1.15版本的,其他版本自己修改
助手下载地址:www.zhuxianzs.cn
第一步跳过验证服务器
1.在004CD6CC 设断,运行,向下找
004CD6CC . 55 push ebp
004CD6CD . 8BEC mov ebp, esp
004CD6CF . B9 06000000 mov ecx, 6
004CD6D4 > 6A 00 push 0
004CD6D6 . 6A 00 push 0
004CD6D8 . 49 dec ecx
004CD6D9 .^ 75 F9 jnz short 004CD6D4
004CD6DB . 51 push ecx
004CD6DC . 53 push ebx
004CD6DD . 56 push esi
004CD6DE . 57 push edi
004CD6DF . 8BD8 mov ebx, eax
004CD6E1 . 33C0 xor eax, eax
004CD6E3 . 55 push ebp
004CD6E4 . 68 08DA4C00 push 004CDA08
004CD6E9 . 64:FF30 push dword ptr fs:[eax]
004CD6EC . 64:8920 mov dword ptr fs:[eax], esp
004CD6EF . B2 01 mov dl, 1
004CD6F1 . A1 88974100 mov eax, dword ptr [419788]
004CD6F6 . E8 815DF3FF call 0040347C
004CD6FB . 8BF0 mov esi, eax
004CD6FD . 8D55 F4 lea edx, dword ptr [ebp-C]
004CD700 . 8B83 0C030000 mov eax, dword ptr [ebx+30C]
004CD706 . E8 7930F8FF call 00450784
004CD70B . 8B4D F4 mov ecx, dword ptr [ebp-C]
004CD70E . 8D45 F8 lea eax, dword ptr [ebp-8]
004CD711 . BA 20DA4C00 mov edx, 004CDA20 ; usname=
004CD716 . E8 AD6EF3FF call 004045C8
004CD71B . 8B55 F8 mov edx, dword ptr [ebp-8]
004CD71E . 8BC6 mov eax, esi
004CD720 . 8B08 mov ecx, dword ptr [eax]
004CD722 . FF51 38 call dword ptr [ecx+38]
004CD725 . 8D55 EC lea edx, dword ptr [ebp-14]
004CD728 . 8B83 14030000 mov eax, dword ptr [ebx+314]
004CD72E . E8 5130F8FF call 00450784
004CD733 . 8B4D EC mov ecx, dword ptr [ebp-14]
004CD736 . 8D45 F0 lea eax, dword ptr [ebp-10]
004CD739 . BA 30DA4C00 mov edx, 004CDA30 ; pwd=
004CD73E . E8 856EF3FF call 004045C8
004CD743 . 8B55 F0 mov edx, dword ptr [ebp-10]
004CD746 . 8BC6 mov eax, esi
004CD748 . 8B08 mov ecx, dword ptr [eax]
004CD74A . FF51 38 call dword ptr [ecx+38]
004CD74D . BA 40DA4C00 mov edx, 004CDA40 ; host=a
004CD752 . 8BC6 mov eax, esi
004CD754 . 8B08 mov ecx, dword ptr [eax]
004CD756 . FF51 38 call dword ptr [ecx+38]
004CD759 . 33C0 xor eax, eax
004CD75B . 55 push ebp
004CD75C . 68 B1D74C00 push 004CD7B1
004CD761 . 64:FF30 push dword ptr fs:[eax]
004CD764 . 64:8920 mov dword ptr fs:[eax], esp
004CD767 . 8B83 38030000 mov eax, dword ptr [ebx+338]
004CD76D . 8B10 mov edx, dword ptr [eax]
004CD76F . FF92 CC000000 call dword ptr [edx+CC]
004CD775 . 85C0 test eax, eax
004CD777 75 18 jnz short 004CD791 ; 这里改成 jmp 004CD8BA
004CD779 8D45 FC lea eax, dword ptr [ebp-4]
004CD77C . 50 push eax
004CD77D . 8B83 08030000 mov eax, dword ptr [ebx+308]
004CD783 . 8BCE mov ecx, esi
004CD785 . BA 50DA4C00 mov edx, 004CDA50 ; http://zs.adminwl.com/zx//loin.asp
