破解一个exe文件的cd-check,运行exe后,用bp GetDriveTypeA设断,然后查看>断点,找到后双击回到Kernel32模块的断点中,然后按F4,堆栈里会出现:
0012FB98 00408A9D /CALL 到 GetDriveTypeA
0012FB9C 0012FBF8 \RootPathName = "a:\"
点上面行,回车,会回到用户模块中,以下是代码:
00408A97 ? FF15 BCB14A00 call dword ptr[<&GetDriveTypeA>]
00408A9C ? 83F8 05 cmp eax, 5
00408A9D 75 6F jnz short 0048B11
00408AA2 . 6A 00 push 0
00408AA4 . 6A 00 push 0
00408AA6 . 6A 00 push 0
00408AA8 . 6A 00 push 0
00408AAA . 6A 00 push 0
00408AAC ? 8D55 AC lea edx, dword ptr [ebp-54]
00408AAF 6A db 6A
00408AB0 50 db 50
00408AB1 8D db 8D
00408AB2 45 db 45
00408AB3 FC db FC
00408AB4 52 db 52
00408AB5 50 db 50
00408AB6 FF15 C0B14A00 call dword ptr [<&KERNEL32.GetVolumeI>
00408ABC . 85C0 test eax, eax
00408ABE . 74 51 je short 00408B11
00408AC0 . B9 06000000 mov ecx, 6
00408AC5 . 8D7D AC lea edi, dword ptr [ebp-54]
00408AC8 BE db BE
00408AC9 50 db 50
00408ACA FA db FA
00408ACB 4A db 4A
00408ACC 00 db 00
00408ACD 33 db 33
00408ACE D2 db D2
00408ACF F3 db F3
00408AD0 A6 db A6
00408AD1 75 db 75
00408AD2 3E db 3E
00408AD3 0F db 0F
00408AD4 BE db BE
00408AD5 45 db 45
00408AD6 B2 db B2
00408AD7 83 db 83
00408AD8 E8 db E8
00408AD9 31 db 31
00408ADA A3 db A3
00408ADB 9C db 9C
00408ADC 6D db 6D
00408ADD 4B db 4B
00408ADE 00 db 00
00408ADF 78 db 78
00408AE0 26 db 26
00408AE1 83 db 83
00408AE2 F8 db F8
00408AE3 02 db 02
00408AE4 7D db 7D
00408AE5 21 db 21
00408AE6 66 db 66
00408AE7 0F db 0F
00408AE8 BE db BE
00408AE9 45 inc ebp
00408AEA FC db FC
00408AEB 66 db 66
00408AEC A3 db A3
00408AED A0 db A0
00408AEE 6D db 6D
00408AEF 4B db 4B
00408AF0 00 db 00
00408AF1 66 db 66
00408AF2 C7 db C7
00408AF3 05 db 05
00408AF4 A2 db A2
00408AF5 6D db 6D
00408AF6 4B dec ebx
00408AF7 00 db 00
00408AF8 3A db 3A
00408AF9 00 db 00
00408AFA 66 db 66
00408AFB 89 db 89
00408AFC 15 db 15
00408AFD A4 db A4
00408AFE 6D db 6D
00408AFF 4B db 4B
00408B00 00 db 00
00408B01 5F db 5F
00408B02 5E db 5E
00408B03 8B db 8B
00408B04 E5 db E5
00408B05 5D pop ebp
00408B06 C3 db C3
00408B07 C7 db C7
00408B08 . 05 9C6D4B00 add eax, 004B6D9C
00408B0D > FFFF ???
00408B0F . FFFF ???
00408B11 . 5F pop edi
00408B12 ? 5E pop esi
00408B13 ? 8BE5 mov esp, ebp
00408B15 ? 5D pop ebp
00408B16 . C3 retn
00408B17 ? 90 nop
00408B18 ? 90 nop
00408B19 ? 90 nop
00408B1A ? 90 nop
00408B1B ? 90 nop
00408B1C . 90 nop
00408B1D . 90 nop
00408B1E ? 90 nop
00408B1F . 90 nop
00408B20 ? 833D 9C6D4B00>cmp dword ptr [4B6D9C], -1
00408B27 74 db 74
00408B28 3C db 3C
00408B29 E8 db E8
00408B2A 32 db 32
00408B2B B0 db B0
00408B2C 02 db 02
00408B2D 00 db 00
00408B2E 3C db 3C
00408B2F FF db FF
00408B30 74 db 74
00408B31 2D db 2D
00408B32 84 db 84
00408B33 C0 db C0
00408B34 74 db 74
00408B35 14 db 14
00408B36 8B db 8B
00408B37 0D db 0D
00408B38 9C db 9C
00408B39 6D db 6D
00408B3A 4B db 4B
00408B3B 00 db 00
00408B3C 0F db 0F
00408B3D BE db BE
00408B3E D0 db D0
00408B3F 41 db 41
00408B40 3B db 3B
00408B41 D1 db D1
00408B42 75 db 75
00408B43 21 db 21
00408B44 B8 db B8
00408B45 01 db 01
00408B46 00 db 00
00408B47 00 db 00
00408B48 00 db 00
00408B49 C3 db C3
00408B4A 8B db 8B
00408B4B 0D db 0D
00408B4C 9C db 9C
00408B4D 6D db 6D
00408B4E 4B db 4B
00408B4F 00 db 00
00408B50 33 db 33
00408B51 C0 db C0
00408B52 3B db 3B
00408B53 C1 db C1
00408B54 74 db 74
00408B55 09 db 09
00408B56 40 db 40
00408B57 83 db 83
00408B58 F8 db F8
00408B59 02 db 02
00408B5A 7C db 7C
00408B5B F6 db F6
00408B5C 33 db 33
00408B5D C0 db C0
00408B5E C3 db C3
00408B5F B8 db B8
00408B60 01 db 01
00408B61 00 db 00
00408B62 00 db 00
00408B63 00 db 00
00408B64 C3 db C3
00408B65 33 db 33
00408B66 C0 db C0
00408B67 C3 db C3
00408B68 90 db 90
00408B69 90 db 90
00408B6A 90 db 90
00408B6B 90 db 90
00408B6C 90 db 90
00408B6D 90 db 90
00408B6E 90 db 90
00408B6F 90 db 90
00408B70 E8 db E8
00408B71 2B db 2B
00408B72 00 db 00
00408B73 00 db 00
00408B74 00 db 00
00408B75 83 db 83
00408B76 3D db 3D
00408B77 9C db 9C
00408B78 6D db 6D
00408B79 4B db 4B
00408B7A 00 db 00
00408B7B FF db FF
00408B7C 74 db 74
00408B7D 19 db 19
00408B7E A1 db A1
00408B7F 60 db 60
00408B80 B1 db B1
00408B81 4D db 4D
00408B82 00 db 00
00408B83 85 db 85
00408B84 C0 db C0
00408B85 74 db 74
00408B86 10 db 10
00408B87 6A db 6A
00408B88 00 db 00
00408B89 6A db 6A
00408B8A . 0168 11 add dword ptr [eax+11], ebp
00408B8D . 0100 add dword ptr [eax], eax
00408B8F ? 0050 FF add byte ptr [eax-1], dl
00408B92 ? 15 84B24A00 adc eax, <&USER32.PostMessageA>
00408B97 ? C3 retn
后面还很多,请牛人看一下...下一步怎么做?
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
