能力值:
( LV3,RANK:20 )
25 楼
OD载入emeditor.exe
右键 查找 所有模块中的名称
敲入 InternetGetConnectedState
右键 在输入函数上切换断点
堆栈窗口
0451F104 0000000E
0451F108 FFFFFFFE
0451F10C 76FAFAA2 kernel32.76FAFAA2
0451F110 0048F7B0 UNICODE "LastCheckedHigh"
0451F114 0451FF34
0451F118 0043AC77 EmEditor.0043AC77
0451F11C 0043AC99 返回到 EmEditor.0043AC99 来自 WININET.InternetGetConnectedState
0451F120 0451F14C
0451F124 00000000
0451F128 00000000 0043AC99 返回到 EmEditor.0043AC99 来自 WININET.InternetGetConnectedState
按ENTER 在反汇编窗口中跟随 0043AC82 /0F84 4C020000 JE EmEditor.0043AED4
0043AC88 |. |385D 10 CMP BYTE PTR SS:[EBP+10],BL
0043AC8B |. |75 14 JNZ SHORT EmEditor.0043ACA1
0043AC8D |. |53 PUSH EBX
0043AC8E |. |8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28]
0043AC92 |. |50 PUSH EAX
0043AC93 |. |FF15 34A84800 CALL DWORD PTR DS:[<&WININET.InternetGet>; WININET.InternetGetConnectedState
0043AC99 |. |85C0 TEST EAX,EAX
0043AC9B |. |0F84 33020000 JE EmEditor.0043AED4
0043ACA1 |> |385D 0C CMP BYTE PTR SS:[EBP+C],BL
0043ACA4 |. |75 20 JNZ SHORT EmEditor.0043ACC6
0043ACA6 |. |837C24 14 01 CMP DWORD PTR SS:[ESP+14],1
0043ACAB |. |75 19 JNZ SHORT EmEditor.0043ACC6
0043ACAD |. |E8 F0FDFFFF CALL EmEditor.0043AAA2
0043ACB2 |. |50 PUSH EAX ; /Arg2
0043ACB3 |. |68 D0F74800 PUSH EmEditor.0048F7D0 ; |Arg1 = 0048F7D0
0043ACB8 |. |8BF2 MOV ESI,EDX ; |
0043ACBA |. |E8 06E5FFFF CALL EmEditor.004391C5 ; \EmEditor.004391C5
0043ACBF |. |56 PUSH ESI ; /Arg2
0043ACC0 |. |57 PUSH EDI ; |Arg1
0043ACC1 |. |E8 FFE4FFFF CALL EmEditor.004391C5 ; \EmEditor.004391C5
0043ACC6 |> |53 PUSH EBX
0043ACC7 |. |53 PUSH EBX
0043ACC8 |. |53 PUSH EBX
0043ACC9 |. |53 PUSH EBX
0043ACCA |. |68 0C034900 PUSH EmEditor.0049030C ; UNICODE "Microsoft Internet Explorer"
0043ACCF |. |FF15 48A84800 CALL DWORD PTR DS:[<&WININET.InternetOpe>; WININET.InternetOpenW
0043ACD5 |. |894424 18 MOV DWORD PTR SS:[ESP+18],EAX
0043ACD9 |. |3BC3 CMP EAX,EBX
0043ACDB |. |0F84 F3010000 JE EmEditor.0043AED4
0043ACE1 |. |68 20DC4800 PUSH EmEditor.0048DC20 ; UNICODE "DefaultLang"
0043ACE6 |. |33C0 XOR EAX,EAX
0043ACE8 |. |E8 9CE5FFFF CALL EmEditor.00439289
0043ACED |. |33C9 XOR ECX,ECX
0043ACEF |. |381D 67C94900 CMP BYTE PTR DS:[49C967],BL
0043ACF5 |. |BE BE230000 MOV ESI,23BE
0043ACFA |. |0F95C1 SETNE CL
0043ACFD |. |8DBC24 B80A00>LEA EDI,DWORD PTR SS:[ESP+AB8]
0043AD04 |. |51 PUSH ECX
0043AD05 |. |6A 01 PUSH 1
0043AD07 |. |50 PUSH EAX
0043AD08 |. |8D4424 44 LEA EAX,DWORD PTR SS:[ESP+44]
0043AD0C |. |50 PUSH EAX
0043AD0D |. |56 PUSH ESI
