用DEDE反编译delphi程序后，得到如下代码，想请高手指点一下，如何屏蔽对光盘的检测。 谢谢大家！
begin
{
004E92CC 55 push ebp
004E92CD 8BEC mov ebp, esp
004E92CF 83C4F0 add esp, -$10
004E92D2 33C0 xor eax, eax
004E92D4 8945F0 mov [ebp-$10], eax
004E92D7 B8348E4E00 mov eax, $004E8E34
* Reference to: sysinit.@InitExe;
|
004E92DC E86BE9F1FF call 00407C4C
004E92E1 33C0 xor eax, eax
004E92E3 55 push ebp
004E92E4 6850944E00 push $004E9450
***** TRY
|
004E92E9 64FF30 push dword ptr fs:[eax]
004E92EC 648920 mov fs:[eax], esp
* Reference to TApplication instance
|
004E92EF A170C74E00 mov eax, dword ptr [$004EC770]
004E92F4 8B00 mov eax, [eax]
* Reference to: forms.TApplication.Initialize(TApplication);
|
004E92F6 E8BD73F6FF call 004506B8
* Reference to TApplication instance
|
004E92FB A170C74E00 mov eax, dword ptr [$004EC770]
004E9300 8B00 mov eax, [eax]
* Possible String Reference to: 'Emulator'
|
004E9302 BA64944E00 mov edx, $004E9464
* Reference to: forms.TApplication.SetTitle(TApplication;AnsiString);
|
004E9307 E8B06FF6FF call 004502BC
004E930C 8D55F0 lea edx, [ebp-$10]
004E930F B801000000 mov eax, $00000001
* Reference to: system.ParamStr(Integer):String;
|
004E9314 E88F97F1FF call 00402AA8
004E9319 8B45F0 mov eax, [ebp-$10]
* Possible String Reference to: 'Restart'
|
004E931C BA78944E00 mov edx, $004E9478
* Reference to: system.@LStrCmp;
|
004E9321 E83AAFF1FF call 00404260
004E9326 742A jz 004E9352
* Reference to: MiracleSubjectInfo.Proc_0048FEC8
|
004E9328 E89B6BFAFF call 0048FEC8
004E932D 84C0 test al, al
004E932F 7421 jz 004E9352
004E9331 6A30 push $30
* Possible String Reference to: '注意'
|
004E9333 6880944E00 push $004E9480
* Possible String Reference to: '不能同时启动多个考试器！'
|
004E9338 6888944E00 push $004E9488
* Reference to TApplication instance
|
004E933D A170C74E00 mov eax, dword ptr [$004EC770]
004E9342 8B00 mov eax, [eax]
* Reference to field TApplication.Handle : HWnd
|
004E9344 8B4024 mov eax, [eax+$24]
004E9347 50 push eax
* Reference to: user32.MessageBoxA()
|
004E9348 E8C3F2F1FF call 00408610
004E934D E9D7000000 jmp 004E9429
* Reference to: Unit_004E4DC0.Proc_004E681C
|
004E9352 E8C5D4FFFF call 004E681C
* Reference to pointer to GlobalVar_004ED918
|
004E9357 A1F4C74E00 mov eax, dword ptr [$004EC7F4]
004E935C 8A00 mov al, byte ptr [eax]
004E935E 2C01 sub al, $01
004E9360 7213 jb 004E9375
004E9362 743F jz 004E93A3
004E9364 FEC8 dec al
004E9366 7451 jz 004E93B9
004E9368 FEC8 dec al
004E936A 0F8494000000 jz 004E9404
004E9370 E9B4000000 jmp 004E9429
* Reference to: Unit_004E4DC0.Proc_004E5F40
|
004E9375 E8C6CBFFFF call 004E5F40
004E937A 84C0 test al, al
004E937C 0F84A7000000 jz 004E9429
* Reference to: uLogon.Proc_004E2968
|
004E9382 E8E195FFFF call 004E2968
004E9387 84C0 test al, al
004E9389 0F849A000000 jz 004E9429
* Reference to: Main.Proc_004B9290
|
004E938F E8FCFEFCFF call 004B9290
* Reference to : TFrmEnd._PROC_004E762C()
|
004E9394 E893E2FFFF call 004E762C
* Reference to : TFrmEnd._PROC_004E7618()
|
004E9399 E87AE2FFFF call 004E7618
004E939E E986000000 jmp 004E9429
