lea ecx, [ebp+var_15C]
.text:00407C80 mov eax, [ebp-14h]
.text:00407C83 mov edx, [ebp-18h]
.text:00407C86 push ecx
.text:00407C87 push eax
.text:00407C88 push edx
.text:00407C89 call sub_403254
.text:00407C8E add esp, 0Ch
.text:00407C91 dec [ebp+var_A0]
.text:00407C97 mov edx, [ebp-8]
.text:00407C9A mov eax, [ebp-18h]
.text:00407C9D sub edx, eax
.text:00407C9F test edx, edx
.text:00407CA1 jns short loc_407CA6
.text:00407CA3 add edx, 3
.text:00407CA6
.text:00407CA6 loc_407CA6: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+7EDj
.text:00407CA6 sar edx, 2
.text:00407CA9 mov [ebp+var_160], edx
.text:00407CAF mov ebx, eax
.text:00407CB1 test ebx, ebx
.text:00407CB3 jz short loc_407CE9
.text:00407CB5 mov eax, [ebp+var_160]
.text:00407CBB shl eax, 2
.text:00407CBE mov [ebp+var_164], eax
.text:00407CC4 cmp [ebp+var_164], 80h
.text:00407CCE jbe short loc_407CD9
.text:00407CD0 push ebx ; handle
.text:00407CD1 call __rtl_close
.text:00407CD6 pop ecx
.text:00407CD7 jmp short loc_407CE9
.text:00407CD9 ; ---------------------------------------------------------------------------
.text:00407CD9
.text:00407CD9 loc_407CD9: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+81Aj
.text:00407CD9 mov edx, [ebp+var_164]
.text:00407CDF push edx
.text:00407CE0 push ebx
.text:00407CE1 call sub_4A0CA4
.text:00407CE6 add esp, 8
.text:00407CE9
.text:00407CE9 loc_407CE9: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+7FFj
.text:00407CE9 ; _TfrmSetDNS_btnConfirmClick+823j
.text:00407CE9 dec [ebp+var_A0]
.text:00407CEF dec [ebp+var_A0]
.text:00407CF5 mov ecx, [ebp+var_BC]
.text:00407CFB mov large fs:0, ecx
.text:00407D02
.text:00407D02 loc_407D02: ; CODE XREF: _TfrmSetDNS_btnConfirmClick+441j
.text:00407D02 ; _TfrmSetDNS_btnConfirmClick+64Ej
.text:00407D02 pop edi
.text:00407D03 pop esi
.text:00407D04 pop ebx
.text:00407D05 mov esp, ebp
.text:00407D07 pop ebp
.text:00407D08 retn
.text:00407D08 _TfrmSetDNS_btnConfirmClick endp
.

复制代码

经我标注伪代码为：

__int32 *__fastcall TfrmSetDNS_btnConfirmClick(int a1, int a2)
{
int i; // ebx@1
int v3; // eax@2
int j; // ebx@9
int v5; // eax@11
__int32 *result; // eax@28
int v7; // [sp+10h] [bp-160h]@53
int v8; // [sp+1Ch] [bp-154h]@50
int v9; // [sp+20h] [bp-150h]@49
int v10; // [sp+2Ch] [bp-144h]@47
int v11; // [sp+30h] [bp-140h]@43
int v12; // [sp+34h] [bp-13Ch]@42
int v13; // [sp+40h] [bp-130h]@42
int v14; // [sp+44h] [bp-12Ch]@42
int v15; // [sp+48h] [bp-128h]@39
int v16; // [sp+4Ch] [bp-124h]@38
int v17; // [sp+58h] [bp-118h]@38
int v18; // [sp+5Ch] [bp-114h]@38
int v19; // [sp+60h] [bp-110h]@34
int v20; // [sp+64h] [bp-10Ch]@29
int v21; // [sp+68h] [bp-108h]@28
int v22; // [sp+74h] [bp-FCh]@28
int v23; // [sp+78h] [bp-F8h]@28
int v24; // [sp+7Ch] [bp-F4h]@24
int v25; // [sp+88h] [bp-E8h]@24
int v26; // [sp+8Ch] [bp-E4h]@24
int v27; // [sp+90h] [bp-E0h]@20
char v28; // [sp+94h] [bp-DCh]@15
char *v29; // [sp+9Ch] [bp-D4h]@9
char v30; // [sp+A0h] [bp-D0h]@6
int *v31; // [sp+A8h] [bp-C8h]@1
int v32; // [sp+ACh] [bp-C4h]@1
int v33; // [sp+B0h] [bp-C0h]@1
__int32 *v34; // [sp+B4h] [bp-BCh]@46
__int16 v35; // [sp+C4h] [bp-ACh]@1
int v36; // [sp+D0h] [bp-A0h]@1
int v37; // [sp+D8h] [bp-98h]@47
int v38; // [sp+DCh] [bp-94h]@48
int v39; // [sp+E0h] [bp-90h]@34
int v40; // [sp+F0h] [bp-80h]@34
int handle; // [sp+100h] [bp-70h]@20
int v42; // [sp+110h] [bp-60h]@20
int v43; // [sp+120h] [bp-50h]@12
int v44; // [sp+124h] [bp-4Ch]@11
char v45; // [sp+128h] [bp-48h]@9
int v46; // [sp+130h] [bp-40h]@3
int addrstring; // [sp+134h] [bp-3Ch]@2
int v48; // [sp+138h] [bp-38h]@1
int v49; // [sp+140h] [bp-30h]@9
int v50; // [sp+144h] [bp-2Ch]@9
int v51; // [sp+150h] [bp-20h]@9
int v52; // [sp+158h] [bp-18h]@1
int v53; // [sp+15Ch] [bp-14h]@1
int v54; // [sp+168h] [bp-8h]@1
v32 = a2;
v33 = a1;
__InitExceptBlockLDTC();
v31 = &v48;
v52 = 0;
v53 = 0;
v54 = 0;
v36 += 4;
v35 = 8;
for ( i = 0; i < (*(int (**)(void))(**(_DWORD **)(*(_DWORD *)(v33 + 772) + 536) + 20))(); ++i )// 0044a604 GetCount 选中DNS地址个数
{
v35 = 44;
v3 = *(_DWORD *)(v33 + 0x304);
addrstring = 0;
++v36;
(*(void (__fastcall **)(_DWORD, int, int *))(**(_DWORD **)(v3 + 0x218)
+ 12))(// 0044a620 getaddrstring 获取地址文本串
*(_DWORD *)(v3 + 0x218),
i,
&addrstring);
if ( v53 == v54 )
{
sub_403C34((int)&v52, v53, (int)&addrstring, (int)&v30, 1u, 1);
}
else
{
v46 = v53;
if ( v53 )
{
v35 = 56;
System::AnsiString::AnsiString(v46, &addrstring);
v35 = 44;
}
v53 += 4;
}
--v36;
System::AnsiString::~AnsiString(&addrstring, 2);
}
++v36;
v29 = &v45;
v49 = 0;
v50 = 0;
++v36;
v51 = 0;
++v36;
++v36;
++v36;
--v36;
v35 = 8;
for ( j = 0; j < (*(int (**)(void))(**(_DWORD **)(*(_DWORD *)(v33 + 768) + 536) + 20))(); ++j )// 对于网卡列表中的每一项
{
if ( (unsigned __int8)TCheckListBox::GetChecked(*(_DWORD *)(v33 + 768), j) )// 如果复选框选中
{
v35 = 92;
v5 = *(_DWORD *)(v33 + 768);
v44 = 0;
++v36;
(*(void (__fastcall **)(_DWORD, int, int *))(**(_DWORD **)(v5 + 536) + 12))(*(_DWORD *)(v5 + 536), j, &v44);// 获取网卡名称
if ( v50 == v51 )
{
sub_403C34((int)&v49, v50, (int)&v44, (int)&v28, 1u, 1);
}
else
{
v43 = v50;
if ( v50 )
{
v35 = 104;
System::AnsiString::AnsiString(v43, &v44);
v35 = 92;
}
v50 += 4;
}
--v36;
System::AnsiString::~AnsiString(&v44, 2);
}
}
if ( (unsigned int)((v53 - v52) / 4) <= 50 ) // 如果选中dns地址小于50个
{
if ( (v50 - v49) / 4 ) // 如果选中了网卡
{
v35 = 284;
v10 = sub_407DCC((int)off_4A4404, 1, v33);
sub_407F6C(v10, (int)&v49, (int)&v52);
(*(void (**)(void))(*(_DWORD *)v10 + 0xE8))();// 004670dc showmodel and setsetting 设置dns并显示进度
*(_BYTE *)(v33 + 776) = (unsigned int)*(_BYTE *)(v10 + 776) < 1;
v35 = 8;
v37 = v10;
if ( v10 )
{
v38 = *(_DWORD *)v10;
v35 = 308;
(*(void (__fastcall **)(int, signed int))(*(_DWORD *)v37 - 4))(v37, 3);
v35 = 296;
}
sub_466E84(v33);
--v36;
sub_403254(v49, v50);
v35 = 8;
--v36;
v9 = (v51 - v49) / 4;
if ( v49 )
{
v8 = 4 * v9;
if ( (unsigned int)(4 * v9) <= 0x80 )
sub_4A0CA4(v49, v8);
else
_rtl_close(v49);
}
--v36;
--v36;
--v36;
sub_403254(v52, v53);
--v36;
result = (__int32 *)v52;
v7 = (v54 - v52) / 4;
if ( v52 )
{
if ( (unsigned int)(4 * v7) <= 0x80 )
result = sub_4A0CA4(v52, 4 * v7);
else
result = (__int32 *)_rtl_close(v52);
}
}
else
{
v35 = 200;
++v36;
FormatString(&v39, (char *)"请至少选择一个连接。");
v36 += 4;
MessageBox((int)&v39);
--v36;
v35 = 8;
--v36;
v19 = v40 - v39;
if ( v39 )
{
if ( (unsigned int)v19 <= 0x80 )
sub_4A0CA4(v39, v19);
else
_rtl_close(v39);
}
--v36;
--v36;
--v36;
(*(void (**)(void))(**(_DWORD **)(v33 + 768) + 192))();
--v36;
v18 = v50;
v17 = v49;
sub_403254(v49, v50);
--v36;
v16 = (v51 - v49) / 4;
if ( v49 )
{
v15 = 4 * v16;
if ( (unsigned int)(4 * v16) <= 0x80 )
sub_4A0CA4(v49, v15);
else
_rtl_close(v49);
}
--v36;
--v36;
--v36;
v14 = v53;
v13 = v52;
sub_403254(v52, v53);
--v36;
v12 = (v54 - v52) / 4;
if ( v52 )
{
v11 = 4 * v12;
if ( (unsigned int)(4 * v12) <= 0x80 )
sub_4A0CA4(v52, v11);
else
_rtl_close(v52);
}
--v36;
--v36;
result = v34;
}
}
else
{
v35 = 116;
++v36;
FormatString(&handle, "选中的DNS地址数量过多。\n只允许选择不超过50个的DNS地址。");
v36 += 4;
MessageBox((int)&handle);
--v36;
v35 = 8;
--v36;
v27 = v42 - handle;
if ( handle )
{
if ( (unsigned int)v27 <= 0x80 )
sub_4A0CA4(handle, v27);
else
_rtl_close(handle);
}
--v36;
--v36;
--v36;
(*(void (**)(void))(**(_DWORD **)(v33 + 764) + 192))();
--v36;
v26 = v50;
v25 = v49;
sub_403254(v49, v50);
--v36;
v24 = (v51 - v49) / 4;
if ( v49 )
{
if ( (unsigned int)(4 * v24) <= 0x80 )
sub_4A0CA4(v49, 4 * v24);
else
_rtl_close(v49);
}
--v36;
--v36;
--v36;
v23 = v53;
v22 = v52;
result = (__int32 *)sub_403254(v52, v53);
--v36;
v21 = (v54 - v52) / 4;
if ( v52 )
{
v20 = 4 * v21;
if ( (unsigned int)(4 * v21) <= 0x80 )
result = sub_4A0CA4(v52, v20);
else
result = (__int32 *)_rtl_close(v52);
}
--v36;
--v36;
}
return result;
}

复制代码

(*(void (**)(void))(*(_DWORD *)v10 + 0xE8))()通过消息机制最终调用了_TfrmSetDNSProccess_tmrStartTimer
该函数真正执行设置dns：
对于每个网卡接口
00407F88先清除dns netsh interface ip set dns name="??网" source=static addr=none
对于每个dns地址
004082F4逐个添加dns netsh interface ip add dns name="??网" addr=??.??.??.??

text:0040852C _TfrmSetDNSProccess_tmrStartTimer proc near
.text:0040852C ; DATA XREF: .data:fastdns___CPPdebugHook+24E1o
.text:0040852C
.text:0040852C var_30 = dword ptr -30h
.text:0040852C var_2C = dword ptr -2Ch
.text:0040852C var_1C = word ptr -1Ch
.text:0040852C var_10 = dword ptr -10h
.text:0040852C var_8 = dword ptr -8
.text:0040852C var_4 = dword ptr -4
.text:0040852C
.text:0040852C push ebp
.text:0040852D mov ebp, esp
.text:0040852F add esp, 0FFFFFFD0h
.text:00408532 push ebx
.text:00408533 push esi
.text:00408534 push edi
.text:00408535 mov ebx, eax
.text:00408537 mov eax, offset unk_4A4378
.text:0040853C call @__InitExceptBlockLDTC
.text:00408541 xor edx, edx
.text:00408543 mov eax, [ebx+2F8h]
.text:00408549 call unknown_libname_1860 ; Delphi2006/BDS2006 Visual Component Library
.text:00408549 ; BDS 4.0 RTL and VCL
.text:0040854E mov edx, 1
.text:00408553 mov eax, [ebx+2F0h]
.text:00408559 call sub_486B60
.text:0040855E mov eax, [ebx+2FCh]
.text:00408564 mov ecx, [eax+4]
.text:00408567 sub ecx, [eax]
.text:00408569 test ecx, ecx
.text:0040856B jns short loc_408570
.text:0040856D add ecx, 3
.text:00408570
.text:00408570 loc_408570: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+3Fj
.text:00408570 sar ecx, 2
.text:00408573 mov edx, [ebx+300h]
.text:00408579 mov eax, [edx+4]
.text:0040857C sub eax, [edx]
.text:0040857E test eax, eax
.text:00408580 jns short loc_408585
.text:00408582 add eax, 3
.text:00408585
.text:00408585 loc_408585: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+54j
.text:00408585 sar eax, 2
.text:00408588 inc eax
.text:00408589 imul ecx, eax
.text:0040858C mov edx, ecx
.text:0040858E mov eax, [ebx+2F0h]
.text:00408594 call sub_486B6C
.text:00408599 mov edx, [ebx+2FCh]
.text:0040859F mov edi, [edx]
.text:004085A1 jmp loc_4086B7
.text:004085A6 ; ---------------------------------------------------------------------------
.text:004085A6
.text:004085A6 loc_4085A6: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+194j
.text:004085A6 mov eax, [edi]
.text:004085A8 xor edx, edx
.text:004085AA push eax
.text:004085AB push offset unk_4A40BB
.text:004085B0 mov [ebp+var_1C], 8
.text:004085B6 mov [ebp+var_4], edx
.text:004085B9 lea ecx, [ebp+var_4]
.text:004085BC inc [ebp+var_10]
.text:004085BF push ecx
.text:004085C0 call @System@AnsiString@sprintf$qpxce ; CBuilder 5 runtime
.text:004085C5 add esp, 0Ch
.text:004085C8 mov edx, [eax]
.text:004085CA mov eax, [ebx+2F4h]
.text:004085D0 call @TControl@SetText ; TControl::SetText
.text:004085D5 dec [ebp+var_10]
.text:004085D8 lea eax, [ebp+var_4]
.text:004085DB mov edx, 2
.text:004085E0 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004085E5 mov ecx, off_4B9450
.text:004085EB mov eax, [ecx]
.text:004085ED call @TApplication@ProcessMessages ; TApplication::ProcessMessages
.text:004085F2 push edi
.text:004085F3 push ebx
.text:004085F4 call dosetdns
.text:004085F9 add esp, 8
.text:004085FC test al, al
.text:004085FE jnz short loc_40860C
.text:00408600 mov byte ptr [ebx+308h], 1
.text:00408607 jmp loc_4086C6
.text:0040860C ; ---------------------------------------------------------------------------
.text:0040860C
.text:0040860C loc_40860C: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+D2j
.text:0040860C mov edx, 1
.text:00408611 mov eax, [ebx+2F0h]
.text:00408617 call @TProgressBar@StepBy ; TProgressBar::StepBy
.text:0040861C mov edx, [ebx+300h]
.text:00408622 mov esi, [edx]
.text:00408624 mov [ebp+var_30], 1
.text:0040862B jmp short loc_4086A5
.text:0040862D ; ---------------------------------------------------------------------------
.text:0040862D
.text:0040862D loc_40862D: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+182j
.text:0040862D mov eax, [esi]
.text:0040862F xor ecx, ecx
.text:00408631 push eax
.text:00408632 lea eax, [ebp+var_8]
.text:00408635 mov edx, [edi]
.text:00408637 push edx
.text:00408638 push offset unk_4A40D9
.text:0040863D mov [ebp+var_1C], 14h
.text:00408643 mov [ebp+var_8], ecx
.text:00408646 inc [ebp+var_10]
.text:00408649 push eax
.text:0040864A call @System@AnsiString@sprintf$qpxce ; CBuilder 5 runtime
.text:0040864F add esp, 10h
.text:00408652 mov edx, [eax]
.text:00408654 mov eax, [ebx+2F4h]
.text:0040865A call @TControl@SetText ; TControl::SetText
.text:0040865F dec [ebp+var_10]
.text:00408662 lea eax, [ebp+var_8]
.text:00408665 mov edx, 2
.text:0040866A call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040866F mov ecx, off_4B9450
.text:00408675 mov eax, [ecx]
.text:00408677 call @TApplication@ProcessMessages ; TApplication::ProcessMessages
.text:0040867C mov edx, [ebp+var_30]
.text:0040867F push edx
.text:00408680 push esi
.text:00408681 push edi
.text:00408682 push ebx
.text:00408683 call sub_4082F4
.text:00408688 add esp, 10h
.text:0040868B test al, al
.text:0040868D jz short loc_408692
.text:0040868F inc [ebp+var_30]
.text:00408692
.text:00408692 loc_408692: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+161j
.text:00408692 mov edx, 1
.text:00408697 mov eax, [ebx+2F0h]
.text:0040869D call @TProgressBar@StepBy ; TProgressBar::StepBy
.text:004086A2 add esi, 4
.text:004086A5
.text:004086A5 loc_4086A5: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+FFj
.text:004086A5 mov ecx, [ebx+300h]
.text:004086AB cmp esi, [ecx+4]
.text:004086AE jnz loc_40862D
.text:004086B4 add edi, 4
.text:004086B7
.text:004086B7 loc_4086B7: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+75j
.text:004086B7 mov eax, [ebx+2FCh]
.text:004086BD cmp edi, [eax+4]
.text:004086C0 jnz loc_4085A6
.text:004086C6
.text:004086C6 loc_4086C6: ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+DBj
.text:004086C6 mov eax, ebx
.text:004086C8 call sub_466E84
.text:004086CD mov edx, [ebp+var_2C]
.text:004086D0 mov large fs:0, edx
.text:004086D7 pop edi
.text:004086D8 pop esi
.text:004086D9 pop ebx
.text:004086DA mov esp, ebp
.text:004086DC pop ebp
.text:004086DD retn

复制代码

.t

int __fastcall TfrmSetDNSProccess_tmrStartTimer(int a1)
{
int v1; // ebx@1
int i; // edi@1
int v3; // ST0C_4@2
int *v4; // eax@2
int v5; // esi@4
int v6; // ST0C_4@5
int v7; // ST08_4@5
int *v8; // eax@5
int v10; // [sp+Ch] [bp-30h]@4
int v11; // [sp+34h] [bp-8h]@5
int v12; // [sp+38h] [bp-4h]@2
v1 = a1;
__InitExceptBlockLDTC();
unknown_libname_1860(*(_DWORD *)(v1 + 760), 0);
sub_486B60(*(_DWORD *)(v1 + 752), 1);
sub_486B6C(
*(_DWORD *)(v1 + 752),
((*(_DWORD *)(*(_DWORD *)(v1 + 768) + 4) - **(_DWORD **)(v1 + 768)) / 4 + 1)
* ((*(_DWORD *)(*(_DWORD *)(v1 + 764) + 4) - **(_DWORD **)(v1 + 764))
/ 4));
for ( i = **(_DWORD **)(v1 + 764); i != *(_DWORD *)(*(_DWORD *)(v1 + 764) + 4); i += 4 )
{
v3 = *(_DWORD *)i;
v12 = 0;
v4 = (int *)System::AnsiString::sprintf(&v12, (const char *)&unk_4A40BB, v3);
TControl::SetText(*(_DWORD *)(v1 + 756), *v4);// 显示清除原有设置
System::AnsiString::~AnsiString(&v12, 2);
TApplication::ProcessMessages(*off_4B9450[0]);
if ( !cleardns(v1, i) )
{
*(_BYTE *)(v1 + 776) = 1;
return sub_466E84(v1);
}
TProgressBar::StepBy(*(_DWORD *)(v1 + 752), 1);// 更新进度条
v5 = **(_DWORD **)(v1 + 768);
v10 = 1;
while ( v5 != *(_DWORD *)(*(_DWORD *)(v1 + 768) + 4) )
{
v6 = *(_DWORD *)v5;
v7 = *(_DWORD *)i;
v11 = 0;
v8 = (int *)System::AnsiString::sprintf(&v11, (const char *)&unk_4A40D9, v7, v6);
TControl::SetText(*(_DWORD *)(v1 + 756), *v8);// 显示正在写入dns
System::AnsiString::~AnsiString(&v11, 2);
TApplication::ProcessMessages(*off_4B9450[0]);
if ( adddns(v1, i, v5, v10) )
++v10;
TProgressBar::StepBy(*(_DWORD *)(v1 + 752), 1);
v5 += 4;
}
}
return sub_466E84(v1);
}

复制代码

text:00407F88 cleardns proc near ; CODE XREF: _TfrmSetDNSProccess_tmrStartTimer+C8p
.text:00407F88
.text:00407F88 var_F4 = dword ptr -0F4h
.text:00407F88 var_F0 = dword ptr -0F0h
.text:00407F88 var_EC = dword ptr -0ECh
.text:00407F88 var_E8 = dword ptr -0E8h
.text:00407F88 ExitCode = dword ptr -0E4h
.text:00407F88 var_E0 = byte ptr -0E0h
.text:00407F88 var_A0 = byte ptr -0A0h
.text:00407F88 var_7C = dword ptr -7Ch
.text:00407F88 var_6C = dword ptr -6Ch
.text:00407F88 var_64 = dword ptr -64h
.text:00407F88 var_60 = dword ptr -60h
.text:00407F88 var_5C = byte ptr -5Ch
.text:00407F88 var_54 = byte ptr -54h
.text:00407F88 handle = dword ptr -50h
.text:00407F88 var_40 = dword ptr -40h
.text:00407F88 s = dword ptr -38h
.text:00407F88 var_34 = dword ptr -34h
.text:00407F88 var_30 = byte ptr -30h
.text:00407F88 var_28 = dword ptr -28h
.text:00407F88 var_18 = dword ptr -18h
.text:00407F88 var_10 = dword ptr -10h
.text:00407F88 var_C = dword ptr -0Ch
.text:00407F88 var_8 = byte ptr -8
.text:00407F88 arg_0 = dword ptr 8
.text:00407F88 arg_4 = dword ptr 0Ch
.text:00407F88
.text:00407F88 push ebp
.text:00407F89 mov ebp, esp
.text:00407F8B add esp, 0FFFFFF0Ch
.text:00407F91 push ebx
.text:00407F92 push esi
.text:00407F93 push edi
.text:00407F94 lea ebx, [ebp+var_A0]
.text:00407F9A mov eax, offset unk_4A423C
.text:00407F9F call @__InitExceptBlockLDTC
.text:00407FA4 mov esi, offset unk_4A3F18
.text:00407FA9 lea edi, [ebp+var_E0]
.text:00407FAF mov ecx, 10h
.text:00407FB4 rep movsd
.text:00407FB6
.text:00407FB6 loc_407FB6: ; CODE XREF: cleardns+349j
.text:00407FB6 mov [ebp+var_E8], 2
.text:00407FC0 mov [ebp+ExitCode], 0FFFFFFFFh
.text:00407FCA lea eax, [ebp+ExitCode]
.text:00407FD0 push eax ; lpExitCode
.text:00407FD1 lea eax, [ebp+var_8]
.text:00407FD4 mov edx, [ebp+arg_0]
.text:00407FD7 mov ecx, [edx+304h]
.text:00407FDD push ecx ; int
.text:00407FDE mov word ptr [ebx+10h], 8
.text:00407FE4 push eax
.text:00407FE5 lea eax, [ebp+var_E0]
.text:00407FEB inc dword ptr [ebx+1Ch]
.text:00407FEE mov edx, [ebp+arg_4]
.text:00407FF1 mov ecx, [edx]
.text:00407FF3 xor edx, edx
.text:00407FF5 push ecx
.text:00407FF6 push 40h
.text:00407FF8 push eax
.text:00407FF9 mov [ebp+var_C], edx
.text:00407FFC lea ecx, [ebp+var_C]
.text:00407FFF push ecx
.text:00408000 inc dword ptr [ebx+1Ch]
.text:00408003 call decode
.text:00408008 add esp, 0Ch
.text:0040800B cmp [ebp+var_C], 0
.text:0040800F jz short loc_408016
.text:00408011 mov eax, [ebp+var_C]
.text:00408014 jmp short loc_40801B
.text:00408016 ; ---------------------------------------------------------------------------
.text:00408016
.text:00408016 loc_408016: ; CODE XREF: cleardns+87j
.text:00408016 mov eax, offset unk_4A3F8E
.text:0040801B
.text:0040801B loc_40801B: ; CODE XREF: cleardns+8Cj
.text:0040801B push eax
.text:0040801C xor edx, edx
.text:0040801E mov [ebp+var_10], edx
.text:00408021 lea ecx, [ebp+var_10]
.text:00408024 push ecx
.text:00408025 inc dword ptr [ebx+1Ch]
.text:00408028 call @System@AnsiString@sprintf$qpxce ; CBuilder 5 runtime
.text:0040802D add esp, 0Ch
.text:00408030 mov [ebp+var_EC], eax
.text:00408036 mov eax, [ebp+var_EC]
.text:0040803C cmp dword ptr [eax], 0
.text:0040803F jz short loc_40804B
.text:00408041 mov edx, [ebp+var_EC]
.text:00408047 mov ecx, [edx]
.text:00408049 jmp short loc_408050
.text:0040804B ; ---------------------------------------------------------------------------
.text:0040804B
.text:0040804B loc_40804B: ; CODE XREF: cleardns+B7j
.text:0040804B mov ecx, offset unk_4A3F8F
.text:00408050
.text:00408050 loc_408050: ; CODE XREF: cleardns+C1j
.text:00408050 push ecx ; s
.text:00408051 lea eax, [ebp+var_28]
.text:00408054 push eax ; _DWORD
.text:00408055 call FormatString
.text:0040805A add dword ptr [ebx+1Ch], 4
.text:0040805E add esp, 0Ch
.text:00408061 lea edx, [ebp+var_28]
.text:00408064 lea eax, [ebp+var_30]
.text:00408067 push edx ; int
.text:00408068 push eax
.text:00408069 xor edx, edx
.text:0040806B inc dword ptr [ebx+1Ch]
.text:0040806E mov [ebp+var_34], edx
.text:00408071 inc dword ptr [ebx+1Ch]
.text:00408074 lea edx, [ebp+var_34]
.text:00408077 mov eax, off_4B9450
.text:0040807C mov eax, [eax]
.text:0040807E call unknown_libname_1857 ; Delphi 5 Visual Component Library
.text:0040807E ; Delphi2006/BDS2006 Visual Component Library
.text:0040807E ; CBuilder 4 and Delphi 4 VCL
.text:0040807E ; CBuilder 5 runtime
.text:0040807E ; BDS 4.0 RTL and VCL
.text:00408083 lea eax, [ebp+var_34]
.text:00408086 mov eax, [eax]
.text:00408088 xor edx, edx
.text:0040808A mov [ebp+s], edx
.text:0040808D lea edx, [ebp+s]
.text:00408090 inc dword ptr [ebx+1Ch]
.text:00408093 call @ExtractFilePath
.text:00408098 cmp [ebp+s], 0
.text:0040809C jz short loc_4080A3
.text:0040809E mov eax, [ebp+s]
.text:004080A1 jmp short loc_4080A8
.text:004080A3 ; ---------------------------------------------------------------------------
.text:004080A3
.text:004080A3 loc_4080A3: ; CODE XREF: cleardns+114j
.text:004080A3 mov eax, offset unk_4A3F8D
.text:004080A8
.text:004080A8 loc_4080A8: ; CODE XREF: cleardns+119j
.text:004080A8 push eax ; s
.text:004080A9 lea edx, [ebp+handle]
.text:004080AC push edx ; _DWORD
.text:004080AD call FormatString
.text:004080B2 add esp, 0Ch
.text:004080B5 lea ecx, [ebp+handle]
.text:004080B8 add dword ptr [ebx+1Ch], 4
.text:004080BC push ecx ; int
.text:004080BD call sub_40E30C
.text:004080C2 add esp, 10h
.text:004080C5 and eax, 0FFh
.text:004080CA cmp eax, 1
.text:004080CD sbb edx, edx
.text:004080CF neg edx
.text:004080D1 push edx
.text:004080D2 dec dword ptr [ebx+1Ch]
.text:004080D5 dec dword ptr [ebx+1Ch]
.text:004080D8 mov ecx, [ebp+var_40]
.text:004080DB sub ecx, [ebp+handle]
.text:004080DE mov [ebp+var_F0], ecx
.text:004080E4 mov esi, [ebp+handle]
.text:004080E7 test esi, esi
.text:004080E9 jz short loc_408110
.text:004080EB cmp [ebp+var_F0], 80h
.text:004080F5 jbe short loc_408100
.text:004080F7 push esi ; handle
.text:004080F8 call __rtl_close
.text:004080FD pop ecx
.text:004080FE jmp short loc_408110
.text:00408100 ; ---------------------------------------------------------------------------
.text:00408100
.text:00408100 loc_408100: ; CODE XREF: cleardns+16Dj
.text:00408100 mov eax, [ebp+var_F0]
.text:00408106 push eax
.text:00408107 push esi
.text:00408108 call sub_4A0CA4
.text:0040810D add esp, 8
.text:00408110
.text:00408110 loc_408110: ; CODE XREF: cleardns+161j
.text:00408110 ; cleardns+176j
.text:00408110 dec dword ptr [ebx+1Ch]
.text:00408113 dec dword ptr [ebx+1Ch]
.text:00408116 dec dword ptr [ebx+1Ch]
.text:00408119 dec dword ptr [ebx+1Ch]
.text:0040811C lea eax, [ebp+s]
.text:0040811F mov edx, 2
.text:00408124 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00408129 dec dword ptr [ebx+1Ch]
.text:0040812C lea eax, [ebp+var_34]
.text:0040812F mov edx, 2
.text:00408134 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00408139 dec dword ptr [ebx+1Ch]
.text:0040813C dec dword ptr [ebx+1Ch]
.text:0040813F mov ecx, [ebp+var_18]
.text:00408142 sub ecx, [ebp+var_28]
.text:00408145 mov [ebp+var_F4], ecx
.text:0040814B mov edi, [ebp+var_28]
.text:0040814E test edi, edi
.text:00408150 jz short loc_408177
.text:00408152 cmp [ebp+var_F4], 80h
.text:0040815C jbe short loc_408167
.text:0040815E push edi ; handle
.text:0040815F call __rtl_close
.text:00408164 pop ecx
.text:00408165 jmp short loc_408177
.text:00408167 ; ---------------------------------------------------------------------------
.text:00408167
.text:00408167 loc_408167: ; CODE XREF: cleardns+1D4j
.text:00408167 mov eax, [ebp+var_F4]
.text:0040816D push eax
.text:0040816E push edi
.text:0040816F call sub_4A0CA4
.text:00408174 add esp, 8
.text:00408177
.text:00408177 loc_408177: ; CODE XREF: cleardns+1C8j
.text:00408177 ; cleardns+1DDj
.text:00408177 dec dword ptr [ebx+1Ch]
.text:0040817A dec dword ptr [ebx+1Ch]
.text:0040817D dec dword ptr [ebx+1Ch]
.text:00408180 dec dword ptr [ebx+1Ch]
.text:00408183 lea eax, [ebp+var_C]
.text:00408186 mov edx, 2
.text:0040818B call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00408190 dec dword ptr [ebx+1Ch]
.text:00408193 lea eax, [ebp+var_10]
.text:00408196 mov edx, 2
.text:0040819B call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004081A0 pop ecx
.text:004081A1 test cl, cl
.text:004081A3 jz short loc_4081E5
.text:004081A5 mov word ptr [ebx+10h], 44h
.text:004081AB mov edx, offset unk_4A3F90
.text:004081B0 lea eax, [ebp+var_54]
.text:004081B3 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:004081B8 inc dword ptr [ebx+1Ch]
.text:004081BB mov edx, [eax]
.text:004081BD mov eax, [ebp+arg_0]
.text:004081C0 mov eax, [eax+304h]
.text:004081C6 mov ecx, [eax]
.text:004081C8 call dword ptr [ecx+2Ch]
.text:004081CB dec dword ptr [ebx+1Ch]
.text:004081CE lea eax, [ebp+var_54]
.text:004081D1 mov edx, 2
.text:004081D6 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004081DB mov [ebp+ExitCode], 270Fh
.text:004081E5
.text:004081E5 loc_4081E5: ; CODE XREF: cleardns+21Bj
.text:004081E5 cmp [ebp+ExitCode], 0
.text:004081EC jz loc_4082CA
.text:004081F2 push 0 ; hWnd
.text:004081F4 push 0 ; __int16
.text:004081F6 push 5 ; char
.text:004081F8 push 40h ; char
.text:004081FA mov word ptr [ebx+10h], 50h
.text:00408200 lea ecx, [ebp+var_5C]
.text:00408203 xor eax, eax
.text:00408205 push ecx
.text:00408206 lea edx, [ebp+var_60]
.text:00408209 inc dword ptr [ebx+1Ch]
.text:0040820C mov [ebp+var_60], eax
.text:0040820F inc dword ptr [ebx+1Ch]
.text:00408212 mov ecx, [ebp+arg_0]
.text:00408215 mov eax, [ecx+304h]
.text:0040821B mov ecx, [eax]
.text:0040821D call dword ptr [ecx+1Ch]
.text:00408220 lea edx, [ebp+var_60]
.text:00408223 lea ecx, [ebp+var_64]
.text:00408226 mov eax, [edx]
.text:00408228 xor edx, edx
.text:0040822A push eax
.text:0040822B push offset unk_4A3FA5
.text:00408230 mov [ebp+var_64], edx
.text:00408233 push ecx
.text:00408234 inc dword ptr [ebx+1Ch]
.text:00408237 call @System@AnsiString@sprintf$qpxce ; CBuilder 5 runtime
.text:0040823C add esp, 0Ch
.text:0040823F mov esi, eax
.text:00408241 cmp dword ptr [esi], 0
.text:00408244 jz short loc_40824A
.text:00408246 mov eax, [esi]
.text:00408248 jmp short loc_40824F
.text:0040824A ; ---------------------------------------------------------------------------
.text:0040824A
.text:0040824A loc_40824A: ; CODE XREF: cleardns+2BCj
.text:0040824A mov eax, offset unk_4A40AA
.text:0040824F
.text:0040824F loc_40824F: ; CODE XREF: cleardns+2C0j
.text:0040824F push eax ; s
.text:00408250 lea edx, [ebp+var_7C]
.text:00408253 push edx ; _DWORD
.text:00408254 call FormatString
.text:00408259 add esp, 0Ch
.text:0040825C lea ecx, [ebp+var_7C]
.text:0040825F add dword ptr [ebx+1Ch], 4
.text:00408263 push ecx ; int
.text:00408264 call sub_40E26C
.text:00408269 add esp, 14h
.text:0040826C mov [ebp+var_E8], eax
.text:00408272 dec dword ptr [ebx+1Ch]
.text:00408275 dec dword ptr [ebx+1Ch]
.text:00408278 mov edi, [ebp+var_6C]
.text:0040827B mov eax, [ebp+var_7C]
.text:0040827E sub edi, eax
.text:00408280 mov esi, eax
.text:00408282 test esi, esi
.text:00408284 jz short loc_4082A1
.text:00408286 cmp edi, 80h
.text:0040828C jbe short loc_408297
.text:0040828E push esi ; handle
.text:0040828F call __rtl_close
.text:00408294 pop ecx
.text:00408295 jmp short loc_4082A1
.text:00408297 ; ---------------------------------------------------------------------------
.text:00408297
.text:00408297 loc_408297: ; CODE XREF: cleardns+304j
.text:00408297 push edi
.text:00408298 push esi
.text:00408299 call sub_4A0CA4
.text:0040829E add esp, 8
.text:004082A1
.text:004082A1 loc_4082A1: ; CODE XREF: cleardns+2FCj
.text:004082A1 ; cleardns+30Dj
.text:004082A1 dec dword ptr [ebx+1Ch]
.text:004082A4 dec dword ptr [ebx+1Ch]
.text:004082A7 dec dword ptr [ebx+1Ch]
.text:004082AA dec dword ptr [ebx+1Ch]
.text:004082AD lea eax, [ebp+var_60]
.text:004082B0 mov edx, 2
.text:004082B5 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004082BA dec dword ptr [ebx+1Ch]
.text:004082BD lea eax, [ebp+var_64]
.text:004082C0 mov edx, 2
.text:004082C5 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004082CA
.text:004082CA loc_4082CA: ; CODE XREF: cleardns+264j
.text:004082CA cmp [ebp+var_E8], 4
.text:004082D1 jz loc_407FB6
.text:004082D7 cmp [ebp+ExitCode], 0
.text:004082DE setz al
.text:004082E1 and eax, 1
.text:004082E4 mov edx, [ebx]
.text:004082E6 mov large fs:0, edx
.text:004082ED pop edi
.text:004082EE pop esi
.text:004082EF pop ebx
.text:004082F0 mov esp, ebp
.text:004082F2 pop ebp
.text:004082F3 retn

