我没有上传附件的权限,就发个最简的说明吧,
软件下载地址:
http://dl.pconline.com.cn/html_2/1/104/id=2306&pn=0.html
下面地简易过程:
软件:ZTZ-IE网络浏览器v2.6最新版
软件没有壳,这一步不要做了。
所用工具:W32Dasm黄金中文版
UltraEdit
就改两个地方:
:004A64B8 E833FDFFFF call 004A61F0
:004A64BD 8B55F0 mov edx, dword ptr [ebp-10]
:004A64C0 58 pop eax
:004A64C1 E8DAEAF5FF call 00404FA0
:004A64C6 743A je 004A6502 // 把75改为74 也是我改过的
:004A64C8 8D55E8 lea edx, dword ptr [ebp-18]
:004A64CB 8B8600030000 mov eax, dword ptr [esi+00000300]
:004A64D1 E856F5F9FF call 00445A2C
:004A64D6 8B45E8 mov eax, dword ptr [ebp-18]
* Possible StringData Ref from Code Obj ->"张铁占"
|
:004A64D9 BA24664A00 mov edx, 004A6624
:004A64DE E8BDEAF5FF call 00404FA0
:004A64E3 7569 jne 004A654E
:004A64E5 8D55E4 lea edx, dword ptr [ebp-1C]
:004A64E8 8B860C030000 mov eax, dword ptr [esi+0000030C]
:004A64EE E8EDDCFFFF call 004A41E0
:004A64F3 8B45E4 mov eax, dword ptr [ebp-1C]
* Possible StringData Ref from Code Obj ->"xidachen"
|
:004A64F6 BA34664A00 mov edx, 004A6634
:004A64FB E8A0EAF5FF call 00404FA0
:004A6500 90 nop //把这改成9090 这是我已 改过的,
:004A6501 90 nop
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A64C6(C)
|
:004A6502 BA0B000000 mov edx, 0000000B
* Possible StringData Ref from Code Obj ->"Tyre"
|
:004A6507 B848664A00 mov eax, 004A6648
:004A650C E8A3A90000 call 004B0EB4
:004A6511 8D45FC lea eax, dword ptr [ebp-04]
* Possible StringData Ref from Code Obj ->"密码正确,注册成功!"
|
:004A6514 BA58664A00 mov edx, 004A6658
各位我没有详细的写别生气。
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课