今天在修改代码的时候遇到一个问题
131C57B8
push 0 修改为多少才不会破坏代码?而且能保证字节数为2。。。?
代码如下
131C57A4 /$ 51 push ecx
131C57A5 |. 83E8 01 sub eax, 1
131C57A8 |. 72 1F jb short 131C57C9
131C57AA |. 75 54 jnz short 131C5800
131C57AC |. 54 push esp
131C57AD |. 6A 00 push 0
131C57AF |. 6A 00 push 0
131C57B1 |. 68 60571C13 push 131C5760
131C57B6 |. 6A 00 push 0
131C57B8 6A 00 push 0 ==此处的push 0修改为多少才不会破坏代码?而且能保证字节数为2。。。?
131C57BA |. E8 BD15F8FF call <jmp.&kernel32.CreateThread>
131C57BF |. 8B15 447F1C13 mov edx, dword ptr [131C7F44]
131C57C5 |. 8902 mov dword ptr [edx], eax
131C57C7 |. 5A pop edx
131C57C8 |. C3 retn
131C57C9 |> B8 30B01C13 mov eax, 131CB030
131C57CE |. BA 18000000 mov edx, 18
131C57D3 |. E8 D020F8FF call 131478A8
131C57D8 |. A1 447F1C13 mov eax, dword ptr [131C7F44]
131C57DD |. 8338 00 cmp dword ptr [eax], 0
131C57E0 |. 74 1E je short 131C5800
131C57E2 |. B8 30B01C13 mov eax, 131CB030
131C57E7 |. BA 18000000 mov edx, 18
131C57EC |. E8 B720F8FF call 131478A8
131C57F1 |. 6A 00 push 0
131C57F3 |. A1 447F1C13 mov eax, dword ptr [131C7F44]
131C57F8 |. 8B00 mov eax, dword ptr [eax]
131C57FA |. 50 push eax
131C57FB |. E8 A418F8FF call <jmp.&kernel32.TerminateThread>
131C5800 |> 5A pop edx
131C5801 \. C3 retn
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课