原帖在此：
http://bbs.pediy.com/showthread.php?s=&threadid=35517
首先感谢楼主和LOCKLOSE告知错误。经检查，OD附加进程及载入程序时标题上的线程等显示操作如下：
00478A5C |. B0 54 MOV AL,54 ; 大写字母"T",此处用于线程列表
00478A5E |. F7C6 00040000 TEST ESI,400
00478A64 |. 75 03 JNZ SHORT Ollydbg.00478A69
00478A66 |. 83C0 20 ADD EAX,20 ; 变成小写字母"t"
00478A69 |> 33D2 XOR EDX,EDX ; |
00478A6B |. 8AD0 MOV DL,AL ; |
00478A6D |. 52 PUSH EDX ; |Arg3
00478A6E |. 68 75224C00 PUSH Ollydbg.004C2275 ; |压入%chread %08lX
00478A73 |. 57 PUSH EDI ; |Arg1
00478A74 |. E8 B3E10200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
00478A79 |. 83C4 10 ADD ESP,10
00478A7C |. 8BD8 MOV EBX,EAX
00478A7E |. EB 11 JMP SHORT Ollydbg.00478A91
00478A80 |> 53 PUSH EBX ; /Arg3
00478A81 |. 68 7D224C00 PUSH Ollydbg.004C227D ; |Arg2 = 004C227D ASCII "%08lX"
00478A86 |. 57 PUSH EDI ; |Arg1
00478A87 |. E8 A0E10200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
00478A8C |. 83C4 0C ADD ESP,0C
00478A8F |. 8BD8 MOV EBX,EAX
00478A91 |> 8BC3 MOV EAX,EBX
00478A93 |. E9 F8000000 JMP Ollydbg.00478B90
00478A98 |> 53 PUSH EBX ; /Arg2
00478A99 |. 68 947C4D00 PUSH Ollydbg.004D7C94 ; |Arg1 = 004D7C94 ASCII "Table of threads"
00478A9E |. E8 6DCAFDFF CALL Ollydbg._Findsorteddata ; \_Findsorteddata
00478AA3 |. 83C4 08 ADD ESP,8
00478AA6 |. 85C0 TEST EAX,EAX
00478AA8 |. 75 55 JNZ SHORT Ollydbg.00478AFF
00478AAA |. F7C6 24000000 TEST ESI,24
00478AB0 |. 74 07 JE SHORT Ollydbg.00478AB9
00478AB2 |. 33DB XOR EBX,EBX
00478AB4 |. E9 D5000000 JMP Ollydbg.00478B8E
00478AB9 |> F7C6 00080000 TEST ESI,800
00478ABF |. 74 28 JE SHORT Ollydbg.00478AE9
00478AC1 |. 53 PUSH EBX
00478AC2 |. B0 54 MOV AL,54 ; 此处用于载入一个程序时显示
00478AC4 |. F7C6 00040000 TEST ESI,400
00478ACA |. 75 03 JNZ SHORT Ollydbg.00478ACF
00478ACC |. 83C0 20 ADD EAX,20
00478ACF |> 33D2 XOR EDX,EDX ; |
00478AD1 |. 8AD0 MOV DL,AL ; |
00478AD3 |. 52 PUSH EDX ; |Arg3
00478AD4 |. 68 75224C00 PUSH Ollydbg.004C2275 ; |Arg2 = 004C2275
00478AD9 |. 57 PUSH EDI ; |Arg1
00478ADA |. E8 4DE10200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
00478ADF |. 83C4 10 ADD ESP,10
00478AE2 |. 8BD8 MOV EBX,EAX
00478AE4 |. E9 A5000000 JMP Ollydbg.00478B8E
00478AE9 |> 53 PUSH EBX ; /Arg3
00478AEA |. 68 7D224C00 PUSH Ollydbg.004C227D ; |Arg2 = 004C227D ASCII "%08lX"
00478AEF |. 57 PUSH EDI ; |Arg1
00478AF0 |. E8 37E10200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
00478AF5 |. 83C4 0C ADD ESP,0C
00478AF8 |. 8BD8 MOV EBX,EAX
00478AFA |. E9 8F000000 JMP Ollydbg.00478B8E
