本人新手，在学习解密过程中，看到“看雪软件安全文档库”中一篇“功能限制的程序”的教程，按照原文的方法，就是不能将程序中的灰色按钮激活。后来在od中运行调试发现，原文所说的跳转只是最靠近EnableMenuItem调用的跳转，单从此处更改，并不能实现灰色菜单激活，因为在这个跳转的上面还有几个跳转判断，会直接跳走，再有EnableMenuItem参数是正确的吗，原文并没有叙述。下面附上原文以及本人的调试代码。
原文：
这个程序是利用函数EnableMenuItem来使菜单变灰的，用W32DASM打开程序，查找EnableMenuItem，你会发现这部分是重点：
|
:004329E4 8B7E58 mov edi, dword ptr [esi+58]
:004329E7 85FF test edi, edi
:004329E9 7427 je 00432A12<---如是零则跳过 EnableMenuItem
:004329EB F6462002 test [esi+20], 02
:004329EF 7521 jne 00432A12
:004329F1 33C0 xor eax, eax
:004329F3 8AC3 mov al, bl
:004329F5 8B0485D4374400 mov eax, dword ptr [4*eax+004437D4]
:004329FC 83C800 or eax, 00000000
:004329FF 50 push eax
:00432A00 0FB74644 movzx eax, word ptr [esi+44]
:00432A04 50 push eax
:00432A05 8BC7 mov eax, edi
:00432A07 E824F4FFFF call 00431E30
:00432A0C 50 push eax
* Reference To: user32.EnableMenuItem, Ord:0000h
|
:00432A0D E89A36FDFF Call 004060AC
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004329E9(C), :004329EF(C)
|
:00432A12 33D2 xor edx, edx
:00432A14 8BC6 mov eax, esi
:00432A16 8B08 mov ecx, dword ptr [eax]
:00432A18 FF5134 call [ecx+34]
这有很多办法可使其跳转，但在这里选用另一法，你在SOFTICE下跟踪会发现在:004329E7 一行，EBX是0,因此将：
004329E7 85FF test edi, edi
改成： test ebx, edi
菜单功能恢复正常。
本人od调试代码：
004329A8 /$ 53 PUSH EBX
004329A9 |. 56 PUSH ESI
004329AA |. 57 PUSH EDI
004329AB |. 8BDA MOV EBX,EDX
004329AD |. 8BF0 MOV ESI,EAX
004329AF |. 3A5E 2D CMP BL,BYTE PTR DS:[ESI+2D]
004329B2 |. 74 67 JE SHORT cm_id10.00432A1B ;
004329B4 |. 885E 2D MOV BYTE PTR DS:[ESI+2D],BL
004329B7 |. A1 843D4400 MOV EAX,DWORD PTR DS:[443D84]
004329BC |. 8338 02 CMP DWORD PTR DS:[EAX],2
004329BF |. 75 0B JNZ SHORT cm_id10.004329CC
004329C1 |. 8BC6 MOV EAX,ESI
004329C3 |. E8 B4000000 CALL cm_id10.00432A7C
004329C8 |. 85C0 TEST EAX,EAX
004329CA |. 75 0D JNZ SHORT cm_id10.004329D9 ; 这个跳不能执行，否则就会跳跑。可以改为JE
004329CC |> 8B7E 58 MOV EDI,DWORD PTR DS:[ESI+58]
004329CF |. 85FF TEST EDI,EDI
004329D1 |. 74 11 JE SHORT cm_id10.004329E4
004329D3 |. 837F 60 00 CMP DWORD PTR DS:[EDI+60],0
004329D7 |. 74 0B JE SHORT cm_id10.004329E4
004329D9 |> B2 01 MOV DL,1
004329DB |. 8BC6 MOV EAX,ESI
004329DD |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
004329DF |. FF51 34 CALL DWORD PTR DS:[ECX+34]
004329E2 |. EB 37 JMP SHORT cm_id10.00432A1B
004329E4 |> 8B7E 58 MOV EDI,DWORD PTR DS:[ESI+58]
004329E7 85FF TEST EDI,EDI
004329E9 |. 74 27 JE SHORT cm_id10.00432A12
004329EB |. F646 20 02 TEST BYTE PTR DS:[ESI+20],2
004329EF |. 75 21 JNZ SHORT cm_id10.00432A12
004329F1 |. 33C0 XOR EAX,EAX
004329F3 |. 8AC3 MOV AL,BL
004329F5 |. 8B0485 D43744>MOV EAX,DWORD PTR DS:[EAX*4+4437D4]
004329FC |. 83C8 00 OR EAX,0
004329FF |. 50 PUSH EAX EnableMenuItem的参数uEnable。这个值必须是0，才能激活菜单
00432A00 |. 0FB746 44 MOVZX EAX,WORD PTR DS:[ESI+44]
00432A04 |. 50 PUSH EAX EnableMenuItem的参数uIDEnableItem。
00432A05 |. 8BC7 MOV EAX,EDI
00432A07 |. E8 24F4FFFF CALL cm_id10.00431E30
00432A0C |. 50 PUSH EAX ; |hMenu EnableMenuItem的参数hMenu。
00432A0D |. E8 9A36FDFF CALL <JMP.&user32.EnableMenuItem> ;
附上EnableMenuItem函数说明
BOOL EnableMenuItem(
HMENU hMenu, // handle to menu
UINT uIDEnableItem, // menu item to update
UINT uEnable // options
);
uEnable
[in] Controls the interpretation of the uIDEnableItem parameter and indicate whether the menu item is enabled, disabled, or grayed. This parameter must be a combination of either MF_BYCOMMAND or MF_BYPOSITION and MF_ENABLED, MF_DISABLED, or MF_GRAYED.
Value Meaning
MF_BYCOMMAND Indicates that uIDEnableItem gives the identifier of the menu item. If neither the MF_BYCOMMAND nor MF_BYPOSITION flag is specified, the MF_BYCOMMAND flag is the default flag.
MF_BYPOSITION Indicates that uIDEnableItem gives the zero-based relative position of the menu item.
MF_DISABLED Indicates that the menu item is disabled, but not grayed, so it cannot be selected.
MF_ENABLED Indicates that the menu item is enabled and restored from a grayed state so that it can be selected.
MF_GRAYED Indicates that the menu item is disabled and grayed so that it cannot be selected.