0043AD0E |. |68 48034900 PUSH EmEditor.00490348 ; UNICODE "https://www.emurasoft.com/support/check_emeditor_version.php?ver=%u&key=%s&lang=%d&os=%d&portable=%d"
0043AD13 |. |B9 A6010000 MOV ECX,1A6
0043AD18 |. |E8 0A69FCFF CALL EmEditor.00401627
0043AD1D |. |83C4 18 ADD ESP,18
0043AD20 |. |53 PUSH EBX
0043AD21 |. |68 00018084 PUSH 84800100
0043AD26 |. |53 PUSH EBX
0043AD27 |. |53 PUSH EBX
0043AD28 |. |8BC7 MOV EAX,EDI
0043AD2A |. |50 PUSH EAX
0043AD2B |. |FF7424 2C PUSH DWORD PTR SS:[ESP+2C]
0043AD2F |. |FF15 40A84800 CALL DWORD PTR DS:[<&WININET.InternetOpe>; WININET.InternetOpenUrlW
0043AD35 |. |894424 30 MOV DWORD PTR SS:[ESP+30],EAX
0043AD39 |. |3BC3 CMP EAX,EBX
0043AD3B |. |0F84 7E010000 JE EmEditor.0043AEBF
0043AD41 |. |885C24 13 MOV BYTE PTR SS:[ESP+13],BL
0043AD45 |. |C74424 20 E70>MOV DWORD PTR SS:[ESP+20],3E7
0043AD4D |. |8DBC24 C00200>LEA EDI,DWORD PTR SS:[ESP+2C0]
0043AD54 |> |8D4424 2C /LEA EAX,DWORD PTR SS:[ESP+2C]
0043AD58 |. |50 |PUSH EAX
0043AD59 |. |FF7424 24 |PUSH DWORD PTR SS:[ESP+24]
0043AD5D |. |895C24 34 |MOV DWORD PTR SS:[ESP+34],EBX
0043AD61 |. |57 |PUSH EDI
0043AD62 |. |FF7424 3C |PUSH DWORD PTR SS:[ESP+3C]
0043AD66 |. |FF15 3CA84800 |CALL DWORD PTR DS:[<&WININET.InternetRe>; WININET.InternetReadFile
0043AD6C |. |85C0 |TEST EAX,EAX
0043AD6E |. |74 10 |JE SHORT EmEditor.0043AD80
0043AD70 |. |8B4424 2C |MOV EAX,DWORD PTR SS:[ESP+2C]
0043AD74 |. |3BC3 |CMP EAX,EBX
0043AD76 |. |74 08 |JE SHORT EmEditor.0043AD80
0043AD78 |. |03F8 |ADD EDI,EAX
0043AD7A |. |294424 20 |SUB DWORD PTR SS:[ESP+20],EAX
0043AD7E |.^|75 D4 \JNZ SHORT EmEditor.0043AD54
0043AD80 |> |881F MOV BYTE PTR DS:[EDI],BL
0043AD82 |. |389C24 C00200>CMP BYTE PTR SS:[ESP+2C0],BL
0043AD89 |. |0F84 26010000 JE EmEditor.0043AEB5
0043AD8F |. |6A 08 PUSH 8
0043AD91 |. |8D8424 C40200>LEA EAX,DWORD PTR SS:[ESP+2C4]
0043AD98 |. |68 14044900 PUSH EmEditor.00490414 ; ASCII "Version="
0043AD9D |. |50 PUSH EAX
0043AD9E |. |E8 3AB40300 CALL EmEditor.004761DD
0043ADA3 |. |83C4 0C ADD ESP,0C
0043ADA6 |. |85C0 TEST EAX,EAX
0043ADA8 |. |75 1A JNZ SHORT EmEditor.0043ADC4
0043ADAA |. |8D8424 C80200>LEA EAX,DWORD PTR SS:[ESP+2C8]
0043ADB1 |. |50 PUSH EAX
0043ADB2 |. |E8 5DB60300 CALL EmEditor.00476414
0043ADB7 |. |3BC6 CMP EAX,ESI
0043ADB9 |. |59 POP ECX
0043ADBA |. |7E 08 JLE SHORT EmEditor.0043ADC4
0043ADBC |. |C74424 1C 010>MOV DWORD PTR SS:[ESP+1C],1
0043ADC4 |> |8D8424 C00200>LEA EAX,DWORD PTR SS:[ESP+2C0]
0043ADCB |. |68 20044900 PUSH EmEditor.00490420 ; ASCII "Status="
0043ADD0 |. |50 PUSH EAX