复制代码

.t

bool __cdecl cleardns(int a1, int a2)
{
const char *v2; // eax@3
char *v3; // ecx@6
char *v4; // eax@9
int v5; // eax@20
char **v6; // eax@22
char *v7; // eax@23
int v9; // [sp-10h] [bp-110h]@2
int v10; // [sp-8h] [bp-108h]@2
bool v11; // [sp-4h] [bp-104h]@11
int v12; // [sp+Ch] [bp-F4h]@15
int v13; // [sp+10h] [bp-F0h]@11
char **v14; // [sp+14h] [bp-ECh]@5
int v15; // [sp+18h] [bp-E8h]@2
DWORD ExitCode; // [sp+1Ch] [bp-E4h]@2
char v17; // [sp+20h] [bp-E0h]@1
signed __int16 v18; // [sp+70h] [bp-90h]@2
int v19; // [sp+7Ch] [bp-84h]@2
int v20; // [sp+84h] [bp-7Ch]@25
int v21; // [sp+94h] [bp-6Ch]@26
int v22; // [sp+9Ch] [bp-64h]@22
int v23; // [sp+A0h] [bp-60h]@22
char v24; // [sp+ACh] [bp-54h]@20
int handle; // [sp+B0h] [bp-50h]@11
int v26; // [sp+C0h] [bp-40h]@11
char *s; // [sp+C8h] [bp-38h]@8
int v28; // [sp+CCh] [bp-34h]@8
int v29; // [sp+D8h] [bp-28h]@8
int v30; // [sp+E8h] [bp-18h]@15
int v31; // [sp+F0h] [bp-10h]@5
const char *v32; // [sp+F4h] [bp-Ch]@2
__InitExceptBlockLDTC();
qmemcpy(&v17, &unk_4A3F18, 0x40u);
do
{
v15 = 2;
ExitCode = -1;
v10 = *(_DWORD *)(a1 + 772);
v18 = 8;
++v19;
v9 = *(_DWORD *)a2;
v32 = 0;
++v19;
sub_40CA68((int)&v32, (int)&v17, 64);
if ( v32 )
v2 = v32;
else
v2 = (const char *)&unk_4A3F8E;
v31 = 0;
++v19;
v14 = (char **)System::AnsiString::sprintf(&v31, v2, v9);// 构造netsh命令
if ( *v14 )
v3 = *v14;
else
v3 = (char *)&unk_4A3F8F;
FormatString(&v29, v3);
v19 += 4;
++v19;
v28 = 0;
++v19;
unknown_libname_1857(*off_4B9450[0], &v28);
s = 0;
++v19;
ExtractFilePath(v28, &s);
if ( s )
v4 = s;
else
v4 = (char *)&unk_4A3F8D;
FormatString(&handle, v4);
v19 += 4;
v11 = (unsigned __int8)sub_40E30C((int)&handle, (int)&v29, v10, &ExitCode) < 1u;// CreateProcess netsh程序
--v19;
--v19;
v13 = v26 - handle;
if ( handle )
{
if ( (unsigned int)v13 <= 0x80 )
sub_4A0CA4(handle, v13);
else
_rtl_close(handle);
}
--v19;
--v19;
--v19;
--v19;
System::AnsiString::~AnsiString(&s, 2);
--v19;
System::AnsiString::~AnsiString(&v28, 2);
--v19;
--v19;
v12 = v30 - v29;
if ( v29 )
{
if ( (unsigned int)v12 <= 0x80 )
sub_4A0CA4(v29, v12);
else
_rtl_close(v29);
}
--v19;
--v19;
--v19;
--v19;
System::AnsiString::~AnsiString(&v32, 2);
--v19;
System::AnsiString::~AnsiString(&v31, 2);
if ( v11 )
{
v18 = 68;
v5 = System::AnsiString::AnsiString(&v24, &unk_4A3F90);// 调用的动态库不存在。
++v19;
(*(void (__fastcall **)(_DWORD, _DWORD))(**(_DWORD **)(a1 + 772) + 44))(*(_DWORD *)(a1 + 772), *(_DWORD *)v5);
--v19;
System::AnsiString::~AnsiString(&v24, 2);
ExitCode = 9999;
}
if ( ExitCode )
{
v18 = 80;
++v19;
v23 = 0; // 设置中遇到问题。设置停止。.若不能解决问题，测试结果仍然有效，可据此在网络属性中手工设置DNS。
++v19;
(*(void (__fastcall **)(_DWORD, int *))(**(_DWORD **)(a1 + 772) + 28))(*(_DWORD *)(a1 + 772), &v23);
v22 = 0;
++v19;
v6 = (char **)System::AnsiString::sprintf(&v22, (const char *)&unk_4A3FA5, v23);
if ( *v6 )
v7 = *v6;
else
v7 = (char *)&unk_4A40AA;
FormatString(&v20, v7);
v19 += 4;
v15 = sub_40E26C((int)&v20, 64, 5, 0, 0);
--v19;
--v19;
if ( v20 )
{
if ( (unsigned int)(v21 - v20) <= 0x80 )
sub_4A0CA4(v20, v21 - v20);
else
_rtl_close(v20);
}
--v19;
--v19;
--v19;
--v19;
System::AnsiString::~AnsiString(&v23, 2);
--v19;
System::AnsiString::~AnsiString(&v22, 2);
}
}
while ( v15 == 4 );
return ExitCode == 0;
}

复制代码

。。。。。。。。
adddns可类似分析，这里不再赘述

FASTDNS如何列出网卡的？
开始以为是找注册表，但是procmon无结果，后来还是根据字符串找到了下面的函数，该函数为设置dns的回调：
text:00403524 _TfrmFastDNS_actSetDNSExecute proc near ; DATA XREF: .data:fastdns___CPPdebugHook+1400o

.text:00403524
.text:00403524 var_58 = dword ptr -58h
.text:00403524 var_54 = dword ptr -54h
.text:00403524 var_44 = word ptr -44h
.text:00403524 var_38 = dword ptr -38h
.text:00403524 var_30 = dword ptr -30h
.text:00403524 var_2C = dword ptr -2Ch
.text:00403524 handle = dword ptr -28h
.text:00403524 var_18 = dword ptr -18h
.text:00403524 var_10 = byte ptr -10h
.text:00403524 var_8 = byte ptr -8
.text:00403524 var_4 = byte ptr -4
.text:00403524
.text:00403524 push ebp
.text:00403525 mov ebp, esp
.text:00403527 add esp, 0FFFFFFA8h
.text:0040352A push ebx
.text:0040352B push esi
.text:0040352C push edi
.text:0040352D mov ebx, eax
.text:0040352F mov eax, offset unk_4A29EC
.text:00403534 call @__InitExceptBlockLDTC
.text:00403539 mov [ebp+var_44], 8
.text:0040353F mov edx, offset unk_4A22C4
.text:00403544 lea eax, [ebp+var_4]
.text:00403547 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:0040354C inc [ebp+var_38]
.text:0040354F mov edx, [eax]
.text:00403551 mov eax, [ebx+34Ch]
.text:00403557 call @TControl@SetText ; TControl::SetText
.text:0040355C dec [ebp+var_38]
.text:0040355F lea eax, [ebp+var_4]
.text:00403562 mov edx, 2
.text:00403567 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040356C xor ecx, ecx
.text:0040356E mov dl, 1
.text:00403570 mov [ebp+var_58], ecx
.text:00403573 mov ecx, ebx
.text:00403575 mov [ebp+var_44], 14h
.text:0040357B mov eax, off_4A3D2C
.text:00403580 call sub_40738C
.text:00403585 mov [ebp+var_58], eax
.text:00403588 mov eax, [ebx+340h]
.text:0040358E call @TCustomListView@GetSelection ; TCustomListView::GetSelection
.text:00403593 test eax, eax
.text:00403595 jz loc_403642
.text:0040359B mov edx, [ebp+var_58]
.text:0040359E mov eax, [edx+304h]
.text:004035A4 mov edx, [eax]
.text:004035A6 call dword ptr [edx+0D4h]
.text:004035AC mov [ebp+var_44], 14h
.text:004035B2 xor esi, esi
.text:004035B4 jmp short loc_403629
.text:004035B6 ; ---------------------------------------------------------------------------
.text:004035B6
.text:004035B6 loc_4035B6: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+118j
.text:004035B6 mov eax, [ebx+340h]
.text:004035BC mov edx, esi
.text:004035BE mov eax, [eax+22Ch]
.text:004035C4 call sub_48A1E4
.text:004035C9 mov edx, 3
.text:004035CE call @TListItem@GetState ; TListItem::GetState
.text:004035D3 test al, al
.text:004035D5 jz short loc_403628
.text:004035D7 mov eax, [ebp+var_58]
.text:004035DA mov edx, esi
.text:004035DC mov edi, [eax+304h]
.text:004035E2 mov [ebp+var_44], 20h
.text:004035E8 mov eax, [ebx+340h]
.text:004035EE add edi, 218h
.text:004035F4 mov eax, [eax+22Ch]
.text:004035FA call sub_48A1E4
.text:004035FF mov edx, eax
.text:00403601 lea eax, [ebp+var_8]
.text:00403604 add edx, 24h
.text:00403607 call @System@AnsiString@$bctr$qqrrx17System@AnsiString ; System::AnsiString::AnsiString(System::AnsiString &)
.text:0040360C inc [ebp+var_38]
.text:0040360F mov edx, [eax]
.text:00403611 mov eax, [edi]
.text:00403613 mov ecx, [eax]
.text:00403615 call dword ptr [ecx+38h]
.text:00403618 dec [ebp+var_38]
.text:0040361B lea eax, [ebp+var_8]
.text:0040361E mov edx, 2
.text:00403623 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00403628
.text:00403628 loc_403628: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+B1j
.text:00403628 inc esi
.text:00403629
.text:00403629 loc_403629: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+90j
.text:00403629 mov ecx, [ebx+340h]
.text:0040362F mov eax, [ecx+22Ch]
.text:00403635 call @TListItems@GetCount ; TListItems::GetCount
.text:0040363A cmp esi, eax
.text:0040363C jl loc_4035B6
.text:00403642
.text:00403642 loc_403642: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+71j
.text:00403642 mov eax, [ebp+var_58]
.text:00403645 mov edx, [eax]
.text:00403647 call dword ptr [edx+0E8h]
.text:0040364D mov ecx, [ebp+var_58]
.text:00403650 cmp byte ptr [ecx+308h], 0
.text:00403657 jz short loc_4036C3
.text:00403659 mov [ebp+var_44], 2Ch
.text:0040365F lea eax, [ebp+var_10]
.text:00403662 lea edx, [ebp+handle]
.text:00403665 push eax
.text:00403666 inc [ebp+var_38]
.text:00403669 push offset aSDnsBg ; "设置DNS完成。"
.text:0040366E push edx ; _DWORD
.text:0040366F call FormatString
.text:00403674 add esp, 0Ch
.text:00403677 lea ecx, [ebp+handle]
.text:0040367A add [ebp+var_38], 4
.text:0040367E push ecx
.text:0040367F call MessageBox
.text:00403684 pop ecx
.text:00403685 dec [ebp+var_38]
.text:00403688 mov [ebp+var_44], 14h
.text:0040368E dec [ebp+var_38]
.text:00403691 mov esi, [ebp+var_18]
.text:00403694 mov eax, [ebp+handle]
.text:00403697 sub esi, eax
.text:00403699 mov ebx, eax
.text:0040369B test ebx, ebx
.text:0040369D jz short loc_4036BA
.text:0040369F cmp esi, 80h
.text:004036A5 jbe short loc_4036B0
.text:004036A7 push ebx ; handle
.text:004036A8 call __rtl_close
.text:004036AD pop ecx
.text:004036AE jmp short loc_4036BA
.text:004036B0 ; ---------------------------------------------------------------------------
.text:004036B0
.text:004036B0 loc_4036B0: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+181j
.text:004036B0 push esi
.text:004036B1 push ebx
.text:004036B2 call sub_4A0CA4
.text:004036B7 add esp, 8
.text:004036BA
.text:004036BA loc_4036BA: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+179j
.text:004036BA ; _TfrmFastDNS_actSetDNSExecute+18Aj
.text:004036BA dec [ebp+var_38]
.text:004036BD dec [ebp+var_38]
.text:004036C0 dec [ebp+var_38]
.text:004036C3
.text:004036C3 loc_4036C3: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+133j
.text:004036C3 mov [ebp+var_44], 0
.text:004036C9 jmp short loc_4036D6
.text:004036CB ; ---------------------------------------------------------------------------
.text:004036CB
.text:004036CB loc_4036CB: ; DATA XREF: .data:fastdns___CPPdebugHook+8F0o
.text:004036CB mov [ebp+var_44], 1Ch
.text:004036D1 call @_CatchCleanup$qv ; _CatchCleanup(void)
.text:004036D6
.text:004036D6 loc_4036D6: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+1A5j
.text:004036D6 mov ebx, [ebp+var_58]
.text:004036D9 mov [ebp+var_30], ebx
.text:004036DC test ebx, ebx
.text:004036DE jz short loc_4036FE
.text:004036E0 mov eax, [ebx]
.text:004036E2 mov [ebp+var_2C], eax
.text:004036E5 mov [ebp+var_44], 5Ch
.text:004036EB mov edx, 3
.text:004036F0 mov eax, [ebp+var_30]
.text:004036F3 mov ecx, [eax]
.text:004036F5 call dword ptr [ecx-4]
.text:004036F8 mov [ebp+var_44], 50h
.text:004036FE
.text:004036FE loc_4036FE: ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+1BAj
.text:004036FE mov edx, [ebp+var_54]
.text:00403701 mov large fs:0, edx
.text:00403708 pop edi
.text:00403709 pop esi
.text:0040370A pop ebx
.text:0040370B mov esp, ebp
.text:0040370D pop ebp
.text:0040370E retn
.text:0040370E _TfrmFastDNS_actSetDNSExecute endp
.t
.text:0040738C sub_40738C proc near ; CODE XREF: _TfrmFastDNS_actSetDNSExecute+5Cp
.text:0040738C ; DATA XREF: .data:fastdns___CPPdebugHook+1D0Co
.text:0040738C
.text:0040738C var_54 = byte ptr -54h
.text:0040738C var_49 = byte ptr -49h
.text:0040738C var_48 = dword ptr -48h
.text:0040738C var_38 = word ptr -38h
.text:0040738C var_2C = dword ptr -2Ch
.text:0040738C var_28 = byte ptr -28h
.text:0040738C var_1C = byte ptr -1Ch
.text:0040738C var_4 = dword ptr -4
.text:0040738C
.text:0040738C push ebp
.text:0040738D mov ebp, esp
.text:0040738F add esp, 0FFFFFFACh
.text:00407392 push ebx
.text:00407393 push esi
.text:00407394 push edi
.text:00407395 mov [ebp+var_28], dl
.text:00407398 test dl, dl
.text:0040739A jle short loc_4073A1
.text:0040739C call __ClassCreate
.text:004073A1
.text:004073A1 loc_4073A1: ; CODE XREF: sub_40738C+Ej
.text:004073A1 mov ebx, ecx
.text:004073A3 mov [ebp+var_49], dl
.text:004073A6 mov [ebp+var_4], eax
.text:004073A9 lea esi, [ebp+var_1C]
.text:004073AC mov eax, offset unk_4A3A70
.text:004073B1 call @__InitExceptBlockLDTC
.text:004073B6 mov [ebp+var_38], 8
.text:004073BC mov ecx, ebx
.text:004073BE xor edx, edx
.text:004073C0 mov eax, [ebp+var_4]
.text:004073C3 call sub_401EFC
.text:004073C8 add [ebp+var_2C], 10h
.text:004073CC mov edx, [ebp+var_4]
.text:004073CF xor ecx, ecx
.text:004073D1 xor eax, eax
.text:004073D3 mov byte ptr [edx+308h], 0
.text:004073DA mov [ebp+var_38], 20h
.text:004073E0 inc [ebp+var_2C]
.text:004073E3 mov [esi], ecx
.text:004073E5 mov [esi+4], eax
.text:004073E8 xor edx, edx
.text:004073EA inc [ebp+var_2C]
.text:004073ED mov [esi+10h], edx
.text:004073F0 inc [ebp+var_2C]
.text:004073F3 inc [ebp+var_2C]
.text:004073F6 inc [ebp+var_2C]
.text:004073F9 dec [ebp+var_2C]
.text:004073FC mov [ebp+var_38], 14h
.text:00407402 push esi
.text:00407403 call sub_4071FC
.text:00407408 pop ecx
.text:00407409 mov ebx, [esi]
.text:0040740B jmp short loc_407427
.text:0040740D ; ---------------------------------------------------------------------------
.text:0040740D
.text:0040740D loc_40740D: ; CODE XREF: sub_40738C+9Ej
.text:0040740D mov eax, [ebp+var_4]
.text:00407410 mov eax, [eax+300h]
.text:00407416 add eax, 218h
.text:0040741B mov edx, [ebx]
.text:0040741D mov eax, [eax]
.text:0040741F mov ecx, [eax]
.text:00407421 call dword ptr [ecx+38h]
.text:00407424 add ebx, 4
.text:00407427
.text:00407427 loc_407427: ; CODE XREF: sub_40738C+7Fj
.text:00407427 cmp ebx, [esi+4]
.text:0040742A jnz short loc_40740D
.text:0040742C dec [ebp+var_2C]
.text:0040742F lea ecx, [ebp+var_54]
.text:00407432 mov eax, [esi+4]
.text:00407435 mov edx, [esi]
.text:00407437 push ecx
.text:00407438 push eax
.text:00407439 push edx
.text:0040743A call sub_403254
.text:0040743F mov [ebp+var_38], 14h
.text:00407445 dec [ebp+var_2C]
.text:00407448 add esp, 0Ch
.text:0040744B mov edi, [esi+10h]
.text:0040744E mov eax, [esi]
.text:00407450 sub edi, eax
.text:00407452 test edi, edi
.text:00407454 jns short loc_407459
.text:00407456 add edi, 3
.text:00407459
.text:00407459 loc_407459: ; CODE XREF: sub_40738C+C8j
.text:00407459 sar edi, 2
.text:0040745C mov ebx, eax
.text:0040745E test ebx, ebx
.text:00407460 jz short loc_407482
.text:00407462 mov esi, edi
.text:00407464 shl esi, 2
.text:00407467 cmp esi, 80h
.text:0040746D jbe short loc_407478
.text:0040746F push ebx ; handle
.text:00407470 call __rtl_close
.text:00407475 pop ecx
.text:00407476 jmp short loc_407482
.text:00407478 ; ---------------------------------------------------------------------------
.text:00407478
.text:00407478 loc_407478: ; CODE XREF: sub_40738C+E1j
.text:00407478 push esi
.text:00407479 push ebx
.text:0040747A call sub_4A0CA4
.text:0040747F add esp, 8
.text:00407482
.text:00407482 loc_407482: ; CODE XREF: sub_40738C+D4j
.text:00407482 ; sub_40738C+EAj
.text:00407482 dec [ebp+var_2C]
.text:00407485 dec [ebp+var_2C]
.text:00407488 mov [ebp+var_38], 8
.text:0040748E mov eax, [ebp+var_48]
.text:00407491 mov large fs:0, eax
.text:00407497 mov eax, [ebp+var_4]
.text:0040749A cmp [ebp+var_49], 0
.text:0040749E jz short loc_4074A5
.text:004074A0 call @@AfterConstruction ; __AfterConstruction
.text:004074A5
.text:004074A5 loc_4074A5: ; CODE XREF: sub_40738C+112j
.text:004074A5 pop edi
.text:004074A6 pop esi
.text:004074A7 pop ebx
.text:004074A8 mov esp, ebp
.text:004074AA pop ebp
.text:004074AB retn
.text:004074AB sub_40738C endp
.text:004074AB
.
.text:004071FC sub_4071FC proc near ; CODE XREF: showstatus+374p
.text:004071FC ; sub_40738C+77p
.text:004071FC
.text:004071FC var_54 = byte ptr -54h
.text:004071FC var_4C = dword ptr -4Ch
.text:004071FC SizePointer = dword ptr -48h
.text:004071FC var_44 = byte ptr -44h
.text:004071FC var_3C = byte ptr -3Ch
.text:004071FC var_34 = dword ptr -34h
.text:004071FC var_30 = dword ptr -30h
.text:004071FC var_20 = word ptr -20h
.text:004071FC var_14 = dword ptr -14h
.text:004071FC var_C = dword ptr -0Ch
.text:004071FC var_8 = byte ptr -8
.text:004071FC var_4 = dword ptr -4
.text:004071FC arg_0 = dword ptr 8
.text:004071FC
.text:004071FC push ebp
.text:004071FD mov ebp, esp
.text:004071FF add esp, 0FFFFFFACh
.text:00407202 mov eax, offset unk_4A39F0
.text:00407207 push ebx
.text:00407208 push esi
.text:00407209 push edi
.text:0040720A mov ebx, [ebp+arg_0]
.text:0040720D call @__InitExceptBlockLDTC
.text:00407212 mov edi, [ebx+4]
.text:00407215 mov esi, [ebx]
.text:00407217 mov eax, [ebx+4]
.text:0040721A lea edx, [ebp+var_3C]
.text:0040721D mov [ebp+var_34], eax
.text:00407220 push 0
.text:00407222 push edx
.text:00407223 push esi
.text:00407224 mov ecx, [ebp+var_34]
.text:00407227 push ecx
.text:00407228 push edi
.text:00407229 call sub_403BF8
.text:0040722E add esp, 14h
.text:00407231 mov edi, eax
.text:00407233 mov eax, [ebx+4]
.text:00407236 mov edx, edi
.text:00407238 lea ecx, [ebp+var_44]
.text:0040723B push ecx
.text:0040723C push eax
.text:0040723D push edx
.text:0040723E call sub_403254
.text:00407243 add esp, 0Ch
.text:00407246 mov [ebx+4], edi
.text:00407249 mov [ebp+var_20], 8
.text:0040724F push 280h
.text:00407254 call @$bnwa$qui ; operator new[](uint)
.text:00407259 pop ecx
.text:0040725A mov edi, eax
.text:0040725C mov [ebp+SizePointer], 280h
.text:00407263 mov [ebp+var_20], 8
.text:00407269 lea eax, [ebp+SizePointer]
.text:0040726C push eax ; SizePointer
.text:0040726D push edi ; AdapterInfo
.text:0040726E call GetAdaptersInfo
.text:00407273 cmp eax, 6Fh
.text:00407276 jnz short loc_40728B
.text:00407278 push edi ; handle
.text:00407279 call __close
.text:0040727E pop ecx
.text:0040727F mov edx, [ebp+SizePointer]
.text:00407282 push edx
.text:00407283 call @$bnwa$qui ; operator new[](uint)
.text:00407288 pop ecx
.text:00407289 mov edi, eax
.text:0040728B
.text:0040728B loc_40728B: ; CODE XREF: sub_4071FC+7Aj
.text:0040728B lea eax, [ebp+SizePointer]
.text:0040728E push eax ; SizePointer
.text:0040728F push edi ; AdapterInfo
.text:00407290 call GetAdaptersInfo
.text:00407295 test eax, eax
.text:00407297 jnz loc_40735D
.text:0040729D mov esi, edi
.text:0040729F test esi, esi
.text:004072A1 jz loc_40735D
.text:004072A7
.text:004072A7 loc_4072A7: ; CODE XREF: sub_4071FC+15Bj
.text:004072A7 mov [ebp+var_20], 20h
.text:004072AD lea edx, [esi+8]
.text:004072B0 lea eax, [ebp+var_8]
.text:004072B3 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:004072B8 inc [ebp+var_14]
.text:004072BB lea ecx, [ebp+var_8]
.text:004072BE push ecx
.text:004072BF xor eax, eax
.text:004072C1 mov [ebp+var_4], eax
.text:004072C4 lea edx, [ebp+var_4]
.text:004072C7 push edx
.text:004072C8 inc [ebp+var_14]
.text:004072CB call sub_406FD8
.text:004072D0 add esp, 8
.text:004072D3 dec [ebp+var_14]
.text:004072D6 lea eax, [ebp+var_8]
.text:004072D9 mov edx, 2
.text:004072DE call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004072E3 mov [ebp+var_20], 14h
.text:004072E9 cmp [ebp+var_4], 0
.text:004072ED jz short loc_40733D
.text:004072EF mov ecx, [ebx+4]
.text:004072F2 cmp ecx, [ebx+10h]
.text:004072F5 jz short loc_407324
.text:004072F7 mov eax, [ebx+4]
.text:004072FA mov [ebp+var_4C], eax
.text:004072FD mov edx, [ebp+var_4C]
.text:00407300 mov [ebp+var_C], edx
.text:00407303 test edx, edx
.text:00407305 jz short loc_40731E
.text:00407307 mov [ebp+var_20], 38h
.text:0040730D lea edx, [ebp+var_4]
.text:00407310 mov eax, [ebp+var_C]
.text:00407313 call @System@AnsiString@$bctr$qqrrx17System@AnsiString ; System::AnsiString::AnsiString(System::AnsiString &)
.text:00407318 mov [ebp+var_20], 2Ch
.text:0040731E
.text:0040731E loc_40731E: ; CODE XREF: sub_4071FC+109j
.text:0040731E add dword ptr [ebx+4], 4
.text:00407322 jmp short loc_40733D
.text:00407324 ; ---------------------------------------------------------------------------
.text:00407324
.text:00407324 loc_407324: ; CODE XREF: sub_4071FC+F9j
.text:00407324 push 1
.text:00407326 push 1
.text:00407328 lea ecx, [ebp+var_54]
.text:0040732B push ecx
.text:0040732C lea eax, [ebp+var_4]
.text:0040732F push eax
.text:00407330 mov edx, [ebx+4]
.text:00407333 push edx
.text:00407334 push ebx
.text:00407335 call sub_403C34
.text:0040733A add esp, 18h
.text:0040733D
.text:0040733D loc_40733D: ; CODE XREF: sub_4071FC+F1j
.text:0040733D ; sub_4071FC+126j
.text:0040733D mov esi, [esi]
.text:0040733F dec [ebp+var_14]
.text:00407342 lea eax, [ebp+var_4]
.text:00407345 mov edx, 2
.text:0040734A call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040734F mov [ebp+var_20], 8
.text:00407355 test esi, esi
.text:00407357 jnz loc_4072A7
.text:0040735D
.text:0040735D loc_40735D: ; CODE XREF: sub_4071FC+9Bj
.text:0040735D ; sub_4071FC+A5j
.text:0040735D mov [ebp+var_20], 0
.text:00407363 jmp short loc_407372
.text:00407365 ; ---------------------------------------------------------------------------
.text:00407365
.text:00407365 loc_407365: ; DATA XREF: .data:fastdns___CPPdebugHook+1904o
.text:00407365 xor edi, edi
.text:00407367 mov [ebp+var_20], 10h
.text:0040736D call @_CatchCleanup$qv ; _CatchCleanup(void)
.text:00407372
.text:00407372 loc_407372: ; CODE XREF: sub_4071FC+167j
.text:00407372 push edi ; handle
.text:00407373 call __close
.text:00407378 pop ecx
.text:00407379 mov eax, [ebp+var_30]
.text:0040737C mov large fs:0, eax
.text:00407382 pop edi
.text:00407383 pop esi
.text:00407384 pop ebx
.text:00407385 mov esp, ebp
.text:00407387 pop ebp
.text:00407388 retn

复制代码

.

