各位,下面是一段北信源的卸载程序中检查卸载密码的一段代码。
如果密码不对的话,程序会禁止卸载。
我想把它改成不论任何密码都能卸载,我已经定位到核心代码就是这一段了,各位帮看一下吧,多谢!
代码:
/*462EE0*/ push ebx
/*462EE1*/ push esi
/*462EE2*/ push edi
/*462EE3*/ mov edi, ecx
/*462EE5*/ mov ecx, dword ptr [5395D0]
/*462EEB*/ mov eax, dword ptr [ecx]
/*462EED*/ call dword ptr [eax+A8]
/*462EF3*/ test eax, eax
/*462EF5*/ jnz short 00462F30
/*462EF7*/ mov ecx, dword ptr [5395D0]
/*462EFD*/ mov edx, dword ptr [ecx]
/*462EFF*/ call dword ptr [edx+90]
/*462F05*/ test al, al
/*462F07*/ je short 00462F30
/*462F09*/ lea esp, dword ptr [esp]
/*462F10*/ mov ecx, dword ptr [5395D0]
/*462F16*/ mov eax, dword ptr [ecx]
/*462F18*/ call dword ptr [eax+94]
/*462F1E*/ mov ecx, dword ptr [5395D0]
/*462F24*/ mov edx, dword ptr [ecx]
/*462F26*/ call dword ptr [edx+90]
/*462F2C*/ test al, al
/*462F2E*/ jnz short 00462F10
/*462F30*/ mov eax, dword ptr [edi+1AC]
/*462F36*/ test eax, eax
/*462F38*/ jnz short 00462F47
/*462F3A*/ mov ecx, edi
/*462F3C*/ call 00429230
/*462F41*/ mov dword ptr [edi+1AC], eax
/*462F47*/ mov eax, dword ptr [edi+1AC]
/*462F4D*/ test eax, eax
/*462F4F*/ je short 00462F59
/*462F51*/ mov ebx, dword ptr [eax+114]
/*462F57*/ jmp short 00462F5B
/*462F59*/ xor ebx, ebx
/*462F5B*/ mov eax, dword ptr [edi+1A0]
/*462F61*/ xor esi, esi
/*462F63*/ test al, 0A
/*462F65*/ je short 00462F7F
/*462F67*/ mov cl, al
/*462F69*/ and cl, 10
/*462F6C*/ neg cl
/*462F6E*/ sbb ecx, ecx
/*462F70*/ add ecx, 4
/*462F73*/ test al, al
/*462F75*/ mov esi, ecx
/*462F77*/ jns short 00462F7F
/*462F79*/ or esi, 100
/*462F7F*/ test al, 4
/*462F81*/ je short 00462F8C
/*462F83*/ movsx esi, al
/*462F86*/ and esi, 10
/*462F89*/ shr esi, 4
/*462F8C*/ test ah, 1
/*462F8F*/ je short 00462F96
/*462F91*/ or esi, 30
/*462F94*/ jmp short 00462FB2
/*462F96*/ test ah, 2
/*462F99*/ je short 00462FA0
/*462F9B*/ or esi, 10
/*462F9E*/ jmp short 00462FB2
/*462FA0*/ test ah, 8
/*462FA3*/ je short 00462FAA
/*462FA5*/ or esi, 40
/*462FA8*/ jmp short 00462FB2
/*462FAA*/ test ah, 4
/*462FAD*/ je short 00462FB2
/*462FAF*/ or esi, 20
/*462FB2*/ test ah, ah
/*462FB4*/ jns short 00462FBC
/*462FB6*/ or esi, 40000
/*462FBC*/ mov ecx, dword ptr [5395D0]
/*462FC2*/ mov edx, dword ptr [ecx]
/*462FC4*/ call dword ptr [edx+B8]
/*462FCA*/ cmp eax, 2
/*462FCD*/ jnz short 00462FD5
/*462FCF*/ or esi, 180000
/*462FD5*/ test ebx, ebx
/*462FD7*/ jnz short 00462FDF
/*462FD9*/ or esi, 2000
/*462FDF*/ mov eax, dword ptr [edi+1A4]
/*462FE5*/ mov ecx, dword ptr [edi+1A8]
/*462FEB*/ push esi
/*462FEC*/ push eax
/*462FED*/ push ecx
/*462FEE*/ push ebx
/*462FEF*/ call dword ptr [<&USER32.MessageBoxA>]
/*462FF5*/ pop edi
/*462FF6*/ dec eax
/*462FF7*/ cmp eax, 6
/*462FFA*/ pop esi
/*462FFB*/ pop ebx
/*462FFC*/ ja short 00463017
/*462FFE*/ jmp dword ptr [eax*4+463020]
/*463005*/ mov eax, 13EC
/*46300A*/ retn
/*46300B*/ mov eax, 13EF
/*463010*/ retn
/*463011*/ mov eax, 13F0
/*463016*/ retn
/*463017*/ mov eax, 13ED
/*46301C*/ retn
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课