有一软件设置了时间限制,只能在20080128年前使用, 本人搞了好久都没有搞掂,看懂了的大侠请指点指点.
我把 ' KillTimer ' 'SetTimer ' 都NOP了还是不行,怎么办?
0043BD07 90 nop
0043BD08 /$ 55 push ebp
0043BD09 |. 8BEC mov ebp, esp
0043BD0B |. 6A 00 push 0
0043BD0D |. 53 push ebx
0043BD0E |. 56 push esi
0043BD0F |. 8BD8 mov ebx, eax
0043BD11 |. 33C0 xor eax, eax
0043BD13 |. 55 push ebp
0043BD14 |. 68 87BD4300 push 0043BD87
0043BD19 |. 64:FF30 push dword ptr fs:[eax]
0043BD1C |. 64:8920 mov dword ptr fs:[eax], esp
0043BD1F |. 6A 01 push 1 ; /TimerID = 1
0043BD21 |. 8B43 34 mov eax, dword ptr [ebx+34] ; |
0043BD24 |. 50 push eax ; |hWnd
0043BD25 |. E8 2ABDFCFF call <jmp.&user32.KillTimer> ; \KillTimer
0043BD2A |. 8B73 30 mov esi, dword ptr [ebx+30]
0043BD2D |. 85F6 test esi, esi
0043BD2F |. 74 40 je short 0043BD71
0043BD31 |. 807B 40 00 cmp byte ptr [ebx+40], 0
0043BD35 |. 74 3A je short 0043BD71
0043BD37 |. 66:837B 3A 00 cmp word ptr [ebx+3A], 0
0043BD3C |. 74 33 je short 0043BD71
0043BD3E |. 6A 00 push 0 ; /Timerproc = NULL
0043BD40 |. 56 push esi ; |Timeout
0043BD41 |. 6A 01 push 1 ; |TimerID = 1
0043BD43 |. 8B43 34 mov eax, dword ptr [ebx+34] ; |
0043BD46 |. 50 push eax ; |hWnd
0043BD47 |. E8 68BEFCFF call <jmp.&user32.SetTimer> ; \SetTimer
0043BD4C |. 85C0 test eax, eax
0043BD4E |. 75 21 jnz short 0043BD71
0043BD50 |. 8D55 FC lea edx, dword ptr [ebp-4]
0043BD53 |. A1 A4D85100 mov eax, dword ptr [51D8A4]
0043BD58 |. E8 2BAFFCFF call 00406C88
0043BD5D |. 8B4D FC mov ecx, dword ptr [ebp-4]
0043BD60 |. B2 01 mov dl, 1
0043BD62 |. A1 98B44100 mov eax, dword ptr [41B498]
0043BD67 |. E8 7415FDFF call 0040D2E0
0043BD6C |. E8 0B85FCFF call 0040427C
0043BD71 |> 33C0 xor eax, eax
0043BD73 |. 5A pop edx
0043BD74 |. 59 pop ecx
0043BD75 |. 59 pop ecx
0043BD76 |. 64:8910 mov dword ptr fs:[eax], edx
0043BD79 |. 68 8EBD4300 push 0043BD8E
0043BD7E |> 8D45 FC lea eax, dword ptr [ebp-4]
0043BD81 |. E8 5A8BFCFF call 004048E0
0043BD86 \. C3 retn
0043BD87 .^ E9 F483FCFF jmp 00404180
0043BD8C .^ EB F0 jmp short 0043BD7E
0048A460 /$ 53 push ebx
0048A461 |. 56 push esi
0048A462 |. 57 push edi
0048A463 |. 8BD9 mov ebx, ecx
0048A465 |. 8BF2 mov esi, edx
0048A467 |. 8BF8 mov edi, eax
0048A469 |. 8BC7 mov eax, edi
0048A46B |. E8 34000000 call 0048A4A4
0048A470 |. 68 D8804800 push 004880D8 ; /Timerproc = BoYing7.004880D8
0048A475 |. 56 push esi ; |Timeout
0048A476 |. 6A 00 push 0 ; |TimerID = 0
0048A478 |. 6A 00 push 0 ; |hWnd = NULL
0048A47A |. E8 35D7F7FF call <jmp.&user32.SetTimer> ; \SetTimer
0048A47F |. 66:8987 8A000>mov word ptr [edi+8A], ax
0048A486 |. 889F 89000000 mov byte ptr [edi+89], bl
0048A48C |. 66:83BF 8A000>cmp word ptr [edi+8A], 0
0048A494 |. 75 07 jnz short 0048A49D