这里可以看到是用GetAdapterInfo得到的，得到的每个AdapterName再送到sub_406FDB中检查：

text:00406FD8 sub_406FD8 proc near ; CODE XREF: sub_4071FC+CFp
.text:00406FD8
.text:00406FD8 var_50 = dword ptr -50h
.text:00406FD8 var_4C = dword ptr -4Ch
.text:00406FD8 var_3C = word ptr -3Ch
.text:00406FD8 var_30 = dword ptr -30h
.text:00406FD8 var_28 = dword ptr -28h
.text:00406FD8 var_24 = dword ptr -24h
.text:00406FD8 var_20 = byte ptr -20h
.text:00406FD8 var_1C = dword ptr -1Ch
.text:00406FD8 var_18 = byte ptr -18h
.text:00406FD8 var_14 = dword ptr -14h
.text:00406FD8 var_10 = byte ptr -10h
.text:00406FD8 var_C = dword ptr -0Ch
.text:00406FD8 var_8 = byte ptr -8
.text:00406FD8 var_4 = dword ptr -4
.text:00406FD8 arg_0 = dword ptr 8
.text:00406FD8 arg_4 = dword ptr 0Ch
.text:00406FD8
.text:00406FD8 push ebp
.text:00406FD9 mov ebp, esp
.text:00406FDB add esp, 0FFFFFFB0h
.text:00406FDE mov eax, offset unk_4A3914
.text:00406FE3 push ebx
.text:00406FE4 push esi
.text:00406FE5 push edi
.text:00406FE6 call @__InitExceptBlockLDTC
.text:00406FEB mov [ebp+var_3C], 8
.text:00406FF1 xor edx, edx
.text:00406FF3 mov eax, ds:off_427A54
.text:00406FF8 mov [ebp+var_4], edx
.text:00406FFB mov dl, 1
.text:00406FFD inc [ebp+var_30]
.text:00407000 xor ecx, ecx
.text:00407002 mov [ebp+var_3C], 14h
.text:00407008 mov [ebp+var_50], ecx
.text:0040700B mov ecx, 20019h
.text:00407010 mov [ebp+var_3C], 20h
.text:00407016 call @TRegistry@$bctr_0 ; TRegistry::`...'
.text:0040701B mov [ebp+var_50], eax
.text:0040701E mov edx, 80000002h
.text:00407023 mov eax, [ebp+var_50]
.text:00407026 call j_@TRegistry@SetRootKey ; TRegistry::SetRootKey
.text:0040702B mov [ebp+var_3C], 2Ch
.text:00407031 mov edx, offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Control\\Net"...
.text:00407036 lea eax, [ebp+var_8]
.text:00407039 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:0040703E inc [ebp+var_30]
.text:00407041 xor ecx, ecx
.text:00407043 mov [ebp+var_C], ecx
.text:00407046 lea ecx, [ebp+var_C]
.text:00407049 inc [ebp+var_30]
.text:0040704C mov edx, [ebp+arg_4]
.text:0040704F call @System@AnsiString@$badd$xqqrrx17System@AnsiString ; System::AnsiString::operator+(System::AnsiString &)
.text:00407054 lea eax, [ebp+var_C]
.text:00407057 push eax
.text:00407058 mov edx, offset aConnection ; "\\Connection\"
.text:0040705D lea eax, [ebp+var_10]
.text:00407060 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:00407065 inc [ebp+var_30]
.text:00407068 xor eax, eax
.text:0040706A mov [ebp+var_14], eax
.text:0040706D lea edx, [ebp+var_10]
.text:00407070 inc [ebp+var_30]
.text:00407073 lea ecx, [ebp+var_14]
.text:00407076 pop eax
.text:00407077 call @System@AnsiString@$badd$xqqrrx17System@AnsiString ; System::AnsiString::operator+(System::AnsiString &)
.text:0040707C lea edx, [ebp+var_14]
.text:0040707F mov edx, [edx]
.text:00407081 xor ecx, ecx
.text:00407083 mov eax, [ebp+var_50]
.text:00407086 call @TRegistry@OpenKey ; TRegistry::OpenKey
.text:0040708B push eax
.text:0040708C dec [ebp+var_30]
.text:0040708F lea eax, [ebp+var_14]
.text:00407092 mov edx, 2
.text:00407097 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040709C dec [ebp+var_30]
.text:0040709F lea eax, [ebp+var_10]
.text:004070A2 mov edx, 2
.text:004070A7 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004070AC dec [ebp+var_30]
.text:004070AF lea eax, [ebp+var_C]
.text:004070B2 mov edx, 2
.text:004070B7 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004070BC dec [ebp+var_30]
.text:004070BF lea eax, [ebp+var_8]
.text:004070C2 mov edx, 2
.text:004070C7 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004070CC pop ecx
.text:004070CD test cl, cl
.text:004070CF jz short loc_407129
.text:004070D1 mov [ebp+var_3C], 38h
.text:004070D7 mov edx, offset aName ; "Name"
.text:004070DC lea eax, [ebp+var_18]
.text:004070DF call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:004070E4 inc [ebp+var_30]
.text:004070E7 mov edx, [eax]
.text:004070E9 xor eax, eax
.text:004070EB mov [ebp+var_1C], eax
.text:004070EE lea ecx, [ebp+var_1C]
.text:004070F1 inc [ebp+var_30]
.text:004070F4 mov eax, [ebp+var_50]
.text:004070F7 call @TRegistry@ReadString ; TRegistry::ReadString
.text:004070FC lea edx, [ebp+var_1C]
.text:004070FF lea eax, [ebp+var_4]
.text:00407102 call sub_4A0484
.text:00407107 dec [ebp+var_30]
.text:0040710A lea eax, [ebp+var_1C]
.text:0040710D mov edx, 2
.text:00407112 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00407117 dec [ebp+var_30]
.text:0040711A lea eax, [ebp+var_18]
.text:0040711D mov edx, 2
.text:00407122 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00407127 jmp short loc_40715A
.text:00407129 ; ---------------------------------------------------------------------------
.text:00407129
.text:00407129 loc_407129: ; CODE XREF: sub_406FD8+F7j
.text:00407129 mov [ebp+var_3C], 44h
.text:0040712F mov edx, offset unk_4A37E9
.text:00407134 lea eax, [ebp+var_20]
.text:00407137 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:0040713C inc [ebp+var_30]
.text:0040713F lea edx, [ebp+var_20]
.text:00407142 lea eax, [ebp+var_4]
.text:00407145 call sub_4A0484
.text:0040714A dec [ebp+var_30]
.text:0040714D lea eax, [ebp+var_20]
.text:00407150 mov edx, 2
.text:00407155 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040715A
.text:0040715A loc_40715A: ; CODE XREF: sub_406FD8+14Fj
.text:0040715A mov [ebp+var_3C], 14h
.text:00407160 jmp short loc_40716D
.text:00407162 ; ---------------------------------------------------------------------------
.text:00407162
.text:00407162 loc_407162: ; DATA XREF: .data:fastdns___CPPdebugHook+17B4o
.text:00407162 mov [ebp+var_3C], 28h
.text:00407168 call @_CatchCleanup$qv ; _CatchCleanup(void)
.text:0040716D
.text:0040716D loc_40716D: ; CODE XREF: sub_406FD8+188j
.text:0040716D mov ebx, [ebp+var_50]
.text:00407170 mov [ebp+var_28], ebx
.text:00407173 test ebx, ebx
.text:00407175 jz short loc_407195
.text:00407177 mov eax, [ebx]
.text:00407179 mov [ebp+var_24], eax
.text:0040717C mov [ebp+var_3C], 5Ch
.text:00407182 mov edx, 3
.text:00407187 mov eax, [ebp+var_28]
.text:0040718A mov ecx, [eax]
.text:0040718C call dword ptr [ecx-4]
.text:0040718F mov [ebp+var_3C], 50h
.text:00407195
.text:00407195 loc_407195: ; CODE XREF: sub_406FD8+19Dj
.text:00407195 mov [ebp+var_3C], 68h
.text:0040719B lea edx, [ebp+var_4]
.text:0040719E mov eax, [ebp+arg_0]
.text:004071A1 call sub_4A0484
.text:004071A6 mov eax, [ebp+arg_0]
.text:004071A9 mov edx, 2
.text:004071AE mov [ebp+var_3C], 74h
.text:004071B4 push eax
.text:004071B5 lea eax, [ebp+var_4]
.text:004071B8 dec [ebp+var_30]
.text:004071BB call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004071C0 pop eax
.text:004071C1 mov [ebp+var_3C], 68h
.text:004071C7 inc [ebp+var_30]
.text:004071CA mov edx, [ebp+var_4C]
.text:004071CD mov large fs:0, edx
.text:004071D4 pop edi
.text:004071D5 pop esi
.text:004071D6 pop ebx
.text:004071D7 mov esp, ebp
.text:004071D9 pop ebp
.text:004071DA retn
.text:004071DA sub_406FD8 endp
.text:004071DA

复制代码

.t

int __cdecl sub_406FD8(int a1, int a2)
{
int v2; // eax@1
char v3; // ST00_1@1
int v4; // edx@2
int v5; // ST3C_4@5
int v7; // [sp+Ch] [bp-50h]@1
char v8; // [sp+3Ch] [bp-20h]@3
int v9; // [sp+40h] [bp-1Ch]@2
char v10; // [sp+44h] [bp-18h]@2
int v11; // [sp+48h] [bp-14h]@1
char v12; // [sp+4Ch] [bp-10h]@1
int v13; // [sp+50h] [bp-Ch]@1
char v14; // [sp+54h] [bp-8h]@1
int v15; // [sp+58h] [bp-4h]@1
__InitExceptBlockLDTC();
v15 = 0;
v7 = TRegistry::`...'(dword_427AA0, 1, 131097);
TRegistry::SetRootKey(v7, -2147483646);
v2 = System::AnsiString::AnsiString(
&v14,
"SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\");
v13 = 0;
System::AnsiString::operator+(v2, a2, &v13);
System::AnsiString::AnsiString(&v12, "\\Connection\");
v11 = 0;
System::AnsiString::operator+(&v13, &v12, &v11);
v3 = TRegistry::OpenKey(v7, v11, 0);
System::AnsiString::~AnsiString(&v11, 2);
System::AnsiString::~AnsiString(&v12, 2);
System::AnsiString::~AnsiString(&v13, 2);
System::AnsiString::~AnsiString(&v14, 2);
if ( v3 )
{
v4 = *(_DWORD *)System::AnsiString::AnsiString(&v10, "Name");
v9 = 0;
TRegistry::ReadString(v7, v4);
sub_4A0484(&v15, &v9);
System::AnsiString::~AnsiString(&v9, 2);
System::AnsiString::~AnsiString(&v10, 2);
}
else
{
System::AnsiString::AnsiString(&v8, &unk_4A37E9);
sub_4A0484(&v15, &v8);
System::AnsiString::~AnsiString(&v8, 2);
}
if ( v7 )
{
v5 = *(_DWORD *)v7;
(*(void (__fastcall **)(int, signed int))(*(_DWORD *)v7 - 4))(v7, 3);
}
sub_4A0484(a1, &v15);
System::AnsiString::~AnsiString(&v15, 2);
return a1;
}

复制代码

做一些字符串操作然后查注册表中存储的网卡信息，取得name并存储

FASTDNS如何初始化那些DNS串的，存储在哪里？
熟悉windows消息机制的会清楚，ListView显示条目用的是SendMessage LVM_SETITEXT或类似机制，而绝不是自己设置，那么我们只需要在启动时加载程序并拦截该函数，看看数目和ip数目吻合程度就知道了。由于结果较多只贴出循环节：
hwnd=812a0 msg=4103
hwnd=812a0 msg=4101
hwnd=812a0 msg=4109
hwnd=812a0 msg=4142
此时可以用spy++查下hwnd是不是ListView，然后看看消息代码
可知分别对应：
LVM_GETITEMA LVM_INSERTITEMA LVM_FINDITEMA LVM_SETITEMTEXTA
第二个和第四个正是我们处理多column的ListView所用的操作，没想到Delphi程序也是这么做的（只不过可能经过层层封装）
下条件断点，进入后发现LVITEM.pszText为-1(LPSTR_TEXTCALLBACK，该消息是说显示到哪再加载那里的数据，较为灵活，对分析造成了困难)，也就是说并未再此时赋值，因此使用该方法寻找dns地址根源是失败的，那么我们再次想到字符串，用winhex搜索地址串，并下数据断点，等移动ListView的滚动条时，程序自动断下，进入.text:0048C33C ; TCustomListView::CNNotify
。。。。。。。。

else
{
v4 = v3 + 308;
if ( v4 )
{
v5 = v4 - 151;
if ( v5 )
{
v6 = v5 - 5;
if ( v6 )
{
if ( v6 == 2 ) // LVN_GETDISPINFOA
{
v64 = TCustomListView::GetItem(v106, (const void *)(v2 + 12));
v65 = *(_DWORD *)(v105 + 8);
v66 = v65 + 12;
if ( *(_BYTE *)(v65 + 12) & 1 )
{
v67 = *(_DWORD *)(v65 + 20);
if ( v67 )
{
v96 = *(_DWORD *)(v64 + 8);
if ( v67 > (*(int (__cdecl **)(unsigned int, _UNKNOWN *, int *))(*(_DWORD *)v96 + 20))(v87, v88, v89) )
{
**(_BYTE **)(v66 + 20) = 0;
}
else
{
(*(void (__fastcall **)(int, int, int *))(*(_DWORD *)v96 + 12))(v96, *(_DWORD *)(v66 + 8) - 1, &v91);
StrPLCopy(*(void **)(v66 + 20), v91, *(_DWORD *)(v66 + 24) - 1);
}
}
else
{
StrPLCopy(*(void **)(v65 + 32), *(char **)(v64 + 0x24), *(_DWORD *)(v65 + 36) - 1);
}
}

复制代码

。。。。。。。。
可以看到这里正是我们需要的LVN_GETDISPINFOA，程序通过该回调设置真正的列表数据
程序经过最后面这个StrPLCopy，因此我们的重点是看谁改了v64，向上发现源头在TCustomListView::GetItem
跟进，发现最终源头为SendMessageA(hWnd, LVM_GETITEM, 0, &lvitem);得到的*(char*)(lvitem->lparam+0x24)最终结果。
那么谁设置了lparam呢？继续追寻
-100 -101 -102 -150
LVN_ITEMCHANGING FFFFFF9C
LVN_ITEMCHANGED FFFFFF9B
LVN_INSERTITEM FFFFFF9A
LVN_GETDISPINFOA FFFFFF6A
如果下消息断点，并不能发现LVM_SETITEM消息，可能是对delphi不了解吧
这时还要采用最古老的方法，既然显示给我们了，那么内存里已经有字符串，并且一定是解密的，winhex找到位置后，下硬件断点，到了这里：
FastDNS!DnslistFinalize+0x555:
0040ba8d 3a4d14 cmp cl,byte ptr [ebp+14h] ss:002b:0018fbf4=2c
向上层回溯，看看拿到dns地址的根源在什么地方：

.text:0040A258 sub_40A258 proc near ; CODE XREF: sub_402474+81p
.text:0040A258
.text:0040A258 var_180 = dword ptr -180h
.text:0040A258 var_17C = dword ptr -17Ch
.text:0040A258 var_178 = byte ptr -178h
.text:0040A258 var_170 = dword ptr -170h
.text:0040A258 var_16C = dword ptr -16Ch
.text:0040A258 var_168 = dword ptr -168h
.text:0040A258 var_164 = byte ptr -164h
.text:0040A258 var_15C = dword ptr -15Ch
.text:0040A258 var_158 = dword ptr -158h
.text:0040A258 var_154 = dword ptr -154h
.text:0040A258 var_150 = dword ptr -150h
.text:0040A258 var_14C = dword ptr -14Ch
.text:0040A258 var_148 = dword ptr -148h
.text:0040A258 var_144 = dword ptr -144h
.text:0040A258 var_140 = dword ptr -140h
.text:0040A258 var_13C = byte ptr -13Ch
.text:0040A258 var_134 = dword ptr -134h
.text:0040A258 var_130 = byte ptr -130h
.text:0040A258 var_128 = dword ptr -128h
.text:0040A258 var_124 = byte ptr -124h
.text:0040A258 var_11C = dword ptr -11Ch
.text:0040A258 var_118 = dword ptr -118h
.text:0040A258 var_114 = byte ptr -114h
.text:0040A258 var_F0 = dword ptr -0F0h
.text:0040A258 var_EC = byte ptr -0ECh
.text:0040A258 var_E8 = dword ptr -0E8h
.text:0040A258 var_D8 = dword ptr -0D8h
.text:0040A258 var_D0 = dword ptr -0D0h
.text:0040A258 var_CC = byte ptr -0CCh
.text:0040A258 var_C8 = dword ptr -0C8h
.text:0040A258 var_B8 = dword ptr -0B8h
.text:0040A258 var_B0 = dword ptr -0B0h
.text:0040A258 var_AC = byte ptr -0ACh
.text:0040A258 var_A4 = dword ptr -0A4h
.text:0040A258 var_A0 = dword ptr -0A0h
.text:0040A258 var_7C = dword ptr -7Ch
.text:0040A258 handle = dword ptr -58h
.text:0040A258 var_30 = dword ptr -30h
.text:0040A258 var_18 = dword ptr -18h
.text:0040A258 arg_0 = dword ptr 8
.text:0040A258 arg_4 = dword ptr 0Ch
.text:0040A258
.text:0040A258 push ebp
.text:0040A259 mov ebp, esp
.text:0040A25B add esp, 0FFFFFE80h
.text:0040A261 push ebx
.text:0040A262 push esi
.text:0040A263 push edi
.text:0040A264 lea ebx, [ebp+var_114]
.text:0040A26A mov eax, offset unk_4B2A5C
.text:0040A26F call @__InitExceptBlockLDTC
.text:0040A274 mov edx, [ebp+arg_0]
.text:0040A277 push edx
.text:0040A278 call sub_40C368
.text:0040A27D pop ecx
.text:0040A27E xor eax, eax
.text:0040A280 mov word ptr [ebx+10h], 14h
.text:0040A286 inc dword ptr [ebx+1Ch]
.text:0040A289 lea ecx, [ebp-38h]
.text:0040A28C mov [ebp+var_118], ecx
.text:0040A292 mov [ebp+var_18], eax
.text:0040A295 xor edx, edx
.text:0040A297 xor ecx, ecx
.text:0040A299 mov [ebp+var_18+4], edx
.text:0040A29C lea eax, [ebp-40h]
.text:0040A29F inc dword ptr [ebx+1Ch]
.text:0040A2A2 mov [ebp+var_18+10h], ecx
.text:0040A2A5 inc dword ptr [ebx+1Ch]
.text:0040A2A8 inc dword ptr [ebx+1Ch]
.text:0040A2AB inc dword ptr [ebx+1Ch]
.text:0040A2AE dec dword ptr [ebx+1Ch]
.text:0040A2B1 lea edx, [ebp+handle]
.text:0040A2B4 mov word ptr [ebx+10h], 8
.text:0040A2BA mov word ptr [ebx+10h], 2Ch
.text:0040A2C0 push eax
.text:0040A2C1 inc dword ptr [ebx+1Ch]
.text:0040A2C4 push offset asc_4B2712 ; "\r\n"
.text:0040A2C9 push edx ; _DWORD
.text:0040A2CA call FormatString
.text:0040A2CF add dword ptr [ebx+1Ch], 4
.text:0040A2D3 mov ecx, [ebp+var_18+4]
.text:0040A2D6 add esp, 0Ch
.text:0040A2D9 cmp ecx, [ebp+var_18+10h]
.text:0040A2DC jz short loc_40A316
.text:0040A2DE mov eax, [ebp+var_18+4]
.text:0040A2E1 mov [ebp+var_11C], eax
.text:0040A2E7 mov edx, [ebp+var_11C]
.text:0040A2ED mov [ebp-5Ch], edx
.text:0040A2F0 test edx, edx
.text:0040A2F2 jz short loc_40A310
.text:0040A2F4 mov word ptr [ebx+10h], 38h
.text:0040A2FA lea eax, [ebp+handle]
.text:0040A2FD push eax
.text:0040A2FE mov ecx, [ebp-5Ch]
.text:0040A301 push ecx
.text:0040A302 call sub_40AD98
.text:0040A307 mov word ptr [ebx+10h], 2Ch
.text:0040A30D add esp, 8
.text:0040A310
.text:0040A310 loc_40A310: ; CODE XREF: sub_40A258+9Aj
.text:0040A310 add [ebp+var_18+4], 18h
.text:0040A314 jmp short loc_40A335
.text:0040A316 ; ---------------------------------------------------------------------------
.text:0040A316
.text:0040A316 loc_40A316: ; CODE XREF: sub_40A258+84j
.text:0040A316 push 1
.text:0040A318 push 1
.text:0040A31A lea eax, [ebp+var_124]
.text:0040A320 push eax
.text:0040A321 lea edx, [ebp+handle]
.text:0040A324 push edx
.text:0040A325 mov ecx, [ebp+var_18+4]
.text:0040A328 push ecx
.text:0040A329 lea eax, [ebp+var_18]
.text:0040A32C push eax
.text:0040A32D call sub_40A968
.text:0040A332 add esp, 18h
.text:0040A335
.text:0040A335 loc_40A335: ; CODE XREF: sub_40A258+BCj
.text:0040A335 dec dword ptr [ebx+1Ch]
.text:0040A338 mov word ptr [ebx+10h], 8
.text:0040A33E dec dword ptr [ebx+1Ch]
.text:0040A341 mov edi, [ebp+handle+10h]
.text:0040A344 sub edi, [ebp+handle]
.text:0040A347 mov esi, [ebp+handle]
.text:0040A34A test esi, esi
.text:0040A34C jz short loc_40A369
.text:0040A34E cmp edi, 80h
.text:0040A354 jbe short loc_40A35F
.text:0040A356 push esi ; handle
.text:0040A357 call __rtl_close
.text:0040A35C pop ecx
.text:0040A35D jmp short loc_40A369
.text:0040A35F ; ---------------------------------------------------------------------------
.text:0040A35F
.text:0040A35F loc_40A35F: ; CODE XREF: sub_40A258+FCj
.text:0040A35F push edi
.text:0040A360 push esi
.text:0040A361 call sub_4A0CA4
.text:0040A366 add esp, 8
.text:0040A369
.text:0040A369 loc_40A369: ; CODE XREF: sub_40A258+F4j
.text:0040A369 ; sub_40A258+105j
.text:0040A369 dec dword ptr [ebx+1Ch]
.text:0040A36C dec dword ptr [ebx+1Ch]
.text:0040A36F dec dword ptr [ebx+1Ch]
.text:0040A372 lea eax, [ebp-64h]
.text:0040A375 mov word ptr [ebx+10h], 5Ch
.text:0040A37B push eax
.text:0040A37C lea edx, [ebp+var_7C]
.text:0040A37F inc dword ptr [ebx+1Ch]
.text:0040A382 push offset asc_4B2715 ; "\r"
.text:0040A387 push edx ; _DWORD
.text:0040A388 call FormatString
.text:0040A38D add dword ptr [ebx+1Ch], 4
.text:0040A391 mov ecx, [ebp+var_18+4]
.text:0040A394 add esp, 0Ch
.text:0040A397 cmp ecx, [ebp+var_18+10h]
.text:0040A39A jz short loc_40A3D4
.text:0040A39C mov eax, [ebp+var_18+4]
.text:0040A39F mov [ebp+var_128], eax
.text:0040A3A5 mov edx, [ebp+var_128]
.text:0040A3AB mov [ebp-80h], edx
.text:0040A3AE test edx, edx
.text:0040A3B0 jz short loc_40A3CE
.text:0040A3B2 mov word ptr [ebx+10h], 68h
.text:0040A3B8 lea eax, [ebp+var_7C]
.text:0040A3BB push eax
.text:0040A3BC mov ecx, [ebp-80h]
.text:0040A3BF push ecx
.text:0040A3C0 call sub_40AD98
.text:0040A3C5 mov word ptr [ebx+10h], 5Ch
.text:0040A3CB add esp, 8
.text:0040A3CE
.text:0040A3CE loc_40A3CE: ; CODE XREF: sub_40A258+158j
.text:0040A3CE add [ebp+var_18+4], 18h
.text:0040A3D2 jmp short loc_40A3F3
.text:0040A3D4 ; ---------------------------------------------------------------------------
.text:0040A3D4
.text:0040A3D4 loc_40A3D4: ; CODE XREF: sub_40A258+142j
.text:0040A3D4 push 1
.text:0040A3D6 push 1
.text:0040A3D8 lea eax, [ebp+var_130]
.text:0040A3DE push eax
.text:0040A3DF lea edx, [ebp+var_7C]
.text:0040A3E2 push edx
.text:0040A3E3 mov ecx, [ebp+var_18+4]
.text:0040A3E6 push ecx
.text:0040A3E7 lea eax, [ebp+var_18]
.text:0040A3EA push eax
.text:0040A3EB call sub_40A968
.text:0040A3F0 add esp, 18h
.text:0040A3F3
.text:0040A3F3 loc_40A3F3: ; CODE XREF: sub_40A258+17Aj
.text:0040A3F3 dec dword ptr [ebx+1Ch]
.text:0040A3F6 mov word ptr [ebx+10h], 8
.text:0040A3FC dec dword ptr [ebx+1Ch]
.text:0040A3FF mov edi, [ebp+var_7C+10h]
.text:0040A402 sub edi, [ebp+var_7C]
.text:0040A405 mov esi, [ebp+var_7C]
.text:0040A408 test esi, esi
.text:0040A40A jz short loc_40A427
.text:0040A40C cmp edi, 80h
.text:0040A412 jbe short loc_40A41D
.text:0040A414 push esi ; handle
.text:0040A415 call __rtl_close
.text:0040A41A pop ecx
.text:0040A41B jmp short loc_40A427
.text:0040A41D ; ---------------------------------------------------------------------------
.text:0040A41D
.text:0040A41D loc_40A41D: ; CODE XREF: sub_40A258+1BAj
.text:0040A41D push edi
.text:0040A41E push esi
.text:0040A41F call sub_4A0CA4
.text:0040A424 add esp, 8
.text:0040A427
.text:0040A427 loc_40A427: ; CODE XREF: sub_40A258+1B2j
.text:0040A427 ; sub_40A258+1C3j
.text:0040A427 dec dword ptr [ebx+1Ch]
.text:0040A42A dec dword ptr [ebx+1Ch]
.text:0040A42D dec dword ptr [ebx+1Ch]
.text:0040A430 lea eax, [ebp-88h]
.text:0040A436 mov word ptr [ebx+10h], 8Ch
.text:0040A43C push eax
.text:0040A43D lea edx, [ebp+var_A0]
.text:0040A443 inc dword ptr [ebx+1Ch]
.text:0040A446 push offset asc_4B2717 ; "\n"
.text:0040A44B push edx ; _DWORD
.text:0040A44C call FormatString
.text:0040A451 add dword ptr [ebx+1Ch], 4
.text:0040A455 mov ecx, [ebp+var_18+4]
.text:0040A458 add esp, 0Ch
.text:0040A45B cmp ecx, [ebp+var_18+10h]
.text:0040A45E jz short loc_40A4A1
.text:0040A460 mov eax, [ebp+var_18+4]
.text:0040A463 mov [ebp+var_134], eax
.text:0040A469 mov edx, [ebp+var_134]
.text:0040A46F mov [ebp+var_A4], edx
.text:0040A475 test edx, edx
.text:0040A477 jz short loc_40A49B
.text:0040A479 mov word ptr [ebx+10h], 98h
.text:0040A47F lea eax, [ebp+var_A0]
.text:0040A485 push eax
.text:0040A486 mov ecx, [ebp+var_A4]
.text:0040A48C push ecx
.text:0040A48D call sub_40AD98
.text:0040A492 mov word ptr [ebx+10h], 8Ch
.text:0040A498 add esp, 8
.text:0040A49B
.text:0040A49B loc_40A49B: ; CODE XREF: sub_40A258+21Fj
.text:0040A49B add [ebp+var_18+4], 18h
.text:0040A49F jmp short loc_40A4C3
.text:0040A4A1 ; ---------------------------------------------------------------------------
.text:0040A4A1
.text:0040A4A1 loc_40A4A1: ; CODE XREF: sub_40A258+206j
.text:0040A4A1 push 1
.text:0040A4A3 push 1
.text:0040A4A5 lea eax, [ebp+var_13C]
.text:0040A4AB push eax
.text:0040A4AC lea edx, [ebp+var_A0]
.text:0040A4B2 push edx
.text:0040A4B3 mov ecx, [ebp+var_18+4]
.text:0040A4B6 push ecx
.text:0040A4B7 lea eax, [ebp+var_18]
.text:0040A4BA push eax
.text:0040A4BB call sub_40A968
.text:0040A4C0 add esp, 18h
.text:0040A4C3
.text:0040A4C3 loc_40A4C3: ; CODE XREF: sub_40A258+247j
.text:0040A4C3 dec dword ptr [ebx+1Ch]
.text:0040A4C6 mov word ptr [ebx+10h], 8
.text:0040A4CC dec dword ptr [ebx+1Ch]
.text:0040A4CF mov edi, [ebp+var_A0+10h]
.text:0040A4D5 sub edi, [ebp+var_A0]
.text:0040A4DB mov esi, [ebp+var_A0]
.text:0040A4E1 test esi, esi
.text:0040A4E3 jz short loc_40A500
.text:0040A4E5 cmp edi, 80h
.text:0040A4EB jbe short loc_40A4F6
.text:0040A4ED push esi ; handle
.text:0040A4EE call __rtl_close
.text:0040A4F3 pop ecx
.text:0040A4F4 jmp short loc_40A500
.text:0040A4F6 ; ---------------------------------------------------------------------------
.text:0040A4F6
.text:0040A4F6 loc_40A4F6: ; CODE XREF: sub_40A258+293j
.text:0040A4F6 push edi
.text:0040A4F7 push esi
.text:0040A4F8 call sub_4A0CA4
.text:0040A4FD add esp, 8
.text:0040A500
.text:0040A500 loc_40A500: ; CODE XREF: sub_40A258+28Bj
.text:0040A500 ; sub_40A258+29Cj
.text:0040A500 dec dword ptr [ebx+1Ch]
.text:0040A503 dec dword ptr [ebx+1Ch]
.text:0040A506 dec dword ptr [ebx+1Ch]
.text:0040A509 lea eax, [ebp+var_AC]
.text:0040A50F mov word ptr [ebx+10h], 0BCh
.text:0040A515 inc dword ptr [ebx+1Ch]
.text:0040A518 mov [ebp+var_140], eax
.text:0040A51E xor edx, edx
.text:0040A520 xor ecx, ecx
.text:0040A522 mov [ebp+var_30], edx
.text:0040A525 mov [ebp+var_30+4], ecx
.text:0040A528 inc dword ptr [ebx+1Ch]
.text:0040A52B xor eax, eax
.text:0040A52D mov [ebp+var_30+10h], eax
.text:0040A530 lea edx, [ebp+var_30]
.text:0040A533 inc dword ptr [ebx+1Ch]
.text:0040A536 inc dword ptr [ebx+1Ch]
.text:0040A539 inc dword ptr [ebx+1Ch]
.text:0040A53C dec dword ptr [ebx+1Ch]
.text:0040A53F lea ecx, [ebp+var_18]
.text:0040A542 mov word ptr [ebx+10h], 8
.text:0040A548 push edx
.text:0040A549 push ecx
.text:0040A54A mov eax, [ebp+arg_4]
.text:0040A54D push eax
.text:0040A54E call sub_40B7F4
.text:0040A553 add esp, 0Ch
.text:0040A556 mov edi, [ebp+var_30]
.text:0040A559 jmp loc_40A850
.text:0040A55E ; ---------------------------------------------------------------------------
.text:0040A55E
.text:0040A55E loc_40A55E: ; CODE XREF: sub_40A258+5FBj
.text:0040A55E push 28h
.text:0040A560 call @$bnew$qui ; operator new(uint)
.text:0040A565 pop ecx
.text:0040A566 mov [ebp+var_B0], eax
.text:0040A56C test eax, eax
.text:0040A56E jz short loc_40A5E6
.text:0040A570 mov word ptr [ebx+10h], 0E0h
.text:0040A576 mov edx, [ebp+var_B0]
.text:0040A57C xor ecx, ecx
.text:0040A57E mov [edx+14h], ecx
.text:0040A581 mov eax, offset off_4B2DD4
.text:0040A586 mov edx, [ebp+var_B0]
.text:0040A58C mov [edx+18h], eax
.text:0040A58F mov ecx, [ebp+var_B0]
.text:0040A595 xor eax, eax
.text:0040A597 mov [ecx+1Ch], eax
.text:0040A59A mov edx, offset off_4B2DE4
.text:0040A59F mov ecx, [ebp+var_B0]
.text:0040A5A5 mov [ecx+18h], edx
.text:0040A5A8 mov esi, [ebp+var_B0]
.text:0040A5AE add esi, 20h
.text:0040A5B1 xor eax, eax
.text:0040A5B3 mov [esi], eax
.text:0040A5B5 inc dword ptr [ebx+1Ch]
.text:0040A5B8 mov edx, [ebp+var_B0]
.text:0040A5BE add edx, 24h
.text:0040A5C1 mov [ebp+var_144], edx
.text:0040A5C7 mov ecx, [ebp+var_144]
.text:0040A5CD xor eax, eax
.text:0040A5CF mov [ecx], eax
.text:0040A5D1 inc dword ptr [ebx+1Ch]
.text:0040A5D4 add dword ptr [ebx+1Ch], 0FFFFFFFEh
.text:0040A5D8 mov word ptr [ebx+10h], 0D4h
.text:0040A5DE mov edx, [ebp+var_B0]
.text:0040A5E4 jmp short loc_40A5EC
.text:0040A5E6 ; ---------------------------------------------------------------------------
.text:0040A5E6
.text:0040A5E6 loc_40A5E6: ; CODE XREF: sub_40A258+316j
.text:0040A5E6 mov edx, [ebp+var_B0]
.text:0040A5EC
.text:0040A5EC loc_40A5EC: ; CODE XREF: sub_40A258+38Cj
.text:0040A5EC mov esi, edx
.text:0040A5EE mov word ptr [ebx+10h], 8
.text:0040A5F4 mov word ptr [ebx+10h], 0ECh
.text:0040A5FA push 2Ch
.text:0040A5FC push 0
.text:0040A5FE push edi
.text:0040A5FF lea eax, [ebp+var_C8]
.text:0040A605 push eax
.text:0040A606 call sub_40B96C
.text:0040A60B add esp, 10h
.text:0040A60E lea ecx, [ebp+var_C8]
.text:0040A614 add dword ptr [ebx+1Ch], 4
.text:0040A618 mov [ebp+var_148], ecx
.text:0040A61E mov eax, [ebp+var_148]
.text:0040A624 mov edx, [eax]
.text:0040A626 lea eax, [ebp+var_CC]
.text:0040A62C call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:0040A631 inc dword ptr [ebx+1Ch]
.text:0040A634 lea edx, [ebp+var_CC]
.text:0040A63A lea eax, [esi+20h]
.text:0040A63D call sub_4A0484
.text:0040A642 dec dword ptr [ebx+1Ch]
.text:0040A645 lea eax, [ebp+var_CC]
.text:0040A64B mov edx, 2
.text:0040A650 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040A655 dec dword ptr [ebx+1Ch]
.text:0040A658 mov word ptr [ebx+10h], 8
.text:0040A65E dec dword ptr [ebx+1Ch]
.text:0040A661 mov ecx, [ebp+var_B8]
.text:0040A667 mov eax, [ebp+var_C8]
.text:0040A66D sub ecx, eax
.text:0040A66F mov [ebp+var_14C], ecx
.text:0040A675 mov [ebp+var_150], eax
.text:0040A67B cmp [ebp+var_150], 0
.text:0040A682 jz short loc_40A6B5
.text:0040A684 cmp [ebp+var_14C], 80h
.text:0040A68E jbe short loc_40A69F
.text:0040A690 mov edx, [ebp+var_150]
.text:0040A696 push edx ; handle
.text:0040A697 call __rtl_close
.text:0040A69C pop ecx
.text:0040A69D jmp short loc_40A6B5
.text:0040A69F ; ---------------------------------------------------------------------------
.text:0040A69F
.text:0040A69F loc_40A69F: ; CODE XREF: sub_40A258+436j
.text:0040A69F mov ecx, [ebp+var_14C]
.text:0040A6A5 push ecx
.text:0040A6A6 mov eax, [ebp+var_150]
.text:0040A6AC push eax
.text:0040A6AD call sub_4A0CA4
.text:0040A6B2 add esp, 8
.text:0040A6B5
.text:0040A6B5 loc_40A6B5: ; CODE XREF: sub_40A258+42Aj
.text:0040A6B5 ; sub_40A258+445j
.text:0040A6B5 dec dword ptr [ebx+1Ch]
.text:0040A6B8 dec dword ptr [ebx+1Ch]
.text:0040A6BB xor edx, edx
.text:0040A6BD mov word ptr [ebx+10h], 110h
.text:0040A6C3 mov [ebp+var_D0], edx
.text:0040A6C9 lea edx, [ebp+var_D0]
.text:0040A6CF inc dword ptr [ebx+1Ch]
.text:0040A6D2 lea eax, [esi+20h]
.text:0040A6D5 call sub_4A05EC
.text:0040A6DA lea edx, [ebp+var_D0]
.text:0040A6E0 lea eax, [esi+20h]
.text:0040A6E3 call sub_4A0484
.text:0040A6E8 dec dword ptr [ebx+1Ch]
.text:0040A6EB lea eax, [ebp+var_D0]
.text:0040A6F1 mov edx, 2
.text:0040A6F6 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040A6FB mov word ptr [ebx+10h], 11Ch
.text:0040A701 push 2Ch
.text:0040A703 push 1
.text:0040A705 push edi
.text:0040A706 lea ecx, [ebp+var_E8]
.text:0040A70C push ecx
.text:0040A70D call sub_40B96C
.text:0040A712 add esp, 10h
.text:0040A715 lea eax, [ebp+var_E8]
.text:0040A71B add dword ptr [ebx+1Ch], 4
.text:0040A71F mov [ebp+var_154], eax
.text:0040A725 lea eax, [ebp+var_EC]
.text:0040A72B mov edx, [ebp+var_154]
.text:0040A731 mov edx, [edx]
.text:0040A733 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:0040A738 inc dword ptr [ebx+1Ch]
.text:0040A73B lea edx, [ebp+var_EC]
.text:0040A741 lea eax, [esi+24h]
.text:0040A744 call sub_4A0484
.text:0040A749 dec dword ptr [ebx+1Ch]
.text:0040A74C lea eax, [ebp+var_EC]
.text:0040A752 mov edx, 2
.text:0040A757 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040A75C dec dword ptr [ebx+1Ch]
.text:0040A75F mov word ptr [ebx+10h], 8
.text:0040A765 dec dword ptr [ebx+1Ch]
.text:0040A768 mov ecx, [ebp+var_D8]
.text:0040A76E mov eax, [ebp+var_E8]
.text:0040A774 sub ecx, eax
.text:0040A776 mov [ebp+var_158], ecx
.text:0040A77C mov [ebp+var_15C], eax
.text:0040A782 cmp [ebp+var_15C], 0
.text:0040A789 jz short loc_40A7BC
.text:0040A78B cmp [ebp+var_158], 80h
.text:0040A795 jbe short loc_40A7A6
.text:0040A797 mov edx, [ebp+var_15C]
.text:0040A79D push edx ; handle
.text:0040A79E call __rtl_close
.text:0040A7A3 pop ecx
.text:0040A7A4 jmp short loc_40A7BC
.text:0040A7A6 ; ---------------------------------------------------------------------------
.text:0040A7A6
.text:0040A7A6 loc_40A7A6: ; CODE XREF: sub_40A258+53Dj
.text:0040A7A6 mov ecx, [ebp+var_158]
.text:0040A7AC push ecx
.text:0040A7AD mov eax, [ebp+var_15C]
.text:0040A7B3 push eax
.text:0040A7B4 call sub_4A0CA4
.text:0040A7B9 add esp, 8
.text:0040A7BC
.text:0040A7BC loc_40A7BC: ; CODE XREF: sub_40A258+531j
.text:0040A7BC ; sub_40A258+54Cj
.text:0040A7BC dec dword ptr [ebx+1Ch]
.text:0040A7BF dec dword ptr [ebx+1Ch]
.text:0040A7C2 xor edx, edx
.text:0040A7C4 mov [esi+8], edx
.text:0040A7C7 mov [esi+0Ch], edx
.text:0040A7CA lea eax, [esi+20h]
.text:0040A7CD mov byte ptr [esi+10h], 1
.text:0040A7D1 cmp dword ptr [eax], 0
.text:0040A7D4 jz short loc_40A7DA
.text:0040A7D6 mov edx, [eax]
.text:0040A7D8 jmp short loc_40A7DF
.text:0040A7DA ; ---------------------------------------------------------------------------
.text:0040A7DA
.text:0040A7DA loc_40A7DA: ; CODE XREF: sub_40A258+57Cj
.text:0040A7DA mov edx, offset unk_4B2719
.text:0040A7DF
.text:0040A7DF loc_40A7DF: ; CODE XREF: sub_40A258+580j
.text:0040A7DF push edx ; cp
.text:0040A7E0 call inet_addr
.text:0040A7E5 cmp eax, 0FFFFFFFFh
.text:0040A7E8 jz short loc_40A7F9
.text:0040A7EA push esi
.text:0040A7EB mov eax, [ebp+arg_0]
.text:0040A7EE push eax
.text:0040A7EF call sub_40C46C
.text:0040A7F4 add esp, 8
.text:0040A7F7 jmp short loc_40A84D
.text:0040A7F9 ; ---------------------------------------------------------------------------
.text:0040A7F9
.text:0040A7F9 loc_40A7F9: ; CODE XREF: sub_40A258+590j
.text:0040A7F9 mov [ebp+var_F0], esi
.text:0040A7FF cmp [ebp+var_F0], 0
.text:0040A806 jz short loc_40A84D
.text:0040A808 mov word ptr [ebx+10h], 14Ch
.text:0040A80E dec dword ptr [ebx+1Ch]
.text:0040A811 mov edx, 2
.text:0040A816 mov eax, [ebp+var_F0]
.text:0040A81C add eax, 24h
.text:0040A81F call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040A824 dec dword ptr [ebx+1Ch]
.text:0040A827 mov edx, 2
.text:0040A82C mov eax, [ebp+var_F0]
.text:0040A832 add eax, 20h
.text:0040A835 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040A83A mov ecx, [ebp+var_F0]
.text:0040A840 push ecx ; handle
.text:0040A841 call __rtl_close
.text:0040A846 pop ecx
.text:0040A847 mov word ptr [ebx+10h], 140h
.text:0040A84D
.text:0040A84D loc_40A84D: ; CODE XREF: sub_40A258+59Fj
.text:0040A84D ; sub_40A258+5AEj
.text:0040A84D add edi, 18h
.text:0040A850
.text:0040A850 loc_40A850: ; CODE XREF: sub_40A258+301j
.text:0040A850 cmp edi, [ebp+var_30+4]
.text:0040A853 jnz loc_40A55E
.text:0040A859 dec dword ptr [ebx+1Ch]
.text:0040A85C lea ecx, [ebp+var_164]
.text:0040A862 mov eax, [ebp+var_30+4]
.text:0040A865 mov edx, [ebp+var_30]
.text:0040A868 push ecx
.text:0040A869 push eax
.text:0040A86A push edx
.text:0040A86B call sub_40AB5C
.text:0040A870 mov word ptr [ebx+10h], 8
.text:0040A876 dec dword ptr [ebx+1Ch]
.text:0040A879 mov ecx, 18h
.text:0040A87E mov eax, [ebp+var_30+10h]
.text:0040A881 add esp, 0Ch
.text:0040A884 sub eax, [ebp+var_30]
.text:0040A887 cdq
.text:0040A888 idiv ecx
.text:0040A88A mov [ebp+var_168], eax
.text:0040A890 mov esi, [ebp+var_30]
.text:0040A893 test esi, esi
.text:0040A895 jz short loc_40A8CE
.text:0040A897 mov eax, [ebp+var_168]
.text:0040A89D shl eax, 3
.text:0040A8A0 lea eax, [eax+eax*2]
.text:0040A8A3 mov [ebp+var_16C], eax
.text:0040A8A9 cmp [ebp+var_16C], 80h
.text:0040A8B3 jbe short loc_40A8BE
.text:0040A8B5 push esi ; handle
.text:0040A8B6 call __rtl_close
.text:0040A8BB pop ecx
.text:0040A8BC jmp short loc_40A8CE
.text:0040A8BE ; ---------------------------------------------------------------------------
.text:0040A8BE
.text:0040A8BE loc_40A8BE: ; CODE XREF: sub_40A258+65Bj
.text:0040A8BE mov edx, [ebp+var_16C]
.text:0040A8C4 push edx
.text:0040A8C5 push esi
.text:0040A8C6 call sub_4A0CA4
.text:0040A8CB add esp, 8
.text:0040A8CE
.text:0040A8CE loc_40A8CE: ; CODE XREF: sub_40A258+63Dj
.text:0040A8CE ; sub_40A258+664j
.text:0040A8CE dec dword ptr [ebx+1Ch]
.text:0040A8D1 dec dword ptr [ebx+1Ch]
.text:0040A8D4 dec dword ptr [ebx+1Ch]
.text:0040A8D7 mov eax, [ebp+var_18+4]
.text:0040A8DA mov edx, [ebp+var_18]
.text:0040A8DD mov [ebp+var_170], edx
.text:0040A8E3 lea ecx, [ebp+var_178]
.text:0040A8E9 push ecx
.text:0040A8EA push eax
.text:0040A8EB mov eax, [ebp+var_170]
.text:0040A8F1 push eax
.text:0040A8F2 call sub_40AB5C
.text:0040A8F7 add esp, 0Ch
.text:0040A8FA dec dword ptr [ebx+1Ch]
.text:0040A8FD mov eax, [ebp+var_18+10h]
.text:0040A900 sub eax, [ebp+var_18]
.text:0040A903 mov ecx, 18h
.text:0040A908 cdq
.text:0040A909 idiv ecx
.text:0040A90B mov [ebp+var_17C], eax
.text:0040A911 mov esi, [ebp+var_18]
.text:0040A914 test esi, esi
.text:0040A916 jz short loc_40A94F
.text:0040A918 mov eax, [ebp+var_17C]
.text:0040A91E shl eax, 3
.text:0040A921 lea eax, [eax+eax*2]
.text:0040A924 mov [ebp+var_180], eax
.text:0040A92A cmp [ebp+var_180], 80h
.text:0040A934 jbe short loc_40A93F
.text:0040A936 push esi ; handle
.text:0040A937 call __rtl_close
.text:0040A93C pop ecx
.text:0040A93D jmp short loc_40A94F
.text:0040A93F ; ---------------------------------------------------------------------------
.text:0040A93F
.text:0040A93F loc_40A93F: ; CODE XREF: sub_40A258+6DCj
.text:0040A93F mov edx, [ebp+var_180]
.text:0040A945 push edx
.text:0040A946 push esi
.text:0040A947 call sub_4A0CA4
.text:0040A94C add esp, 8
.text:0040A94F
.text:0040A94F loc_40A94F: ; CODE XREF: sub_40A258+6BEj
.text:0040A94F ; sub_40A258+6E5j
.text:0040A94F dec dword ptr [ebx+1Ch]
.text:0040A952 dec dword ptr [ebx+1Ch]
.text:0040A955 mov ecx, [ebx]
.text:0040A957 mov large fs:0, ecx
.text:0040A95E pop edi
.text:0040A95F pop esi
.text:0040A960 pop ebx
.text:0040A961 mov esp, ebp
.text:0040A963 pop ebp
.text:0040A964 retn

