有一程序，不注册限制打印，OD查找字符“注册提示”，双击来到0053B6D3
0053B687 55 push ebp
0053B688 68 FFB65300 push sAf.0053B6FF
0053B68D 64:FF30 push dword ptr fs:[eax]
0053B690 64:8920 mov dword ptr fs:[eax],esp
0053B693 8D45 FC lea eax,dword ptr ss:[ebp-4]
0053B696 BA 14B75300 mov edx,sAf.0053B714 ; 由于您不是正式注册用户，故不能执行打印功能！
0053B69B E8 A892ECFF call sAf.00404948
0053B6A0 FF75 FC push dword ptr ss:[ebp-4]
0053B6A3 68 4CB75300 push sAf.0053B74C ; \n
0053B6A8 68 4CB75300 push sAf.0053B74C ; \n
0053B6AD 8D45 FC lea eax,dword ptr ss:[ebp-4]
0053B6B0 BA 03000000 mov edx,3
0053B6B5 E8 6E95ECFF call sAf.00404C28
0053B6BA 8D45 FC lea eax,dword ptr ss:[ebp-4]
0053B6BD BA 58B75300 mov edx,sAf.0053B758 ; 如果您希望成为注册用户，请参阅[软件注册].
0053B6C2 E8 A994ECFF call sAf.00404B70
0053B6C7 6A 30 push 30
0053B6C9 8B45 FC mov eax,dword ptr ss:[ebp-4]
0053B6CC E8 8F96ECFF call sAf.00404D60
0053B6D1 8BD0 mov edx,eax
0053B6D3 B9 84B75300 mov ecx,sAf.0053B784 ; 注册提示
0053B6D8 A1 606C5A00 mov eax,dword ptr ds:[5A6C60]
0053B6DD 8B00 mov eax,dword ptr ds:[eax]
0053B6DF E8 A8EFF2FF call sAf.0046A68C
0053B6E4 E8 431CEDFF call sAf.0040D32C
0053B6E9 33C0 xor eax,eax
0053B6EB 5A pop edx
0053B6EC 59 pop ecx
0053B6ED 59 pop ecx
0053B6EE 64:8910 mov dword ptr fs:[eax],edx
0053B6F1 68 06B75300 push sAf.0053B706
0053B6F6 8D45 FC lea eax,dword ptr ss:[ebp-4]
0053B6F9 E8 B291ECFF call sAf.004048B0
0053B6FE C3 retn
0053B6FF ^ E9 708AECFF jmp sAf.00404174
0053B704 ^ EB F0 jmp short sAf.0053B6F6
0053B706 59 pop ecx
0053B707 5D pop ebp
0053B708 C3 retn
F8单步到0053B6DF，注册窗口出现，F7跟进，然后到这：
0046A68C 55 push ebp
0046A68D 8BEC mov ebp,esp
0046A68F 83C4 AC add esp,-54
0046A692 53 push ebx
0046A693 56 push esi
0046A694 57 push edi
0046A695 8BF9 mov edi,ecx
0046A697 8BF2 mov esi,edx
0046A699 8945 FC mov dword ptr ss:[ebp-4],eax
0046A69C 8B5D 08 mov ebx,dword ptr ss:[ebp+8]
0046A69F E8 50D2F9FF call <jmp.&user32.GetActiveWindow>
0046A6A4 8945 F4 mov dword ptr ss:[ebp-C],eax
0046A6A7 6A 02 push 2
0046A6A9 8B45 F4 mov eax,dword ptr ss:[ebp-C]
0046A6AC 50 push eax
0046A6AD A1 646A5A00 mov eax,dword ptr ds:[5A6A64]
0046A6B2 8B00 mov eax,dword ptr ds:[eax]
0046A6B4 FFD0 call eax
0046A6B6 8945 EC mov dword ptr ss:[ebp-14],eax
0046A6B9 6A 02 push 2
0046A6BB 8B45 FC mov eax,dword ptr ss:[ebp-4]
0046A6BE 8B40 30 mov eax,dword ptr ds:[eax+30]
0046A6C1 50 push eax
0046A6C2 A1 646A5A00 mov eax,dword ptr ds:[5A6A64]
0046A6C7 8B00 mov eax,dword ptr ds:[eax]
0046A6C9 FFD0 call eax
0046A6CB 8945 E8 mov dword ptr ss:[ebp-18],eax
0046A6CE 8B45 EC mov eax,dword ptr ss:[ebp-14]
0046A6D1 3B45 E8 cmp eax,dword ptr ss:[ebp-18]
0046A6D4 74 60 je short sAf.0046A736 我机器这跳了
0046A6D6 C745 BC 2800000>mov dword ptr ss:[ebp-44],28
0046A6DD 8D45 BC lea eax,dword ptr ss:[ebp-44]
0046A6E0 50 push eax
0046A6E1 8B45 EC mov eax,dword ptr ss:[ebp-14]
0046A6E4 50 push eax
0046A6E5 A1 90685A00 mov eax,dword ptr ds:[5A6890]
0046A6EA 8B00 mov eax,dword ptr ds:[eax]
0046A6EC FFD0 call eax
0046A6EE 8D45 AC lea eax,dword ptr ss:[ebp-54]
0046A6F1 50 push eax
0046A6F2 8B45 FC mov eax,dword ptr ss:[ebp-4]
0046A6F5 8B40 30 mov eax,dword ptr ds:[eax+30]
0046A6F8 50 push eax
0046A6F9 E8 66D3F9FF call <jmp.&user32.GetWindowRect>
0046A6FE 6A 1D push 1D
0046A700 6A 00 push 0
0046A702 6A 00 push 0
0046A704 8B4D CC mov ecx,dword ptr ss:[ebp-34]