0048A496 |. 8BC7 mov eax, edi
0048A498 |. E8 BB010000 call 0048A658
0048A49D |> 5F pop edi
0048A49E |. 5E pop esi
0048A49F |. 5B pop ebx
0048A4A0 \. C3 retn
0048A4A1 8D40 00 lea eax, dword ptr [eax]
0048A4A4 /$ 53 push ebx
0048A4A5 |. 8BD8 mov ebx, eax
0048A4A7 |. 66:8B83 8A000>mov ax, word ptr [ebx+8A]
0048A4AE |. 66:85C0 test ax, ax
0048A4B1 |. 74 14 je short 0048A4C7
0048A4B3 |. 0FB7C0 movzx eax, ax
0048A4B6 |. 50 push eax ; /TimerID
0048A4B7 |. 6A 00 push 0 ; |hWnd = NULL
0048A4B9 |. E8 96D5F7FF call <jmp.&user32.KillTimer> ; \KillTimer
0048A4BE |. 66:C783 8A000>mov word ptr [ebx+8A], 0
0048A4C7 |> 5B pop ebx
0048A4C8 \. C3 retn
0043BD1F |. 6A 01 push 1 ; /TimerID = 1
0043BD21 |. 8B43 34 mov eax, dword ptr [ebx+34] ; |
0043BD24 |. 50 push eax ; |hWnd
0043BD25 |. E8 2ABDFCFF call <jmp.&user32.KillTimer> ; \KillTimer
0043BD2A |. 8B73 30 mov esi, dword ptr [ebx+30]
0043BD2D |. 85F6 test esi, esi
0043BD2F |. 74 40 je short 0043BD71
0043BD31 |. 807B 40 00 cmp byte ptr [ebx+40], 0
0043BD35 |. 74 3A je short 0043BD71
0043BD37 |. 66:837B 3A 00 cmp word ptr [ebx+3A], 0
0043BD3C |. 74 33 je short 0043BD71
0043BD3E |. 6A 00 push 0 ; /Timerproc = NULL
0043BD40 |. 56 push esi ; |Timeout
0043BD41 |. 6A 01 push 1 ; |TimerID = 1
0043BD43 |. 8B43 34 mov eax, dword ptr [ebx+34] ; |
0043BD46 |. 50 push eax ; |hWnd
0043BD47 |. E8 68BEFCFF call <jmp.&user32.SetTimer> ; \SetTimer
0048A467 |. 8BF8 mov edi, eax
0048A469 |. 8BC7 mov eax, edi
0048A46B |. E8 34000000 call 0048A4A4
0048A470 |. 68 D8804800 push 004880D8 ; /Timerproc = BoYing7.004880D8
0048A475 |. 56 push esi ; |Timeout
0048A476 |. 6A 00 push 0 ; |TimerID = 0
0048A478 |. 6A 00 push 0 ; |hWnd = NULL
0048A47A |. E8 35D7F7FF call <jmp.&user32.SetTimer> ; \SetTimer
0048A47F |. 66:8987 8A000>mov word ptr [edi+8A], ax
0048A486 |. 889F 89000000 mov byte ptr [edi+89], bl
0048A48C |. 66:83BF 8A000>cmp word ptr [edi+8A], 0
0048A494 |. 75 07 jnz short 0048A49D
0048A496 |. 8BC7 mov eax, edi
0048A498 |. E8 BB010000 call 0048A658
0048A49D |> 5F pop edi
0048A49E |. 5E pop esi
0048A49F |. 5B pop ebx
0048A4A0 \. C3 retn
0048A4A1 8D40 00 lea eax, dword ptr [eax]
0048A4A4 /$ 53 push ebx
0048A4A5 |. 8BD8 mov ebx, eax
0048A4A7 |. 66:8B83 8A000>mov ax, word ptr [ebx+8A]
0048A4AE |. 66:85C0 test ax, ax
0048A4B1 |. 74 14 je short 0048A4C7
0048A4B3 |. 0FB7C0 movzx eax, ax
0048A4B6 |. 50 push eax ; /TimerID
0048A4B7 |. 6A 00 push 0 ; |hWnd = NULL
0048A4B9 |. E8 96D5F7FF call <jmp.&user32.KillTimer> ; \KillTimer
0048A4BE |. 66:C783 8A000>mov word ptr [ebx+8A], 0
0048A4C7 |> 5B pop ebx
0048A4C8 \. C3 retn
应该怎样进行反编译,本人是菜鸟.
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
