是一个网络游戏的外挂
段下后在这里开始:
10028F99 55 push ebp ; ?
10028F9A 8BEC mov ebp,esp
10028F9C 83EC 18 sub esp,18
10028F9F 53 push ebx
10028FA0 56 push esi
10028FA1 57 push edi
10028FA2 894D E8 mov dword ptr ss:[ebp-18],ecx
10028FA5 8B45 08 mov eax,dword ptr ss:[ebp+8]
10028FA8 8B48 0C mov ecx,dword ptr ds:[eax+C]
10028FAB 51 push ecx
10028FAC 8B55 08 mov edx,dword ptr ss:[ebp+8]
10028FAF 8B42 08 mov eax,dword ptr ds:[edx+8]
10028FB2 50 push eax
10028FB3 8B4D 08 mov ecx,dword ptr ss:[ebp+8]
10028FB6 8B51 04 mov edx,dword ptr ds:[ecx+4]
10028FB9 52 push edx
10028FBA 8B45 08 mov eax,dword ptr ss:[ebp+8]
10028FBD 8B08 mov ecx,dword ptr ds:[eax]
10028FBF 51 push ecx
10028FC0 8B4D E8 mov ecx,dword ptr ss:[ebp-18]
10028FC3 E8 58EA0200 call krnln.10057A20
10028FC8 8945 FC mov dword ptr ss:[ebp-4],eax
10028FCB 837D FC 00 cmp dword ptr ss:[ebp-4],0
10028FCF 75 04 jnz short krnln.10028FD5
10028FD1 33C0 xor eax,eax
10028FD3 EB 67 jmp short krnln.1002903C
10028FD5 56 push esi
10028FD6 57 push edi
10028FD7 8B55 08 mov edx,dword ptr ss:[ebp+8]
10028FDA 8B42 0C mov eax,dword ptr ds:[edx+C]
10028FDD 83E8 01 sub eax,1
10028FE0 8945 EC mov dword ptr ss:[ebp-14],eax
10028FE3 EB 09 jmp short krnln.10028FEE
10028FE5 8B4D EC mov ecx,dword ptr ss:[ebp-14]
10028FE8 83E9 01 sub ecx,1
10028FEB 894D EC mov dword ptr ss:[ebp-14],ecx
10028FEE 837D EC 00 cmp dword ptr ss:[ebp-14],0
10028FF2 7C 12 jl short krnln.10029006
10028FF4 8B55 EC mov edx,dword ptr ss:[ebp-14]
10028FF7 8B45 08 mov eax,dword ptr ss:[ebp+8]
10028FFA 8B4C90 10 mov ecx,dword ptr ds:[eax+edx*4+10]
10028FFE 894D F0 mov dword ptr ss:[ebp-10],ecx
10029001 FF75 F0 push dword ptr ss:[ebp-10]
10029004 ^ EB DF jmp short krnln.10028FE5
10029006 FF55 FC call dword ptr ss:[ebp-4]
10029009 5F pop edi
1002900A 5E pop esi
1002900B 895D F4 mov dword ptr ss:[ebp-C],ebx
1002900E 8945 F8 mov dword ptr ss:[ebp-8],eax
10029011 8B55 E8 mov edx,dword ptr ss:[ebp-18]
10029014 C782 70020000 000000>mov dword ptr ds:[edx+270],0
1002901E 837D F4 00 cmp dword ptr ss:[ebp-C],0
10029022 74 13 je short krnln.10029037
10029024 8B45 08 mov eax,dword ptr ss:[ebp+8]
10029027 C740 24 01000000 mov dword ptr ds:[eax+24],1
1002902E 8B4D 08 mov ecx,dword ptr ss:[ebp+8]
10029031 8B55 F8 mov edx,dword ptr ss:[ebp-8]
10029034 8951 28 mov dword ptr ds:[ecx+28],edx
10029037 B8 01000000 mov eax,1
1002903C 5F pop edi
1002903D 5E pop esi
1002903E 5B pop ebx
1002903F 8BE5 mov esp,ebp
10029041 5D pop ebp
10029042 C2 0400 retn 4 //0012F1E8 10052578 返回到 krnln.10052578 来自 krnln.10028F99 返回到自己的调用
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