复制代码

.

这里已经在做字符串处理了，内存中是4.2.2.1,美国科罗拉多州布隆菲尔德市Level 3通信公司这种形式，因此需要用逗号吧地址和位置分开，查看变量的访问情况后（这是个很耗时的过程）发现还要向上回溯：

.text:00402474 sub_402474 proc near ; CODE XREF: sub_401B74+1A8p
.text:00402474
.text:00402474 var_48 = byte ptr -48h
.text:00402474 s = dword ptr -24h
.text:00402474 var_20 = byte ptr -20h
.text:00402474 handle = dword ptr -18h
.text:00402474 var_8 = dword ptr -8
.text:00402474 arg_0 = dword ptr 8
.text:00402474
.text:00402474 push ebp
.text:00402475 mov ebp, esp
.text:00402477 add esp, 0FFFFFFB8h
.text:0040247A mov eax, offset unk_4A2564
.text:0040247F push ebx
.text:00402480 push esi
.text:00402481 push edi
.text:00402482 lea edi, [ebp+var_48]
.text:00402485 mov ebx, [ebp+arg_0]
.text:00402488 call @__InitExceptBlockLDTC
.text:0040248D mov word ptr [edi+10h], 14h
.text:00402493 lea edx, [ebp+var_20]
.text:00402496 xor ecx, ecx
.text:00402498 push edx
.text:00402499 lea eax, [ebp+s]
.text:0040249C inc dword ptr [edi+1Ch]
.text:0040249F mov [ebp+s], ecx
.text:004024A2 push eax
.text:004024A3 inc dword ptr [edi+1Ch]
.text:004024A6 call sub_408F5C
.text:004024AB cmp [ebp+s], 0
.text:004024AF pop ecx
.text:004024B0 jz short loc_4024B7
.text:004024B2 mov edx, [ebp+s]
.text:004024B5 jmp short loc_4024BC
.text:004024B7 ; ---------------------------------------------------------------------------
.text:004024B7
.text:004024B7 loc_4024B7: ; CODE XREF: sub_402474+3Cj
.text:004024B7 mov edx, offset unk_4A21CB
.text:004024BC
.text:004024BC loc_4024BC: ; CODE XREF: sub_402474+41j
.text:004024BC push edx ; s
.text:004024BD lea eax, [ebp+handle]
.text:004024C0 push eax ; _DWORD
.text:004024C1 call FormatString
.text:004024C6 add dword ptr [edi+1Ch], 4
.text:004024CA dec dword ptr [edi+1Ch]
.text:004024CD add esp, 0Ch
.text:004024D0 dec dword ptr [edi+1Ch]
.text:004024D3 lea eax, [ebp+s]
.text:004024D6 mov edx, 2
.text:004024DB call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:004024E0 mov word ptr [edi+10h], 8
.text:004024E6 mov eax, [ebx+400h]
.text:004024EC test eax, eax
.text:004024EE jz short loc_4024FD
.text:004024F0 lea edx, [ebp+handle]
.text:004024F3 push edx
.text:004024F4 push eax
.text:004024F5 call sub_40A258
.text:004024FA add esp, 8
.text:004024FD
.text:004024FD loc_4024FD: ; CODE XREF: sub_402474+7Aj
.text:004024FD dec dword ptr [edi+1Ch]
.text:00402500 dec dword ptr [edi+1Ch]
.text:00402503 mov esi, [ebp+var_8]
.text:00402506 mov eax, [ebp+handle]
.text:00402509 sub esi, eax
.text:0040250B mov ebx, eax
.text:0040250D test ebx, ebx
.text:0040250F jz short loc_40252C
.text:00402511 cmp esi, 80h
.text:00402517 jbe short loc_402522
.text:00402519 push ebx ; handle
.text:0040251A call __rtl_close
.text:0040251F pop ecx
.text:00402520 jmp short loc_40252C
.text:00402522 ; ---------------------------------------------------------------------------
.text:00402522
.text:00402522 loc_402522: ; CODE XREF: sub_402474+A3j
.text:00402522 push esi
.text:00402523 push ebx
.text:00402524 call sub_4A0CA4
.text:00402529 add esp, 8
.text:0040252C
.text:0040252C loc_40252C: ; CODE XREF: sub_402474+9Bj
.text:0040252C ; sub_402474+ACj
.text:0040252C dec dword ptr [edi+1Ch]
.text:0040252F dec dword ptr [edi+1Ch]
.text:00402532 mov eax, [edi]
.text:00402534 mov large fs:0, eax
.text:0040253A pop edi
.text:0040253B pop esi
.text:0040253C pop ebx
.text:0040253D mov esp, ebp
.text:0040253F pop ebp
.text:00402540 retn
.text:0040254
再次调试，发现408F5C处得到的s已经包含地址，而之前再无修改s之处或者传递之处，因此确定sub_408F5C用于解密字符串，之所以是解密，是因为无法通过资源和字符串找到这些数据，也就说一定经过加密了。
进入该函数，这下有趣了：
text:00408F5C sub_408F5C proc near ; CODE XREF: sub_402474+32p
.text:00408F5C
.text:00408F5C var_28 = dword ptr -28h
.text:00408F5C var_18 = word ptr -18h
.text:00408F5C var_C = dword ptr -0Ch
.text:00408F5C var_4 = dword ptr -4
.text:00408F5C arg_0 = dword ptr 8
.text:00408F5C
.text:00408F5C push ebp
.text:00408F5D mov ebp, esp
.text:00408F5F add esp, 0FFFFFFD8h
.text:00408F62 mov eax, offset unk_4B1FA0
.text:00408F67 call @__InitExceptBlockLDTC
.text:00408F6C mov [ebp+var_18], 8
.text:00408F72 push 0D3EEh
.text:00408F77 push offset unk_4A4B80
.text:00408F7C xor edx, edx
.text:00408F7E mov [ebp+var_4], edx
.text:00408F81 lea ecx, [ebp+var_4]
.text:00408F84 push ecx
.text:00408F85 inc [ebp+var_C]
.text:00408F88 call decode
.text:00408F8D add esp, 0Ch
.text:00408F90 lea edx, [ebp+var_4]
.text:00408F93 mov eax, [ebp+arg_0]
.text:00408F96 call sub_4A0484
.text:00408F9B mov eax, [ebp+arg_0]
.text:00408F9E mov edx, 2
.text:00408FA3 mov [ebp+var_18], 14h
.text:00408FA9 push eax
.text:00408FAA lea eax, [ebp+var_4]
.text:00408FAD dec [ebp+var_C]
.text:00408FB0 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00408FB5 pop eax
.text:00408FB6 mov [ebp+var_18], 8
.text:00408FBC inc [ebp+var_C]
.text:00408FBF mov edx, [ebp+var_28]
.text:00408FC2 mov large fs:0, edx
.text:00408FC9 mov esp, ebp
.text:00408FCB pop ebp
.text:00408FCC retn
.text:00408FCC sub_408F5C endp
.t
text:0040CA68 ; int __cdecl decode(int dest, int src, int len)
.text:0040CA68 decode proc near ; CODE XREF: dosetdns+7Bp
.text:0040CA68 ; sub_4082F4+75p ...
.text:0040CA68
.text:0040CA68 var_30 = dword ptr -30h
.text:0040CA68 var_2C = dword ptr -2Ch
.text:0040CA68 var_1C = word ptr -1Ch
.text:0040CA68 var_10 = dword ptr -10h
.text:0040CA68 var_8 = dword ptr -8
.text:0040CA68 var_4 = byte ptr -4
.text:0040CA68 dest = dword ptr 8
.text:0040CA68 src = dword ptr 0Ch
.text:0040CA68 len = dword ptr 10h
.text:0040CA68
.text:0040CA68 push ebp
.text:0040CA69 mov ebp, esp
.text:0040CA6B add esp, 0FFFFFFD0h
.text:0040CA6E mov eax, offset unk_4B3420
.text:0040CA73 call @__InitExceptBlockLDTC
.text:0040CA78 mov [ebp+var_1C], 8
.text:0040CA7E lea eax, [ebp+var_4]
.text:0040CA81 call unknown_libname_1128 ; CBuilder 5 runtime
.text:0040CA86 inc [ebp+var_10]
.text:0040CA89 mov [ebp+var_1C], 14h
.text:0040CA8F xor edx, edx
.text:0040CA91 mov [ebp+var_30], edx
.text:0040CA94 mov ecx, [ebp+var_30]
.text:0040CA97 cmp ecx, [ebp+len]
.text:0040CA9A jge short loc_40CAE4
.text:0040CA9C
.text:0040CA9C loc_40CA9C: ; CODE XREF: decode+7Aj
.text:0040CA9C mov [ebp+var_1C], 20h
.text:0040CAA2 mov eax, [ebp+var_30]
.text:0040CAA5 mov edx, [ebp+src]
.text:0040CAA8 xor ecx, ecx
.text:0040CAAA mov cl, [edx+eax]
.text:0040CAAD mov dl, byte_4B32CC[ecx]
.text:0040CAB3 lea eax, [ebp+var_8]
.text:0040CAB6 call @System@AnsiString@$bctr$qqrc ; System::AnsiString::AnsiString(char)
.text:0040CABB inc [ebp+var_10]
.text:0040CABE lea edx, [ebp+var_8]
.text:0040CAC1 lea eax, [ebp+var_4]
.text:0040CAC4 call sub_4A0498
.text:0040CAC9 dec [ebp+var_10]
.text:0040CACC lea eax, [ebp+var_8]
.text:0040CACF mov edx, 2
.text:0040CAD4 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040CAD9 inc [ebp+var_30]
.text:0040CADC mov ecx, [ebp+var_30]
.text:0040CADF cmp ecx, [ebp+len]
.text:0040CAE2 jl short loc_40CA9C
.text:0040CAE4
.text:0040CAE4 loc_40CAE4: ; CODE XREF: decode+32j
.text:0040CAE4 mov [ebp+var_1C], 2Ch
.text:0040CAEA lea edx, [ebp+var_4]
.text:0040CAED mov eax, [ebp+dest]
.text:0040CAF0 call sub_4A0484
.text:0040CAF5 mov eax, [ebp+dest]
.text:0040CAF8 mov [ebp+var_1C], 38h
.text:0040CAFE push eax
.text:0040CAFF dec [ebp+var_10]
.text:0040CB02 lea eax, [ebp+var_4]
.text:0040CB05 mov edx, 2
.text:0040CB0A call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:0040CB0F pop eax
.text:0040CB10 mov [ebp+var_1C], 2Ch
.text:0040CB16 inc [ebp+var_10]
.text:0040CB19 mov edx, [ebp+var_2C]
.text:0040CB1C mov large fs:0, edx
.text:0040CB23 mov esp, ebp
.text:0040CB25 pop ebp
.text:0040CB26 retn

复制代码

4A4B80和4B32CC处在data段，可以看到作者煞费苦心地构造了2个数组，后者用于做ascii码可逆映射，前者是加密过的字符串数组。大小分别为54254和256
既然如此，我们写程序总不能把这些数据从文件提取出来再解密啊，所以还是用winhex拷贝来的快。这里只是一种好奇心，看看作者到底怎么存储和解密这些数据。

现在其他问题都解决了，那么FASTDNS怎么测网速的呢？也就是最核心的部分？
根据前述，核心在TfrmFastDNS_actTestSpendingExecute中。文章流程太长了，请听下回分解！！！

元始天尊 · 发表于 2015-2-22 19:17:45

对彗星DNS加速器的分析（二）
+00h virtualtable
+0 STOP
+4 FUNC1
+8 FUNC2
+04h HANDLE hthread
+08h ????
+18h FARPROC func0
+1Ch LPVOID param0
+20h FARPROC func1//OnIdle处理函数
+24h LPVOID param1
+28h BOOL IsMainthread??
+30h struct*
   +00h int leftTime//剩余次数
   +08h double pertime//平均消耗时间
   +10h flag statu  //成功0 失败3
+38h FARPROC callbackfunc  //测试结束的回调函数showstatus
+3Ch DWORD param2 //callbackfunc的参数
+40h int repeatTime//取样次数
+44h int timeout//超时
+48h Class IdDNSResolver_TIdDNSResolver* extends TIdUDPBase extends TIdUDPBase extends....
//原来delphi自带了组件，好方便啊，不过我得自行解决
+00h virtualtable 00412B24
TIdUDPBase::AssignError
TIdUDPBase:

efineProperties
TIdUDPBase::Assign
TIdUDPBase:

oaded
。。。。。。。。。。
+74h char* ipdns
+7Ch int timeout
+90h package*//发包结构体
+94h int repeattime
+9Ch int sendinfo//要发送的数据包
。。。。。。。。
+50h char* ipstart//存放ip地址字串起始位置
+54h char* ipend//存放ip地址字串结束位置
。。。。。。。

.text:0040970C ; DWORD __cdecl FUNC2(int structa, int *usedtime)
.text:0040970C FUNC2 proc near ; DATA XREF: .data:fastdns___CPPdebugHook+105D4o
.text:0040970C
.text:0040970C var_2C = dword ptr -2Ch
.text:0040970C var_1C = word ptr -1Ch
.text:0040970C var_10 = dword ptr -10h
.text:0040970C var_8 = byte ptr -8
.text:0040970C var_4 = byte ptr -4
.text:0040970C structa = dword ptr 8
.text:0040970C usedtime = dword ptr 0Ch
.text:0040970C
.text:0040970C push ebp
.text:0040970D mov ebp, esp
.text:0040970F add esp, 0FFFFFFD4h
.text:00409712 push ebx
.text:00409713 push esi
.text:00409714 push edi
.text:00409715 mov edi, [ebp+usedtime]
.text:00409718 mov ebx, [ebp+structa]
.text:0040971B mov eax, offset unk_4B25EC
.text:00409720 call @__InitExceptBlockLDTC
.text:00409725 mov [ebp+var_1C], 8
.text:0040972B mov esi, [ebx+48h]
.text:0040972E test esi, esi
.text:00409730 jz loc_40984A
.text:00409736 mov [ebp+var_1C], 14h
.text:0040973C mov edx, [ebx+50h]
.text:0040973F lea eax, [ebp+var_4]
.text:00409742 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:00409747 mov edx, eax
.text:00409749 inc [ebp+var_10]
.text:0040974C mov eax, esi
.text:0040974E add eax, 74h
.text:00409751 call sub_4A0484
.text:00409756 dec [ebp+var_10]
.text:00409759 lea eax, [ebp+var_4]
.text:0040975C mov edx, 2
.text:00409761 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00409766 mov ecx, [ebx+44h]
.text:00409769 mov eax, [ebx+48h]
.text:0040976C mov [eax+7Ch], ecx
.text:0040976F mov edx, [eax]
.text:00409771 call dword ptr [edx+48h]
.text:00409774 mov ecx, [ebx+48h]
.text:00409777 xor edx, edx
.text:00409779 mov eax, [ecx+90h]
.text:0040977F call sub_412E58
.text:00409784 mov ecx, [ebx+48h]
.text:00409787 xor edx, edx
.text:00409789 mov eax, [ecx+90h]
.text:0040978F call sub_412E6C
.text:00409794 mov ecx, [ebx+48h]
.text:00409797 mov dl, 1
.text:00409799 mov eax, [ecx+90h]
.text:0040979F call sub_412E88
.text:004097A4 mov eax, [ebx+48h]
.text:004097A7 mov edx, [eax+90h]
.text:004097AD mov word ptr [edx+0Ch], 1
.text:004097B3 mov eax, [eax+94h]
.text:004097B9 call @TCollection@Clear ; TCollection::Clear
.text:004097BE mov edx, [ebx+48h]
.text:004097C1 mov eax, [edx+94h]
.text:004097C7 call sub_412EA8
.text:004097CC mov [ebp+var_1C], 8
.text:004097D2 mov [ebp+var_1C], 20h
.text:004097D8 mov esi, eax
.text:004097DA lea eax, [ebp+var_8]
.text:004097DD mov edx, offset aWww_microsoft_ ; "www.microsoft.com"
.text:004097E2 call @System@AnsiString@$bctr$qqrpxc ; System::AnsiString::AnsiString(char *)
.text:004097E7 inc [ebp+var_10]
.text:004097EA lea edx, [ebp+var_8]
.text:004097ED lea eax, [esi+10h]
.text:004097F0 call sub_4A0484
.text:004097F5 dec [ebp+var_10]
.text:004097F8 lea eax, [ebp+var_8]
.text:004097FB mov edx, 2
.text:00409800 call @System@AnsiString@$bdtr$qqrv ; System::AnsiString::~AnsiString(void)
.text:00409805 mov word ptr [esi+14h], 1
.text:0040980B mov word ptr [esi+0Ch], 1
.text:00409811 call @GetCurrentTime
.text:00409816 mov esi, eax
.text:00409818 mov [ebp+var_1C], 8
.text:0040981E mov eax, [ebx+48h]
.text:00409821 call sub_413174
.text:00409826 call @GetCurrentTime
.text:0040982B mov ebx, eax
.text:0040982D sub ebx, esi
.text:0040982F mov [edi], ebx
.text:00409831 cmp ebx, 1
.text:00409834 jnb short loc_40983C
.text:00409836 mov dword ptr [edi], 1
.text:0040983C
.text:0040983C loc_40983C: ; CODE XREF: FUNC2+128j
.text:0040983C mov al, 1
.text:0040983E mov edx, [ebp+var_2C]
.text:00409841 mov large fs:0, edx
.text:00409848 jmp short loc_409869
.text:0040984A ; ---------------------------------------------------------------------------
.text:0040984A
.text:0040984A loc_40984A: ; CODE XREF: FUNC2+24j
.text:0040984A mov [ebp+var_1C], 0
.text:00409850 jmp short loc_40985D
.text:00409852 ; ---------------------------------------------------------------------------
.text:00409852
.text:00409852 loc_409852: ; DATA XREF: .data:fastdns___CPPdebugHook+1051Co
.text:00409852 mov [ebp+var_1C], 10h
.text:00409858 call @_CatchCleanup$qv ; _CatchCleanup(void)
.text:0040985D
.text:0040985D loc_40985D: ; CODE XREF: FUNC2+144j
.text:0040985D xor eax, eax
.text:0040985F mov edx, [ebp+var_2C]
.text:00409862 mov large fs:0, edx
.text:00409869
.text:00409869 loc_409869: ; CODE XREF: FUNC2+13Cj
.text:00409869 pop edi
.text:0040986A pop esi
.text:0040986B pop ebx
.text:0040986C mov esp, ebp
.text:0040986E pop ebp
.text:0040986F retn

复制代码

.
本段程序构造某网络包类，sub_413174为真正执行代码，在其前后取时间进行测速：

.text:00413174 sub_413174 proc near ; CODE XREF: FUNC2+115p
.text:00413174
.text:00413174 var_8 = dword ptr -8
.text:00413174 var_4 = dword ptr -4
.text:00413174
.text:00413174 push ebp
.text:00413175 mov ebp, esp
.text:00413177 add esp, 0FFFFFFF8h
.text:0041317A xor edx, edx
.text:0041317C mov [ebp+var_8], edx
.text:0041317F mov [ebp+var_4], eax
.text:00413182 xor eax, eax
.text:00413184 push ebp
.text:00413185 push offset loc_413208
.text:0041318A push dword ptr fs:[eax]
.text:0041318D mov fs:[eax], esp
.text:00413190 xor eax, eax
.text:00413192 push ebp
.text:00413193 push offset loc_4131EB
.text:00413198 push dword ptr fs:[eax]
.text:0041319B mov fs:[eax], esp
.text:0041319E mov eax, [ebp+var_4]
.text:004131A1 call sub_413470
.text:004131A6 mov eax, [ebp+var_4]
.text:004131A9 mov edx, [eax+9Ch]
.text:004131AF mov eax, [ebp+var_4]
.text:004131B2 call @TIdUDPClient@Send ; TIdUDPClient::Send
.text:004131B7 lea ecx, [ebp+var_8]
.text:004131BA or edx, 0FFFFFFFFh
.text:004131BD mov eax, [ebp+var_4]
.text:004131C0 call @TIdUDPBase@ReceiveString ; TIdUDPBase::ReceiveString
.text:004131C5 mov edx, [ebp+var_8]
.text:004131C8 mov eax, [ebp+var_4]
.text:004131CB add eax, 0A0h
.text:004131D0 call @@LStrAsg ; __linkproc__ LStrAsg
.text:004131D5 xor eax, eax
.text:004131D7 pop edx
.text:004131D8 pop ecx
.text:004131D9 pop ecx
.text:004131DA mov fs:[eax], edx
.text:004131DD push offset loc_4131F2
.text:004131E2
.text:004131E2 loc_4131E2: ; CODE XREF: sub_413174+7Cj
.text:004131E2 mov eax, [ebp+var_4]
.text:004131E5 call sub_414B3C
.text:004131EA retn
.text:004131EB ; ---------------------------------------------------------------------------
.text:004131EB
.text:004131EB loc_4131EB: ; DATA XREF: sub_413174+1Fo
.text:004131EB jmp @@HandleFinally ; __linkproc__ HandleFinally
.text:004131F0 ; ---------------------------------------------------------------------------
.text:004131F0 jmp short loc_4131E2
.text:004131F2 ; ---------------------------------------------------------------------------
.text:004131F2
.text:004131F2 loc_4131F2: ; CODE XREF: sub_413174+76j
.text:004131F2 ; DATA XREF: sub_413174+69o
.text:004131F2 xor eax, eax
.text:004131F4 pop edx
.text:004131F5 pop ecx
.text:004131F6 pop ecx
.text:004131F7 mov fs:[eax], edx
.text:004131FA push offset loc_41320F
.text:004131FF
.text:004131FF loc_4131FF: ; CODE XREF: sub_413174+99j
.text:004131FF lea eax, [ebp+var_8]
.text:00413202 call @@LStrClr ; __linkproc__ LStrClr
.text:00413207 retn
.text:00413208 ; ---------------------------------------------------------------------------
.text:00413208
.text:00413208 loc_413208: ; DATA XREF: sub_413174+11o
.text:00413208 jmp @@HandleFinally ; __linkproc__ HandleFinally
.text:0041320D ; ---------------------------------------------------------------------------
.text:0041320D jmp short loc_4131FF
.text:0041320F ; ---------------------------------------------------------------------------
.text:0041320F
.text:0041320F loc_41320F: ; CODE XREF: sub_413174+93j
.text:0041320F ; DATA XREF: sub_413174+86o
.text:0041320F pop ecx
.text:00413210 pop ecx
.text:00413211 pop ebp
.text:00413212 retn

复制代码

.