00478AFF |> F640 08 04 TEST BYTE PTR DS:[EAX+8],4
00478B03 |. 74 3F JE SHORT Ollydbg.00478B44
00478B05 |. F7C6 00040000 TEST ESI,400
00478B0B |. B1 4D MOV CL,4D ; 大写字母"M",用于载入文件时显示main
00478B0D |. 75 03 JNZ SHORT Ollydbg.00478B12
00478B0F |. 83C1 20 ADD ECX,20 ; 变成小写字母"m"
00478B12 |> 33C0 XOR EAX,EAX
00478B14 |. 8AC1 MOV AL,CL
00478B16 |. 50 PUSH EAX ; /Arg3
00478B17 |. 68 83224C00 PUSH Ollydbg.004C2283 ; |Arg2 = 004C2283
00478B1C |. 57 PUSH EDI ; |Arg1
00478B1D |. E8 0AE10200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
00478B22 |. 83C4 0C ADD ESP,0C
00478B25 |. 8BD8 MOV EBX,EAX
00478B27 |. F7C6 00080000 TEST ESI,800
00478B2D |. 74 5F JE SHORT Ollydbg.00478B8E
00478B2F |. 68 68224C00 PUSH Ollydbg.004C2268 ; /Arg2 = 004C2268 ASCII " thread"
00478B34 |. 8D043B LEA EAX,DWORD PTR DS:[EBX+EDI] ; |
00478B37 |. 50 PUSH EAX ; |Arg1
00478B38 |. E8 EFE00200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
00478B3D |. 83C4 08 ADD ESP,8
00478B40 |. 03D8 ADD EBX,EAX
00478B42 |. EB 4A JMP SHORT Ollydbg.00478B8E
00478B44 |> F7C6 20000000 TEST ESI,20
00478B4A |. 74 04 JE SHORT Ollydbg.00478B50
00478B4C |. 33DB XOR EBX,EBX
00478B4E |. EB 3E JMP SHORT Ollydbg.00478B8E
00478B50 |> F7C6 00080000 TEST ESI,800
00478B56 |. 74 25 JE SHORT Ollydbg.00478B7D
00478B58 |. 53 PUSH EBX
00478B59 |. B0 54 MOV AL,54 ; 大写字母"T",此处用于附加进程
00478B5B |. F7C6 00040000 TEST ESI,400
00478B61 |. 75 03 JNZ SHORT Ollydbg.00478B66
00478B63 |. 83C0 20 ADD EAX,20 ; 变成小写字母"t"
00478B66 |> 33D2 XOR EDX,EDX ; |
00478B68 |. 8AD0 MOV DL,AL ; |
00478B6A |. 52 PUSH EDX ; |Arg3
00478B6B |. 68 75224C00 PUSH Ollydbg.004C2275 ; |压入%chread %08lX
00478B70 |. 57 PUSH EDI ; |Arg1
00478B71 |. E8 B6E00200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
00478B76 |. 83C4 10 ADD ESP,10
00478B79 |. 8BD8 MOV EBX,EAX
00478B7B |. EB 11 JMP SHORT Ollydbg.00478B8E
00478B7D |> 53 PUSH EBX ; /Arg3
00478B7E |. 68 7D224C00 PUSH Ollydbg.004C227D ; |Arg2 = 004C227D ASCII "%08lX"
00478B83 |. 57 PUSH EDI ; |Arg1
00478B84 |. E8 A3E00200 CALL Ollydbg.004A6C2C ; \Ollydbg.004A6C2C
原先的翻译如下：
790645:%chread %08lX
线程 %08lX
790659:%cain
主
当时测试是显示正常，因为这个地方看的比较少，未作仔细测试，在此为所造成的错误表示歉意！现修正如下：
翻译：
790645:%chread %08lX
%c线程 %08lX
790659:%cain
%c主
同时修改00478A5C、00478AC2、00478B59三个地方的原代码 MOV AL,54 为 MOV AL,0 机器码为B0 00；修改00478B0B处的原代码 MOV CL,4D 为 MOV CL,0 机器码为B1 00。
这次把那个main也顺手修正一下，以防出现错误。附件是补丁程序，此补丁适用于我所有的汉化版本及OllyICE。
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
