-
-
[旧帖] 灰色菜单的分析方法 有能力的可以看下 0.00雪花
-
发表于: 2011-3-10 19:26
-
004918E0 /$ 55 push ebp
004918E1 |. 8BEC mov ebp, esp
004918E3 |. 53 push ebx
004918E4 |. 8B45 08 mov eax, dword ptr [ebp+8]
004918E7 |. 8B40 FC mov eax, dword ptr [eax-4]
004918EA |. 80B8 29020000>cmp byte ptr [eax+229], 0
004918F1 0F84 DF000000 je 004919D6
004918F7 |. 8B45 08 mov eax, dword ptr [ebp+8]
004918FA |. 8B40 FC mov eax, dword ptr [eax-4]
004918FD |. F680 28020000>test byte ptr [eax+228], 1
00491904 0F84 CC000000 je 004919D6
0049190A |. 8B45 08 mov eax, dword ptr [ebp+8]
0049190D |. 8B40 FC mov eax, dword ptr [eax-4]
00491910 |. 80B8 2F020000>cmp byte ptr [eax+22F], 1
00491917 0F84 B9000000 je 004919D6
0049191D |. 6A 00 push 0
0049191F |. 8B45 08 mov eax, dword ptr [ebp+8]
00491922 |. 8B40 FC mov eax, dword ptr [eax-4]
00491925 |. E8 AEA5FEFF call 0047BED8
0049192A |. 50 push eax ; |hWnd
0049192B |. E8 C863F7FF call <jmp.&user32.GetSystemMenu> ; \GetSystemMenu
00491930 |. 8BD8 mov ebx, eax
00491932 |. 8B45 08 mov eax, dword ptr [ebp+8]
00491935 |. 8B40 FC mov eax, dword ptr [eax-4]
00491938 |. 80B8 29020000>cmp byte ptr [eax+229], 3
0049193F 75 5D jnz short 0049199E
00491941 6A 00 push 0
00491943 |. 68 30F10000 push 0F130 ; |ItemId = F130 (61744.)
00491948 |. 53 push ebx ; |hMenu
00491949 |. E8 9261F7FF call <jmp.&user32.DeleteMenu> ; \DeleteMenu
0049194E 68 00040000 push 400
00491953 |. 6A 07 push 7 ; |ItemId = 7
00491955 |. 53 push ebx ; |hMenu
00491956 |. E8 8561F7FF call <jmp.&user32.DeleteMenu> ; \DeleteMenu
0049195B |. 68 00040000 push 400 ; /Flags = MF_BYPOSITION|MF_ENABLED|MF_STRING
00491960 |. 6A 05 push 5 ; |ItemId = 5
00491962 |. 53 push ebx ; |hMenu
00491963 |. E8 7861F7FF call <jmp.&user32.DeleteMenu> ; \DeleteMenu
00491968 6A 00 push 0
0049196A |. 68 30F00000 push 0F030 ; |ItemId = F030 (61488.)
0049196F |. 53 push ebx ; |hMenu
00491970 |. E8 6B61F7FF call <jmp.&user32.DeleteMenu> ; \DeleteMenu
00491975 6A 00 push 0
00491977 |. 68 20F00000 push 0F020 ; |ItemId = F020 (61472.)
0049197C |. 53 push ebx ; |hMenu
0049197D |. E8 5E61F7FF call <jmp.&user32.DeleteMenu> ; \DeleteMenu
00491982 6A 00 push 0
00491984 |. 68 00F00000 push 0F000 ; |ItemId = F000 (61440.)
00491989 |. 53 push ebx ; |hMenu
0049198A |. E8 5161F7FF call <jmp.&user32.DeleteMenu> ; \DeleteMenu
0049198F 6A 00 push 0
00491991 |. 68 20F10000 push 0F120 ; |ItemId = F120 (61728.)
00491996 |. 53 push ebx ; |hMenu
00491997 |. E8 4461F7FF call <jmp.&user32.DeleteMenu> ; \DeleteMenu
0049199C EB 38 jmp short 004919D6
0049199E |> 8B45 08 mov eax, dword ptr [ebp+8]
004919A1 |. 8B40 FC mov eax, dword ptr [eax-4]
004919A4 |. F680 28020000>test byte ptr [eax+228], 2
004919AB 75 0D jnz short 004919BA
004919AD 6A 01 push 1
004919AF |. 68 20F00000 push 0F020 ; |ItemID = F020 (61472.)
004919B4 |. 53 push ebx ; |hMenu
004919B5 |. E8 9661F7FF call <jmp.&user32.EnableMenuItem> ; \EnableMenuItem
004919BA |> 8B45 08 mov eax, dword ptr [ebp+8]
004919BD |. 8B40 FC mov eax, dword ptr [eax-4]
004919C0 |. F680 28020000>test byte ptr [eax+228], 4
004919C7 75 0D jnz short 004919D6
004919C9 6A 01 push 1
004919CB |. 68 30F00000 push 0F030 ; |ItemID = F030 (61488.)
004919D0 |. 53 push ebx ; |hMenu
004919D1 |. E8 7A61F7FF call <jmp.&user32.EnableMenuItem> ; \EnableMenuItem
004919D6 |> 5B pop ebx
004919D7 |. 5D pop ebp
004919D8 \. C3 retn
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