从以上代码可以得知，重要调用有：
sub_413470
TIdDNSResolver::Send
TIdDNSResolver::ReceiveString
sub_414B3C
由于调用函数库较多，较为浪费时间，因此这里用WireShark抓取+API break的方式查看网络情况，可以得到如下结果：
启动时对每个ip做inet_addr
检测时：WSAStartup 101
socket af=AF_INET type=SOCK_DGRAM protocol=IPPROTO_IP
setsockopt level=SOL_SOCKET optname=SO_BROADCAST optval="\0\0\0\0" optlen=4
ntohs hostshort=53//DNS
sendto len=35 flags=0 tolen=sizeof(sockaddr) buf=
b4 c3 01 00 00 01 00 00-00 00 00 00 03 77 77 77  .............www
09 6d 69 63 72 6f 73 6f-66 74 03 63 6f 6d 00 00  .microsoft.com..
01 00 01
sockaddr=02 00 00 35 04 02 02 01-00 00 00 00 00 00 00 00
select nfds=0 readfs={1,socket} writefds={0,0} exceptfds={0,0}
timeout{tv_sec=2 tv_usec=0}
recvfrom len=8192 flag=0 from=02 00 00 35 04 02 02 01-00 00 00 00 00 00 00 00
fromlen=sizeof(sockaddr) buf=
b4 c3 81 80 00 01 00 04-00 00 00 00 03 77 77 77  .............www
09 6d 69 63 72 6f 73 6f-66 74 03 63 6f 6d 00 00  .microsoft.com..
01 00 01 c0 0c 00 05 00-01 00 00 0c fd 00 1a 06  ................
74 6f 67 67 6c 65 03 77-77 77 02 6d 73 06 61 6b  toggle.www.ms.ak
61 64 6e 73 03 6e 65 74-00 c0 2f 00 05 00 01 00  adns.net../.....
00 00 09 00 1c 03 77 77-77 09 6d 69 63 72 6f 73  ......www.micros
6f 66 74 03 63 6f 6d 07-65 64 67 65 6b 65 79 c0  oft.com.edgekey.
44 c0 55 00 05 00 01 00-00 00 39 00 19 06 65 31  D.U.......9...e1
30 30 38 38 04 64 73 63-62 0a 61 6b 61 6d 61 69  0088.dscb.akamai
65 64 67 65 c0 44 c0 7d-00 01 00 01 00 00 00 0d  edge.D.}........
00 04 ac e7 28 ee 00 00-a4 46 c5 01 c2 46 c5 01  ....(....F...F..
00 00 00 00 00 00 00 00-c3 46 c5 01 00 00 00 00  .........F......
c4 46 c5 01 e2 46 c5 01-00 00 00 00 00 00 00 00  .F...F..........
e3 46 c5 01 00 00 00 00-40 63 c6 01 5e 63 c6 01  .F......@c..^c..
00 00 00 00 00 00 00 00-5f 63 c6 01 00 00 00 00  ........_c......
74 68 c5 01 94 68 c5 01-00 00 00 00 00 00 00 00  th...h..........
95 68 c5 01 00 00 00 00-10 ed c4 01 3b ed c4 01  .h..........;...
00 00 00 00 00 00 00 00-3c ed c4 01 00 00 00 00  ........<.......
40 ed c4 01 6b ed c4 01-00 00 00 00 00 00 00 00  @...k...........
6c ed c4 01 00 00 00 00-70 ed c4 01 9b ed c4 01  l.......p.......
00 00 00 00 00 00 00 00-9c ed c4 01 00 00 00 00  ................
a0 ed c4 01 cb ed c4 01-00 00 00 00 00 00 00 00  ................
cc ed c4 01 00 00 00 00-a0 36 c4 01 cb 36 c4 01  .........6...6..
00 00 00 00 00 00 00 00-cc 36 c4 01 00 00 00 00  .........6......
70 36 c4 01 9b 36 c4 01-00 00 00 00 00 00 00 00  p6...6..........
9c 36 c4 01 00 00 00 00-bc ff c4 01 da ff c4 01  .6..............
00 00 00 00 00 00 00 00-db ff c4 01 00 00 00 00  ................
dc ff c4 01 fa ff c4 01-00 00 00 00 00 00 00 00  ................
fb ff c4 01 00 00 00 00-fc ff c4 01 1a 00 c5 01  ................
00 00 00 00 00 00 00 00-1b 00 c5 01 00 00 00 00  ................
1c 00 c5 01 3a 00 c5 01-00 00 00 00 00 00 00 00  ....:...........
3b 00 c5 01 00 00 00 00-3c 00 c5 01 5a 00 c5 01  ;.......<...Z...
00 00 00 00 00 00 00 00-5b 00 c5 01 00 00 00 00  ........[.......
5c 00 c5 01 7a 00 c5 01-00 00 00 00 00 00 00 00  \...z...........
7b 00 c5 01 00 00 00 00-7c 00 c5 01 9a 00 c5 01  {.......|.......
00 00 00 00 00 00 00 00-9b 00 c5 01 00 00 00 00  ................
9c 00 c5 01 ba 00 c5 01-00 00 00 00 00 00 00 00  ................
bb 00 c5 01 00 00 00 00-bc 00 c5 01 da 00 c5 01  ................
00 00 00 00 00 00 00 00-db 00 c5 01 00 00 00 00  ................
dc 00 c5 01 fa 00 c5 01-00 00 00 00 00 00 00 00  ................
fb 00 c5 01 00 00 00 00-60 65 c6 01 83 65 c6 01  ........`e...e..
00 00 00 00 00 00 00 00-84 65 c6 01 00 00 00 00  .........e......
84 47 c5 01 a8 47 c5 01-00 00 00 00 00 00 00 00  .G...G..........
a9 47 c5 01 00 00 00 00-fc 00 c5 01 1b 01 c5 01  .G..............
00 00 00 00 00 00 00 00-1c 01 c5 01 00 00 00 00  ................
ac 47 c5 01 cc 47 c5 01-00 00 00 00 00 00 00 00  .G...G..........
cd 47 c5 01 00 00 00 00-c4 0a c5 01 dd 0a c5 01  .G..............
00 00 00 00 00 00 00 00-de 0a c5 01 00 00 00 00  ................
00 0b c5 01 1a 0b c5 01-00 00 00 00 00 00 00 00  ................
1b 0b c5 01 00 00 00 00-20 0b c5 01 39 0b c5 01  ........ ...9...
00 00 00 00 00 00 00 00-3a 0b c5 01 00 00 00 00  ........:.......
40 0b c5 01 5b 0b c5 01-00 00 00 00 00 00 00 00  @...[...........
5c 0b c5 01 00 00 00 00-d4 47 c5 01 f8 47 c5 01  \........G...G..
00 00 00 00 00 00 00 00-f9 47 c5 01 00 00 00 00  .........G......
44 e7 c4 01 68 e7 c4 01-00 00 00 00 00 00 00 00  D...h...........
69 e7 c4 01 00 00 00 00-60 0b c5 01 79 0b c5 01  i.......`...y...
00 00 00 00 00 00 00 00-7a 0b c5 01 00 00 00 00  ........z.......
80 0b c5 01 9e 0b c5 01-00 00 00 00 00 00 00 00  ................
9f 0b c5 01 00 00 00 00-a0 0b c5 01 be 0b c5 01  ................
00 00 00 00 00 00 00 00-bf 0b c5 01 00 00 00 00  ................
44 01 c5 01 64 01 c5 01-00 00 00 00 00 00 00 00  D...d...........
65 01 c5 01 00 00 00 00-6c 01 c5 01 8e 01 c5 01  e.......l.......
00 00 00 00 00 00 00 00-8f 01 c5 01 00 00 00 00  ................
94 01 c5 01 b6 01 c5 01-00 00 00 00 00 00 00 00  ................
b7 01 c5 01 00 00 00 00-bc 01 c5 01 df 01 c5 01  ................
00 00 00 00 00 00 00 00-e0 01 c5 01 00 00 00 00  ................
e4 01 c5 01 08 02 c5 01-00 00 00 00 00 00 00 00  ................
09 02 c5 01 00 00 00 00-0c 02 c5 01 31 02 c5 01  ............1...
00 00 00 00 00 00 00 00-32 02 c5 01 00 00 00 00  ........2.......
34 02 c5 01 55 02 c5 01-00 00 00 00 00 00 00 00  4...U...........
56 02 c5 01 00 00 00 00-5c 02 c5 01 7d 02 c5 01  V.......\...}...
00 00 00 00 00 00 00 00-7e 02 c5 01 00 00 00 00  ........~.......
c0 0b c5 01 df 0b c5 01-00 00 00 00 00 00 00 00  ................
e0 0b c5 01 00 00 00 00-84 02 c5 01 a4 02 c5 01  ................
00 00 00 00 00 00 00 00-a5 02 c5 01 00 00 00 00  ................
ac 02 c5 01 cd 02 c5 01-00 00 00 00 00 00 00 00  ................
ce 02 c5 01 00 00 00 00-e0 0b c5 01 ff 0b c5 01  ................
00 00 00 00 00 00 00 00-00 0c c5 01 00 00 00 00  ................
00 0c c5 01 1f 0c c5 01-00 00 00 00 00 00 00 00  ................
20 0c c5 01 00 00 00 00-20 0c c5 01 3f 0c c5 01 ....... ...?...
00 00 00 00 00 00 00 00-40 0c c5 01 00 00 00 00  ........@.......
40 0c c5 01 5f 0c c5 01-00 00 00 00 00 00 00 00  @..._...........
60 0c c5 01 00 00 00 00-d4 02 c5 01 f8 02 c5 01  `...............
00 00 00 00 00 00 00 00-f9 02 c5 01 00 00 00 00  ................
60 0c c5 01 7e 0c c5 01-00 00 00 00 00 00 00 00  `...~...........
7f 0c c5 01 00 00 00 00-80 0c c5 01 9e 0c c5 01  ................
00 00 00 00 00 00 00 00-9f 0c c5 01 00 00 00 00  ................
a0 0c c5 01 be 0c c5 01-00 00 00 00 00 00 00 00  ................
bf 0c c5 01 00 00 00 00-c0 0c c5 01 de 0c c5 01  ................
00 00 00 00 00 00 00 00-df 0c c5 01 00 00 00 00  ................
e0 0c c5 01 fd 0c c5 01-00 00 00 00 00 00 00 00  ................
fe 0c c5 01 00 00 00 00-00 0d c5 01 1e 0d c5 01  ................
00 00 00 00 00 00 00 00-1f 0d c5 01 00 00 00 00  ................
fc 02 c5 01 1e 03 c5 01-00 00 00 00 00 00 00 00  ................
1f 03 c5 01 00 00 00 00-24 03 c5 01 46 03 c5 01  ........$...F...
00 00 00 00 00 00 00 00-47 03 c5 01 00 00 00 00  ........G.......
20 0d c5 01 3d 0d c5 01-00 00 00 00 00 00 00 00 ...=...........
3e 0d c5 01 00 00 00 00-40 0d c5 01 5d 0d c5 01  >.......@...]...
00 00 00 00 00 00 00 00-5e 0d c5 01 00 00 00 00  ........^.......
40 36 c4 01 68 36 c4 01-00 00 00 00 00 00 00 00  @6..h6..........
69 36 c4 01 00 00 00 00-4c 03 c5 01 73 03 c5 01  i6......L...s...
00 00 00 00 00 00 00 00-74 03 c5 01 00 00 00 00  ........t.......
60 0d c5 01 7e 0d c5 01-00 00 00 00 00 00 00 00  `...~...........
7f 0d c5 01 00 00 00 00-80 0d c5 01 9f 0d c5 01  ................
00 00 00 00 00 00 00 00-a0 0d c5 01 00 00 00 00  ................
74 03 c5 01 94 03 c5 01-00 00 00 00 00 00 00 00  t...............
95 03 c5 01 00 00 00 00-a0 0d c5 01 be 0d c5 01  ................
00 00 00 00 00 00 00 00-bf 0d c5 01 00 00 00 00  ................
c0 0d c5 01 d9 0d c5 01-00 00 00 00 00 00 00 00  ................
da 0d c5 01 00 00 00 00-e0 0d c5 01 ff 0d c5 01  ................
00 00 00 00 00 00 00 00-00 0e c5 01 00 00 00 00  ................
00 0e c5 01 1f 0e c5 01-00 00 00 00 00 00 00 00  ................
20 0e c5 01 00 00 00 00-9c 03 c5 01 bc 03 c5 01 ...............
00 00 00 00 00 00 00 00-bd 03 c5 01 00 00 00 00  ................
c4 03 c5 01 e5 03 c5 01-00 00 00 00 00 00 00 00  ................
e6 03 c5 01 00 00 00 00-ec 03 c5 01 13 04 c5 01  ................
00 00 00 00 00 00 00 00-14 04 c5 01 00 00 00 00  ................
10 36 c4 01 3d 36 c4 01-00 00 00 00 00 00 00 00  .6..=6..........
3e 36 c4 01 00 00 00 00-e0 35 c4 01 0e 36 c4 01  >6.......5...6..
00 00 00 00 00 00 00 00-0f 36 c4 01 00 00 00 00  .........6......
14 04 c5 01 36 04 c5 01-00 00 00 00 00 00 00 00  ....6...........
37 04 c5 01 00 00 00 00-00 10 c5 01 22 10 c5 01  7..........."...
00 00 00 00 00 00 00 00-23 10 c5 01 00 00 00 00  ........#.......
48 40 c4 01 59 40 c4 01-00 00 00 00 00 00 00 00  H@..Y@..........
5a 40 c4 01 00 00 00 00-3c 6f c6 01 51 6f c6 01  Z@......<o..Qo..
00 00 00 00 00 00 00 00-52 6f c6 01 00 00 00 00  ........Ro......
24 6f c6 01 38 6f c6 01-00 00 00 00 00 00 00 00  $o..8o..........
39 6f c6 01 00 00 00 00-30 1b c4 01 3f 1b c4 01  9o......0...?...
00 00 00 00 00 00 00 00-40 1b c4 01 00 00 00 00  ........@.......
0c 6f c6 01 1e 6f c6 01-00 00 00 00 00 00 00 00  .o...o..........
1f 6f c6 01 00 00 00 00-f4 6e c6 01 07 6f c6 01  .o.......n...o..
00 00 00 00 00 00 00 00-08 6f c6 01 00 00 00 00  .........o......
dc 6e c6 01 ee 6e c6 01-00 00 00 00 00 00 00 00  .n...n..........
ef 6e c6 01 00 00 00 00-c4 6e c6 01 d6 6e c6 01  .n.......n...n..
00 00 00 00 00 00 00 00-d7 6e c6 01 00 00 00 00  .........n......
ac 6e c6 01 bc 6e c6 01-00 00 00 00 00 00 00 00  .n...n..........
bd 6e c6 01 00 00 00 00-b0 35 c4 01 df 35 c4 01  .n.......5...5..
00 00 00 00 00 00 00 00-e0 35 c4 01 00 00 00 00  .........5......
94 6e c6 01 a8 6e c6 01-00 00 00 00 00 00 00 00  .n...n..........
a9 6e c6 01 00 00 00 00-7c 6e c6 01 8f 6e c6 01  .n......|n...n..
00 00 00 00 00 00 00 00-90 6e c6 01 00 00 00 00  .........n......
64 6e c6 01 79 6e c6 01-00 00 00 00 00 00 00 00  dn..yn..........
7a 6e c6 01 00 00 00 00-4c 6e c6 01 5d 6e c6 01  zn......Ln..]n..
00 00 00 00 00 00 00 00-5e 6e c6 01 00 00 00 00  ........^n......
34 6e c6 01 46 6e c6 01-00 00 00 00 00 00 00 00  4n..Fn..........
47 6e c6 01 00 00 00 00-1c 6e c6 01 2f 6e c6 01  Gn.......n../n..
00 00 00 00 00 00 00 00-30 6e c6 01 00 00 00 00  ........0n......
20 0e c5 01 38 0e c5 01-00 00 00 00 00 00 00 00 ...8...........
39 0e c5 01 00 00 00 00-04 6e c6 01 16 6e c6 01  9........n...n..
00 00 00 00 00 00 00 00-17 6e c6 01 00 00 00 00  .........n......
ec 6d c6 01 02 6e c6 01-00 00 00 00 00 00 00 00  .m...n..........
03 6e c6 01 00 00 00 00-d4 6d c6 01 e9 6d c6 01  .n.......m...m..
00 00 00 00 00 00 00 00-ea 6d c6 01 00 00 00 00  .........m......
bc 6d c6 01 cd 6d c6 01-00 00 00 00 00 00 00 00  .m...m..........
ce 6d c6 01 00 00 00 00-a4 6d c6 01 b6 6d c6 01  .m.......m...m..
00 00 00 00 00 00 00 00-b7 6d c6 01 00 00 00 00  .........m......
8c 6d c6 01 9f 6d c6 01-00 00 00 00 00 00 00 00  .m...m..........
a0 6d c6 01 00 00 00 00-74 6d c6 01 85 6d c6 01  .m......tm...m..
00 00 00 00 00 00 00 00-86 6d c6 01 00 00 00 00  .........m......
5c 6d c6 01 6d 6d c6 01-00 00 00 00 00 00 00 00  \m..mm..........
6e 6d c6 01 00 00 00 00-44 6d c6 01 55 6d c6 01  nm......Dm..Um..
00 00 00 00 00 00 00 00-56 6d c6 01 00 00 00 00  ........Vm......
2c 6d c6 01 3d 6d c6 01-00 00 00 00 00 00 00 00  ,m..=m..........
3e 6d c6 01 00 00 00 00-14 6d c6 01 26 6d c6 01  >m.......m..&m..
00 00 00 00 00 00 00 00-27 6d c6 01 00 00 00 00  ........'m......
fc 6c c6 01 10 6d c6 01-00 00 00 00 00 00 00 00  .l...m..........
11 6d c6 01 00 00 00 00-e4 6c c6 01 f8 6c c6 01  .m.......l...l..
00 00 00 00 00 00 00 00-f9 6c c6 01 00 00 00 00  .........l......
cc 6c c6 01 df 6c c6 01-00 00 00 00 00 00 00 00  .l...l..........
e0 6c c6 01 00 00 00 00-b4 6c c6 01 c8 6c c6 01  .l.......l...l..
00 00 00 00 00 00 00 00-c9 6c c6 01 00 00 00 00  .........l......
9c 6c c6 01 af 6c c6 01-00 00 00 00 00 00 00 00  .l...l..........
b0 6c c6 01 00 00 00 00-84 6c c6 01 96 6c c6 01  .l.......l...l..
00 00 00 00 00 00 00 00-97 6c c6 01 00 00 00 00  .........l......
6c 6c c6 01 7e 6c c6 01-00 00 00 00 00 00 00 00  ll..~l..........
7f 6c c6 01 00 00 00 00-54 6c c6 01 65 6c c6 01  .l......Tl..el..
00 00 00 00 00 00 00 00-66 6c c6 01 00 00 00 00  ........fl......
3c 6c c6 01 4e 6c c6 01-00 00 00 00 00 00 00 00  <l..Nl..........
4f 6c c6 01 00 00 00 00-24 6c c6 01 36 6c c6 01  Ol......$l..6l..
00 00 00 00 00 00 00 00-37 6c c6 01 00 00 00 00  ........7l......
0c 6c c6 01 1e 6c c6 01-00 00 00 00 00 00 00 00  .l...l..........
1f 6c c6 01 00 00 00 00-f4 6b c6 01 07 6c c6 01  .l.......k...l..
00 00 00 00 00 00 00 00-08 6c c6 01 00 00 00 00  .........l......
dc 6b c6 01 ef 6b c6 01-00 00 00 00 00 00 00 00  .k...k..........
f0 6b c6 01 00 00 00 00-c4 6b c6 01 d7 6b c6 01  .k.......k...k..
00 00 00 00 00 00 00 00-d8 6b c6 01 00 00 00 00  .........k......
ac 6b c6 01 bf 6b c6 01-00 00 00 00 00 00 00 00  .k...k..........
c0 6b c6 01 00 00 00 00-94 6b c6 01 a7 6b c6 01  .k.......k...k..
00 00 00 00 00 00 00 00-a8 6b c6 01 00 00 00 00  .........k......
7c 6b c6 01 8f 6b c6 01-00 00 00 00 00 00 00 00  |k...k..........
90 6b c6 01 00 00 00 00-64 6b c6 01 78 6b c6 01  .k......dk..xk..
00 00 00 00 00 00 00 00-79 6b c6 01 00 00 00 00  ........yk......
40 0e c5 01 58 0e c5 01-00 00 00 00 00 00 00 00  @...X...........
59 0e c5 01 00 00 00 00-4c 6b c6 01 5e 6b c6 01  Y.......Lk..^k..
00 00 00 00 00 00 00 00-5f 6b c6 01 00 00 00 00  ........_k......
34 6b c6 01 45 6b c6 01-00 00 00 00 00 00 00 00  4k..Ek..........
46 6b c6 01 00 00 00 00-1c 6b c6 01 2e 6b c6 01  Fk.......k...k..
00 00 00 00 00 00 00 00-2f 6b c6 01 00 00 00 00  ......../k......
04 6b c6 01 16 6b c6 01-00 00 00 00 00 00 00 00  .k...k..........
17 6b c6 01 00 00 00 00-ec 44 c5 01 00 45 c5 01  .k.......D...E..
00 00 00 00 00 00 00 00-01 45 c5 01 00 00 00 00  .........E......
d4 44 c5 01 e6 44 c5 01-00 00 00 00 00 00 00 00  .D...D..........
e7 44 c5 01 00 00 00 00-bc 44 c5 01 ce 44 c5 01  .D.......D...D..
00 00 00 00 00 00 00 00-cf 44 c5 01 00 00 00 00  .........D......
a4 44 c5 01 b6 44 c5 01-00 00 00 00 00 00 00 00  .D...D..........
b7 44 c5 01 00 00 00 00-8c 44 c5 01 a0 44 c5 01  .D.......D...D..
00 00 00 00 00 00 00 00-a1 44 c5 01 00 00 00 00  .........D......
f0 1b c4 01 04 1c c4 01-00 00 00 00 00 00 00 00  ................
05 1c c4 01 00 00 00 00-20 1c c4 01 31 1c c4 01  ........ ...1...
00 00 00 00 00 00 00 00-32 1c c4 01 00 00 00 00  ........2.......
08 1c c4 01 1a 1c c4 01-00 00 00 00 00 00 00 00  ................
1b 1c c4 01 00 00 00 00-98 62 c6 01 aa 62 c6 01  .........b...b..
00 00 00 00 00 00 00 00-ab 62 c6 01 00 00 00 00  .........b......
b0 62 c6 01 c2 62 c6 01-00 00 00 00 00 00 00 00  .b...b..........
c3 62 c6 01 00 00 00 00-c8 62 c6 01 dc 62 c6 01  .b.......b...b..
00 00 00 00 00 00 00 00-dd 62 c6 01 00 00 00 00  .........b......
60 0e c5 01 79 0e c5 01-00 00 00 00 00 00 00 00  `...y...........
7a 0e c5 01 00 00 00 00-0c 78 c6 01 20 78 c6 01  z........x.. x..
00 00 00 00 00 00 00 00-21 78 c6 01 00 00 00 00  ........!x......
80 0e c5 01 98 0e c5 01-00 00 00 00 00 00 00 00  ................
99 0e c5 01 00 00 00 00-a0 0e c5 01 b8 0e c5 01  ................
00 00 00 00 00 00 00 00-b9 0e c5 01 00 00 00 00  ................
c0 0e c5 01 d8 0e c5 01-00 00 00 00 00 00 00 00  ................
d9 0e c5 01 00 00 00 00-e0 0e c5 01 f9 0e c5 01  ................
00 00 00 00 00 00 00 00-fa 0e c5 01 00 00 00 00  ................
00 0f c5 01 19 0f c5 01-00 00 00 00 00 00 00 00  ................
1a 0f c5 01 00 00 00 00-20 0f c5 01 39 0f c5 01  ........ ...9...
00 00 00 00 00 00 00 00-3a 0f c5 01 00 00 00 00  ........:.......
40 0f c5 01 59 0f c5 01-00 00 00 00 00 00 00 00  @...Y...........
5a 0f c5 01 00 00 00 00-60 0f c5 01 78 0f c5 01  Z.......`...x...
00 00 00 00 00 00 00 00-79 0f c5 01 00 00 00 00  ........y.......
80 0f c5 01 99 0f c5 01-00 00 00 00 00 00 00 00  ................
9a 0f c5 01 00 00 00 00-a0 0f c5 01 b9 0f c5 01  ................
00 00 00 00 00 00 00 00-ba 0f c5 01 00 00 00 00  ................
c0 0f c5 01 d8 0f c5 01-00 00 00 00 00 00 00 00  ................
d9 0f c5 01 00 00 00 00-24 78 c6 01 37 78 c6 01  ........$x..7x..
00 00 00 00 00 00 00 00-38 78 c6 01 00 00 00 00  ........8x......
3c 78 c6 01 4f 78 c6 01-00 00 00 00 00 00 00 00  <x..Ox..........
50 78 c6 01 00 00 00 00-54 78 c6 01 66 78 c6 01  Px......Tx..fx..
00 00 00 00 00 00 00 00-67 78 c6 01 00 00 00 00  ........gx......
e0 0f c5 01 f9 0f c5 01-00 00 00 00 00 00 00 00  ................
fa 0f c5 01 00 00 00 00-6c 78 c6 01 82 78 c6 01  ........lx...x..
00 00 00 00 00 00 00 00-83 78 c6 01 00 00 00 00  .........x......
84 78 c6 01 9b 78 c6 01-00 00 00 00 00 00 00 00  .x...x..........
9c 78 c6 01 00 00 00 00-9c 78 c6 01 b3 78 c6 01  .x.......x...x..
00 00 00 00 00 00 00 00-b4 78 c6 01 00 00 00 00  .........x......
20 13 c5 01 38 13 c5 01-00 00 00 00 00 00 00 00 ...8...........
39 13 c5 01 00 00 00 00-40 13 c5 01 58 13 c5 01  9.......@...X...
00 00 00 00 00 00 00 00-59 13 c5 01 00 00 00 00  ........Y.......
60 13 c5 01 79 13 c5 01-00 00 00 00 00 00 00 00  `...y...........
