正在破一时间限制软件,运行90~120分钟后停止运行,且每次运行停止时间不一样,但不自杀介面,只在介面显示“测试版已过时”字样。
试验后无法在定时程序上做立章,否则程序将失去很多功能。我的看法是可能是相关功能也需要调用此定时程序。于是从定时程序出发,寻找与之相关的调用,找到了如下疑点:
00453270 /$ 3B50 24 CMP EDX,DWORD PTR DS:[EAX+24]
00453273 |. 74 08 JE SHORT Unpacked.0045327D
00453275 |. 8950 24 MOV DWORD PTR DS:[EAX+24],EDX
00453278 |. E8 57FFFFFF CALL Unpacked.004531D4 ////这里调用定时
0045327D \> C3 RETN
奇怪的是00453273 |. 74 08 JE SHORT Unpacked.0045327D 这个地方,除JE和JL外,修改成任何指令都会使程序在两秒左右停止运行。
这是怎么回事呢?请指教
附:定时部分,即上面的004531D4
004531D4 /$ 55 PUSH EBP
004531D5 |. 8BEC MOV EBP,ESP
004531D7 |. 6A 00 PUSH 0
004531D9 |. 53 PUSH EBX
004531DA |. 56 PUSH ESI
004531DB |. 8BD8 MOV EBX,EAX
004531DD |. 33C0 XOR EAX,EAX
004531DF |. 55 PUSH EBP
004531E0 |. 68 53324500 PUSH Unpacked.00453253
004531E5 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
004531E8 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
004531EB |. 6A 01 PUSH 1 ; /TimerID = 1
004531ED |. 8B43 28 MOV EAX,DWORD PTR DS:[EBX+28] ; |
004531F0 |. 50 PUSH EAX ; |hWnd
004531F1 |. E8 9E3EFBFF CALL <JMP.&USER32.KillTimer> ; \KillTimer
004531F6 |. 8B73 24 MOV ESI,DWORD PTR DS:[EBX+24]
004531F9 |. 85F6 TEST ESI,ESI
004531FB |. 74 40 JE SHORT Unpacked.0045323D
004531FD |. 807B 38 00 CMP BYTE PTR DS:[EBX+38],0
00453201 |. 74 3A JE SHORT Unpacked.0045323D
00453203 |. 66:837B 32 00 CMP WORD PTR DS:[EBX+32],0
00453208 |. 74 33 JE SHORT Unpacked.0045323D
0045320A |. 6A 00 PUSH 0 ; /Timerproc = NULL
0045320C |. 56 PUSH ESI ; |Timeout
0045320D |. 6A 01 PUSH 1 ; |TimerID = 1
0045320F |. 8B43 28 MOV EAX,DWORD PTR DS:[EBX+28] ; |
00453212 |. 50 PUSH EAX ; |hWnd
00453213 |. E8 D43FFBFF CALL <JMP.&USER32.SetTimer> ; \SetTimer
00453218 |. 85C0 TEST EAX,EAX
0045321A |. 75 21 JNZ SHORT Unpacked.0045323D
0045321C |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
0045321F |. A1 606D4900 MOV EAX,DWORD PTR DS:[496D60]
00453224 |. E8 0B27FBFF CALL Unpacked.00405934
00453229 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0045322C |. B2 01 MOV DL,1
0045322E |. A1 10EE4000 MOV EAX,DWORD PTR DS:[40EE10]
00453233 |. E8 9486FBFF CALL Unpacked.0040B8CC
00453238 |. E8 2704FBFF CALL Unpacked.00403664
0045323D |> 33C0 XOR EAX,EAX
0045323F |. 5A POP EDX
00453240 |. 59 POP ECX
00453241 |. 59 POP ECX
00453242 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
00453245 |. 68 5A324500 PUSH Unpacked.0045325A
0045324A |> 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0045324D |. E8 5E09FBFF CALL Unpacked.00403BB0
00453252 \. C3 RETN
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课