0043ADD1 |. |E8 CAB40300 CALL EmEditor.004762A0
0043ADD6 |. |59 POP ECX
0043ADD7 |. |59 POP ECX
0043ADD8 |. |3BC3 CMP EAX,EBX
0043ADDA |. |74 2D JE SHORT EmEditor.0043AE09
0043ADDC |. |8078 07 31 CMP BYTE PTR DS:[EAX+7],31
0043ADE0 |. |75 12 JNZ SHORT EmEditor.0043ADF4
0043ADE2 |. |C74424 14 030>MOV DWORD PTR SS:[ESP+14],3
0043ADEA |. |385C24 11 CMP BYTE PTR SS:[ESP+11],BL
0043ADEE |. |75 19 JNZ SHORT EmEditor.0043AE09
0043ADF0 |. |6A 01 PUSH 1
0043ADF2 |. |EB 0B JMP SHORT EmEditor.0043ADFF
0043ADF4 |> |385C24 11 CMP BYTE PTR SS:[ESP+11],BL
0043ADF8 |. |74 0F JE SHORT EmEditor.0043AE09
0043ADFA |. |885C24 11 MOV BYTE PTR SS:[ESP+11],BL
0043ADFE |. |53 PUSH EBX
0043ADFF |> |68 60F74800 PUSH EmEditor.0048F760 ; |Arg1 = 0048F760
0043AE04 |. |E8 BCE3FFFF CALL EmEditor.004391C5 ; \EmEditor.004391C5
0043AE09 |> |8D8424 C00200>LEA EAX,DWORD PTR SS:[ESP+2C0]
0043AE10 |. |68 28044900 PUSH EmEditor.00490428 ; ASCII "FileUrl="
0043AE15 |. |50 PUSH EAX
0043AE16 |. |E8 85B40300 CALL EmEditor.004762A0
0043AE1B |. |8B35 A0A24800 MOV ESI,DWORD PTR DS:[<&KERNEL32.MultiBy>; kernel32.MultiByteToWideChar
0043AE21 |. |8BF8 MOV EDI,EAX
0043AE23 |. |59 POP ECX
0043AE24 |. |59 POP ECX
0043AE25 |. |3BFB CMP EDI,EBX
0043AE27 |. |74 26 JE SHORT EmEditor.0043AE4F
0043AE29 |. |83C7 08 ADD EDI,8
0043AE2C |. |6A 0A PUSH 0A
0043AE2E |. |57 PUSH EDI
0043AE2F |. |E8 0CB50300 CALL EmEditor.00476340
0043AE34 |. |59 POP ECX
0043AE35 |. |59 POP ECX
0043AE36 |. |3BC3 CMP EAX,EBX
0043AE38 |. |74 15 JE SHORT EmEditor.0043AE4F
0043AE3A |. |68 04010000 PUSH 104
0043AE3F |. |8D8C24 B40800>LEA ECX,DWORD PTR SS:[ESP+8B4]
0043AE46 |. |51 PUSH ECX
0043AE47 |. |2BC7 SUB EAX,EDI
0043AE49 |. |50 PUSH EAX
0043AE4A |. |57 PUSH EDI
0043AE4B |. |53 PUSH EBX
0043AE4C |. |53 PUSH EBX
0043AE4D |. |FFD6 CALL ESI
0043AE4F |> |8D8424 C00200>LEA EAX,DWORD PTR SS:[ESP+2C0]
0043AE56 |. |68 34044900 PUSH EmEditor.00490434 ; ASCII "InfoUrl="
0043AE5B |. |50 PUSH EAX
0043AE5C |. |E8 3FB40300 CALL EmEditor.004762A0
0043AE61 |. |8BF8 MOV EDI,EAX
0043AE63 |. |59 POP ECX
0043AE64 |. |59 POP ECX
0043AE65 |. |3BFB CMP EDI,EBX
0043AE67 |. |74 26 JE SHORT EmEditor.0043AE8F
0043AE69 |. |83C7 08 ADD EDI,8
0043AE6C |. |6A 0A PUSH 0A
0043AE6E |. |57 PUSH EDI
0043AE6F |. |E8 CCB40300 CALL EmEditor.00476340
0043AE74 |. |59 POP ECX
0043AE75 |. |59 POP ECX
0043AE76 |. |3BC3 CMP EAX,EBX
0043AE78 |. |74 15 JE SHORT EmEditor.0043AE8F
0043AE7A |. |68 04010000 PUSH 104
0043AE7F |. |8D8C24 AC0600>LEA ECX,DWORD PTR SS:[ESP+6AC]
