这是一个带有时间限制的软件，软件使用日期为2008年5月27日14：37：51至2008年9月1日14：37：51，搞了好长时间都没有搞明白，更谈不上如何改了。下面是几段用OD读出来的东东，请各位帮忙指点迷津！
在API断点设置中，将时间项目全部选择上。然后是F9和SHIFT+F9若干遍，得到以下内容：
这个是断点，7C8017E5 > 8BFF MOV EDI,EDI
7C8017E7 55 PUSH EBP
7C8017E8 8BEC MOV EBP,ESP
7C8017EA A1 1800FE7F MOV EAX,DWORD PTR DS:[7FFE0018]
7C8017EF 8B15 1400FE7F MOV EDX,DWORD PTR DS:[7FFE0014]
7C8017F5 3B05 1C00FE7F CMP EAX,DWORD PTR DS:[7FFE001C]
7C8017FB ^ 75 ED JNZ SHORT KERNEL32.7C8017EA
7C8017FD 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
7C801800 8911 MOV DWORD PTR DS:[ECX],EDX
7C801802 8941 04 MOV DWORD PTR DS:[ECX+4],EAX
7C801805 5D POP EBP
7C801806 C2 0400 RETN 4
7C801809 90 NOP
7C80180A 90 NOP
7C80180B 90 NOP
7C80180C 90 NOP
7C80180D 90 NOP
7C80180E > 6A 20 PUSH 20
7C801810 68 A89B807C PUSH KERNEL32.7C809BA8
7C801815 E8 AC0C0000 CALL KERNEL32.7C8024C6
7C80181A 33DB XOR EBX,EBX
7C80181C 8B4D 14 MOV ECX,DWORD PTR SS:[EBP+14]
7C80181F 3BCB CMP ECX,EBX
7C801821 74 02 JE SHORT KERNEL32.7C801825
7C801823 8919 MOV DWORD PTR DS:[ECX],EBX
7C801825 64:A1 18000000 MOV EAX,DWORD PTR FS:[18]
7C80182B 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30]
7C80182E 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
7C801831 83FF F4 CMP EDI,-0C
7C801834 0F84 A8010000 JE KERNEL32.7C8019E2
7C80183A 83FF F5 CMP EDI,-0B
7C80183D 0F84 94010000 JE KERNEL32.7C8019D7
7C801843 83FF F6 CMP EDI,-0A
7C801846 74 53 JE SHORT KERNEL32.7C80189B
7C801848 8BC7 MOV EAX,EDI
7C80184A 25 03000010 AND EAX,10000003
7C80184F 83F8 03 CMP EAX,3
7C801852 74 4F JE SHORT KERNEL32.7C8018A3
7C801854 8B75 18 MOV ESI,DWORD PTR SS:[EBP+18]
7C801857 3BF3 CMP ESI,EBX
7C801859 0F85 FF000000 JNZ KERNEL32.7C80195E
7C80185F 53 PUSH EBX
7C801860 53 PUSH EBX
7C801861 FF75 10 PUSH DWORD PTR SS:[EBP+10]
7C801864 FF75 0C PUSH DWORD PTR SS:[EBP+C]
7C801867 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28]
7C80186A 50 PUSH EAX
7C80186B 53 PUSH EBX
7C80186C 53 PUSH EBX
7C80186D 53 PUSH EBX
7C80186E 57 PUSH EDI
7C80186F FF15 8C11807C CALL DWORD PTR DS:[<&ntdll.NtReadFile>] ; ntdll.ZwReadFile
7C801875 3D 03010000 CMP EAX,103
7C80187A 0F84 B8000000 JE KERNEL32.7C801938
7C801880 3BC3 CMP EAX,EBX
7C801882 0F8C 65010000 JL KERNEL32.7C8019ED
7C801888 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24]
7C80188B 8B4D 14 MOV ECX,DWORD PTR SS:[EBP+14]
7C80188E 8901 MOV DWORD PTR DS:[ECX],EAX
7C801890 33C0 XOR EAX,EAX
7C801892 40 INC EAX
7C801893 E8 690C0000 CALL KERNEL32.7C802501
7C801898 C2 1400 RETN 14
7C80189B 8B40 10 MOV EAX,DWORD PTR DS:[EAX+10]
7C80189E 8B78 18 MOV EDI,DWORD PTR DS:[EAX+18]
7C8018A1 ^ EB A5 JMP SHORT KERNEL32.7C801848
7C8018A3 FF75 18 PUSH DWORD PTR SS:[EBP+18]
7C8018A6 51 PUSH ECX
7C8018A7 FF75 10 PUSH DWORD PTR SS:[EBP+10]
7C8018AA FF75 0C PUSH DWORD PTR SS:[EBP+C]
7C8018AD 57 PUSH EDI
7C8018AE E8 7A010700 CALL KERNEL32.ReadConsoleA
7C8018B3 85C0 TEST EAX,EAX
7C8018B5 0F84 5D010000 JE KERNEL32.7C801A18
7C8018BB 33F6 XOR ESI,ESI
7C8018BD 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
7C8018C0 50 PUSH EAX
7C8018C1 57 PUSH EDI
7C8018C2 E8 4D960100 CALL KERNEL32.GetConsoleMode