004CD78A . E8 0DD5FFFF call 004CAC9C
004CD78F . EB 16 jmp short 004CD7A7
004CD791 > 8D45 FC lea eax, dword ptr [ebp-4]
004CD794 . 50 push eax
004CD795 . 8B83 08030000 mov eax, dword ptr [ebx+308]
004CD79B . 8BCE mov ecx, esi
004CD79D . BA 7CDA4C00 mov edx, 004CDA7C ; http://www.adminwl.com/zx//loin.asp
004CD7A2 . E8 F5D4FFFF call 004CAC9C
004CD7A7 > 33C0 xor eax, eax
004CD7A9 . 5A pop edx
004CD7AA . 59 pop ecx
004CD7AB . 59 pop ecx
004CD7AC . 64:8910 mov dword ptr fs:[eax], edx
004CD7AF . EB 2C jmp short 004CD7DD
004CD7B1 .^ E9 9661F3FF jmp 0040394C
004CD7B6 . 6A 00 push 0
004CD7B8 . B9 A0DA4C00 mov ecx, 004CDAA0
004CD7BD . BA A4DA4C00 mov edx, 004CDAA4 ; 无法连接认证服务器 请稍后在试
004CD7C2 . A1 2C1E4D00 mov eax, dword ptr [4D1E2C]
004CD7C7 . 8B00 mov eax, dword ptr [eax]
004CD7C9 . E8 622EFAFF call 00470630
004CD7CE . E8 E164F3FF call 00403CB4
004CD7D3 . E9 E3010000 jmp 004CD9BB
004CD7D8 . E8 D764F3FF call 00403CB4
004CD7DD > 33C0 xor eax, eax
004CD7DF . 55 push ebp
004CD7E0 . 68 4FD84C00 push 004CD84F
004CD7E5 . 64:FF30 push dword ptr fs:[eax]
004CD7E8 . 64:8920 mov dword ptr fs:[eax], esp
004CD7EB . 8B83 38030000 mov eax, dword ptr [ebx+338]
004CD7F1 . 8B10 mov edx, dword ptr [eax]
004CD7F3 . FF92 CC000000 call dword ptr [edx+CC]
004CD7F9 . 85C0 test eax, eax
004CD7FB . 75 25 jnz short 004CD822
004CD7FD . 8D45 E8 lea eax, dword ptr [ebp-18]
004CD800 . 50 push eax
004CD801 . 8B83 08030000 mov eax, dword ptr [ebx+308]
004CD807 . 8BCE mov ecx, esi
004CD809 . BA CCDA4C00 mov edx, 004CDACC ; http://zs.adminwl.com/zx//session.asp
004CD80E . E8 89D4FFFF call 004CAC9C
004CD813 . 8B55 E8 mov edx, dword ptr [ebp-18]
004CD816 . A1 141B4D00 mov eax, dword ptr [4D1B14]
004CD81B . E8 D46AF3FF call 004042F4
004CD820 . EB 23 jmp short 004CD845
004CD822 > 8D45 E4 lea eax, dword ptr [ebp-1C]
004CD825 . 50 push eax
004CD826 . 8B83 08030000 mov eax, dword ptr [ebx+308]
004CD82C . 8BCE mov ecx, esi
004CD82E . BA FCDA4C00 mov edx, 004CDAFC ; http://www.adminwl.com/zx//session.asp
004CD833 . E8 64D4FFFF call 004CAC9C
004CD838 . 8B55 E4 mov edx, dword ptr [ebp-1C]
004CD83B . A1 141B4D00 mov eax, dword ptr [4D1B14]
004CD840 . E8 AF6AF3FF call 004042F4
004CD845 > 33C0 xor eax, eax
004CD847 . 5A pop edx
004CD848 . 59 pop ecx
004CD849 . 59 pop ecx
004CD84A . 64:8910 mov dword ptr fs:[eax], edx
004CD84D . EB 2C jmp short 004CD87B
004CD84F .^ E9 F860F3FF jmp 0040394C
004CD854 . 6A 00 push 0