7a 13 c5 01 00 00 00 00-80 13 c5 01 98 13 c5 01  z...............
00 00 00 00 00 00 00 00-99 13 c5 01 00 00 00 00  ................
a0 13 c5 01 b9 13 c5 01-00 00 00 00 00 00 00 00  ................
ba 13 c5 01 00 00 00 00-b4 78 c6 01 cb 78 c6 01  .........x...x..
00 00 00 00 00 00 00 00-cc 78 c6 01 00 00 00 00  .........x......
cc 78 c6 01 e3 78 c6 01-00 00 00 00 00 00 00 00  .x...x..........
e4 78 c6 01 00 00 00 00-c0 13 c5 01 d8 13 c5 01  .x..............
00 00 00 00 00 00 00 00-d9 13 c5 01 00 00 00 00  ................
e0 13 c5 01 f8 13 c5 01-00 00 00 00 00 00 00 00  ................
f9 13 c5 01 00 00 00 00-00 14 c5 01 18 14 c5 01  ................
00 00 00 00 00 00 00 00-19 14 c5 01 00 00 00 00  ................
20 14 c5 01 38 14 c5 01-00 00 00 00 00 00 00 00 ...8...........
39 14 c5 01 00 00 00 00-e4 78 c6 01 fb 78 c6 01  9........x...x..
00 00 00 00 00 00 00 00-fc 78 c6 01 00 00 00 00  .........x......
40 14 c5 01 58 14 c5 01-00 00 00 00 00 00 00 00  @...X...........
59 14 c5 01 00 00 00 00-60 14 c5 01 78 14 c5 01  Y.......`...x...
00 00 00 00 00 00 00 00-79 14 c5 01 00 00 00 00  ........y.......
80 14 c5 01 99 14 c5 01-00 00 00 00 00 00 00 00  ................
9a 14 c5 01 00 00 00 00-80 35 c4 01 ae 35 c4 01  .........5...5..
00 00 00 00 00 00 00 00-af 35 c4 01 00 00 00 00  .........5......
a0 14 c5 01 b8 14 c5 01-00 00 00 00 00 00 00 00  ................
b9 14 c5 01 00 00 00 00-c0 14 c5 01 da 14 c5 01  ................
00 00 00 00 00 00 00 00-db 14 c5 01 00 00 00 00  ................
e0 14 c5 01 f9 14 c5 01-00 00 00 00 00 00 00 00  ................
fa 14 c5 01 00 00 00 00-00 15 c5 01 1a 15 c5 01  ................
00 00 00 00 00 00 00 00-1b 15 c5 01 00 00 00 00  ................
20 15 c5 01 39 15 c5 01-00 00 00 00 00 00 00 00 ...9...........
3a 15 c5 01 00 00 00 00-40 15 c5 01 5b 15 c5 01  :.......@...[...
00 00 00 00 00 00 00 00-5c 15 c5 01 00 00 00 00  ........\.......
60 15 c5 01 7b 15 c5 01-00 00 00 00 00 00 00 00  `...{...........
7c 15 c5 01 00 00 00 00-80 15 c5 01 99 15 c5 01  |...............
00 00 00 00 00 00 00 00-9a 15 c5 01 00 00 00 00  ................
a0 15 c5 01 bb 15 c5 01-00 00 00 00 00 00 00 00  ................
bc 15 c5 01 00 00 00 00-c0 15 c5 01 db 15 c5 01  ................
00 00 00 00 00 00 00 00-dc 15 c5 01 00 00 00 00  ................
e0 15 c5 01 f8 15 c5 01-00 00 00 00 00 00 00 00  ................
f9 15 c5 01 00 00 00 00-00 16 c5 01 19 16 c5 01  ................
00 00 00 00 00 00 00 00-1a 16 c5 01 00 00 00 00  ................
20 16 c5 01 3a 16 c5 01-00 00 00 00 00 00 00 00 ...:...........
3b 16 c5 01 00 00 00 00-40 16 c5 01 58 16 c5 01  ;.......@...X...
00 00 00 00 00 00 00 00-59 16 c5 01 00 00 00 00  ........Y.......
60 16 c5 01 7b 16 c5 01-00 00 00 00 00 00 00 00  `...{...........
7c 16 c5 01 00 00 00 00-80 16 c5 01 99 16 c5 01  |...............
00 00 00 00 00 00 00 00-9a 16 c5 01 00 00 00 00  ................
a0 16 c5 01 b9 16 c5 01-00 00 00 00 00 00 00 00  ................
ba 16 c5 01 00 00 00 00-c0 16 c5 01 da 16 c5 01  ................
00 00 00 00 00 00 00 00-db 16 c5 01 00 00 00 00  ................
e0 16 c5 01 fa 16 c5 01-00 00 00 00 00 00 00 00  ................
fb 16 c5 01 00 00 00 00-00 17 c5 01 19 17 c5 01  ................
00 00 00 00 00 00 00 00-1a 17 c5 01 00 00 00 00  ................
20 17 c5 01 39 17 c5 01-00 00 00 00 00 00 00 00 ...9...........
3a 17 c5 01 00 00 00 00-40 17 c5 01 59 17 c5 01  :.......@...Y...
00 00 00 00 00 00 00 00-5a 17 c5 01 00 00 00 00  ........Z.......
60 17 c5 01 79 17 c5 01-00 00 00 00 00 00 00 00  `...y...........
7a 17 c5 01 00 00 00 00-80 17 c5 01 9a 17 c5 01  z...............
00 00 00 00 00 00 00 00-9b 17 c5 01 00 00 00 00  ................
a0 17 c5 01 bb 17 c5 01-00 00 00 00 00 00 00 00  ................
bc 17 c5 01 00 00 00 00-c0 17 c5 01 da 17 c5 01  ................
00 00 00 00 00 00 00 00-db 17 c5 01 00 00 00 00  ................
fc 78 c6 01 0f 79 c6 01-00 00 00 00 00 00 00 00  .x...y..........
10 79 c6 01 00 00 00 00-14 79 c6 01 26 79 c6 01  .y.......y..&y..
00 00 00 00 00 00 00 00-27 79 c6 01 00 00 00 00  ........'y......
2c 79 c6 01 43 79 c6 01-00 00 00 00 00 00 00 00  ,y..Cy..........
44 79 c6 01 00 00 00 00-44 79 c6 01 5b 79 c6 01  Dy......Dy..[y..
00 00 00 00 00 00 00 00-5c 79 c6 01 00 00 00 00  ........\y......
e0 17 c5 01 fa 17 c5 01-00 00 00 00 00 00 00 00  ................
fb 17 c5 01 00 00 00 00-00 18 c5 01 1a 18 c5 01  ................
00 00 00 00 00 00 00 00-1b 18 c5 01 00 00 00 00  ................
20 18 c5 01 39 18 c5 01-00 00 00 00 00 00 00 00 ...9...........
3a 18 c5 01 00 00 00 00-40 18 c5 01 5b 18 c5 01  :.......@...[...
00 00 00 00 00 00 00 00-5c 18 c5 01 00 00 00 00  ........\.......
60 18 c5 01 79 18 c5 01-00 00 00 00 00 00 00 00  `...y...........
7a 18 c5 01 00 00 00 00-80 18 c5 01 99 18 c5 01  z...............
00 00 00 00 00 00 00 00-9a 18 c5 01 00 00 00 00  ................
a0 18 c5 01 ba 18 c5 01-00 00 00 00 00 00 00 00  ................
bb 18 c5 01 00 00 00 00-c0 18 c5 01 da 18 c5 01  ................
00 00 00 00 00 00 00 00-db 18 c5 01 00 00 00 00  ................
e0 18 c5 01 fa 18 c5 01-00 00 00 00 00 00 00 00  ................
fb 18 c5 01 00 00 00 00-00 19 c5 01 19 19 c5 01  ................
00 00 00 00 00 00 00 00-1a 19 c5 01 00 00 00 00  ................
20 19 c5 01 3a 19 c5 01-00 00 00 00 00 00 00 00 ...:...........
3b 19 c5 01 00 00 00 00-40 19 c5 01 5a 19 c5 01  ;.......@...Z...
00 00 00 00 00 00 00 00-5b 19 c5 01 00 00 00 00  ........[.......
60 19 c5 01 7a 19 c5 01-00 00 00 00 00 00 00 00  `...z...........
7b 19 c5 01 00 00 00 00-80 19 c5 01 9a 19 c5 01  {...............
00 00 00 00 00 00 00 00-9b 19 c5 01 00 00 00 00  ................
50 35 c4 01 7e 35 c4 01-00 00 00 00 00 00 00 00  P5..~5..........
7f 35 c4 01 00 00 00 00-a0 19 c5 01 ba 19 c5 01  .5..............
00 00 00 00 00 00 00 00-bb 19 c5 01 00 00 00 00  ................
c0 19 c5 01 db 19 c5 01-00 00 00 00 00 00 00 00  ................
dc 19 c5 01 00 00 00 00-e0 19 c5 01 f9 19 c5 01  ................
00 00 00 00 00 00 00 00-fa 19 c5 01 00 00 00 00  ................
00 1a c5 01 1a 1a c5 01-00 00 00 00 00 00 00 00  ................
1b 1a c5 01 00 00 00 00-20 1a c5 01 3a 1a c5 01  ........ ...:...
00 00 00 00 00 00 00 00-3b 1a c5 01 00 00 00 00  ........;.......
40 1a c5 01 59 1a c5 01-00 00 00 00 00 00 00 00  @...Y...........
5a 1a c5 01 00 00 00 00-5c 79 c6 01 6d 79 c6 01  Z.......\y..my..
00 00 00 00 00 00 00 00-6e 79 c6 01 00 00 00 00  ........ny......
50 1c c4 01 61 1c c4 01-00 00 00 00 00 00 00 00  P...a...........
62 1c c4 01 00 00 00 00-68 1c c4 01 79 1c c4 01  b.......h...y...
00 00 00 00 00 00 00 00-7a 1c c4 01 00 00 00 00  ........z.......
90 5b c6 01 a2 5b c6 01-00 00 00 00 00 00 00 00  .[...[..........
a3 5b c6 01 00 00 00 00-00 61 c6 01 10 61 c6 01  .[.......a...a..
00 00 00 00 00 00 00 00-11 61 c6 01 00 00 00 00  .........a......
18 61 c6 01 29 61 c6 01-00 00 00 00 00 00 00 00  .a..)a..........
2a 61 c6 01 00 00 00 00-30 61 c6 01 42 61 c6 01  *a......0a..Ba..
00 00 00 00 00 00 00 00-43 61 c6 01 00 00 00 00  ........Ca......
48 61 c6 01 5b 61 c6 01-00 00 00 00 00 00 00 00  Ha..[a..........
5c 61 c6 01 00 00 00 00-60 61 c6 01 72 61 c6 01  \a......`a..ra..
00 00 00 00 00 00 00 00-73 61 c6 01 00 00 00 00  ........sa......
80 62 c6 01 92 62 c6 01-00 00 00 00 00 00 00 00  .b...b..........
93 62 c6 01 00 00 00 00-74 44 c5 01 85 44 c5 01  .b......tD...D..
00 00 00 00 00 00 00 00-86 44 c5 01 00 00 00 00  .........D......
5c 44 c5 01 6e 44 c5 01-00 00 00 00 00 00 00 00  \D..nD..........
6f 44 c5 01 00 00 00 00-44 44 c5 01 57 44 c5 01  oD......DD..WD..
00 00 00 00 00 00 00 00-58 44 c5 01 00 00 00 00  ........XD......
2c 44 c5 01 3e 44 c5 01-00 00 00 00 00 00 00 00  ,D..>D..........
3f 44 c5 01 00 00 00 00-14 44 c5 01 27 44 c5 01  ?D.......D..'D..
00 00 00 00 00 00 00 00-28 44 c5 01 00 00 00 00  ........(D......
fc 43 c5 01 0f 44 c5 01-00 00 00 00 00 00 00 00  .C...D..........
10 44 c5 01 00 00 00 00-e4 43 c5 01 f7 43 c5 01  .D.......C...C..
00 00 00 00 00 00 00 00-f8 43 c5 01 00 00 00 00  .........C......
cc 43 c5 01 df 43 c5 01-00 00 00 00 00 00 00 00  .C...C..........
e0 43 c5 01 00 00 00 00-b4 43 c5 01 c7 43 c5 01  .C.......C...C..
00 00 00 00 00 00 00 00-c8 43 c5 01 00 00 00 00  .........C......
9c 43 c5 01 b0 43 c5 01-00 00 00 00 00 00 00 00  .C...C..........
b1 43 c5 01 00 00 00 00-84 43 c5 01 97 43 c5 01  .C.......C...C..
00 00 00 00 00 00 00 00-98 43 c5 01 00 00 00 00  .........C......
6c 43 c5 01 7f 43 c5 01-00 00 00 00 00 00 00 00  lC...C..........
80 43 c5 01 00 00 00 00-54 43 c5 01 68 43 c5 01  .C......TC..hC..
00 00 00 00 00 00 00 00-69 43 c5 01 00 00 00 00  ........iC......
28 10 c5 01 49 10 c5 01-00 00 00 00 00 00 00 00  (...I...........
4a 10 c5 01 00 00 00 00-50 10 c5 01 75 10 c5 01  J.......P...u...
00 00 00 00 00 00 00 00-76 10 c5 01 00 00 00 00  ........v.......
78 10 c5 01 9b 10 c5 01-00 00 00 00 00 00 00 00  x...............
9c 10 c5 01 00 00 00 00-a0 10 c5 01 c6 10 c5 01  ................
00 00 00 00 00 00 00 00-c7 10 c5 01 00 00 00 00  ................
60 1a c5 01 7f 1a c5 01-00 00 00 00 00 00 00 00  `...............
80 1a c5 01 00 00 00 00-c8 10 c5 01 e9 10 c5 01  ................
00 00 00 00 00 00 00 00-ea 10 c5 01 00 00 00 00  ................
f0 10 c5 01 10 11 c5 01-00 00 00 00 00 00 00 00  ................
11 11 c5 01 00 00 00 00-3c 43 c5 01 4d 43 c5 01  ........<C..MC..
00 00 00 00 00 00 00 00-4e 43 c5 01 00 00 00 00  ........NC......
80 1a c5 01 9f 1a c5 01-00 00 00 00 00 00 00 00  ................
a0 1a c5 01 00 00 00 00-a0 1a c5 01 bd 1a c5 01  ................
00 00 00 00 00 00 00 00-be 1a c5 01 00 00 00 00  ................
a0 f0 c4 01 ce f0 c4 01-00 00 00 00 00 00 00 00  ................
cf f0 c4 01 00 00 00 00-18 11 c5 01 38 11 c5 01  ............8...
00 00 00 00 00 00 00 00-39 11 c5 01 00 00 00 00  ........9.......
70 f0 c4 01 9a f0 c4 01-00 00 00 00 00 00 00 00  p...............
9b f0 c4 01 00 00 00 00-40 f0 c4 01 6b f0 c4 01  ........@...k...
00 00 00 00 00 00 00 00-6c f0 c4 01 00 00 00 00  ........l.......
10 f0 c4 01 3c f0 c4 01-00 00 00 00 00 00 00 00  ....<...........
3d f0 c4 01 00 00 00 00-c0 1a c5 01 da 1a c5 01  =...............
00 00 00 00 00 00 00 00-db 1a c5 01 00 00 00 00  ................
40 11 c5 01 63 11 c5 01-00 00 00 00 00 00 00 00  @...c...........
64 11 c5 01 00 00 00 00-e0 ef c4 01 08 f0 c4 01  d...............
00 00 00 00 00 00 00 00-09 f0 c4 01 00 00 00 00  ................
68 11 c5 01 8a 11 c5 01-00 00 00 00 00 00 00 00  h...............
8b 11 c5 01 00 00 00 00-90 11 c5 01 b2 11 c5 01  ................
00 00 00 00 00 00 00 00-b3 11 c5 01 00 00 00 00  ................
b8 11 c5 01 df 11 c5 01-00 00 00 00 00 00 00 00  ................
e0 11 c5 01 00 00 00 00-e0 1a c5 01 fd 1a c5 01  ................
00 00 00 00 00 00 00 00-fe 1a c5 01 00 00 00 00  ................
e0 11 c5 01 00 12 c5 01-00 00 00 00 00 00 00 00  ................
01 12 c5 01 00 00 00 00-00 1b c5 01 1e 1b c5 01  ................
00 00 00 00 00 00 00 00-1f 1b c5 01 00 00 00 00  ................
20 1b c5 01 3e 1b c5 01-00 00 00 00 00 00 00 00 ...>...........
3f 1b c5 01 00 00 00 00-08 12 c5 01 29 12 c5 01  ?...........)...
00 00 00 00 00 00 00 00-2a 12 c5 01 00 00 00 00  ........*.......
30 12 c5 01 51 12 c5 01-00 00 00 00 00 00 00 00  0...Q...........
52 12 c5 01 00 00 00 00-58 12 c5 01 7f 12 c5 01  R.......X.......
00 00 00 00 00 00 00 00-80 12 c5 01 00 00 00 00  ................
80 12 c5 01 a1 12 c5 01-00 00 00 00 00 00 00 00  ................
a2 12 c5 01 00 00 00 00-a8 12 c5 01 c8 12 c5 01  ................
00 00 00 00 00 00 00 00-c9 12 c5 01 00 00 00 00  ................
d0 12 c5 01 f5 12 c5 01-00 00 00 00 00 00 00 00  ................
f6 12 c5 01 00 00 00 00-f8 12 c5 01 1c 13 c5 01  ................
00 00 00 00 00 00 00 00-1d 13 c5 01 00 00 00 00  ................
20 1d c5 01 45 1d c5 01-00 00 00 00 00 00 00 00 ...E...........
46 1d c5 01 00 00 00 00-40 1b c5 01 59 1b c5 01  F.......@...Y...
00 00 00 00 00 00 00 00-5a 1b c5 01 00 00 00 00  ........Z.......
24 43 c5 01 3b 43 c5 01-00 00 00 00 00 00 00 00  $C..;C..........
3c 43 c5 01 00 00 00 00-60 1b c5 01 78 1b c5 01  <C......`...x...
00 00 00 00 00 00 00 00-79 1b c5 01 00 00 00 00  ........y.......
48 1d c5 01 6b 1d c5 01-00 00 00 00 00 00 00 00  H...k...........
6c 1d c5 01 00 00 00 00-d4 79 c6 01 eb 79 c6 01  l........y...y..
00 00 00 00 00 00 00 00-ec 79 c6 01 00 00 00 00  .........y......
bc 79 c6 01 d3 79 c6 01-00 00 00 00 00 00 00 00  .y...y..........
d4 79 c6 01 00 00 00 00-70 1d c5 01 91 1d c5 01  .y......p.......
00 00 00 00 00 00 00 00-92 1d c5 01 00 00 00 00  ................
98 1d c5 01 b9 1d c5 01-00 00 00 00 00 00 00 00  ................
ba 1d c5 01 00 00 00 00-c0 1d c5 01 e1 1d c5 01  ................
00 00 00 00 00 00 00 00-e2 1d c5 01 00 00 00 00  ................
a4 79 c6 01 b6 79 c6 01-00 00 00 00 00 00 00 00  .y...y..........
b7 79 c6 01 00 00 00 00-8c 79 c6 01 9e 79 c6 01  .y.......y...y..
00 00 00 00 00 00 00 00-9f 79 c6 01 00 00 00 00  .........y......
74 79 c6 01 86 79 c6 01-00 00 00 00 00 00 00 00  ty...y..........
87 79 c6 01 00 00 00 00-b0 ef c4 01 df ef c4 01  .y..............
00 00 00 00 00 00 00 00-e0 ef c4 01 00 00 00 00  ................
80 1b c5 01 9d 1b c5 01-00 00 00 00 00 00 00 00  ................
9e 1b c5 01 00 00 00 00-a0 1b c5 01 bd 1b c5 01  ................
00 00 00 00 00 00 00 00-be 1b c5 01 00 00 00 00  ................
78 61 c6 01 8b 61 c6 01-00 00 00 00 00 00 00 00  xa...a..........
8c 61 c6 01 00 00 00 00-e8 1d c5 01 0e 1e c5 01  .a..............
00 00 00 00 00 00 00 00-0f 1e c5 01 00 00 00 00  ................
10 1e c5 01 36 1e c5 01-00 00 00 00 00 00 00 00  ....6...........
37 1e c5 01 00 00 00 00-c0 1b c5 01 df 1b c5 01  7...............
00 00 00 00 00 00 00 00-e0 1b c5 01 00 00 00 00  ................
e0 1b c5 01 ff 1b c5 01-00 00 00 00 00 00 00 00  ................
00 1c c5 01 00 00 00 00-38 1e c5 01 5f 1e c5 01  ........8..._...
00 00 00 00 00 00 00 00-60 1e c5 01 00 00 00 00  ........`.......
60 1e c5 01 84 1e c5 01-00 00 00 00 00 00 00 00  `...............
85 1e c5 01 00 00 00 00-80 ef c4 01 a9 ef c4 01  ................
00 00 00 00 00 00 00 00-aa ef c4 01 00 00 00 00  ................
50 ef c4 01 79 ef c4 01-00 00 00 00 00 00 00 00  P...y...........
7a ef c4 01 00 00 00 00-88 1e c5 01 a9 1e c5 01  z...............
00 00 00 00 00 00 00 00-aa 1e c5 01 00 00 00 00  ................
00 1c c5 01 1d 1c c5 01-00 00 00 00 00 00 00 00  ................
1e 1c c5 01 00 00 00 00-b0 1e c5 01 d0 1e c5 01  ................
00 00 00 00 00 00 00 00-d1 1e c5 01 00 00 00 00  ................
d8 1e c5 01 f9 1e c5 01-00 00 00 00 00 00 00 00  ................
fa 1e c5 01 00 00 00 00-84 6a c6 01 c3 6a c6 01  .........j...j..
00 00 00 00 00 00 00 00-c4 6a c6 01 00 00 00 00  .........j......
90 61 c6 01 a1 61 c6 01-00 00 00 00 00 00 00 00  .a...a..........
a2 61 c6 01 00 00 00 00-20 1c c5 01 3f 1c c5 01  .a...... ...?...
00 00 00 00 00 00 00 00-40 1c c5 01 00 00 00 00  ........@.......
40 1c c5 01 5f 1c c5 01-00 00 00 00 00 00 00 00  @..._...........
60 1c c5 01 00 00 00 00-60 1c c5 01 7e 1c c5 01  `.......`...~...
00 00 00 00 00 00 00 00-7f 1c c5 01 00 00 00 00  ................
80 1c c5 01 9f 1c c5 01-00 00 00 00 00 00 00 00  ................
a0 1c c5 01 00 00 00 00-a0 1c c5 01 bf 1c c5 01  ................
00 00 00 00 00 00 00 00-c0 1c c5 01 00 00 00 00  ................
00 1f c5 01 21 1f c5 01-00 00 00 00 00 00 00 00  ....!...........
22 1f c5 01 00 00 00 00-c0 1c c5 01 dc 1c c5 01  "...............
00 00 00 00 00 00 00 00-dd 1c c5 01 00 00 00 00  ................
e0 1c c5 01 fd 1c c5 01-00 00 00 00 00 00 00 00  ................
fe 1c c5 01 00 00 00 00-28 1f c5 01 48 1f c5 01  ........(...H...
00 00 00 00 00 00 00 00-49 1f c5 01 00 00 00 00  ........I.......
50 1f c5 01 70 1f c5 01-00 00 00 00 00 00 00 00  P...p...........
71 1f c5 01 00 00 00 00-00 1d c5 01 1f 1d c5 01  q...............
00 00 00 00 00 00 00 00-20 1d c5 01 00 00 00 00  ........ .......
40 20 c5 01 5d 20 c5 01-00 00 00 00 00 00 00 00  @ ..] ..........
5e 20 c5 01 00 00 00 00-60 20 c5 01 7e 20 c5 01  ^ ......` ..~ ..
00 00 00 00 00 00 00 00-7f 20 c5 01 00 00 00 00  ......... ......
80 20 c5 01 9b 20 c5 01-00 00 00 00 00 00 00 00  . ... ..........
9c 20 c5 01 00 00 00 00-bc 20 c5 01 d9 20 c5 01  . ....... ... ..
00 00 00 00 00 00 00 00-da 20 c5 01 00 00 00 00  ......... ......
dc 20 c5 01 f9 20 c5 01-00 00 00 00 00 00 00 00  . ... ..........
fa 20 c5 01 00 00 00 00-78 1f c5 01 99 1f c5 01  . ......x.......
00 00 00 00 00 00 00 00-9a 1f c5 01 00 00 00 00  ................
fc 20 c5 01 18 21 c5 01-00 00 00 00 00 00 00 00  . ...!..........
19 21 c5 01 00 00 00 00-1c 21 c5 01 3a 21 c5 01  .!.......!..:!..
00 00 00 00 00 00 00 00-3b 21 c5 01 00 00 00 00  ........;!......
3c 21 c5 01 59 21 c5 01-00 00 00 00 00 00 00 00  <!..Y!..........
5a 21 c5 01 00 00 00 00-5c 21 c5 01 78 21 c5 01  Z!......\!..x!..
00 00 00 00 00 00 00 00-79 21 c5 01 00 00 00 00  ........y!......
7c 21 c5 01 98 21 c5 01-00 00 00 00 00 00 00 00  |!...!..........
99 21 c5 01 00 00 00 00-a0 1f c5 01 c0 1f c5 01  .!..............
00 00 00 00 00 00 00 00-c1 1f c5 01 00 00 00 00  ................
9c 21 c5 01 ba 21 c5 01-00 00 00 00 00 00 00 00  .!...!..........
bb 21 c5 01 00 00 00 00-bc 21 c5 01 da 21 c5 01  .!.......!...!..
ntohs hostshort=13568
shutdown how=SD_SEND
closesocket

