在创建线程的地方下断,点确定后就来到以下地方:
00452C02 . 68 E45B4500 PUSH HLRCrack.00455BE4 ; /pThreadId = HLRCrack.00455BE4
00452C07 . 6A 00 PUSH 0 ; |CreationFlags = 0
00452C09 . 6A 00 PUSH 0 ; |pThreadParm = NULL
00452C0B . 68 F4264500 PUSH HLRCrack.004526F4 ; |ThreadFunction = HLRCrack.004526F4
00452C10 . 6A 00 PUSH 0 ; |StackSize = 0
00452C12 . 6A 00 PUSH 0 ; |pSecurity = NULL
00452C14 . E8 B736FBFF CALL <JMP.&kernel32.CreateThread> ; \CreateThread
看到上面的ThreadFunction没?我就到那个地址那去,004526F4 ,这个地方就是处理线程的,不知道对不对,大侠指点.
在那下断:
004526F4 /. 55 PUSH EBP
004526F5 |. 8BEC MOV EBP,ESP
004526F7 |. 33C9 XOR ECX,ECX
004526F9 |. 51 PUSH ECX
004526FA |. 51 PUSH ECX
004526FB |. 51 PUSH ECX
004526FC |. 51 PUSH ECX
004526FD |. 51 PUSH ECX
004526FE |. 51 PUSH ECX
004526FF |. 53 PUSH EBX
00452700 |. 56 PUSH ESI
00452701 |. 57 PUSH EDI
00452702 |. 33C0 XOR EAX,EAX
00452704 |. 55 PUSH EBP
00452705 |. 68 DD2A4500 PUSH HLRCrack.00452ADD
0045270A |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0045270D |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00452710 |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00452713 |. A1 E85B4500 MOV EAX,DWORD PTR DS:[455BE8]
00452718 |. E8 9FFFFFFF
CALL HLRCrack.004526BC ///////注意这
///里,好像就是楼主说的测试时间,每次到这单步就死.不过你
///直接运行到下面就没事
下面就是一些较的东东了,太多,有个选择分支,18个啊,我头都大了...
不看了...哪位强人去分析吧,我这种菜是分析不出来了...
以上不知道对不对,还请哪位大侠指点一二.