* Reference to: Unit_004E4DC0.Proc_004E64D8
|
004E93A3 E830D1FFFF call 004E64D8
* Reference to TStringList instance
|
004E93A8 A18CC64E00 mov eax, dword ptr [$004EC68C]
* Reference to: Unit_004E4DC0.Proc_004E63B0
|
004E93AD E8FECFFFFF call 004E63B0
* Reference to: Main.Proc_004B9290
|
004E93B2 E8D9FEFCFF call 004B9290
004E93B7 EB70 jmp 004E9429
* Reference to: Unit_004E4DC0.Proc_004E684C
|
004E93B9 E88ED4FFFF call 004E684C
004E93BE 84C0 test al, al
004E93C0 751E jnz 004E93E0
004E93C2 6A30 push $30
* Possible String Reference to: '注意'
|
004E93C4 6880944E00 push $004E9480
* Possible String Reference to: '请插入考试器模拟光盘！'
|
004E93C9 68A4944E00 push $004E94A4
* Reference to TApplication instance
|
004E93CE A170C74E00 mov eax, dword ptr [$004EC770]
004E93D3 8B00 mov eax, [eax]
* Reference to field TApplication.Handle : HWnd
|
004E93D5 8B4024 mov eax, [eax+$24]
004E93D8 50 push eax
* Reference to: user32.MessageBoxA()
|
004E93D9 E832F2F1FF call 00408610
004E93DE EB49 jmp 004E9429
* Reference to: Unit_004E4DC0.Proc_004E64D8
|
004E93E0 E8F3D0FFFF call 004E64D8
* Reference to: uSimLogon.Proc_004E45FC
|
004E93E5 E812B2FFFF call 004E45FC
004E93EA 84C0 test al, al
004E93EC 743B jz 004E9429
* Reference to TStringList instance
|
004E93EE A18CC64E00 mov eax, dword ptr [$004EC68C]
* Reference to: Unit_004E4DC0.Proc_004E63B0
|
004E93F3 E8B8CFFFFF call 004E63B0
* Reference to: Main.Proc_004B9290
|
004E93F8 E893FEFCFF call 004B9290
* Reference to: FormSimEnd.Proc_004E81EC
|
004E93FD E8EAEDFFFF call 004E81EC
004E9402 EB25 jmp 004E9429
* Reference to: Unit_004E4DC0.Proc_004E5F40
|
004E9404 E837CBFFFF call 004E5F40
004E9409 84C0 test al, al
004E940B 741C jz 004E9429
* Reference to: uPlaybackConfirm.Proc_004E88DC
|
004E940D E8CAF4FFFF call 004E88DC
004E9412 84C0 test al, al
004E9414 7413 jz 004E9429
* Reference to: uLogon.Proc_004E2968
|
004E9416 E84D95FFFF call 004E2968
004E941B 84C0 test al, al
004E941D 740A jz 004E9429
* Reference to: Main.Proc_004B9290
|
004E941F E86CFEFCFF call 004B9290
* Reference to : TFrmEnd._PROC_004E7618()
|
004E9424 E8EFE1FFFF call 004E7618
* Reference to: Unit_004E8D04.Proc_004E8DB0
|
004E9429 E882F9FFFF call 004E8DB0
* Reference to TApplication instance
|
004E942E A170C74E00 mov eax, dword ptr [$004EC770]
004E9433 8B00 mov eax, [eax]
* Reference to: forms.TApplication.Run(TApplication);
|
004E9435 E89672F6FF call 004506D0
004E943A 33C0 xor eax, eax
004E943C 5A pop edx
004E943D 59 pop ecx
004E943E 59 pop ecx
004E943F 648910 mov fs:[eax], edx
****** FINALLY
|
004E9442 6857944E00 push $004E9457
004E9447 8D45F0 lea eax, [ebp-$10]
* Reference to: system.@LStrClr(String;String);
|
004E944A E881AAF1FF call 00403ED0
004E944F C3 ret
* Reference to: system.@HandleFinally;
|
004E9450 E9B3A3F1FF jmp 00403808
004E9455 EBF0 jmp 004E9447
* Reference to: system.@Halt0;
|
004E9457 E8B8A8F1FF call 00403D14
004E945C FFFF DB $FF, $FF //
004E945E FFFF DB $FF, $FF //
004E9460 0800 or [eax], al
004E9462 0000 add [eax], al
}
end.
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