0043AE86 |. |51 PUSH ECX
0043AE87 |. |2BC7 SUB EAX,EDI
0043AE89 |. |50 PUSH EAX
0043AE8A |. |57 PUSH EDI
0043AE8B |. |53 PUSH EBX
0043AE8C |. |53 PUSH EBX
0043AE8D |. |FFD6 CALL ESI
0043AE8F |> |8D8424 C00200>LEA EAX,DWORD PTR SS:[ESP+2C0]
0043AE96 |. |68 40044900 PUSH EmEditor.00490440 ; ASCII "NeedNewKey="
0043AE9B |. |50 PUSH EAX
0043AE9C |. |E8 FFB30300 CALL EmEditor.004762A0
0043AEA1 |. |59 POP ECX
0043AEA2 |. |59 POP ECX
0043AEA3 |. |3BC3 CMP EAX,EBX
0043AEA5 |. |74 0E JE SHORT EmEditor.0043AEB5
0043AEA7 |. |83C0 0B ADD EAX,0B
0043AEAA |. |50 PUSH EAX ; /Arg1
0043AEAB |. |E8 64B50300 CALL EmEditor.00476414 ; \EmEditor.00476414
0043AEB0 |. |59 POP ECX
0043AEB1 |. |894424 34 MOV DWORD PTR SS:[ESP+34],EAX
0043AEB5 |> |FF7424 30 PUSH DWORD PTR SS:[ESP+30]
0043AEB9 |. |FF15 44A84800 CALL DWORD PTR DS:[<&WININET.InternetClo>; WININET.InternetCloseHandle
0043AEBF |> |53 PUSH EBX
0043AEC0 |. |FF7424 1C PUSH DWORD PTR SS:[ESP+1C]
0043AEC4 |. |FF15 38A84800 CALL DWORD PTR DS:[<&WININET.InternetSet>; WININET.InternetSetStatusCallbackW
0043AECA |. |FF7424 18 PUSH DWORD PTR SS:[ESP+18]
0043AECE |. |FF15 44A84800 CALL DWORD PTR DS:[<&WININET.InternetClo>; WININET.InternetCloseHandle
0043AED4 |> \385C24 11 CMP BYTE PTR SS:[ESP+11],BL 0043AC82 处的JE 跳转比较大
将其改为JMP 改成这个,会提示注册成功
但还是会去联网 0043AECE . FF15 44A84800 CALL DWORD PTR DS:[<&WININET.InternetCloseH>; WININET.InternetCloseHandle
往下看
0043AED4 > \385C24 11 CMP BYTE PTR SS:[ESP+11],BL
0043AED8 . 74 0D JE SHORT EmEditor.0043AEE7 ; 小跳
0043AEDA . 385D 0C CMP BYTE PTR SS:[EBP+C],BL
0043AEDD . 75 08 JNZ SHORT EmEditor.0043AEE7 ; 小跳
0043AEDF . C74424 14 030>MOV DWORD PTR SS:[ESP+14],3
0043AEE7 > 385D 10 CMP BYTE PTR SS:[EBP+10],BL
0043AEEA . 75 1D JNZ SHORT EmEditor.0043AF09 ; 小跳
0043AEEC . 837C24 14 01 CMP DWORD PTR SS:[ESP+14],1
0043AEF1 . 74 07 JE SHORT EmEditor.0043AEFA ; 小跳
0043AEF3 . 837C24 14 05 CMP DWORD PTR SS:[ESP+14],5
0043AEF8 . 75 0F JNZ SHORT EmEditor.0043AF09 ; 小跳
0043AEFA > 395C24 1C CMP DWORD PTR SS:[ESP+1C],EBX
0043AEFE . 75 09 JNZ SHORT EmEditor.0043AF09 ; 小跳
0043AF00 . 385D 0C CMP BYTE PTR SS:[EBP+C],BL
0043AF03 . 0F84 DB000000 JE EmEditor.0043AFE4 ; 稍微大点的跳 下方有定时器相关调用
; 改为jmp 就跳过联网检测
0043AF09 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0043AF0C . 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]
0043AF0F . 3BC3 CMP EAX,EBX
0043AF11 0F84 CD000000 JE EmEditor.0043AFE4 ; 与上方稍大跳转地址一样
; 也可在这改为jmp 就跳过联网检测
0043AF17 . 50 PUSH EAX ; /hWnd
0043AF18 . FF15 70A74800 CALL DWORD PTR DS:[<&USER32.IsWindow>] ; \IsWindow
