大家好,能不能帮我看一看这个狗如何破!!
这是我从软件拷下的代码:
0045566C j>/$ 55 push ebp
0045566D |. 8BEC mov ebp,esp
0045566F |. 6A FF push -1
00455671 |. 68 78704600 push jdpaint.00467078
00455676 |. 68 CA574500 push <jmp.&MSVCRT._except_handler3> ; SE handler installation
0045567B |. 64:A1 00000000 mov eax,dword ptr fs:[0]
00455681 |. 50 push eax
00455682 |. 64:8925 00000000 mov dword ptr fs:[0],esp
00455689 |. 83EC 68 sub esp,68
0045568C |. 53 push ebx
0045568D |. 56 push esi
0045568E |. 57 push edi
0045568F |. 8965 E8 mov dword ptr ss:[ebp-18],esp
00455692 |. 33DB xor ebx,ebx
00455694 |. 895D FC mov dword ptr ss:[ebp-4],ebx
00455697 |. 6A 02 push 2
00455699 |. FF15 A4CC4500 call dword ptr ds:[<&MSVCRT.__set_a>; msvcrt.__set_app_type
0045569F |. 59 pop ecx
004556A0 |. 830D 18E54700 FF or dword ptr ds:[47E518],FFFFFFFF
004556A7 |. 830D 1CE54700 FF or dword ptr ds:[47E51C],FFFFFFFF
004556AE |. FF15 A8CC4500 call dword ptr ds:[<&MSVCRT.__p__fm>; msvcrt.__p__fmode
004556B4 |. 8B0D 0CE54700 mov ecx,dword ptr ds:[47E50C]
004556BA |. 8908 mov dword ptr ds:[eax],ecx
004556BC |. FF15 ACCC4500 call dword ptr ds:[<&MSVCRT.__p__co>; msvcrt.__p__commode
004556C2 |. 8B0D 08E54700 mov ecx,dword ptr ds:[47E508]
004556C8 |. 8908 mov dword ptr ds:[eax],ecx
004556CA |. A1 B0CC4500 mov eax,dword ptr ds:[<&MSVCRT._adj>
004556CF |. 8B00 mov eax,dword ptr ds:[eax]
004556D1 |. A3 14E54700 mov dword ptr ds:[47E514],eax
004556D6 |. E8 28010000 call jdpaint.00455803
004556DB |. 391D 08E14700 cmp dword ptr ds:[47E108],ebx
004556E1 75 0C jnz short jdpaint.004556EF
004556E3 68 00584500 push jdpaint.00455800
004556E8 |. FF15 B4CC4500 call dword ptr ds:[<&MSVCRT.__setus>; msvcrt.__setusermatherr
004556EE |. 59 pop ecx
004556EF |> E8 FA000000 call jdpaint.004557EE
004556F4 |. 68 28904700 push jdpaint.00479028
004556F9 |. 68 24904700 push jdpaint.00479024
004556FE |. E8 E5000000 call <jmp.&MSVCRT._initterm>
00455703 |. A1 04E54700 mov eax,dword ptr ds:[47E504]
00455708 |. 8945 94 mov dword ptr ss:[ebp-6C],eax
0045570B |. 8D45 94 lea eax,dword ptr ss:[ebp-6C]
0045570E |. 50 push eax
0045570F |. FF35 00E54700 push dword ptr ds:[47E500]
00455715 |. 8D45 9C lea eax,dword ptr ss:[ebp-64]
00455718 |. 50 push eax
00455719 |. 8D45 90 lea eax,dword ptr ss:[ebp-70]
0045571C |. 50 push eax
0045571D |. 8D45 A0 lea eax,dword ptr ss:[ebp-60]
00455720 |. 50 push eax
00455721 |. FF15 BCCC4500 call dword ptr ds:[<&MSVCRT.__getma>; msvcrt.__getmainargs
00455727 |. 68 20904700 push jdpaint.00479020
0045572C |. 68 00904700 push jdpaint.00479000
00455731 |. E8 B2000000 call <jmp.&MSVCRT._initterm>
00455736 |. 83C4 24 add esp,24
00455739 |. A1 C0CC4500 mov eax,dword ptr ds:[<&MSVCRT._acm>
0045573E |. 8B30 mov esi,dword ptr ds:[eax]
00455740 |. 8975 8C mov dword ptr ss:[ebp-74],esi
00455743 |. 803E 22 cmp byte ptr ds:[esi],22
00455746 75 3A jnz short jdpaint.00455782
00455748 |> 46 /inc esi
00455749 |. 8975 8C |mov dword ptr ss:[ebp-74],esi
0045574C |. 8A06 |mov al,byte ptr ds:[esi]
0045574E |. 3AC3 |cmp al,bl
00455750 |. 74 04 |je short jdpaint.00455756
00455752 |. 3C 22 |cmp al,22
00455754 |.^ 75 F2 \jnz short jdpaint.00455748
00455756 |> 803E 22 cmp byte ptr ds:[esi],22
00455759 |. 75 04 jnz short jdpaint.0045575F
0045575B |> 46 inc esi
0045575C |. 8975 8C mov dword ptr ss:[ebp-74],esi
0045575F |> 8A06 mov al,byte ptr ds:[esi]
00455761 |. 3AC3 cmp al,bl
00455763 |. 74 04 je short jdpaint.00455769
00455765 |. 3C 20 cmp al,20
00455767 |.^ 76 F2 jbe short jdpaint.0045575B
00455769 |> 895D D0 mov dword ptr ss:[ebp-30],ebx
0045576C |. 8D45 A4 lea eax,dword ptr ss:[ebp-5C]
0045576F |. 50 push eax ; /pStartupinfo
00455770 |. FF15 28C44500 call dword ptr ds:[<&KERNEL32.GetSt>; \GetStartupInfoA
00455776 F645 D0 01 test byte ptr ss:[ebp-30],1
0045577A 74 11 je short jdpaint.0045578D
0045577C |. 0FB745 D4 movzx eax,word ptr ss:[ebp-2C]
00455780 |. EB 0E jmp short jdpaint.00455790
00455782 |> 803E 20 /cmp byte ptr ds:[esi],20
00455785 ^ 76 D8 jbe short jdpaint.0045575F
00455787 46 inc esi
00455788 8975 8C mov dword ptr ss:[ebp-74],esi
0045578B |.^ EB F5 \jmp short jdpaint.00455782
0045578D |> 6A 0A push 0A
0045578F |. 58 pop eax
00455790 |> 50 push eax
00455791 |. 56 push esi
00455792 |. 53 push ebx
00455793 |. 53 push ebx ; /pModule
00455794 |. FF15 D8C34500 call dword ptr ds:[<&KERNEL32.GetMo>; \GetModuleHandleA
0045579A 50 push eax
0045579B E8 6A000000 call jdpaint.0045580A
004557A0 8945 98 mov dword ptr ss:[ebp-68],eax
004557A3 50 push eax
004557A4 FF15 C4CC4500 call dword ptr ds:[<&MSVCRT.exit>] ; msvcrt.exit
到这里跟进去后修改几个跳在od里面显示运行,但软件的介面就是出不来,请高手看看!!谢谢!!
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课