直接使用udp层链接即可
另外按照（一）所述，用WinHex可得到ip列表：
4.2.2.1,美国科罗拉多州布隆菲尔德市Level 3通信公司
4.2.2.2,美国科罗拉多州布隆菲尔德市Level 3通信公司
4.2.2.3,美国科罗拉多州布隆菲尔德市Level 3通信公司
4.2.2.4,美国科罗拉多州布隆菲尔德市Level 3通信公司
4.2.2.5,美国科罗拉多州布隆菲尔德市Level 3通信公司
4.2.2.6,美国科罗拉多州布隆菲尔德市Level 3通信公司
4.2.2.10,美国科罗拉多州布隆菲尔德市Level 3通信公司
4.4.4.4,美国科罗拉多州布隆菲尔德市Level 3通信公司
8.2.208.5,美国科罗拉多州布隆菲尔德市Level 3通信公司
8.8.4.4,美国加利福尼亚州山景市谷歌公司DNS服务器
8.8.8.8,美国加利福尼亚州山景市谷歌公司DNS服务器
8.8.192.35,美国科罗拉多州布隆菲尔德市Level 3通信公司
12.17.136.131,美国 ATT用户
12.25.232.115,美国 ATT用户
12.26.86.73,美国 ATT用户
12.32.34.33,美国 ATT用户
12.49.240.68,美国 ATT用户
12.150.146.198,美国 ATT用户
12.166.30.2,美国 ATT用户
12.180.165.40,美国 ATT用户
12.184.191.26,美国 ATT用户
24.113.0.30,美国
24.113.0.31,美国
24.116.213.232,美国
24.116.219.232,美国
24.116.220.232,美国
24.116.222.232,美国
24.116.225.232,美国
24.117.164.232,美国
24.117.215.232,美国
24.138.111.162,加拿大
24.138.111.163,加拿大
24.143.246.29,美国
24.154.1.4,美国俄亥俄洲
24.154.1.5,美国俄亥俄洲
24.197.96.16,美国密苏里州
24.212.0.7,加拿大
24.212.0.8,加拿大
24.222.0.33,加拿大 Andara用户
24.224.127.197,加拿大
24.226.147.200,加拿大
24.237.132.5,美国阿拉斯加
24.244.65.8,加拿大
24.244.175.2,巴哈马 Cable用户
24.244.175.133,巴哈马 Cable用户
38.98.1.5,美国华盛顿哥伦比亚特区Cogent通信公司
38.98.10.132,美国华盛顿哥伦比亚特区Cogent通信公司
38.116.192.11,美国华盛顿哥伦比亚特区Cogent通信公司
38.117.92.104,美国华盛顿哥伦比亚特区Cogent通信公司
41.204.224.2,尼日利亚
41.211.224.7,尼日利亚
58.6.115.42,澳大利亚
58.6.115.43,澳大利亚
58.20.57.4,湖南省长沙市联通
58.20.127.170,湖南省长沙市联通
58.22.96.66,福建省福州市联通
58.64.124.150,泰国 ADC网络
59.51.78.210,湖南省衡阳市电信
59.51.78.211,湖南省衡阳市电信
59.144.127.17,印度 BHARTI网络
59.151.21.101,北京市世纪互联IDC机房
59.185.0.50,印度 VSNL网络
60.191.134.206,浙江省台州市 (椒江区)电信
60.191.244.5,浙江省金华市电信
61.10.0.130,香港有线电视
61.10.1.130,香港有线电视
61.55.166.248,河北省邯郸市联通ADSL
61.128.97.73,新疆乌鲁木齐市电信
61.128.97.74,新疆乌鲁木齐市电信
61.128.99.133,新疆乌鲁木齐市电信
61.128.99.134,新疆乌鲁木齐市电信
61.128.114.133,新疆乌鲁木齐市电信
61.128.114.166,新疆乌鲁木齐市电信
61.128.128.67,重庆市电信
61.128.128.68,重庆市电信
61.128.192.4,重庆市电信
61.128.192.64,重庆市电信
61.128.192.68,重庆市电信
61.134.1.4,陕西省西安市电信IDC机房
61.134.1.9,陕西省西安市电信IDC机房
61.134.2.5,陕西省西安市电信ADSL
61.137.94.195,湖南省长沙市电信
61.137.94.196,湖南省长沙市电信
61.138.1.9,黑龙江省哈尔滨市联通
61.139.2.69,四川省成都市电信
61.139.54.66,四川省凉山州西昌市电信
61.140.7.67,广东省广州市电信
61.144.56.100,广东省广州市电信ADSL
61.144.56.101,广东省广州市电信ADSL
61.147.37.1,江苏省徐州市 (沛县)电信
61.153.177.196,浙江省温州市电信
61.153.177.197,浙江省温州市电信
61.153.177.198,浙江省温州市电信
61.153.177.199,浙江省温州市电信
61.155.152.86,江苏省苏州市电信
61.166.15.170,云南省玉溪市电信
61.166.150.101,云南省曲靖市电信ADSL
61.166.150.123,云南省曲靖市电信DNS服务器
61.177.7.1,江苏省苏州市电信ADSL
61.178.0.93,甘肃省兰州市电信ADSL
61.187.91.18,湖南省岳阳市电信
61.187.98.3,湖南省株洲市电信DNS服务器
61.187.98.6,湖南省株洲市电信DNS服务器
61.187.99.3,湖南省株洲市电信
61.232.202.158,陕西省西安市铁通DNS
61.232.206.100,湖北省武汉市铁通
61.232.206.102,湖北省武汉市铁通
61.233.65.3,河南省洛阳市铁通
61.233.75.3,河南省郑州市铁通
61.234.254.5,湖南省铁通(公用)
61.234.254.6,湖南省铁通(公用)
61.235.70.98,广东省广州市白云区快灵通用户
61.235.146.18,河北省石家庄市铁通ADSL
61.236.159.99,四川省铁通
61.237.160.66,江苏省苏州市铁通ADSL
61.247.202.89,韩国
61.247.202.90,韩国
61.247.202.91,韩国
61.247.202.92,韩国
62.3.32.17,英国
62.6.40.162,英国
62.6.40.178,英国
62.8.96.38,英国
62.32.46.100,格鲁吉亚
62.32.49.100,英国
62.39.164.12,法国
62.69.62.6,英国
62.69.62.7,英国
62.73.136.246,英国
62.77.202.25,匈牙利
62.128.175.14,肯尼亚
62.129.139.2,荷兰
62.140.195.132,英国
62.157.94.6,德国
62.171.194.100,英国
62.171.194.105,英国
62.191.128.248,英国
62.196.2.70,意大利
62.208.208.163,德国
62.240.110.197,埃及
62.244.176.176,英国
63.64.9.12,美国 NIC注册机构
63.76.176.252,美国 NIC注册机构
63.88.42.5,美国 NIC注册机构
63.89.185.17,美国
63.91.110.178,美国
63.135.48.130,美国 NIC注册机构
63.139.151.116,加拿大
63.139.151.117,加拿大
63.139.151.118,加拿大
63.139.151.119,加拿大
63.147.76.2,美国科罗拉多州丹佛市Qwest通信有限责任公司
63.148.170.11,美国科罗拉多州丹佛市Qwest通信有限责任公司
63.150.244.16,美国科罗拉多州丹佛市Qwest通信有限责任公司
63.243.188.2,美国 Teleglobe公司
63.245.14.196,美国佛罗里达州
63.245.243.5,美国
63.246.64.8,美国
63.246.240.20,美国
63.246.240.21,美国
63.251.129.33,美国 Internap网络
64.4.129.250,美国加洲
64.13.32.5,美国加洲
64.13.48.12,美国加洲
64.13.131.34,美国加洲
64.15.138.6,加拿大
64.30.215.129,美国加洲
64.42.243.198,加拿大
64.56.133.149,美国加洲
64.57.176.12,美国加洲
64.58.4.2,美国加洲
64.58.15.2,美国加洲
64.58.254.2,美国加洲
64.72.224.34,美国加洲
64.79.224.3,美国加洲
64.79.224.27,美国加洲
64.85.177.10,美国加洲
64.85.177.11,美国加洲
64.89.247.15,美国加洲
64.90.209.53,美国加洲
64.91.89.2,美国加洲
64.105.97.90,美国加洲
64.105.124.156,美国加洲
64.105.152.186,美国加洲
64.105.156.138,美国加洲
64.105.172.26,美国加洲
64.105.179.138,美国加洲
64.105.189.25,美国加洲
64.105.202.138,美国加洲
64.118.80.141,美国加洲
64.119.60.5,美国加洲
64.119.60.9,美国加洲
64.129.67.100,美国加洲
64.129.67.101,美国加洲
64.129.67.102,美国加洲
64.129.67.103,美国加洲
64.129.67.104,美国加洲
64.129.67.105,美国加洲
64.135.2.250,美国加洲
64.140.128.10,美国加洲
64.142.109.51,美国加洲
64.146.192.16,美国加洲
64.149.136.201,美国加洲
64.150.192.94,巴哈马
64.192.0.10,美国威廉姆斯通讯集团公司
64.201.183.97,美国加洲
64.207.64.5,美国加洲
64.222.212.249,美国 Verizon环球网
64.233.189.104,美国加利福尼亚州山景市谷歌公司
64.233.219.99,美国
64.234.41.13,美国
64.234.241.2,美国
64.235.98.226,加拿大
64.235.98.227,加拿大
64.242.250.25,美国
64.247.129.9,美国
64.247.129.24,美国
64.255.237.191,美国
64.255.237.246,美国
65.38.1.2,美国 TULSACONNECT INTERNET SERVICES
65.39.139.53,美国 Peer 1 Network Inc
65.39.196.215,美国 Peer 1 Network Inc
65.50.3.27,加拿大罗杰斯通信公司
65.54.238.70,美国 Microsoft公司
65.69.27.202,美国西南Bell用户
65.74.130.6,美国
65.88.88.2,美国 Broadwing通信公司
65.98.224.50,美国
65.115.122.147,美国科罗拉多州丹佛市Qwest通信有线责任公司
65.125.132.1,美国科罗拉多州丹佛市Qwest通信有线责任公司
65.160.96.54,美国
65.182.32.35,美国
65.182.168.20,美国
65.183.0.86,美国
65.207.30.58,美国
65.207.30.95,美国
65.207.58.134,美国
65.215.163.151,美国
65.248.165.11,美国 UUNET用户
66.6.49.179,美国
66.6.49.217,美国
66.11.240.150,美国
66.17.189.3,美国
66.18.32.3,美国
66.33.206.206,美国加利福尼亚州布瑞亚市DreamHost公司
66.33.216.216,美国加利福尼亚州布瑞亚市DreamHost公司
66.38.159.33,美国
66.38.192.233,美国
66.39.194.62,美国
66.51.128.191,加拿大
66.51.128.241,加拿大
66.51.158.182,美国
66.51.158.183,美国
66.54.175.122,美国
66.59.235.1,加拿大
66.75.160.39,美国弗吉尼亚州赫恩登镇Road Runner控股有限责任公司
66.76.175.74,美国
66.80.130.35,美国
66.84.126.5,美国
66.93.57.99,美国
66.101.58.3,美国
66.110.192.50,安哥拉
66.111.113.7,美国
66.111.113.8,美国
66.112.11.88,美国
66.115.210.4,美国
66.119.189.138,加拿大温哥华ZooLink通信公司
66.128.240.7,美国
66.128.240.8,美国
66.133.150.76,美国
66.135.0.18,美国
66.135.102.133,加拿大
66.135.247.30,美国
66.146.160.12,美国
66.151.16.30,美国
66.163.0.161,加拿大
66.163.0.173,加拿大
66.172.201.11,美国
66.180.208.5,美国
66.181.69.116,美国
66.187.16.5,波多黎各
66.187.16.6,波多黎各
66.187.178.238,美国
66.189.0.6,美国
66.189.0.20,美国
66.199.228.254,美国纽约
66.207.155.31,美国 Pennsylvania
66.207.199.44,美国 Beanfield公司
66.209.48.10,加拿大
66.209.192.5,美国
66.212.224.241,美国
66.212.252.10,美国
66.212.252.11,美国
66.218.145.10,美国
66.218.145.11,美国
66.218.224.40,美国 CableAmerica公司
66.218.245.10,美国 CableAmerica公司
66.218.245.13,美国 CableAmerica公司
66.234.16.12,加拿大
66.234.185.2,美国
66.240.67.234,美国
66.242.160.5,美国
66.242.160.6,美国
66.244.95.20,美国
66.249.71.227,美国加利福尼亚州山景市谷歌公司
66.251.214.70,美国
66.251.214.71,美国
66.252.79.12,美国
66.252.240.25,美国
67.14.192.2,美国
67.14.192.3,美国
67.15.193.162,美国 ThePlanet机房
67.15.193.163,美国 ThePlanet机房
67.15.193.164,美国 ThePlanet机房
67.15.193.165,美国 ThePlanet机房
67.15.193.166,美国 ThePlanet机房
67.15.193.167,美国 ThePlanet机房
67.15.193.168,美国 ThePlanet机房
67.15.193.169,美国 ThePlanet机房
67.15.193.170,美国 ThePlanet机房
67.15.193.171,美国 ThePlanet机房
67.18.214.114,美国 ThePlanet机房
67.32.14.245,美国乔治亚州
67.55.85.229,加拿大蒙特利尔
67.58.192.10,美国
67.63.68.57,美国肯塔基州
67.63.68.58,美国肯塔基州
67.128.8.2,美国
67.133.62.13,美国
67.138.54.100,美国
67.142.166.18,美国
67.142.168.17,美国
67.142.168.18,美国
67.142.168.19,美国
67.199.112.21,美国弗吉尼亚州
67.201.32.11,美国弗吉尼亚州
67.201.32.12,美国弗吉尼亚州
67.211.225.10,美国弗吉尼亚州
67.214.64.6,美国弗吉尼亚州
67.214.64.7,美国弗吉尼亚州
67.214.64.28,美国弗吉尼亚州
68.4.16.30,美国加州
68.6.16.30,美国 Cox通信用户
68.6.16.245,美国 Cox通信用户
68.8.16.30,美国 Cox通信用户
68.28.154.11,美国加利福尼亚州La
68.87.64.154,美国新泽西州月桂山镇Comcast通信公司
68.87.64.199,美国新泽西州月桂山镇Comcast通信公司
68.87.66.199,美国新泽西州月桂山镇Comcast通信公司
68.105.29.140,美国亚利桑那洲
68.105.29.142,美国亚利桑那洲
68.178.101.99,美国
68.208.149.226,美国南方贝尔公司用户
68.234.128.70,美国宾夕法尼亚州Coudersport
69.1.131.3,美国
69.4.184.138,美国
69.4.184.139,美国
69.6.190.3,美国
69.6.190.6,美国
69.7.33.10,美国
69.7.192.1,美国
69.9.129.9,美国
69.9.144.10,美国
69.18.41.140,美国
69.18.41.209,美国
69.24.208.3,美国
69.25.160.15,美国
69.25.160.20,美国
69.28.104.5,美国
69.28.136.102,美国
69.28.144.102,美国
69.28.207.4,美国
69.28.239.8,美国
69.45.112.40,美国
69.49.32.2,美国
69.50.208.2,美国
69.51.76.26,美国
69.51.76.36,美国
69.57.17.129,美国
69.57.18.161,美国
69.59.32.9,美国 CafeNetwork
69.63.44.106,美国
69.63.44.108,美国
69.63.44.109,美国
69.65.16.101,美国
69.65.17.102,美国
69.87.16.254,美国
69.93.110.242,美国 ThePlanet机房
69.111.95.106,美国
69.155.200.6,美国密苏里州圣路易斯市
69.165.167.157,美国
69.165.167.158,美国
70.43.17.40,美国
70.43.67.3,美国
70.45.95.8,美国
70.45.95.9,美国
70.86.61.71,美国 ThePlanet机房
70.228.181.2,美国东北部七州电讯网
70.254.229.2,美国东北部七州电讯网
71.15.32.9,美国密苏里州圣路易斯市
71.36.224.29,美国
72.1.80.220,美国缅因州
72.13.161.10,美国缅因州
72.13.167.34,美国缅因州
72.14.163.190,加拿大 Oakville
72.14.189.120,美国新泽西州亚特兰提克县阿布西肯市Linode有限责任公司
72.19.128.53,美国缅因州/新罕布什尔州
72.22.224.3,美国缅因州/新罕布什尔州
72.29.162.17,美国缅因州/新罕布什尔州
72.37.141.91,美国缅因州/新罕布什尔州
72.45.110.250,美国缅因州/新罕布什尔州
72.45.111.250,美国缅因州/新罕布什尔州
72.45.111.251,美国缅因州/新罕布什尔州
72.45.127.250,美国缅因州/新罕布什尔州
72.45.127.251,美国缅因州/新罕布什尔州
72.51.175.10,美国佛罗里达州
72.51.175.11,美国佛罗里达州
72.233.151.51,美国加利福尼亚州圣弗朗西斯科市
74.51.143.98,美国
74.51.143.99,美国
74.84.119.150,美国联合航空通信网络(东南部通用)
74.84.119.153,美国联合航空通信网络(东南部通用)
74.86.49.131,美国德克萨斯州达拉斯市SoftLayer科技公司
74.111.35.68,美国
74.143.31.19,美国
74.174.200.5,美国
74.174.200.10,美国
74.200.84.4,美国
74.204.42.10,美国
74.222.30.2,美国加利福尼亚州洛杉矶市Vrtservers公司
75.101.149.182,美国华盛顿州金县西雅图市亚马逊公司
75.116.63.155,美国
75.116.63.156,美国
75.116.63.157,美国
75.116.63.158,美国
75.116.127.155,美国
75.116.127.156,美国
75.126.98.108,美国德克萨斯州达拉斯市SoftLayer科技公司
76.10.67.2,美国联合航空通信网络(北部通用)
76.10.191.198,美国联合航空通信网络(北部通用)
76.10.191.199,美国联合航空通信网络(北部通用)
76.14.0.8,美国联合航空通信网络(北部通用)
76.14.0.9,美国联合航空通信网络(北部通用)
76.14.96.13,美国联合航空通信网络(北部通用)
76.14.96.14,美国联合航空通信网络(北部通用)
76.14.192.8,美国联合航空通信网络(北部通用)
76.14.192.9,美国联合航空通信网络(北部通用)
76.73.18.50,美国 FDC丹佛机房
76.77.79.154,加拿大
76.77.208.23,美国新泽西州月桂山镇Comcast有线通信公司
76.77.208.24,美国新泽西州月桂山镇Comcast有线通信公司
77.75.184.4,英国
77.220.15.4,安哥拉
77.243.34.71,丹麦
77.247.144.3,荷兰
77.247.144.131,荷兰
80.10.250.14,法国
80.70.172.108,德国
80.72.146.34,丹麦
80.83.47.11,瑞士
80.95.160.2,荷兰
80.118.192.100,法国
80.118.196.40,法国
80.190.139.6,德国
80.241.16.34,奥地利
80.241.16.36,奥地利
80.254.77.39,瑞士
80.254.79.157,瑞士
81.7.200.80,德国
81.27.133.50,意大利
81.29.66.3,英国
81.92.99.6,瑞士
81.95.144.16,英国
81.144.190.98,英国
81.149.140.110,英国
81.199.0.36,以色列
81.199.3.7,以色列
82.96.64.2,德国
82.96.65.2,德国
82.113.193.3,意大利
82.148.223.100,荷兰
82.165.177.207,美国
82.180.0.166,荷兰
82.195.157.15,荷兰
82.195.157.19,荷兰
82.200.117.26,哈萨克斯坦
82.216.111.121,法国图卢兹
82.216.111.122,法国图卢兹
82.229.244.191,法国巴黎
83.97.120.225,美国
83.137.137.46,美国
83.146.21.5,加拿大
83.146.21.6,加拿大
83.170.69.2,英国伦敦市UK2集团公司
83.218.143.36,美国
83.244.236.176,英国
84.19.188.171,英国
84.39.1.20,荷兰
84.45.99.230,英国
84.103.237.140,法国
84.103.237.141,法国
84.103.237.142,法国
84.103.237.143,法国
84.103.237.144,法国
84.103.237.146,法国
84.243.238.4,法国
85.17.143.192,荷兰阿姆斯特丹Leaseweb IDC
85.17.170.136,荷兰阿姆斯特丹Leaseweb IDC
85.17.184.36,荷兰阿姆斯特丹Leaseweb IDC
85.37.17.6,英国伦敦
85.37.17.10,英国伦敦
85.37.17.12,英国伦敦
85.37.17.14,英国伦敦
85.37.17.17,英国伦敦
85.37.17.40,英国伦敦
85.37.17.43,英国伦敦
85.37.17.44,英国伦敦
85.37.17.46,英国伦敦
85.37.17.47,英国伦敦
85.37.17.48,英国伦敦
85.37.17.49,英国伦敦
85.37.17.50,英国伦敦
85.37.17.56,英国伦敦
85.37.17.57,英国伦敦
85.38.28.68,英国伦敦
85.38.28.70,英国伦敦
85.38.28.71,英国伦敦
85.38.28.72,英国伦敦
85.38.28.73,英国伦敦
85.38.28.74,英国伦敦
85.38.28.76,英国伦敦
85.38.28.77,英国伦敦
85.38.28.79,英国伦敦
85.38.28.80,英国伦敦
85.38.28.81,英国伦敦
85.38.28.83,英国伦敦
85.38.28.84,英国伦敦
85.38.28.85,英国伦敦
85.38.28.86,英国伦敦
85.38.28.89,英国伦敦
85.38.28.90,英国伦敦
85.38.28.91,英国伦敦
85.38.28.92,英国伦敦
85.38.28.93,英国伦敦
85.38.28.94,英国伦敦
85.38.28.95,英国伦敦
85.38.28.96,英国伦敦
85.38.28.98,英国伦敦
85.38.28.99,英国伦敦
85.88.19.10,欧洲电信联盟英国客户端
85.88.19.11,欧洲电信联盟英国客户端
85.90.33.5,欧洲电信联盟英国客户端
85.90.229.188,欧洲电信联盟英国客户端
85.214.18.161,英国伦敦大学
85.234.133.209,英国伯明翰市
85.255.112.107,英国北爱尔兰
85.255.113.94,英国北爱尔兰
85.255.113.98,英国北爱尔兰
85.255.113.101,英国北爱尔兰
85.255.113.102,英国北爱尔兰
85.255.113.106,英国北爱尔兰
85.255.113.107,英国北爱尔兰
85.255.113.108,英国北爱尔兰
85.255.113.109,英国北爱尔兰
85.255.113.115,英国北爱尔兰
85.255.113.117,英国北爱尔兰
85.255.113.118,英国北爱尔兰
85.255.113.130,英国北爱尔兰
85.255.113.147,英国北爱尔兰
85.255.113.198,英国北爱尔兰
85.255.113.205,英国北爱尔兰
85.255.114.12,英国北爱尔兰
85.255.114.40,英国北爱尔兰
86.64.145.142,英国威尔士
86.64.145.143,英国威尔士
86.64.145.144,英国威尔士
86.64.145.145,英国威尔士
86.64.145.146,英国威尔士
86.64.233.83,英国威尔士
86.64.233.84,英国威尔士
86.64.233.85,英国威尔士
87.98.222.22,法国
87.98.222.250,法国
87.117.198.200,英国
87.117.237.100,英国
87.118.100.175,德国
87.237.0.20,美国
87.249.121.242,尼日利亚
89.107.0.84,美国
89.145.68.166,英国
89.238.64.148,美国
91.85.5.25,英国
91.121.136.250,法国
92.246.34.129,美国
94.23.39.201,法国
94.23.69.12,法国
94.23.200.250,法国
94.23.208.250,法国
94.23.216.250,法国
94.23.232.250,法国
94.75.209.141,荷兰阿姆斯特丹市
94.75.228.29,荷兰阿姆斯特丹市
94.75.253.77,荷兰阿姆斯特丹市
95.36.102.181,美国
96.2.187.66,美国
96.5.80.11,美国
97.64.180.150,欧洲
97.64.187.150,欧洲
97.64.187.153,欧洲
97.67.232.17,欧洲
97.67.232.18,欧洲
97.77.8.218,美国
97.77.36.246,美国
98.124.193.1,美国
109.0.64.242,欧洲和中东地区
109.0.64.243,欧洲和中东地区
113.111.211.22,广东省广州市电信
116.66.201.190,印度尼西亚
116.199.206.54,印度尼西亚
119.31.230.42,欧洲
119.46.240.1,欧洲
119.46.240.2,欧洲
119.46.240.3,欧洲
119.46.240.4,欧洲
119.46.240.5,欧洲
119.46.240.6,欧洲
119.46.240.7,欧洲
119.46.241.1,欧洲
119.46.241.2,欧洲
119.46.241.4,欧洲
119.46.241.5,欧洲
119.46.241.7,欧洲
119.145.145.42,广东省深圳市电信ADSL
119.146.223.130,广东省电信
120.136.16.2,印度尼西亚
121.14.117.71,广东省中山市电信
121.28.7.38,河北省石家庄市联通ADSL
121.199.254.185,北京市万网IDC机房
122.70.138.4,北京市铁通
122.70.138.9,北京市铁通
123.129.254.13,山东省联通
123.196.113.38,中国
124.42.122.8,北京市光环新网
124.224.20.254,宁夏电信
125.22.47.125,印度
128.2.200.100,美国卡耐基·梅隆大学
128.8.10.90,美国马里兰大学
128.9.0.107,美国加利福尼亚州
128.63.2.53,美国马里兰州
128.84.154.9,美国康乃尔大学
128.86.249.14,英国伦敦大学
128.100.100.128,加拿大多伦多大学
128.114.129.105,美国加利福尼亚大学
128.143.2.126,美国 University of Virginia
128.143.3.7,美国 University of Virginia
128.143.22.119,美国 University of Virginia
128.189.4.1,加拿大温哥华
128.194.176.195,美国德克萨斯州A&M大学
128.233.119.73,加拿大萨斯卡彻温大学
128.233.150.126,加拿大萨斯卡彻温大学
129.66.20.6,美国阿拉巴马州超级计算机中心
129.66.95.3,美国阿拉巴马州超级计算机中心
129.66.172.9,美国阿拉巴马州超级计算机中心
129.71.1.1,美国西维吉尼亚网络教育
129.108.202.20,美国德克萨斯大学
129.113.38.36,美国德克萨斯大学
129.128.5.233,加拿大阿尔伯达大学
129.128.76.233,加拿大阿尔伯达大学
129.128.209.13,加拿大阿尔伯达大学
129.137.254.4,美国辛辛那提大学
129.137.255.4,美国辛辛那提大学
129.175.34.240,法国 Paris-Sud University
129.186.88.244,美国
129.206.100.126,德国
129.250.35.250,美国
129.250.35.251,美国
129.250.48.66,美国
129.250.48.82,美国
129.250.48.221,美国
129.250.50.14,美国
130.179.16.11,加拿大曼尼托巴大学
130.179.16.67,加拿大曼尼托巴大学
131.94.134.129,美国佛罗里达国际大学
131.104.20.10,加拿大
131.104.136.36,加拿大
131.191.7.12,美国
131.247.100.1,美国佛罗里达州坦帕市南佛罗里达大学
132.170.13.121,美国中佛罗里达大学
132.170.13.227,美国中佛罗里达大学
132.170.249.15,美国中佛罗里达大学
132.203.250.10,加拿大
132.203.250.13,加拿大
132.206.25.21,加拿大 McGill University
132.206.44.21,加拿大 McGill University
132.210.157.248,加拿大施尔布鲁克大学
132.210.162.235,加拿大施尔布鲁克大学
132.213.1.27,加拿大魁北克大学赫尔校区
132.216.44.21,加拿大麦吉尔大学
133.145.228.6,日本东京
134.2.200.2,德国
134.58.60.1,比利时荷语天主教鲁汶大学
134.139.1.2,美国 California State University
136.142.57.10,美国 University of Pittsburgh
136.142.188.76,美国 University of Pittsburgh
137.82.1.1,加拿大 University of British Columbia
139.7.144.165,德国
139.103.8.23,加拿大
139.142.5.108,加拿大
139.142.5.131,加拿大
139.142.140.22,加拿大
140.148.3.33,墨西哥
140.186.1.14,美国
140.198.80.134,美国
140.198.80.145,美国
141.166.30.6,美国 University of Richmond
141.211.125.17,美国密歇根大学
141.211.144.15,美国密歇根大学
141.211.144.17,美国密歇根大学
142.46.1.130,加拿大
142.46.58.101,加拿大
142.46.227.161,加拿大
142.47.133.81,加拿大
142.57.224.50,加拿大
142.58.103.1,加拿大 Simon Fraser University
142.58.103.2,加拿大 Simon Fraser University
142.103.1.1,加拿大 University of British Columbia
142.104.0.18,加拿大维多利亚大学
142.146.39.30,加拿大
142.154.239.225,加拿大
142.166.86.18,加拿大
142.166.86.19,加拿大
142.169.1.5,加拿大
142.176.33.186,加拿大
142.177.1.2,加拿大 Halifax NS
142.204.1.2,加拿大
142.204.79.71,加拿大
142.204.140.20,加拿大
142.232.99.100,加拿大
142.232.99.101,加拿大
143.93.32.2,德国
144.202.248.30,美国
144.202.248.31,美国
145.253.2.6,德国
146.188.96.6,美国
147.144.1.251,美国加州
147.144.1.252,美国加州
148.202.3.5,墨西哥
148.216.1.2,墨西哥
148.231.1.3,墨西哥
148.233.151.6,墨西哥
148.233.151.8,墨西哥
149.250.222.22,德国
150.198.164.100,美国
153.90.2.138,美国 Montana State University
154.11.147.2,英国
155.94.110.176,美国
155.135.55.2,美国 California State University
156.154.70.1,美国
156.154.70.22,美国
156.154.71.1,美国
156.154.71.22,美国
157.89.36.108,美国 Eastern Kentucky University
157.193.40.42,比利时
157.193.71.1,比利时
158.43.128.72,英国
158.43.240.4,英国
158.169.9.30,卢森堡
158.195.34.2,斯洛伐克
158.234.250.70,英国
161.6.94.106,美国 Western Kentucky University
161.45.25.37,美国田纳西州
161.45.193.4,美国田纳西州
161.76.9.2,英国
161.109.128.2,美国
162.105.129.27,北京大学计算中心
164.124.101.31,韩国
164.214.4.52,美国马里兰州
164.214.4.61,美国马里兰州
165.21.100.88,新加坡电信SINGNET
165.87.13.129,美国
165.87.201.244,美国
165.95.31.17,美国德克萨斯州A&M大学
165.112.13.138,美国
166.90.244.254,美国
166.111.8.28,清华大学网络中心core
166.111.8.29,清华大学网络中心core
166.111.8.30,清华大学网络中心core
166.111.168.12,清华大学继续教育学院
167.193.196.160,美国
168.95.1.1,台湾省中华电信
168.95.192.1,台湾省台北
168.95.192.174,台湾省台北
168.126.63.15,韩国
168.126.63.16,韩国
168.126.63.60,韩国
168.126.63.61,韩国
168.143.113.201,美国 Englewood
168.143.113.202,美国 Englewood
168.160.231.1,北京市
168.160.233.11,北京市飞华拨号
168.234.219.130,危地马拉
173.13.41.153,美国 CISCO公司VPN用户
173.46.255.30,北美地区
173.49.90.154,北美地区
173.71.0.35,美国佛吉尼亚州Reston市Verizon Internet Services
173.212.47.47,北美地区
174.34.129.34,美国 theplanet
174.37.59.9,美国德克萨斯州达拉斯市SoftLayer科技公司
174.120.16.34,美国德克萨斯州休斯顿The Planet互联网服务公司
174.142.8.58,加拿大魁北克省蒙特利尔市iWeb科技公司
189.7.160.15,巴西
189.200.0.5,墨西哥
189.204.33.67,墨西哥
192.5.5.241,美国加利福尼亚州
192.9.9.3,美国 sun(公司)
192.26.210.1,美国
192.33.4.12,法国
192.36.148.17,瑞典斯德哥尔摩
192.42.42.60,瑞士
192.58.128.30,美国弗吉尼亚州
192.68.228.85,德国
192.69.21.200,德国
192.77.51.5,加拿大
192.112.36.4,美国弗吉尼亚州
192.197.217.18,美国
192.203.230.10,美国加利福尼亚州
192.219.33.33,美国
192.219.63.253,美国
192.228.26.137,马来西亚
192.231.207.102,美国
193.0.14.129,英国伦敦
193.1.100.130,爱尔兰
193.33.134.250,英国
193.55.52.20,法国
193.63.88.11,英国 University of London Computer Centre
193.93.36.50,卢森堡
193.93.172.36,卢森堡
193.108.252.50,斯洛文尼亚
193.110.205.2,芬兰
193.200.145.10,保加利亚
193.201.97.16,俄罗斯
193.205.80.1,意大利 The University of Trento
193.226.61.1,罗马尼亚
194.6.79.162,英国
194.8.57.12,欧洲
194.8.62.65,欧洲
194.20.8.1,意大利
194.20.8.4,意大利
194.25.0.68,德国
194.29.234.144,朝鲜
194.72.0.98,英国
194.72.0.114,英国
194.72.6.57,英国
194.72.9.38,英国
194.73.82.242,英国
194.74.65.68,英国
194.74.65.69,英国
194.77.8.1,德国
194.106.162.2,塞尔维亚和黑山
194.106.162.3,塞尔维亚和黑山
194.106.162.10,塞尔维亚和黑山
194.113.59.64,德国
194.126.101.34,爱沙尼亚
194.154.16.99,英国
194.182.3.2,丹麦
194.196.235.7,德国
194.196.235.133,德国
194.196.235.135,德国
194.208.99.201,奥地利
194.238.48.2,英国
194.238.48.3,英国
194.239.132.34,丹麦
194.239.132.50,丹麦
194.246.101.57,德国
195.12.4.247,英国
195.18.114.5,荷兰
195.27.150.42,英国
195.27.150.138,英国
195.27.150.140,英国
195.40.0.250,英国
195.40.1.11,英国
195.40.1.19,英国
195.40.1.250,英国
195.50.140.14,德国
195.50.140.38,德国
195.50.140.40,德国
195.50.140.69,德国
195.50.140.70,德国
195.50.140.71,德国
195.78.6.210,摩纳哥
195.82.195.100,丹麦
195.92.67.19,英国
195.92.67.20,英国
195.92.168.138,英国
195.92.168.139,英国
195.99.66.220,英国
195.114.160.108,波兰
195.129.12.83,欧洲
195.154.223.1,法国
195.166.13.4,英国
195.167.185.162,英国
195.175.39.11,土耳其
195.175.39.17,土耳其
195.175.39.165,土耳其
195.175.39.167,土耳其
195.175.39.169,土耳其
195.184.180.4,匈牙利
195.186.1.126,瑞士
195.186.4.110,瑞士
196.207.15.42,南非
196.207.15.43,南非
198.20.32.17,美国
198.31.248.3,美国
198.32.64.12,美国弗吉尼亚州
198.41.0.4,美国弗吉尼亚州
198.60.22.2,美国
198.77.116.8,美国
198.77.116.12,美国
198.77.116.221,美国
198.77.116.223,美国
198.77.116.225,美国
198.77.116.227,美国
198.103.148.4,美国
198.164.4.2,美国
198.164.30.2,美国
198.168.8.130,新加坡
198.176.174.181,美国
198.176.174.189,美国
198.176.208.44,美国
198.188.2.69,美国
198.189.143.112,美国
198.190.246.27,美国
198.208.22.27,美国
199.9.65.2,美国/加拿大
199.44.2.10,美国/加拿大
199.166.210.5,美国/加拿大
199.202.105.108,美国/加拿大
199.235.121.1,美国/加拿大/以色列
199.247.2.1,美国/加拿大/以色列
200.6.158.23,巴西圣保罗
200.6.158.24,巴西圣保罗
200.12.229.1,巴西圣保罗
200.12.232.4,巴西圣保罗
200.23.29.218,巴西圣保罗
200.23.59.19,巴西圣保罗
200.23.59.39,巴西圣保罗
200.36.160.100,巴西圣保罗
200.38.100.210,美国 San Diego California
200.46.127.101,巴西圣保罗
200.49.160.31,巴西圣保罗
200.49.161.131,巴西圣保罗
200.56.224.11,巴西圣保罗
200.57.2.108,巴西圣保罗
200.57.64.66,巴西圣保罗
200.57.64.67,巴西圣保罗
200.57.64.85,巴西圣保罗
200.57.64.86,巴西圣保罗
200.57.146.148,巴西圣保罗
200.62.64.1,巴西圣保罗
200.62.64.65,巴西圣保罗
200.69.193.1,厄瓜多尔
200.73.16.178,巴西圣保罗
200.76.49.8,美国 /墨西哥
200.76.49.9,美国 /墨西哥
200.94.160.245,巴西圣保罗
200.95.144.3,墨西哥
200.107.60.58,巴西圣保罗
200.252.98.162,巴西圣保罗
201.82.0.15,巴西 Vivax公司
201.117.66.4,巴西 Vivax公司
201.134.72.19,巴西 Vivax公司
201.144.5.42,巴西 Vivax公司
201.144.5.43,巴西 Vivax公司
201.159.192.6,巴西 Vivax公司
201.159.192.7,巴西 Vivax公司
202.12.19.1,北京市广电网
202.12.27.33,日本
202.14.67.4,香港特别行政区
202.14.67.14,香港特别行政区
202.27.184.3,新西兰
202.38.64.1,安徽省合肥市中国科学技术大学
202.44.8.2,泰国
202.44.8.34,泰国
202.45.84.58,香港特别行政区
202.45.84.59,香港特别行政区
202.56.250.5,印度
202.60.252.8,香港九龙先达电脑网络有限公司
202.67.240.221,香港特别行政区
202.67.240.222,香港特别行政区
202.81.252.1,香港特别行政区
202.81.252.2,香港特别行政区
202.85.146.104,香港柴湾互联优势有限公司
202.96.0.133,北京市联通
202.96.26.243,北京市联通
202.96.49.1,北京市东方网景
202.96.64.68,辽宁省丹东市振兴区杜鹃网吧(白房路12-10)
