这一段自效验我改了好久都没有通过,请各位高手帮我分析一下,改那地方可以通过。
005B8C6D > /6A 58 push 58 断点
005B8C6F . |68 40FA6300 push road1111.0063FA40
005B8C74 . |E8 7F090000 call road1111.005B95F8
005B8C79 . |33F6 xor esi,esi
005B8C7B . |8975 FC mov dword ptr ss:[ebp-4],esi
005B8C7E . |8D45 98 lea eax,dword ptr ss:[ebp-68]
005B8C81 . |50 push eax ; /pStartupinfo
005B8C82 . |FF15 04925E00 call dword ptr ds:[<&KERNEL32.Get>; \GetStartupInfoA
005B8C88 . |6A FE push -2
005B8C8A . |5F pop edi
005B8C8B . |897D FC mov dword ptr ss:[ebp-4],edi
005B8C8E . |B8 4D5A0000 mov eax,5A4D
005B8C93 . |66:3905 00004000 cmp word ptr ds:[400000],ax
005B8C9A |75 38 jnz short road1111.005B8CD4
005B8C9C . |A1 3C004000 mov eax,dword ptr ds:[40003C]
005B8CA1 . |81B8 00004000 504>cmp dword ptr ds:[eax+400000],455>
005B8CAB |75 27 jnz short road1111.005B8CD4
005B8CAD . |B9 0B010000 mov ecx,10B
005B8CB2 . |66:3988 18004000 cmp word ptr ds:[eax+400018],cx
005B8CB9 |75 19 jnz short road1111.005B8CD4
005B8CBB . |83B8 74004000 0E cmp dword ptr ds:[eax+400074],0E
005B8CC2 |76 10 jbe short road1111.005B8CD4
005B8CC4 . |33C9 xor ecx,ecx
005B8CC6 . |39B0 E8004000 cmp dword ptr ds:[eax+4000E8],esi
005B8CCC . |0F95C1 setne cl
005B8CCF . |894D E4 mov dword ptr ss:[ebp-1C],ecx
005B8CD2 . |EB 03 jmp short road1111.005B8CD7
005B8CD4 > |8975 E4 mov dword ptr ss:[ebp-1C],esi
005B8CD7 > |33DB xor ebx,ebx
005B8CD9 . |43 inc ebx
005B8CDA . |53 push ebx ; /Arg1 => 00000001
005B8CDB . |E8 C0E70000 call road1111.005C74A0 ; \road1111.005C74A0
005B8CE0 . |59 pop ecx
005B8CE1 . |85C0 test eax,eax
005B8CE3 |75 08 jnz short road1111.005B8CED
005B8CE5 . |6A 1C push 1C
005B8CE7 . |E8 58FFFFFF call road1111.005B8C44
005B8CEC . |59 pop ecx
005B8CED > |E8 C6660000 call road1111.005BF3B8
005B8CF2 . |85C0 test eax,eax
005B8CF4 |75 08 jnz short road1111.005B8CFE
005B8CF6 . |6A 10 push 10
005B8CF8 . |E8 47FFFFFF call road1111.005B8C44
005B8CFD . |59 pop ecx
005B8CFE > |E8 73A60000 call road1111.005C3376
005B8D03 . |895D FC mov dword ptr ss:[ebp-4],ebx
005B8D06 . |E8 41E50000 call road1111.005C724C
005B8D0B . |85C0 test eax,eax
005B8D0D |7D 08 jge short road1111.005B8D17
005B8D0F . |6A 1B push 1B
005B8D11 . |E8 55D4FFFF call road1111.005B616B
005B8D16 . |59 pop ecx
005B8D17 > |FF15 4C925E00 call dword ptr ds:[<&KERNEL32.Get>; [GetCommandLineA
005B8D1D . |A3 2CDA6400 mov dword ptr ds:[64DA2C],eax
005B8D22 . |E8 EEE30000 call road1111.005C7115
005B8D27 . |A3 E4B86400 mov dword ptr ds:[64B8E4],eax
005B8D2C . |E8 29E30000 call road1111.005C705A
005B8D31 . |85C0 test eax,eax
005B8D33 |7D 08 jge short road1111.005B8D3D
005B8D35 . |6A 08 push 8
005B8D37 . |E8 2FD4FFFF call road1111.005B616B
005B8D3C . |59 pop ecx
005B8D3D > |E8 A0E00000 call road1111.005C6DE2
005B8D42 . |85C0 test eax,eax
005B8D44 |7D 08 jge short road1111.005B8D4E
005B8D46 . |6A 09 push 9
005B8D48 . |E8 1ED4FFFF call road1111.005B616B
005B8D4D . |59 pop ecx
005B8D4E > |53 push ebx ; /Arg1
005B8D4F . |E8 D6D4FFFF call road1111.005B622A ; \road1111.005B622A
005B8D54 . |59 pop ecx
005B8D55 . |3BC6 cmp eax,esi
005B8D57 |74 07 je short road1111.005B8D60
005B8D59 . |50 push eax
005B8D5A . |E8 0CD4FFFF call road1111.005B616B
005B8D5F . |59 pop ecx
005B8D60 > |E8 1EE00000 call road1111.005C6D83
005B8D65 . |845D C4 test byte ptr ss:[ebp-3C],bl
005B8D68 |74 06 je short road1111.005B8D70
005B8D6A . |0FB74D C8 movzx ecx,word ptr ss:[ebp-38]
005B8D6E . |EB 03 jmp short road1111.005B8D73
005B8D70 > |6A 0A push 0A
005B8D72 . |59 pop ecx
005B8D73 > |51 push ecx
005B8D74 . |50 push eax
005B8D75 . |56 push esi
005B8D76 . |68 00004000 push road1111.00400000
005B8D7B . |E8 7A6E0100 call road1111.005CFBFA ; 弹出“软件被修改”对话
框
005B8D80 . |8945 E0 mov dword ptr ss:[ebp-20],eax
005B8D83 . |3975 E4 cmp dword ptr ss:[ebp-1C],esi
005B8D86 |75 06 jnz short road1111.005B8D8E
005B8D88 . |50 push eax
005B8D89 . |E8 4DD6FFFF call road1111.005B63DB
005B8D8E > |E8 74D6FFFF call road1111.005B6407
005B8D93 . |897D FC mov dword ptr ss:[ebp-4],edi
005B8D96 |EB 35 jmp short road1111.005B8DCD
005B8D98 . |8B45 EC mov eax,dword ptr ss:[ebp-14]
005B8D9B . |8B08 mov ecx,dword ptr ds:[eax]
005B8D9D . |8B09 mov ecx,dword ptr ds:[ecx]
005B8D9F . |894D DC mov dword ptr ss:[ebp-24],ecx
005B8DA2 . |50 push eax
005B8DA3 . |51 push ecx
005B8DA4 . |E8 74A70000 call road1111.005C351D
005B8DA9 . |59 pop ecx
005B8DAA . |59 pop ecx
005B8DAB . |C3 retn
点击“确定”软件关闭
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课