0046A707 8B55 C4 mov edx,dword ptr ss:[ebp-3C]
0046A70A 2BCA sub ecx,edx
0046A70C D1F9 sar ecx,1
0046A70E 79 03 jns short sAf.0046A713
0046A710 83D1 00 adc ecx,0
0046A713 03CA add ecx,edx
0046A715 51 push ecx
0046A716 8B55 C8 mov edx,dword ptr ss:[ebp-38]
0046A719 8B45 C0 mov eax,dword ptr ss:[ebp-40]
0046A71C 2BD0 sub edx,eax
0046A71E D1FA sar edx,1
0046A720 79 03 jns short sAf.0046A725
0046A722 83D2 00 adc edx,0
0046A725 03D0 add edx,eax
0046A727 52 push edx
0046A728 6A 00 push 0
0046A72A 8B45 FC mov eax,dword ptr ss:[ebp-4]
0046A72D 8B40 30 mov eax,dword ptr ds:[eax+30]
0046A730 50 push eax
0046A731 E8 76D5F9FF call <jmp.&user32.SetWindowPos>
0046A736 33C0 xor eax,eax
0046A738 E8 B36CFFFF call sAf.004613F0
0046A73D 8945 F0 mov dword ptr ss:[ebp-10],eax
0046A740 E8 C76BFFFF call sAf.0046130C
0046A745 8945 E4 mov dword ptr ss:[ebp-1C],eax
0046A748 8B45 FC mov eax,dword ptr ss:[ebp-4]
0046A74B E8 78EEFFFF call sAf.004695C8
0046A750 84C0 test al,al
0046A752 74 06 je short sAf.0046A75A
0046A754 81CB 00001000 or ebx,100000 这行什么意思？
0046A75A 33C9 xor ecx,ecx
0046A75C 55 push ebp
0046A75D 68 E1A74600 push sAf.0046A7E1
0046A762 64:FF31 push dword ptr fs:[ecx]
0046A765 64:8921 mov dword ptr fs:[ecx],esp
0046A768 53 push ebx
0046A769 57 push edi
0046A76A 56 push esi
0046A76B 8B45 FC mov eax,dword ptr ss:[ebp-4]
0046A76E 8B40 30 mov eax,dword ptr ds:[eax+30]
0046A771 50 push eax
0046A772 E8 DDD3F9FF call <jmp.&user32.MessageBoxA> 一路到这完蛋了
0046A777 8945 F8 mov dword ptr ss:[ebp-8],eax
0046A77A 33C0 xor eax,eax
0046A77C 5A pop edx
0046A77D 59 pop ecx
0046A77E 59 pop ecx
0046A77F 64:8910 mov dword ptr fs:[eax],edx
0046A782 68 E8A74600 push sAf.0046A7E8
0046A787 8B45 EC mov eax,dword ptr ss:[ebp-14]
0046A78A 3B45 E8 cmp eax,dword ptr ss:[ebp-18]
0046A78D 74 38 je short sAf.0046A7C7
0046A78F 6A 1D push 1D
0046A791 6A 00 push 0
0046A793 6A 00 push 0
0046A795 8B4D B8 mov ecx,dword ptr ss:[ebp-48]
0046A798 8B55 B0 mov edx,dword ptr ss:[ebp-50]
0046A79B 2BCA sub ecx,edx
0046A79D D1F9 sar ecx,1
0046A79F 79 03 jns short sAf.0046A7A4
0046A7A1 83D1 00 adc ecx,0
0046A7A4 03CA add ecx,edx
0046A7A6 51 push ecx
0046A7A7 8B55 B4 mov edx,dword ptr ss:[ebp-4C]
0046A7AA 8B45 AC mov eax,dword ptr ss:[ebp-54]
0046A7AD 2BD0 sub edx,eax
0046A7AF D1FA sar edx,1
0046A7B1 79 03 jns short sAf.0046A7B6
0046A7B3 83D2 00 adc edx,0
0046A7B6 03D0 add edx,eax
0046A7B8 52 push edx
0046A7B9 6A 00 push 0
0046A7BB 8B45 FC mov eax,dword ptr ss:[ebp-4]
0046A7BE 8B40 30 mov eax,dword ptr ds:[eax+30]
0046A7C1 50 push eax
0046A7C2 E8 E5D4F9FF call <jmp.&user32.SetWindowPos>
0046A7C7 8B45 F0 mov eax,dword ptr ss:[ebp-10]
0046A7CA E8 D56CFFFF call sAf.004614A4
0046A7CF 8B45 F4 mov eax,dword ptr ss:[ebp-C]
0046A7D2 50 push eax
0046A7D3 E8 3CD4F9FF call <jmp.&user32.SetActiveWindow>
0046A7D8 8B45 E4 mov eax,dword ptr ss:[ebp-1C]
0046A7DB E8 346BFFFF call sAf.00461314
0046A7E0 C3 retn
0046A7E1 ^ E9 8E99F9FF jmp sAf.00404174
0046A7E6 ^ EB 9F jmp short sAf.0046A787
0046A7E8 8B45 F8 mov eax,dword ptr ss:[ebp-8]
0046A7EB 5F pop edi
0046A7EC 5E pop esi
0046A7ED 5B pop ebx
0046A7EE 8BE5 mov esp,ebp
0046A7F0 5D pop ebp
0046A7F1 C2 0400 retn 4
小弟初学，请各位指教关键的跳转在那个位置，前边有几个限制输入数据的弄好了，这个有点郁闷，呵呵。先谢谢了。
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
