-
-
[求助]去时间限制,问题出在哪了?
-
发表于:
2008-10-11 22:25
4977
-
脱壳
从新载入
CTRL+N,在settimer下断
F9运行。
004010C2 . 8B7424 08 mov esi, dword ptr [esp+8] ; Case 110 (WM_INITDIALOG) of switch 004010A5
004010C6 . 6A 00 push 0 ; /Timerproc = NULL
004010C8 . 68 E8030000 push 3E8 ; |Timeout = 1000. ms
004010CD . 6A 01 push 1 ; |TimerID = 1
004010CF . 56 push esi ; |hWnd
004010D0 . FF15 30204000 call dword ptr [<&USER32.SetTimer>] ; \SetTimer
004010D6 . A1 04304000 mov eax, dword ptr [403004]
用hiew打开软件。
两次回车后到代码。
F5查找.004010C6 ,回车。
?004010B5: 7445 je .0004010FC --- (3)
?004010B7: 3D10010000 cmp eax,000000110 ;' '
?004010BC: 0F8586000000 jne .000401148 --- (4)
?004010C2: 8B742408 mov esi,[esp][08]
?004010C6: 6A00 push 0
?004010C8: 68E8030000 push 0000003E8 ;' ?
?004010CD: 6A01 push 1
?004010CF: 56 push esi
?004010D0: FF1530204000 call d,[00402030] ;.0000215C --
?004010D6: A104304000 mov eax,[00403004]
?004010DB: 6A70 push 000000070 ;'p'
?004010DD: 50 push eax
在4010C6那里F3准备输入jmp 10D6 的时候为什么出来的是sharing violation
请问达人,我错在哪里了啊?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课