0043AF1E . 85C0 TEST EAX,EAX
0043AF20 . 0F84 BE000000 JE EmEditor.0043AFE4
0043AF26 . 33FF XOR EDI,EDI
0043AF28 . 385D 0C CMP BYTE PTR SS:[EBP+C],BL
0043AF2B . 75 15 JNZ SHORT EmEditor.0043AF42
0043AF2D . 395C24 1C CMP DWORD PTR SS:[ESP+1C],EBX
0043AF31 . 74 0F JE SHORT EmEditor.0043AF42
0043AF33 . 33C0 XOR EAX,EAX
0043AF35 . 385D 10 CMP BYTE PTR SS:[EBP+10],BL
0043AF38 . 0F94C0 SETE AL
0043AF3B . 48 DEC EAX
0043AF3C . 83E0 03 AND EAX,3
0043AF3F . 40 INC EAX
0043AF40 . EB 10 JMP SHORT EmEditor.0043AF52
0043AF42 > 385D 10 CMP BYTE PTR SS:[EBP+10],BL
0043AF45 . 74 0D JE SHORT EmEditor.0043AF54
0043AF47 . 33C0 XOR EAX,EAX
0043AF49 . 385C24 13 CMP BYTE PTR SS:[ESP+13],BL
0043AF4D . 0F95C0 SETNE AL
0043AF50 . 40 INC EAX
0043AF51 . 40 INC EAX
0043AF52 > 8BF8 MOV EDI,EAX
0043AF54 > 68 50B24900 PUSH EmEditor.0049B250
0043AF59 . 68 B8040000 PUSH 4B8
0043AF5E . E8 DB960300 CALL EmEditor.0047463E
0043AF63 . 395C24 3C CMP DWORD PTR SS:[ESP+3C],EBX
0043AF67 . 8BF0 MOV ESI,EAX
0043AF69 . 59 POP ECX
0043AF6A . 0F95C0 SETNE AL
0043AF6D . 59 POP ECX
0043AF6E . 89BE B0040000 MOV DWORD PTR DS:[ESI+4B0],EDI
0043AF74 . 8886 B4040000 MOV BYTE PTR DS:[ESI+4B4],AL
0043AF7A . BF FEFFFF7F MOV EDI,7FFFFFFE
0043AF7F . 57 PUSH EDI
0043AF80 . 8D8424 B40800>LEA EAX,DWORD PTR SS:[ESP+8B4]
0043AF87 . B9 54010000 MOV ECX,154
0043AF8C . 8BD6 MOV EDX,ESI
0043AF8E . E8 E166FCFF CALL EmEditor.00401674
0043AF93 . 57 PUSH EDI
0043AF94 . 8D96 A8020000 LEA EDX,DWORD PTR DS:[ESI+2A8]
0043AF9A . 8D8424 AC0600>LEA EAX,DWORD PTR SS:[ESP+6AC]
0043AFA1 . B9 04010000 MOV ECX,104
0043AFA6 . E8 C966FCFF CALL EmEditor.00401674
0043AFAB . 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]
0043AFAE . 8DBB A70B0100 LEA EDI,DWORD PTR DS:[EBX+10BA7]
0043AFB4 . EB 08 JMP SHORT EmEditor.0043AFBE
0043AFB6 > 6A 64 PUSH 64 ; /Timeout = 100. ms
0043AFB8 . FF15 A8A34800 CALL DWORD PTR DS:[<&KERNEL32.Sleep>] ; \Sleep
0043AFBE > F607 04 TEST BYTE PTR DS:[EDI],4
0043AFC1 .^ 75 F3 JNZ SHORT EmEditor.0043AFB6
0043AFC3 . 0FB645 0C MOVZX EAX,BYTE PTR SS:[EBP+C]
0043AFC7 . F7D8 NEG EAX
0043AFC9 . 1BC0 SBB EAX,EAX
0043AFCB . 25 80000000 AND EAX,80
0043AFD0 . 0B4424 14 OR EAX,DWORD PTR SS:[ESP+14]
0043AFD4 . 50 PUSH EAX ; /lParam
0043AFD5 . 56 PUSH ESI ; |wParam
0043AFD6 . 68 5E800000 PUSH 805E ; |Message = MSG(805E)
0043AFDB . FF73 04 PUSH DWORD PTR DS:[EBX+4] ; |hWnd
0043AFDE > FF15 50A74800 CALL DWORD PTR DS:[<&USER32.PostMessageW>] ; \PostMessageW
0043AFE4 > 5F POP EDI