能力值：
( LV7，RANK：100 )
|
-
-
2 楼
下断点在EnableWindow函数上
回溯到这里
0046868C /. 55 PUSH EBP
0046868D |. 8BEC MOV EBP,ESP
0046868F |. 6A 00 PUSH 0x0
00468691 |. 53 PUSH EBX
00468692 |. 8BD8 MOV EBX,EAX
00468694 |. 33C0 XOR EAX,EAX
00468696 |. 55 PUSH EBP
00468697 |. 68 0C874600 PUSH CrackMe0.0046870C
0046869C |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0046869F |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004686A2 |. FF0D 14BC4600 DEC DWORD PTR DS:[0x46BC14]
004686A8 |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-0x4]
004686AB |. A1 14BC4600 MOV EAX,DWORD PTR DS:[0x46BC14]
004686B0 |. E8 AFF6F9FF CALL CrackMe0.00407D64
004686B5 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-0x4]
004686B8 |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+0x300]
004686BE |. E8 19B7FCFF CALL CrackMe0.00433DDC
004686C3 |. 833D 14BC4600>CMP DWORD PTR DS:[0x46BC14],0x0
004686CA |. 75 2A JNZ SHORT CrackMe0.004686F6
004686CC |. 33D2 XOR EDX,EDX
004686CE |. 8B83 1C030000 MOV EAX,DWORD PTR DS:[EBX+0x31C]
004686D4 |. E8 2301FCFF CALL CrackMe0.004287FC
004686D9 |. B2 01 MOV DL,0x1
004686DB |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+0x300]
004686E1 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
004686E3 |. FF51 64 CALL DWORD PTR DS:[ECX+0x64]
004686E6 |. BA 20874600 MOV EDX,CrackMe0.00468720
004686EB |. 8B83 00030000 MOV EAX,DWORD PTR DS:[EBX+0x300]
// 这个CALL执行后，按钮可用且内容为“确定”
// 向上看，004686CA的JZ条件跳决定了是否走这里的流程
// 所以，JZ给NOP掉，打开软件立即可以点击“确定”
004686F1 |. E8 E6B6FCFF CALL CrackMe0.00433DDC
004686F6 |> 33C0 XOR EAX,EAX
004686F8 |. 5A POP EDX
004686F9 |. 59 POP ECX
004686FA |. 59 POP ECX
004686FB |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
004686FE |. 68 13874600 PUSH CrackMe0.00468713
00468703 |> 8D45 FC LEA EAX,DWORD PTR SS:[EBP-0x4]
00468706 |. E8 41B7F9FF CALL CrackMe0.00403E4C
0046870B \. C3 RETN
|
|
|
