最近尝试破一个delphi的程序,无壳,用od打开后按F9后OD直接关闭,重复多次后,原delphi程序打开时也是闪一下就关闭了。不知道是怎么回事,还请各位大大指点一下。
我把OD打开后前一部分代码贴在这里
00542ADC > 55 push ebp
00542ADD 8BEC mov ebp,esp
00542ADF 83C4 F0 add esp,-10
00542AE2 B8 BC245400 mov eax,ExamClie.005424BC
00542AE7 E8 CC41ECFF call ExamClie.00406CB8
00542AEC A1 04725400 mov eax,dword ptr ds:[547204]
00542AF1 8B00 mov eax,dword ptr ds:[eax]
00542AF3 E8 B4EEF2FF call ExamClie.004719AC
00542AF8 B2 01 mov dl,1
00542AFA B0 90 mov al,90
00542AFC E8 23F9FFFF call ExamClie.00542424
00542B01 E8 76A0FAFF call ExamClie.004ECB7C
//用OD打开后不直接点F9,用单步方式执行到下面这句OD也直接关闭,不知什么原因,请各位大大帮忙解释下,这种现象又该怎么处理
00542B06 B8 D02B5400 mov eax,ExamClie.00542BD0 ; ASCII "Dede"
00542B0B E8 2CA2FAFF call ExamClie.004ECD3C
00542B10 84C0 test al,al
00542B12 75 54 jnz short ExamClie.00542B68
00542B14 B8 E02B5400 mov eax,ExamClie.00542BE0 ; ASCII "File Monitor"
00542B19 E8 1EA2FAFF call ExamClie.004ECD3C
00542B1E 84C0 test al,al
00542B20 75 46 jnz short ExamClie.00542B68
00542B22 B8 F82B5400 mov eax,ExamClie.00542BF8 ; ASCII "Registry Monitor"
00542B27 E8 10A2FAFF call ExamClie.004ECD3C
00542B2C 84C0 test al,al
00542B2E 75 38 jnz short ExamClie.00542B68
00542B30 B8 142C5400 mov eax,ExamClie.00542C14 ; ASCII "RegSpy"
00542B35 E8 02A2FAFF call ExamClie.004ECD3C
00542B3A 84C0 test al,al
00542B3C 75 2A jnz short ExamClie.00542B68
00542B3E B8 242C5400 mov eax,ExamClie.00542C24 ; ASCII "RegSnap"
00542B43 E8 F4A1FAFF call ExamClie.004ECD3C
00542B48 84C0 test al,al
00542B4A 75 1C jnz short ExamClie.00542B68
00542B4C B8 342C5400 mov eax,ExamClie.00542C34 ; ASCII "Spy"
00542B51 E8 E6A1FAFF call ExamClie.004ECD3C
00542B56 84C0 test al,al
00542B58 75 0E jnz short ExamClie.00542B68
00542B5A B8 402C5400 mov eax,ExamClie.00542C40 ; ASCII "RegShot"
00542B5F E8 D8A1FAFF call ExamClie.004ECD3C
00542B64 84C0 test al,al
00542B66 74 0C je short ExamClie.00542B74
另外如果要修改程序,比如将jz改为jnz应该怎么作,用什么工具比较好?多谢了
[课程]Android-CTF解题方法汇总!