1. 先定位关键点
只有第一个线程是有用的, 另外两个直接patch掉
.text:00403048 push esi
.text:00403049 mov esi, ds:CreateThread
.text:0040304F push edi
.text:00403050 xor edi, edi
.text:00403052 push edi ; lpThreadId
.text:00403053 push edi ; dwCreationFlags
.text:00403054 push edi ; lpParameter
.text:00403055 push offset thread1 ; lpStartAddress
.text:0040305A push edi ; dwStackSize
.text:0040305B push edi ; lpThreadAttributes
.text:0040305C call esi ; CreateThread
.text:0040305E push edi ; lpThreadId
.text:0040305F push edi ; dwCreationFlags
.text:00403060 push edi ; lpParameter
.text:00403061 push offset thread2 ; lpStartAddress
.text:00403066 push edi ; dwStackSize
.text:00403067 push edi ; lpThreadAttributes
.text:00403068 mov g_hThread1, eax
.text:0040306D call esi ; CreateThread
.text:0040306F push edi ; lpThreadId
.text:00403070 push edi ; dwCreationFlags
.text:00403071 push edi ; lpParameter
.text:00403072 push offset thread3 ; lpStartAddress
.text:00403077 push edi ; dwStackSize
.text:00403078 push edi ; lpThreadAttributes
.text:00403079 mov g_hThread2, eax
.text:0040307E call esi ; CreateThread
.text:00403080 push 0FFFFFFFFh ; dwMilliseconds
.text:00403082 push g_hThread1 ; hHandle
.text:00403088 mov g_hThread3, eax
.text:0040308D call ds:WaitForSingleObject
.text:004030D5 call verify_all_402B93
.text:004030DA test al, al
.text:004030DC jz short loc_403106
.text:004030DE lea eax, [ebp+var_28]
.text:004030E1 push eax
.text:004030E2 call decrypt_string
DWORD g_ary[0x3F2];
g_ary[0]=0x6C35B49D;
g_ary[1]=0xA645500D;
g_ary[2]=0xCB9E682E;
g_ary[n]=g_ary[n-1]+g_ary[n-2]+g_ary[n-3];
.text:004026CD push esi
.text:004026CE push 4 ; flProtect
.text:004026D0 push 3000h ; flAllocationType
.text:004026D5 mov esi, 0FC8h
.text:004026DA push esi ; dwSize
.text:004026DB push 0 ; lpAddress
.text:004026DD call ds:VirtualAlloc
.text:004026E3 mov g_ary, eax
.text:004026E8 push 0Ch
.text:004026EA pop edx
.text:004026EB mov dword ptr [eax], 6C35B49Dh
.text:004026F1 mov eax, g_ary
.text:004026F6 mov dword ptr [eax+4], 0A645500Dh
.text:004026FD mov eax, g_ary
.text:00402702 mov dword ptr [eax+8], 0CB9E682Eh
.text:00402709 mov ecx, g_ary
.text:0040270F mov eax, [edx+ecx-8]
.text:00402713 imul eax, [edx+ecx-4]
.text:00402718 add eax, [edx+ecx-0Ch]
.text:0040271C mov [edx+ecx], eax
.text:0040271F add edx, 4
.text:00402722 cmp edx, esi
.text:00402724 jl short loc_402709
计算两个g_sum1及g_sum2
BOOL flag[0x3F2] = 01011010101010101010101010101010101010101010101010101010110101010101010101010101010101010101010101010101010101010101010101010101010101010110101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010110101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010100101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101001010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010100101010101;
g_sum1=sum(g_ary中flag为1的项])
g_sum2=sum(g_ary中flag为0的项])=sum(g_ary)-g_sum1;
.text:00402C5B mov esi, offset flNewProtect
.text:00402C60 mov ecx, esi
.text:00402C62 push edi
.text:00402C63 mov edi, 3F1h
.text:00402C68 push edi
.text:00402C69 push 0
.text:00402C6B call sum_array_what
.text:00402C70 push ebx
.text:00402C71 push edi
.text:00402C72 push 0
.text:00402C74 mov ecx, esi
.text:00402C76 mov dword ptr g_sum1, eax
.text:00402C7B mov dword ptr g_sum1+4, edx
.text:00402C81 call sum_array_all
.text:00402C86 sub eax, dword ptr g_sum1
.text:00402C8C pop edi
.text:00402C8D sbb edx, dword ptr g_sum1+4
.text:00402C93 pop esi
.text:00402C94 mov dword ptr g_sum2, eax
.text:00402C99 mov dword ptr g_sum2+4, edx
.text:00402850 mov ecx, [ebp+arg_0]
.text:00402853 call std_string_length
.text:00402858 cmp eax, 55h
.text:0040285B jnz short loc_402871
.text:0040285D mov ecx, [ebp+arg_0]
.text:00402860 push 9
.text:00402862 call std_string_get_at
.text:00402867 cmp byte ptr [eax], 'F'
.text:0040286A jnz short loc_402871
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
