一、利用Sleep延迟进程启动.586 .model flat , stdcall option casemap :none ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> include windows.incinclude kernel32.incinclude user32.incinclude macros.incincludelib kernel32.libincludelib user32.lib.data db 'crackme.exe' ,0db 74h ;写入的新字节 db 75h ;原来的字节 .data? ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .code invoke GetStartupInfo addr startinfo invoke CreateProcess addr FileName,NULL,NULL,NULL,FALSE ,CREATE_NEW_PROCESS_GROUP,NULL,NULL,addr startinfo,addr pi .if eax == 0invoke MessageBox "请置于程序目录" ),CTXT("错误！" ),MB_OK .endif invoke Sleep ;延迟 500 毫秒等待壳的解压 invoke SuspendThread ;然后迅速挂起 invoke WriteProcessMemory addr NewBytes,sizeof NewBytes,addr OldBytes ;写入字节 invoke ResumeThread ;恢复线程 end start .code invoke GetModuleHandle mov hInstance,eax invoke CreateProcess addr FileName ,NULL,NULL,NULL,FALSE ,NORMAL_PRIORITY_CLASS,NULL,NULL, addr startinfo,addr picmp eax ,0 jz eror_1invoke WaitForInputIdle ;等候进程进入空闲状态 invoke WriteProcessMemory cmp eax ,0 jz eror_2invoke ExitProcess invoke MessageBox "请置于程序目录" ),CTXT("错误！" ),MB_OK jmp fininvoke MessageBox "没有找到补丁位置" ),CTXT("错误！" ),MB_OK jmp finend start .code invoke GetStartupInfo addr stStartUpinvoke CreateProcess ADDR szFileName, NULL, NULL, NULL, FALSE , 0, 0, 0, ADDR stStartUp, ADDR psInfo.IF EAX == 0 invoke MessageBox "请置于程序目录" ),CTXT("错误！" ),MB_OK .ENDIF invoke FindWindow "CrackeMe8 of Laomms" )test eax ,eax jz Search ; 循环，直到找到正确的窗口名字 invoke WriteProcessMemory .if eax ==FALSE invoke MessageBox "文件不匹配！" ),CTXT("错误" ),MB_OK .endif invoke ExitProcess End start
[注意]APP应用上架合规检测服务，协助应用顺利上架！
上传的附件：