004CD856 . B9 A0DA4C00 mov ecx, 004CDAA0
004CD85B . BA A4DA4C00 mov edx, 004CDAA4 ; 无法连接认证服务器 请稍后在试
004CD860 . A1 2C1E4D00 mov eax, dword ptr [4D1E2C]
004CD865 . 8B00 mov eax, dword ptr [eax]
004CD867 . E8 C42DFAFF call 00470630
004CD86C . E8 4364F3FF call 00403CB4
004CD871 . E9 45010000 jmp 004CD9BB
004CD876 . E8 3964F3FF call 00403CB4
004CD87B > 8D45 E0 lea eax, dword ptr [ebp-20]
004CD87E . 50 push eax
004CD87F . B9 01000000 mov ecx, 1
004CD884 . BA 01000000 mov edx, 1
004CD889 . 8B45 FC mov eax, dword ptr [ebp-4]
004CD88C . E8 4B6FF3FF call 004047DC
004CD891 . 8B45 E0 mov eax, dword ptr [ebp-20]
004CD894 . BA 2CDB4C00 mov edx, 004CDB2C ; 1
004CD899 . E8 2A6EF3FF call 004046C8
004CD89E . 0F85 DF000000 jnz 004CD983
004CD8A4 . 8D45 DC lea eax, dword ptr [ebp-24]
004CD8A7 . 50 push eax
004CD8A8 . B9 06000000 mov ecx, 6
004CD8AD . BA 02000000 mov edx, 2
004CD8B2 . 8B45 FC mov eax, dword ptr [ebp-4]
004CD8B5 . E8 226FF3FF call 004047DC
004CD8BA 8B45 DC mov eax, dword ptr [ebp-24] ; 改成mov eax, 9999(这个值随意,别太大了,否则要出错)
004CD8BD E8 AAB5F3FF call 00408E6C
004CD8C2 . 8BF0 mov esi, eax
004CD8C4 . 81FE 30490400 cmp esi, 44930
004CD8CA . 7E 11 jle short 004CD8DD
004CD8CC . A1 2C1E4D00 mov eax, dword ptr [4D1E2C]
004CD8D1 . 8B00 mov eax, dword ptr [eax]
004CD8D3 . E8 B42CFAFF call 0047058C
004CD8D8 . E9 DE000000 jmp 004CD9BB
004CD8DD > E8 FAD1F3FF call 0040AADC
004CD8E2 . 8975 D8 mov dword ptr [ebp-28], esi
004CD8E5 . DB45 D8 fild dword ptr [ebp-28]
004CD8E8 . DB2D 30DB4C00 fld tbyte ptr [4CDB30]
004CD8EE . DEC9 fmulp st(1), st
004CD8F0 . DEC1 faddp st(1), st
004CD8F2 . A1 28204D00 mov eax, dword ptr [4D2028]
004CD8F7 . DD18 fstp qword ptr [eax]
004CD8F9 . 9B wait
004CD8FA . A1 041B4D00 mov eax, dword ptr [4D1B04]
004CD8FF . C600 01 mov byte ptr [eax], 1
004CD902 . 81FE 90010000 cmp esi, 190
004CD908 . 7D 41 jge short 004CD94B
004CD90A . 6A 00 push 0
004CD90C . 68 44DB4C00 push 004CDB44 ; 请充值 你的可用时间为
004CD911 . 8D55 D0 lea edx, dword ptr [ebp-30]
004CD914 . 8BC6 mov eax, esi
004CD916 . E8 15B4F3FF call 00408D30
004CD91B . FF75 D0 push dword ptr [ebp-30]
004CD91E . 68 64DB4C00 push 004CDB64 ; 分钟
004CD923 . 8D45 D4 lea eax, dword ptr [ebp-2C]
004CD926 . BA 03000000 mov edx, 3
004CD92B . E8 0C6DF3FF call 0040463C
004CD930 . 8B45 D4 mov eax, dword ptr [ebp-2C]
004CD933 . E8 446EF3FF call 0040477C
004CD938 . 8BD0 mov edx, eax
004CD93A . B9 A0DA4C00 mov ecx, 004CDAA0
004CD93F . A1 2C1E4D00 mov eax, dword ptr [4D1E2C]
