00482448 . 53 push ebx
00482449 . 8BD8 mov ebx, eax
0048244B . 8BCB mov ecx, ebx
0048244D . 8B93 20020000 mov edx, dword ptr [ebx+220]
00482453 . B8 00B00000 mov eax, 0B000
00482458 . E8 9FFFFFFF call 004823FC
0048245D . 66:83BB 8A020>cmp word ptr [ebx+28A], 0
00482465 74 0E je short 00482475 ; 关键跳
00482467 . 8BD3 mov edx, ebx
00482469 . 8B83 8C020000 mov eax, dword ptr [ebx+28C]
0048246F . FF93 88020000 call dword ptr [ebx+288]
00482475 > 5B pop ebx
00482476 . C3 retn
跟进去上面那个call：
004823FC /$ 53 push ebx
004823FD |. 56 push esi
004823FE |. 57 push edi
004823FF |. 55 push ebp
00482400 |. 8BF9 mov edi, ecx
00482402 |. 8BDA mov ebx, edx
00482404 |. 8BE8 mov ebp, eax
00482406 |. 85DB test ebx, ebx
00482408 |. 74 36 je short 00482440
0048240A |. EB 02 jmp short 0048240E
0048240C |> 8BDE /mov ebx, esi
0048240E |> 8B73 30 mov esi, dword ptr [ebx+30]
00482411 |. 85F6 |test esi, esi
00482413 |. 74 11 |je short 00482426
00482415 |. 8BC3 |mov eax, ebx
00482417 |. 8B15 D4C84700 |mov edx, dword ptr [47C8D4] ; avi_ur.0047C920
0048241D |. E8 F213F8FF |call 00403814
00482422 |. 84C0 |test al, al
00482424 |.^ 74 E6 \je short 0048240C
00482426 |> 85DB test ebx, ebx
00482428 |. 74 16 je short 00482440
0048242A |. 3BFB cmp edi, ebx
0048242C |. 74 12 je short 00482440
0048242E |. 6A 00 push 0
00482430 |. 6A 00 push 0
00482432 |. 55 push ebp
00482433 |. 8BC3 mov eax, ebx
00482435 |. E8 96B6FEFF call 0046DAD0
0048243A |. 50 push eax ; |hWnd
0048243B |. E8 A452F8FF call <jmp.&user32.SendMessageA> ; \SendMessageA
00482440 |> 5D pop ebp
00482441 |. 5F pop edi
00482442 |. 5E pop esi
00482443 |. 5B pop ebx
00482444 \. C3 retn
本人菜鸟，大家能不能帮我看看怎么才能让那个ebx+28A的值为0？谢谢~~~~
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