7C8018C7 85C0 TEST EAX,EAX
7C8018C9 75 03 JNZ SHORT KERNEL32.7C8018CE
7C8018CB 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX
7C8018CE F645 E4 01 TEST BYTE PTR SS:[EBP-1C],1
7C8018D2 74 3A JE SHORT KERNEL32.7C80190E
7C8018D4 895D FC MOV DWORD PTR SS:[EBP-4],EBX
7C8018D7 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
7C8018DA 8038 1A CMP BYTE PTR DS:[EAX],1A
7C8018DD 75 05 JNZ SHORT KERNEL32.7C8018E4
7C8018DF 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14]
7C8018E2 8918 MOV DWORD PTR DS:[EAX],EBX
7C8018E4 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
7C8018E8 EB 24 JMP SHORT KERNEL32.7C80190E
7C8018EA 90 NOP
7C8018EB 90 NOP
7C8018EC 90 NOP
7C8018ED 90 NOP
7C8018EE 90 NOP
7C8018EF 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
7C8018F2 8B00 MOV EAX,DWORD PTR DS:[EAX]
7C8018F4 8B00 MOV EAX,DWORD PTR DS:[EAX]
7C8018F6 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
7C8018F9 33C0 XOR EAX,EAX
7C8018FB 40 INC EAX
7C8018FC C3 RETN
7C8018FD 90 NOP
7C8018FE 90 NOP
7C8018FF 90 NOP
7C801900 90 NOP
7C801901 90 NOP
7C801902 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]
7C801905 8B75 E0 MOV ESI,DWORD PTR SS:[EBP-20]
7C801908 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
7C80190C 33DB XOR EBX,EBX
7C80190E 3BF3 CMP ESI,EBX
7C801910 ^ 0F8D 7AFFFFFF JGE KERNEL32.7C801890
7C801916 56 PUSH ESI
7C801917 E9 F7000000 JMP KERNEL32.7C801A13
7C80191C 90 NOP
7C80191D 90 NOP
7C80191E 90 NOP
7C80191F 90 NOP
7C801920 90 NOP
7C801921 33C0 XOR EAX,EAX
7C801923 40 INC EAX
7C801924 C3 RETN
7C801925 90 NOP
7C801926 90 NOP
7C801927 90 NOP
7C801928 90 NOP
7C801929 90 NOP
7C80192A 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]
7C80192D 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14]
7C801930 8320 00 AND DWORD PTR DS:[EAX],0
7C801933 E9 96000000 JMP KERNEL32.7C8019CE
7C801938 53 PUSH EBX
7C801939 53 PUSH EBX
7C80193A 57 PUSH EDI
7C80193B FF15 2812807C CALL DWORD PTR DS:[<&ntdll.NtWaitForSing>; ntdll.ZwWaitForSingleObject
下面是右下角窗口的内容：
04BFFD2C 77C1AEB4 /CALL 到 GetSystemTimeAsFileTime 来自 msvcrt.77C1AEAE
04BFFD30 04BFFD34 \pFileTime = 04BFFD34
04BFFD34 001BD4E8
04BFFD38 001BD4E8
04BFFD3C /04BFFD78
04BFFD40 |756D4FE7 返回到 comsvcs.756D4FE7 来自 msvcrt.time
04BFFD44 |00000000
04BFFD48 |001B4E60
04BFFD4C |001B2824
04BFFD50 |7C802520 KERNEL32.WaitForSingleObject
04BFFD54 |00000102
04BFFD58 |04BFFD20
04BFFD5C |04BFFD84
04BFFD60 |04BFFFDC
04BFFD64 |75751756 返回到 comsvcs.75751756 来自 KERNEL32.InterlockedCompareExchange
04BFFD68 |756D4FD6 返回到 comsvcs.756D4FD6 来自 comsvcs.75691EB9
04BFFD6C |04BFFFDC 指向下一个 SEH 记录的指针
04BFFD70 |75770571 SE处理程序
04BFFD74 |FFFFFFFF
04BFFD78 ]04BFFD88
04BFFD7C |756D5E29 返回到 comsvcs.756D5E29 来自 comsvcs.756D4FCC
04BFFD80 |00000000
04BFFD84 |00000000
04BFFD88 ]04BFFFB4
04BFFD8C |756D3CD6 返回到 comsvcs.756D3CD6
04BFFD90 |001BD4EC
04BFFD94 |00000001
04BFFD98 |00000000
04BFFD9C |001B2824
04BFFDA0 |75690000 comsvcs.75690000
04BFFDA4 |00000000
04BFFDA8 |003A0043
04BFFDAC |0057005C
04BFFDB0 |004E0049 ASCII "Item"
04BFFDB4 |004F0044 DATAMANA.004F0044
[课程]Linux pwn 探索篇！