004CD944 . 8B00 mov eax, dword ptr [eax]
004CD946 . E8 E52CFAFF call 00470630
004CD94B > 4E dec esi
004CD94C . 7D 0C jge short 004CD95A
004CD94E . A1 2C1E4D00 mov eax, dword ptr [4D1E2C]
004CD953 . 8B00 mov eax, dword ptr [eax]
004CD955 . E8 322CFAFF call 0047058C
004CD95A > 8B15 141B4D00 mov edx, dword ptr [4D1B14] ; zs.004D3D70
004CD960 . 8B12 mov edx, dword ptr [edx]
004CD962 . A1 54194D00 mov eax, dword ptr [4D1954]
004CD967 . 8B00 mov eax, dword ptr [eax]
004CD969 . 8B80 28050000 mov eax, dword ptr [eax+528]
004CD96F . 8B80 3C020000 mov eax, dword ptr [eax+23C]
004CD975 . 8B08 mov ecx, dword ptr [eax]
004CD977 . FF51 2C call dword ptr [ecx+2C]
004CD97A . 8BC3 mov eax, ebx
004CD97C . E8 3BF3F9FF call 0046CCBC
004CD981 . EB 38 jmp short 004CD9BB
004CD983 > 6A 00 push 0
004CD985 . 8D45 CC lea eax, dword ptr [ebp-34]
004CD988 . 50 push eax
004CD989 . 8B45 FC mov eax, dword ptr [ebp-4]
004CD98C . E8 EB6BF3FF call 0040457C
004CD991 . 8BC8 mov ecx, eax
004CD993 . BA 02000000 mov edx, 2
004CD998 . 8B45 FC mov eax, dword ptr [ebp-4]
004CD99B . E8 3C6EF3FF call 004047DC
004CD9A0 . 8B45 CC mov eax, dword ptr [ebp-34]
004CD9A3 . E8 D46DF3FF call 0040477C
004CD9A8 . 8BD0 mov edx, eax
004CD9AA . B9 A0DA4C00 mov ecx, 004CDAA0
004CD9AF . A1 2C1E4D00 mov eax, dword ptr [4D1E2C]
004CD9B4 . 8B00 mov eax, dword ptr [eax]
004CD9B6 . E8 752CFAFF call 00470630
004CD9BB > 33C0 xor eax, eax
004CD9BD . 5A pop edx
004CD9BE . 59 pop ecx
004CD9BF . 59 pop ecx
004CD9C0 . 64:8910 mov dword ptr fs:[eax], edx
004CD9C3 . 68 0FDA4C00 push 004CDA0F
004CD9C8 > 8D45 CC lea eax, dword ptr [ebp-34]
004CD9CB . BA 03000000 mov edx, 3
004CD9D0 . E8 EF68F3FF call 004042C4
004CD9D5 . 8D45 DC lea eax, dword ptr [ebp-24]
004CD9D8 . BA 04000000 mov edx, 4
004CD9DD . E8 E268F3FF call 004042C4
004CD9E2 . 8D45 EC lea eax, dword ptr [ebp-14]
004CD9E5 . E8 B668F3FF call 004042A0
004CD9EA . 8D45 F0 lea eax, dword ptr [ebp-10]
004CD9ED . E8 AE68F3FF call 004042A0
004CD9F2 . 8D45 F4 lea eax, dword ptr [ebp-C]
004CD9F5 . E8 A668F3FF call 004042A0
004CD9FA . 8D45 F8 lea eax, dword ptr [ebp-8]
004CD9FD . BA 02000000 mov edx, 2
004CDA02 . E8 BD68F3FF call 004042C4
004CDA07 . C3 retn
004CDA08 .^ E9 F361F3FF jmp 00403C00
004CDA0D .^ EB B9 jmp short 004CD9C8
004CDA0F . 5F pop edi
004CDA10 . 5E pop esi
004CDA11 . 5B pop ebx
004CDA12 . 8BE5 mov esp, ebp
004CDA14 . 5D pop ebp
004CDA15 . C3 retn
账号密码随意,到这里已经可以登陆外挂
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课