202.96.64.70,辽宁省沈阳市联通
202.96.69.38,辽宁省大连市联通
202.96.75.64,辽宁省沈阳市联通
202.96.75.68,辽宁省沈阳市联通
202.96.75.78,辽宁省沈阳市联通
202.96.86.18,辽宁省抚顺市联通
202.96.86.24,辽宁省抚顺市联通
202.96.91.58,辽宁省阜新市联通
202.96.96.68,浙江省杭州市 (萧山区)电信
202.96.102.3,浙江省电信
202.96.103.36,浙江省电信
202.96.104.15,浙江省宁波市联通
202.96.104.18,浙江省宁波市联通
202.96.104.25,浙江省宁波市联通
202.96.113.34,浙江省衢州市电信
202.96.128.43,广东省广州市电信IDC机房
202.96.128.68,广东省广州市电信IDC机房
202.96.128.86,广东省广州市电信IDC机房
202.96.128.110,广东省广州市电信IDC机房
202.96.128.133,广东省广州市电信IDC机房
202.96.128.143,广东省广州市电信IDC机房
202.96.128.166,广东省广州市电信IDC机房
202.96.133.199,广东省珠海市电信
202.96.134.33,广东省深圳市福田区电信
202.96.134.133,广东省深圳市福田区电信
202.96.134.134,广东省深圳市福田区电信
202.96.134.188,广东省深圳市福田区电信
202.96.135.133,广东省深圳市电信
202.96.144.47,广东省汕头市数据局
202.96.154.8,广东省深圳市电信
202.96.154.15,广东省深圳市电信
202.96.199.97,上海市电信ADSL
202.96.199.132,上海市电信ADSL
202.96.199.133,上海市电信ADSL
202.96.209.5,上海市电信DNS服务器
202.96.209.6,上海市电信DNS服务器
202.96.209.133,上海市电信DNS服务器
202.97.7.6,北京市电信骨干网
202.97.7.17,北京市电信骨干网
202.97.16.195,甘肃省电信骨干网
202.97.224.68,黑龙江省哈尔滨市联通
202.97.224.69,黑龙江省哈尔滨市联通
202.97.224.80,黑龙江省哈尔滨市联通
202.97.227.138,黑龙江省哈尔滨市联通
202.97.229.133,黑龙江省哈尔滨市联通
202.97.230.4,黑龙江省哈尔滨市联通
202.98.0.68,吉林省长春市联通
202.98.3.68,吉林省长春市联通
202.98.5.68,吉林省长春市联通DNS服务器
202.98.14.18,吉林省长春市联通
202.98.14.19,吉林省长春市联通
202.98.32.68,重庆市电信
202.98.96.68,四川省成都市电信
202.98.96.69,四川省成都市电信
202.98.99.34,四川省成都市电信
202.98.160.68,云南省电信
202.98.160.78,云南省电信
202.98.161.68,云南省电信
202.98.192.67,贵州省贵阳市电信
202.98.192.68,贵州省贵阳市电信
202.98.198.167,贵州省兴义市电信
202.98.198.168,贵州省兴义市电信
202.98.224.68,西藏拉萨市电信
202.99.64.69,天津市联通
202.99.96.16,天津市联通
202.99.96.68,天津市联通DNS
202.99.104.68,天津市联通DNS
202.99.160.68,河北省秦皇岛市联通
202.99.160.69,河北省秦皇岛市联通
202.99.166.4,河北省张家口市联通
202.99.168.8,河北省保定市联通
202.99.168.83,河北省保定市联通
202.99.170.45,河北省秦皇岛市联通
202.99.176.30,河北省沧州市联通
202.99.192.66,山西省运城市联通
202.99.192.68,山西省运城市四方科技有限公司
202.99.198.6,山西省晋中市联通
202.99.224.8,内蒙古锡林浩特市网客驿站网吧
202.99.224.67,内蒙古呼和浩特市联通
202.99.224.68,内蒙古呼和浩特市联通
202.99.224.203,内蒙古呼和浩特市联通
202.100.0.68,陕西省西安市电信
202.100.4.15,陕西省西安市电信
202.100.4.16,陕西省西安市电信
202.100.10.2,陕西省西安市电信
202.100.10.194,陕西省西安市电信
202.100.13.11,陕西省西安市电信
202.100.24.20,陕西省汉中市电信
202.100.64.66,甘肃省兰州市电信局枢纽楼(西口电信局)
202.100.64.68,甘肃省兰州市电信局枢纽楼(西口电信局)
202.100.72.13,甘肃省兰州市电信
202.100.96.68,宁夏银川市兴庆区东信龙网吧(凤凰南街大坤水疗旁边)
202.100.128.68,青海省西宁市城中区特殊视角网吧(凤凰山路258-44号)
202.100.160.68,新疆乌鲁木齐市电信
202.100.192.68,海南省海口市电信
202.100.199.8,海南省三亚市电信
202.101.6.2,上海市电信
202.101.10.10,上海市金山区 /青浦区
202.101.98.54,福建省福州市电信
202.101.98.55,福建省福州市电信DNS服务器
202.101.103.54,福建省厦门市电信
202.101.103.55,福建省厦门市电信
202.101.107.55,福建省泉州市电信
202.101.107.85,福建省泉州市电信
202.101.107.98,福建省泉州市电信
202.101.110.55,福建省莆田市电信
202.101.111.55,福建省莆田市电信
202.101.112.55,福建省漳州市电信
202.101.113.55,福建省龙岩市电信
202.101.114.55,福建省三明市电信
202.101.115.55,福建省南平市电信
202.101.172.35,浙江省杭州市电信
202.101.172.37,浙江省杭州市电信
202.101.172.47,浙江省杭州市电信
202.101.172.51,浙江省杭州市电信
202.101.224.68,江西省上饶市电信
202.101.224.69,江西省上饶市电信
202.101.226.68,江西省九江市电信
202.101.226.69,江西省九江市电信
202.101.240.36,江西省南昌市电信
202.102.2.141,江苏省无锡市电信
202.102.3.141,江苏省常州市数据局
202.102.3.144,江苏省常州市数据局
202.102.4.141,江苏省镇江市电信
202.102.7.90,江苏省扬州市热线
202.102.7.141,江苏省扬州市热线
202.102.8.141,江苏省南通地区
202.102.9.141,江苏省盐城市电信
202.102.10.141,江苏省淮阴市电信
202.102.11.141,江苏省盐城市电信
202.102.12.141,江苏省连云港市电信
202.102.13.141,江苏省电信
202.102.14.141,江苏省苏州市电信
202.102.14.146,江苏省苏州市电信
202.102.15.162,江苏省电信
202.102.24.34,江苏省南京市电信
202.102.24.35,江苏省南京市电信
202.102.29.3,江苏省南京市电信
202.102.48.141,江苏省宿迁市电信
202.102.49.141,江苏省泰州市电信
202.102.128.68,山东省济南市联通
202.102.128.69,山东省济南市联通
202.102.134.68,山东省青岛市联通
202.102.134.69,山东省青岛市联通
202.102.152.3,山东省济南市联通
202.102.152.36,山东省济南市联通
202.102.154.3,山东省青岛市联通
202.102.192.68,安徽省阜阳市电信IDC机房
202.102.199.68,安徽省芜湖市电信
202.102.200.98,安徽省蚌埠市电信
202.102.200.101,安徽省蚌埠市电信
202.102.224.68,河南省联通DNS服务器
202.102.227.68,河南省联通DNS服务器
202.102.245.12,河南省郑州市联通
202.103.0.68,湖北省武汉市电信
202.103.0.112,湖北省武汉市电信
202.103.0.117,湖北省武汉市电信
202.103.24.68,湖北省武汉市电信
202.103.44.5,湖北省武汉市电信
202.103.44.150,湖北省武汉市电信
202.103.83.3,湖南省怀化市电信
202.103.88.3,湖南省娄底市电信
202.103.96.68,湖南省长沙市电信
202.103.96.110,湖南省长沙市电信
202.103.96.112,湖南省长沙市电信
202.103.99.3,湖南省岳阳市电信
202.103.100.100,湖南省长沙市电信
202.103.100.206,湖南省长沙市电信
202.103.176.22,广东省茂名市电信ADSL
202.103.218.23,广西百色市电信
202.103.224.68,广西南宁市电信
202.103.225.68,广西柳州市电信
202.103.225.70,广西柳州市电信
202.103.229.40,广西梧州市电信
202.105.65.195,广东省广州市白云区 /天河区电信ADSL
202.105.179.11,广东省珠海市电信IDC机房
202.106.0.20,北京市朝阳区联通ADSL
202.106.46.151,北京市联通ADSL
202.106.124.195,北京市联通ADSL
202.106.148.1,北京市联通ADSL
202.106.169.100,北京市联通ADSL
202.106.196.115,北京市北京信息科技大学
202.106.196.152,北京市联通ADSL
202.109.114.79,上海市电信智慧广场机房
202.109.129.2,江西省南昌市电信
202.109.226.68,福建省三明市电信
202.112.0.33,北京市中国教育和科研计算机网
202.112.0.34,北京市中国教育和科研计算机网
202.112.0.35,北京市中国教育和科研计算机网
202.112.10.36,北京邮电大学网络中心
202.112.10.37,北京邮电大学网络中心
202.112.14.151,四川省成都市电子科技大学
202.112.20.131,湖北省武汉市武汉电子信息专修学院
202.112.26.34,上海交通大学
202.112.112.100,北京市中国人民大学
202.112.144.30,北京交通大学 DNS服务器
202.113.16.10,南开大学网络中心首选DNS服务器
202.113.16.11,南开大学学生邮件系统、网络中心备用DNS服务器
202.114.0.242,华中科技大学 DNS服务器
202.114.64.2,湖北省武汉市武汉大学
202.114.96.1,湖北省武汉市武汉理工大学(鉴湖校区)
202.114.96.2,湖北省武汉市武汉理工大学(鉴湖校区)
202.114.112.13,武汉大学信息学部
202.114.240.6,湖北省武汉市武汉科技大学
202.115.32.39,四川大学工程设计中心
202.115.64.33,四川省成都市西南交通大学
202.115.64.34,四川省成都市西南交通大学
202.116.160.33,华南农业大学
202.117.0.20,西安交通大学家属区拨号用户
202.117.0.21,西安交通大学家属区拨号用户
202.138.96.2,印度
202.138.103.100,印度
202.140.96.51,香港特别行政区
202.140.96.52,香港特别行政区
202.159.65.166,印度尼西亚
202.175.3.3,澳门特别行政区
202.175.3.8,澳门特别行政区
202.181.202.140,香港特别行政区
202.181.224.2,香港特别行政区
202.188.0.133,马来西亚
202.188.1.5,马来西亚
202.194.48.130,山东省烟台市鲁东大学
202.196.64.1,河南省郑州市郑州大学(南校区)
202.201.48.1,甘肃省兰州市西北师范大学
202.201.48.2,甘肃省兰州市西北师范大学
202.202.128.33,重庆市重庆医科大学
202.202.128.34,重庆市重庆医科大学
202.203.128.33,云南省教育网
202.203.128.34,云南省教育网
202.216.228.18,日本
202.224.32.150,日本
202.224.32.151,日本
202.239.113.26,日本
202.247.0.231,日本
202.247.0.234,日本
203.34.118.10,澳大利亚悉尼
203.80.96.9,香港特别行政区
203.80.96.10,香港特别行政区
203.92.214.7,日本 AT&T环球网络
203.93.18.1,北京市金桥网
203.93.18.2,北京市金桥网
203.93.19.133,广东省深圳市天威有线宽带(关内)
203.96.128.68,新西兰
203.96.128.69,新西兰
203.98.129.1,香港特别行政区
203.98.129.9,香港特别行政区
203.109.230.58,新西兰
203.109.230.59,新西兰
203.112.2.5,日本
203.113.10.149,泰国
203.121.130.40,泰国
203.130.138.18,泰国
203.130.138.19,泰国
203.138.63.122,日本
203.138.71.154,日本
203.145.184.13,印度
203.155.33.1,泰国
203.156.254.182,上海市中国移动通信集团上海有限公司
203.208.0.1,中国讯业金网用户
203.248.240.31,韩国
204.9.161.50,加拿大多伦多
204.11.119.21,美国
204.13.249.152,美国
204.15.49.62,美国
204.15.204.73,美国
204.16.144.131,美国
204.16.145.131,美国
204.19.43.2,美国
204.19.249.46,美国
204.101.45.5,加拿大艾伯塔省埃德蒙顿
204.110.15.179,美国/加拿大
204.127.133.11,美国/加拿大
204.127.133.12,美国/加拿大
204.127.163.11,美国/加拿大
204.127.163.12,美国/加拿大
204.153.24.1,美国/加拿大
204.174.16.4,美国/加拿大
204.174.18.2,美国/加拿大
204.187.144.34,美国/加拿大
204.194.36.2,美国/加拿大
204.213.72.2,美国弗吉尼亚州费尔法克斯县雷斯顿地区Sprint公司
204.225.221.2,美国/加拿大
204.244.30.36,美国/加拿大
205.151.16.2,美国/加拿大
205.151.251.2,美国/加拿大
205.151.251.9,美国/加拿大
205.160.52.53,美国奥克拉荷马州止水市Chickasaw Telecommunications Services(CTS)公司
205.171.2.65,美国科罗拉多州丹佛市Qwest通信公司
205.171.3.25,美国科罗拉多州丹佛市Qwest通信公司
205.171.3.65,美国科罗拉多州丹佛市Qwest通信公司
205.188.146.145,美国弗吉尼亚州斯特灵地区美国在线公司总部
205.205.169.69,美国
205.209.16.12,美国
205.209.16.98,美国
205.210.42.205,美国/加拿大
205.234.216.10,美国/加拿大
205.236.148.130,美国/加拿大
205.247.104.20,美国
205.252.144.126,美国弗吉尼亚州赫恩登镇香港电讯盈科有限公司美国分公司
205.252.144.228,美国弗吉尼亚州赫恩登镇香港电讯盈科有限公司美国分公司
206.24.209.19,美国/加拿大
206.48.0.10,美国/加拿大
206.63.63.150,美国/加拿大
206.64.118.165,美国/加拿大
206.67.48.250,美国/加拿大
206.78.48.130,美国/加拿大
206.108.253.70,美国/加拿大
206.123.113.254,美国/加拿大
206.132.48.21,美国/加拿大
206.166.57.20,美国/加拿大
206.167.36.22,美国/加拿大
206.169.210.8,美国/加拿大
206.180.162.9,美国/加拿大
206.191.0.139,美国/加拿大
206.191.0.203,美国/加拿大
206.201.23.123,美国/加拿大
206.210.96.53,美国/加拿大
206.248.79.244,美国/加拿大
206.248.142.221,加拿大
206.248.142.222,加拿大
206.248.154.22,加拿大
206.248.154.170,加拿大
206.252.217.6,美国/加拿大
207.15.198.2,美国
207.15.198.3,美国
207.17.190.5,美国
207.17.190.7,美国
207.23.111.102,美国
207.42.84.38,美国
207.91.250.34,美国/加拿大
207.102.99.66,美国/加拿大
207.102.99.82,美国/加拿大
207.103.0.2,美国/加拿大
207.103.206.67,美国/加拿大
207.126.96.162,美国/加拿大
207.150.240.2,美国/加拿大
207.150.240.4,美国/加拿大
207.150.240.10,美国/加拿大
207.158.39.6,美国/加拿大
207.158.39.7,美国/加拿大
207.170.227.121,美国/加拿大
207.176.226.3,加拿大
207.178.128.92,加拿大
207.179.130.2,加拿大
207.179.130.3,加拿大
207.180.2.78,加拿大
207.225.209.66,美国
207.230.32.1,美国/加拿大
207.248.32.2,美国
207.248.32.3,美国
207.248.33.243,美国
207.248.57.10,美国
207.248.57.11,美国
207.253.250.66,美国/加拿大
207.254.24.2,美国/加拿大
208.34.108.10,美国/加拿大
208.39.233.5,美国/加拿大
208.51.187.6,美国/加拿大
208.54.220.21,美国/加拿大
208.59.247.43,美国
208.65.88.1,美国
208.65.88.2,美国
208.65.173.71,美国
208.65.225.2,美国
208.66.71.6,美国
208.66.71.7,美国
208.67.220.220,美国加利福尼亚州旧金山市OpenDNS有限责任公司
208.67.222.220,美国加利福尼亚州旧金山市OpenDNS有限责任公司
208.67.222.222,美国加利福尼亚州旧金山市OpenDNS有限责任公司
208.67.223.255,美国加利福尼亚州旧金山市OpenDNS有限责任公司
208.68.0.194,美国
208.68.0.195,美国
208.68.50.70,美国
208.68.50.71,美国
208.69.84.9,美国
208.69.160.2,美国
208.71.28.2,美国
208.71.147.74,美国
208.71.159.3,美国
208.72.120.204,美国
208.72.136.5,美国
208.72.145.1,美国
208.72.145.5,美国
208.74.158.3,美国
208.74.158.10,美国
208.75.224.254,美国
208.76.139.27,美国
208.77.0.11,美国
208.79.56.204,美国
208.82.128.2,美国
208.83.64.5,美国
208.83.64.6,美国
208.83.192.162,美国
208.86.182.143,美国
208.88.168.5,美国
208.88.168.6,美国
208.89.107.86,美国
208.90.15.229,美国
208.90.237.9,美国
208.91.112.53,美国
208.93.220.20,美国
208.93.222.6,美国
208.94.72.2,美国
208.94.78.2,美国
208.94.147.150,美国
208.94.147.151,美国
208.95.18.150,美国
208.96.10.221,美国
208.96.162.13,美国
208.97.25.29,美国
208.98.152.3,美国
208.98.152.6,美国
208.98.188.81,美国
208.106.121.4,美国
208.110.128.2,美国
208.110.170.5,美国
208.112.89.183,美国
208.116.30.21,美国
208.123.144.2,美国
208.151.69.65,美国/加拿大
208.167.231.55,美国/加拿大
208.175.109.19,美国/加拿大
208.196.63.2,美国弗吉尼亚州劳登县阿什本地区MCI通信服务公司
208.218.130.5,美国弗吉尼亚州劳登县阿什本地区MCI通信服务公司
208.246.8.14,美国弗吉尼亚州劳登县阿什本地区MCI通信服务公司
209.5.21.78,美国/加拿大
209.20.130.77,美国/加拿大
209.40.66.10,美国/加拿大
209.53.200.2,加拿大
209.53.200.3,加拿大
209.59.164.10,加拿大
209.59.164.250,加拿大
209.60.128.194,加拿大
209.62.57.2,美国 ThePlanet机房
209.74.143.1,美国/加拿大
209.81.0.254,美国/加拿大
209.87.239.20,美国/加拿大
209.90.90.174,美国/加拿大
209.90.160.220,美国/加拿大
209.105.192.122,美国/加拿大
209.114.255.27,美国/加拿大
209.115.131.51,美国/加拿大
209.115.142.1,美国/加拿大
209.115.142.9,美国/加拿大
209.115.142.132,美国/加拿大
209.120.245.58,美国/加拿大
209.124.63.37,美国/加拿大
209.133.21.10,美国/加拿大
209.137.192.10,美国/加拿大
209.137.193.10,美国/加拿大
209.139.247.254,美国/加拿大
209.142.182.250,美国/加拿大
209.147.123.3,美国/加拿大
209.163.108.67,美国/加拿大
209.165.131.71,美国/加拿大
209.165.131.73,美国/加拿大
209.166.160.36,美国/加拿大
209.166.160.132,美国/加拿大
209.172.0.5,美国/加拿大
209.179.23.232,美国/加拿大
209.191.139.131,美国/加拿大
209.197.128.2,美国/加拿大
209.202.110.120,美国/加拿大
209.202.110.121,美国/加拿大
209.226.175.236,美国/加拿大
209.226.175.237,美国/加拿大
209.234.64.193,美国
209.242.0.2,美国加州
209.244.0.3,美国 Broomfield
209.244.0.4,美国 Broomfield
209.250.128.6,美国/加拿大
209.251.130.31,美国/加拿大
209.251.130.41,美国/加拿大
209.252.33.101,美国/加拿大
209.252.33.103,美国/加拿大
210.14.232.241,中国联通
210.21.4.130,广东省广州市联通
210.21.196.5,广东省深圳市联通
210.21.196.6,广东省深圳市联通
210.21.196.50,广东省深圳市联通
210.22.14.68,广东省深圳市联通
210.22.70.2,上海市联通
210.22.70.3,上海市联通
210.22.84.3,上海市联通
210.33.116.112,浙江省浙江广播电视大学
210.38.192.33,广东省韶关市韶关学院
210.51.170.66,北京市联通亦庄IDC中心
210.52.149.2,辽宁省大连市联通
210.52.207.2,上海市联通
210.53.0.3,四川省联通
210.79.232.248,北京市中国工程技术信息网
210.80.60.1,UUNET亚太区网络
210.80.60.2,UUNET亚太区网络
210.130.137.22,日本
210.138.175.22,日本
210.143.144.12,日本
210.150.255.66,日本
210.153.1.1,日本
210.164.22.69,日本
210.191.71.1,日本
210.191.71.13,日本
210.192.103.50,北京市万网公司IDC
211.29.132.16,澳大利亚悉尼
211.31.132.89,澳大利亚
211.31.132.91,澳大利亚
211.90.8.129,河北省石家庄市联通
211.90.72.65,内蒙古呼和浩特市联通
211.90.80.65,山西省太原市联通
211.90.88.129,江苏省联通(全省通用)
211.90.88.132,江苏省联通(全省通用)
211.90.120.80,江苏省无锡市联通
211.90.216.129,浙江省杭州市联通
211.91.88.129,安徽省合肥市联通
211.91.120.129,湖北省武汉市联通
211.91.184.129,河南省郑州市联通
211.91.216.129,湖南省长沙市联通
211.91.248.129,江西省南昌市联通
211.92.8.161,重庆市联通
211.92.136.81,贵州省贵阳市联通
211.92.144.161,云南省昆明市联通
211.92.248.65,甘肃省兰州市联通
211.93.0.81,宁夏银川市联通
211.93.8.81,青海省西宁市联通
211.93.16.65,新疆乌鲁木齐市联通
211.93.24.129,黑龙江省哈尔滨市联通
211.93.64.129,吉林省长春市联通
211.93.80.129,辽宁省沈阳市联通
211.94.33.193,河北省石家庄市联通
211.94.33.194,河北省石家庄市联通
211.94.65.97,北京市联通
211.94.193.129,天津市联通
211.95.1.97,上海市联通
211.95.72.1,上海市联通
211.95.129.161,四川省成都市联通
211.95.193.97,广东省广州市联通
211.97.64.129,广西南宁市联通
211.97.96.65,海南省海口市联通
211.97.104.129,福建省福州市联通
211.97.168.129,山东省济南市联通
211.97.184.100,山东省青岛市联通
211.98.2.4,广东省广州市铁通
211.98.2.40,广东省广州市铁通
211.98.4.1,广东省广州市铁通
211.98.4.15,广东省广州市铁通
211.98.72.7,云南省昆明市铁通DNS服务器
211.98.72.8,云南省昆明市铁通DNS服务器
211.98.72.73,云南省昆明市铁通
211.98.192.3,河南省郑州市铁通
211.99.199.194,北京市世纪互联数据中心
211.99.199.195,北京市世纪互联数据中心
211.100.1.10,北京市
211.100.2.130,北京市
211.103.13.101,江苏省无锡市移动
211.136.17.97,广西南宁市移动
211.136.17.98,广西南宁市移动
211.136.17.99,广西南宁市移动
211.136.17.100,广西南宁市移动
211.136.17.101,广西南宁市移动
211.136.17.107,广西南宁市移动
211.136.18.171,广东省深圳市移动
211.136.20.193,广西南宁市 /广东省广州市移动
211.136.20.194,广西南宁市 /广东省广州市移动
211.136.20.195,广西南宁市 /广东省广州市移动
211.136.20.196,广西南宁市 /广东省广州市移动
211.136.20.197,广西南宁市 /广东省广州市移动
211.136.20.203,广西南宁市 /广东省广州市移动
211.136.28.228,北京市移动GPRS
211.136.28.231,北京市移动GPRS
211.136.28.234,北京市移动GPRS
211.136.28.237,北京市移动GPRS
211.136.32.100,北京市移动GPRS
211.136.32.103,北京市移动GPRS
211.136.32.106,北京市移动GPRS
211.136.32.109,北京市移动GPRS
211.136.112.50,上海市移动GPRS
211.136.150.66,上海市移动GPRS
211.136.192.6,广东省移动(全省通用)
211.137.32.178,辽宁省移动(全省通用)
211.137.58.20,湖北省武汉市移动
211.137.64.163,湖北省武汉市移动
211.137.130.3,陕西省移动
211.137.130.19,陕西省移动
211.137.160.5,天津市移动
211.137.160.185,天津市移动
211.137.241.34,黑龙江省哈尔滨市移动
211.137.241.35,黑龙江省哈尔滨市移动
211.138.13.66,河北省移动
211.138.31.3,河南省郑州市移动
211.138.31.4,河南省郑州市移动
211.138.75.123,青海省西宁市移动
211.138.91.1,内蒙古呼和浩特市移动
211.138.91.2,内蒙古呼和浩特市移动
211.138.106.3,山西省移动(全省通用)
211.138.106.19,山西省移动(全省通用)
211.138.130.254,浙江省移动(全省通用)
211.138.145.194,福建省福州市移动
211.138.151.161,福建省福州市移动
211.138.156.6,福建省福州市移动
211.138.156.66,福建省福州市移动
211.138.157.106,福建省泉州市移动
211.138.164.6,海南省海口市移动
211.138.164.7,海南省海口市移动
211.138.180.2,安徽省合肥市移动
211.138.180.3,安徽省合肥市移动
211.138.200.69,江苏省移动(全省通用)
211.138.242.18,广西南宁市移动
211.138.252.30,广西南宁市移动
211.138.252.32,广西南宁市移动
211.138.252.71,广西南宁市移动
211.139.1.3,贵州省贵阳市移动
211.139.2.18,贵州省贵阳市移动
211.139.29.68,云南省移动DNS服务器
211.139.29.69,云南省移动DNS服务器
211.139.73.34,西藏拉萨市移动
211.139.73.35,西藏拉萨市移动
211.139.136.68,广东省移动GPRS(全省通用)
211.139.163.6,广东省移动GPRS(全省通用)
211.140.10.2,浙江省杭州市移动
211.140.14.36,浙江省杭州市移动
211.140.197.58,辽宁省大连市移动
211.141.0.99,吉林省吉林市移动
211.141.16.99,吉林省移动
211.141.90.68,江西省南昌市移动
211.141.90.69,江西省南昌市移动
211.142.210.98,湖南省长沙市移动
211.142.210.100,湖南省长沙市移动
211.143.60.56,河北省移动GRPS(全省通用)
211.150.124.76,北京市 263网络通信股份有限公司
211.150.125.198,北京市 263网络通信股份有限公司
211.162.62.1,广东省广州市长城宽带
211.162.78.1,广东省深圳市长城宽带
212.8.216.41,德国
212.24.188.131,匈牙利
212.24.192.15,卢森堡
212.29.0.1,德国
212.30.96.123,法国
212.31.224.2,意大利
212.34.160.56,德国
212.34.164.68,德国
212.40.0.10,瑞士
212.51.207.67,波兰 Technical University of Lodz
212.56.224.20,卢森堡
212.58.224.138,英国
212.68.193.196,比利时
212.72.23.31,阿曼
212.73.209.34,法国
212.74.114.193,英国
212.76.68.200,沙特阿拉伯
212.83.64.140,荷兰
212.98.160.65,白俄罗斯
212.108.200.75,匈牙利
212.111.32.7,英国
212.118.241.1,英国
212.118.241.33,英国
212.135.1.32,英国
212.135.1.33,英国
212.135.1.34,英国
212.135.1.35,英国
212.135.1.204,英国
212.158.248.5,俄罗斯
212.158.248.6,俄罗斯
212.159.11.150,英国
212.189.127.131,荷兰
212.222.128.86,德国
212.223.22.22,德国
213.11.43.241,法国
213.19.146.3,荷兰
213.41.78.235,法国
213.41.78.237,法国
213.41.78.238,法国
213.52.192.198,英国
213.92.5.193,意大利
213.94.78.16,奥地利
213.94.78.17,奥地利
213.94.78.18,奥地利
213.131.66.248,埃及
213.138.110.132,伊朗
213.143.65.12,斯洛文尼亚
213.159.10.58,荷兰
213.160.40.2,瑞士
213.160.212.2,英国
213.161.83.20,英国
213.172.33.34,西班牙
213.183.65.31,德国
213.191.74.12,德国
213.191.92.82,德国
213.201.213.227,荷兰
213.203.192.234,德国
213.214.0.44,德国
213.249.210.4,欧洲
213.249.210.5,欧洲
213.249.210.6,欧洲
213.251.133.164,英国
216.13.127.50,美国/加拿大
216.16.248.50,加拿大
216.17.3.121,美国/加拿大
216.17.3.122,美国/加拿大
216.17.220.1,美国/加拿大
216.17.220.49,美国/加拿大
216.17.220.65,美国/加拿大
216.21.128.22,美国/加拿大
216.21.129.22,美国/加拿大
216.23.179.1,美国/加拿大
216.24.27.208,美国/加拿大
216.26.137.20,美国 Xodiax
216.29.107.8,美国/加拿大
216.36.128.2,加拿大
216.36.128.3,加拿大
216.38.154.66,美国
216.48.26.101,美国/加拿大
216.52.1.1,美国/加拿大
216.52.1.33,美国/加拿大
216.52.41.1,美国/加拿大
216.52.94.33,美国/加拿大
216.52.126.1,美国/加拿大
216.52.161.33,美国/加拿大
216.52.169.1,美国/加拿大
216.52.169.33,美国/加拿大
216.54.2.10,美国/加拿大
216.54.2.11,美国/加拿大
216.55.128.7,美国/加拿大
216.57.160.5,美国/加拿大
216.57.160.8,美国/加拿大
216.58.97.20,美国/加拿大
216.68.71.4,美国/加拿大
216.81.96.67,美国/加拿大
216.83.194.5,美国/加拿大
216.85.85.217,美国/加拿大
216.87.84.211,美国科罗拉多州丹佛市ViaWest公司
216.94.180.2,美国/加拿大
216.106.14.194,美国/加拿大
216.106.184.2,美国/加拿大
216.106.184.50,美国/加拿大
216.110.214.2,美国/加拿大
216.114.192.111,美国/加拿大
216.123.198.243,美国/加拿大
216.129.211.2,美国/加拿大
216.130.105.133,美国/加拿大
216.130.189.116,美国/加拿大
216.131.94.5,美国/加拿大
216.131.95.20,美国/加拿大
216.134.244.11,美国/加拿大
216.144.4.10,美国/加拿大
216.144.192.250,美国/加拿大
216.146.35.35,美国/加拿大
216.146.36.36,美国/加拿大
216.152.160.30,美国/加拿大
216.168.202.21,美国/加拿大
216.171.96.38,美国/加拿大
216.171.98.75,美国/加拿大
216.171.98.76,美国/加拿大
216.181.30.11,美国/加拿大
216.187.117.12,美国/加拿大
216.187.117.130,美国/加拿大
216.187.119.10,美国/加拿大
216.198.139.69,美国
216.206.157.7,美国
216.211.190.3,美国纽约
216.211.191.3,美国纽约
216.220.80.200,美国/加拿大
216.220.93.193,美国/加拿大
216.220.96.17,美国/加拿大
216.220.208.209,美国/加拿大
216.221.96.36,美国/加拿大
216.221.96.38,美国/加拿大
216.224.112.15,美国/加拿大
216.227.100.60,美国/加拿大
216.227.253.10,美国/加拿大
216.230.107.8,美国/加拿大
216.230.112.41,美国/加拿大
216.230.112.42,美国/加拿大
216.235.128.10,美国/加拿大
216.235.138.10,美国/加拿大
216.239.80.185,美国加利福尼亚州山景市谷歌公司
216.240.187.22,美国/加拿大
216.241.164.234,美国/加拿大
216.245.224.4,美国/加拿大
216.251.128.22,美国/加拿大
216.251.128.40,美国/加拿大
216.254.141.2,美国纽约州
217.10.135.6,英国
217.10.160.8,英国
217.10.162.8,英国
217.14.164.35,德国
217.17.22.2,德国
217.19.176.2,欧洲
217.20.127.32,欧洲
217.20.127.198,欧洲
217.27.240.20,欧洲
217.64.112.13,英国
217.72.162.2,英国
217.72.168.34,英国
217.79.186.148,欧洲
217.116.226.3,丹麦
217.144.144.11,欧洲
217.150.35.129,欧洲
217.154.96.244,英国
217.154.96.245,英国
217.154.131.34,英国
217.170.32.66,俄罗斯
217.174.194.33,美国
217.175.160.11,法国
217.194.96.10,乌克兰
218.2.135.1,江苏省南京市电信ADSL
218.5.75.141,福建省厦门市电信IDC机房
218.6.200.139,四川省成都市电信ADSL
218.29.54.109,河南省新乡市联通IDC机房
218.29.255.68,河南省郑州市联通
218.30.19.40,陕西省西安市电信DNS
218.30.103.93,北京市电信IDC机房
218.40.228.9,日本
218.76.64.138,湖南省吉首市电信
218.76.90.1,湖南省吉首市电信
218.76.192.100,湖南省邵阳市邵阳学院七里坪校区
218.76.192.101,湖南省邵阳市电信
218.76.248.6,湖南省永州市 (东安县)电信ADSL
218.76.248.60,湖南省永州市 (东安县)电信ADSL
218.76.248.100,湖南省永州市 (东安县)电信ADSL
218.77.31.200,湖南省怀化市
218.85.139.33,福建省厦门市电信ADSL
218.85.157.99,福建省福州市电信DNS服务器
218.87.132.1,江西省赣州市电信ADSL
218.87.142.1,江西省赣州市电信ADSL
218.89.0.124,四川省乐山市电信DNS服务器
218.102.62.71,香港特别行政区
218.104.32.106,江苏省苏州市联通
218.104.78.2,安徽省合肥市联通
218.104.78.3,安徽省合肥市联通
218.104.111.112,湖北省武汉市联通
218.104.111.114,湖北省武汉市联通
218.104.128.106,福建省厦门市联通路由器
218.104.136.156,福建省厦门市联通
218.107.207.40,福建省厦门市联通
218.108.245.157,浙江省杭州市华数宽带
218.108.248.20,浙江省杭州市华数宽带
218.108.248.200,浙江省杭州市华数宽带
218.138.156.161,日本东京
218.201.4.3,重庆市移动
218.201.17.2,重庆市移动
218.202.152.130,新疆乌鲁木齐市移动
218.203.101.3,宁夏移动
218.203.101.4,宁夏移动
218.203.160.194,甘肃省兰州市移动
218.203.160.195,甘肃省兰州市移动
218.205.229.114,四川省资阳市移动
218.219.54.67,日本
218.223.68.33,日本
218.223.68.73,日本
218.244.147.72,北京市电信通中关村IDC(万网租用)
218.248.240.135,印度 BSNL网络
218.248.240.208,印度 BSNL网络
218.251.89.134,日本
219.72.225.253,湖南省中信网络有限公司
219.72.225.254,湖南省中信网络有限公司
219.146.0.130,山东省济南市电信
219.146.0.132,山东省济南市电信
219.147.198.230,黑龙江省齐齐哈尔市电信
219.148.162.31,内蒙古呼和浩特市电信
219.149.194.55,吉林省长春市电信DNS服务器
219.150.32.132,山东省济南市电信DNS服务器
219.150.150.150,河南省开封市电信
219.151.32.66,西藏拉萨市电信
219.157.70.130,河南省洛阳市联通
219.235.1.248,上海市邦特网络通信
219.238.235.184,北京市瑞星信息技术有限公司(中关村大街中科大厦)
220.103.99.3,日本
220.168.208.3,湖南省常德市电信
220.168.208.6,湖南省常德市电信
220.170.0.18,湖南省衡阳市电信
220.170.64.68,湖南省衡阳市电信
220.170.64.96,湖南省衡阳市电信
220.189.127.107,浙江省嘉兴市电信
220.192.8.58,上海市电信CDMA
220.231.41.77,北京市光环新网
220.248.192.12,江西省南昌市联通
220.248.192.13,江西省南昌市联通
220.255.4.18,新加坡电信SINGNET
221.3.131.9,云南省昆明市联通
221.3.131.10,云南省昆明市联通
221.4.8.1,广东省广州市联通
221.4.66.66,广东省广州市联通
221.4.98.66,广东省深圳市联通
221.5.88.88,广东省肇庆市联通ADSL
221.6.4.66,江苏省南京市联通
221.6.96.177,江苏省无锡市联通
221.7.34.10,甘肃省兰州市联通
221.7.128.68,广西南宁市联通
221.7.136.68,广西柳州市联通
221.10.251.196,四川省自贡市联通
221.11.132.2,海南省海口市联通
221.12.1.228,浙江省杭州市联通
221.12.33.228,浙江省宁波市电信
221.12.65.228,浙江省温州市联通
221.130.32.100,北京市移动
221.130.32.103,北京市移动
221.130.32.106,北京市移动
221.130.32.109,北京市移动
221.130.33.52,北京市移动
221.130.33.60,北京市移动
221.130.252.200,重庆市移动IDC机房
221.176.3.70,江西省移动
221.176.3.73,江西省移动
221.176.3.76,江西省移动
221.176.3.79,江西省移动
221.176.3.82,江西省移动
221.176.3.85,江西省移动
221.176.4.6,江西省移动
221.176.4.9,江西省移动
221.176.4.12,江西省移动
221.176.4.15,江西省移动
221.176.4.18,江西省移动
221.176.4.21,江西省移动
221.228.255.1,江苏省无锡市电信ADSL
222.45.0.110,江苏省无锡市 /南通市铁通
222.45.1.40,江苏省徐州市铁通
222.73.44.148,上海市电信(沈家弄路)IDC机房
222.75.152.129,宁夏银川市电信
222.85.85.85,河南省郑州市电信
222.88.88.88,河南省洛阳市电信IDC机房
222.124.198.150,印度尼西亚
222.172.200.68,云南省昆明市电信DNS服务器
222.246.129.80,湖南省长沙市电信
222.246.129.81,湖南省长沙市电信
此时要解决的问题都已解决，可以完整地写一个程序了^_^

账号		自动登录	找回密码
密码			立即注册→加入我们