按网上有人提过的关于flexnet的做法,想学习一下,结果不能按他们说的地方停下来,用OD和W32dsm8.93两种方法均无法停下来, 下面是代码:
:0041F635 55 push ebp <-这个地方下断可停
:0041F636 8BEC mov ebp, esp
:0041F638 83EC24 sub esp, 00000024
:0041F63B C645EC00 mov [ebp-14], 00
:0041F63F 33C0 xor eax, eax
:0041F641 668945ED mov word ptr [ebp-13], ax
:0041F645 8845EF mov byte ptr [ebp-11], al
:0041F648 C745F4B830736F mov [ebp-0C], 6F7330B8
:0041F64F C745FC00000000 mov [ebp-04], 00000000
:0041F656 C745F800000000 mov [ebp-08], 00000000
:0041F65D C745F003000000 mov [ebp-10], 00000003
:0041F664 6800100000 push 00001000
:0041F669 8B4D08 mov ecx, dword ptr [ebp+08]
:0041F66C 51 push ecx
:0041F66D E8BB7A0100 call 0043712D
:0041F672 83C408 add esp, 00000008
:0041F675 85C0 test eax, eax
:0041F677 7452 je 0041F6CB 到这里总是跳:
:0041F679 8B5508 mov edx, dword ptr [ebp+08]
:0041F67C 8B829C010000 mov eax, dword ptr [edx+0000019C]
:0041F682 8B88E81C0000 mov ecx, dword ptr [eax+00001CE8]
:0041F688 83B92405000000 cmp dword ptr [ecx+00000524], 00000000
:0041F68F 743A je 0041F6CB
:0041F691 8B5510 mov edx, dword ptr [ebp+10]
:0041F694 52 push edx
:0041F695 8B450C mov eax, dword ptr [ebp+0C]
:0041F698 50 push eax
:0041F699 8B4D08 mov ecx, dword ptr [ebp+08]
:0041F69C 8B919C010000 mov edx, dword ptr [ecx+0000019C]
:0041F6A2 8B82E81C0000 mov eax, dword ptr [edx+00001CE8]
:0041F6A8 0528050000 add eax, 00000528
:0041F6AD 50 push eax
:0041F6AE 8B4D08 mov ecx, dword ptr [ebp+08]
:0041F6B1 8B919C010000 mov edx, dword ptr [ecx+0000019C]
:0041F6B7 8B82E81C0000 mov eax, dword ptr [edx+00001CE8]
:0041F6BD FF9024050000 call dword ptr [eax+00000524] <-这里总是不能到达
:0041F6C3 83C40C add esp, 0000000C
:0041F6C6 E913010000 jmp 0041F7DE
完全按网上的做法进行,为何就是不能到达:
:0041F6BD FF9024050000 call dword ptr [eax+00000524]
这是为何??
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课