程序好像有反调试。。运行od。。运行程序机制od就断在这里~然后就报错。
7C812A09 > 8BFF mov edi, edi
7C812A0B 55 push ebp
7C812A0C 8BEC mov ebp, esp
7C812A0E 83EC 50 sub esp, 50
7C812A11 8B45 08 mov eax, dword ptr [ebp+8]
7C812A14 8365 B8 00 and dword ptr [ebp-48], 0
7C812A18 8945 B0 mov dword ptr [ebp-50], eax
7C812A1B 8B45 0C mov eax, dword ptr [ebp+C]
7C812A1E 56 push esi
7C812A1F 8B75 14 mov esi, dword ptr [ebp+14]
7C812A22 83E0 01 and eax, 1
7C812A25 85F6 test esi, esi
7C812A27 8945 B4 mov dword ptr [ebp-4C], eax
7C812A2A C745 BC 092A817>mov dword ptr [ebp-44], RaiseExcepti>
7C812A31 0F84 99000000 je 7C812AD0
7C812A37 8B4D 10 mov ecx, dword ptr [ebp+10]
7C812A3A 83F9 0F cmp ecx, 0F
7C812A3D 0F87 2D1C0300 ja 7C844670
7C812A43 85C9 test ecx, ecx
7C812A45 894D C0 mov dword ptr [ebp-40], ecx
7C812A48 74 07 je short 7C812A51
7C812A4A 57 push edi
7C812A4B 8D7D C4 lea edi, dword ptr [ebp-3C]
7C812A4E F3:A5 rep movs dword ptr es:[edi], dword p>
7C812A50 5F pop edi
7C812A51 8D45 B0 lea eax, dword ptr [ebp-50]
7C812A54 50 push eax
7C812A55 FF15 0815807C call dword ptr [<&ntdll.RtlRaiseExcep>; ntdll.RtlRaiseException
7C812A5B 5E pop esi ; msvcrt.77BE14BC //断在这里
7C812A5C C9 leave
7C812A5D C2 1000 retn 10
然后弹出错误窗口。。提示什么c++ runtime library
这种反调试怎么破?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课