程序脱壳后有自校验,在如下地方修改一下即可,00459A1E 8B10 mov edx, dword ptr ds:[eax]00459A20 FF12 call dword ptr ds:[edx]00459A22 83FA 00 cmp edx, 000459A25 0F85 5D010000 jnz dumped_.00459B88 => nop掉 100459A2B 3D 00F40300 cmp eax, 3F40000459A30 0F85 52010000 jnz dumped_.00459B88 => nop掉 2...00459B82 74 06 je short dumped_.00459B8A => jmp 00459B8A 300459B84 33DB xor ebx, ebx00459B86 EB 02 jmp short dumped_.00459B8A00459B88 33DB xor ebx, ebx00459B8A 8BC6 mov eax, esi00459B8C E8 379CFAFF call dumped_.004037C800459B91 E8 F6CAFAFF call <jmp.&kernel32.GetTickCount> ; [GetTickCount00459B96 2B45 F0 sub eax, dword ptr ss:[ebp-10]00459B99 3D 18010000 cmp eax, 11800459B9E 76 05 jbe short dumped_.00459BA5 => jmp 00459BA5 400459BA0 E8 7FFAFFFF call dumped_.0045962400459BA5 84DB test bl, bl00459BA7 75 27 jnz short dumped_.00459BD0 =>jmp 00459BD0 500459BA9 8D45 D8 lea eax, dword ptr ss:[ebp-28]00459BAC 50 push eax00459BAD 6A FF push -100459BAF 8D55 D4 lea edx, dword ptr ss:[ebp-2C]00459BB2 A1 3CD24500 mov eax, dword ptr ds:[45D23C]00459BB7 E8 10C5FAFF call dumped_.004060CC00459BBC 8B4D D4 mov ecx, dword ptr ss:[ebp-2C]00459BBF B2 01 mov dl, 100459BC1 A1 B0774000 mov eax, dword ptr ds:[4077B0]00459BC6 E8 E91FFBFF call dumped_.0040BBB400459BCB E8 84A3FAFF call dumped_.00403F5400459BD0 33C0 xor eax, eax00459BD2 5A pop edx
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
