-
-
[旧帖] [求助]Flexnet 10.4 Feature 如何查询 0.00雪花
-
发表于: 2008-11-9 21:13 3553
-
请问:
小弟已经找到 lm_ckout.c 的位置在 00536347 ,但是依照 前辈的说法应该在堆栈里出现 feature 与 版本 ...但是我却找不到 请问是否能指点一下呢
.textidx:00536320 ; Attributes: bp-based frame
.textidx:00536320
.textidx:00536320 sub_536320 proc near ; CODE XREF: sub_40CC10+35p
.textidx:00536320 ; sub_44F480+47p ...
.textidx:00536320
.textidx:00536320 var_4= dword ptr -4
.textidx:00536320 arg_0= dword ptr 8
.textidx:00536320 arg_4= dword ptr 0Ch
.textidx:00536320 arg_8= dword ptr 10h
.textidx:00536320
.textidx:00536320 push ebp
.textidx:00536321 mov ebp, esp
.textidx:00536323 push ecx
.textidx:00536324 mov eax, [ebp+arg_0]
.textidx:00536327 push eax
.textidx:00536328 call sub_54D2D9
.textidx:0053632D add esp, 4
.textidx:00536330 mov ecx, [ebp+arg_0]
.textidx:00536333 mov edx, [ecx+138h]
.textidx:00536339 or dh, 40h
.textidx:0053633C mov eax, [ebp+arg_0]
.textidx:0053633F mov [eax+138h], edx
.textidx:00536345 push 4Ah
.textidx:00536347 push offset aCCygwinHomeN_4 ; "C:\\cygwin\\home\\nightly\\FNP-11.6.0.0\\tie"... >>> chkout.c
.textidx:0053634C mov ecx, [ebp+arg_0]
.textidx:0053634F push ecx
.textidx:00536350 call __initp_misc_winxfltr_3 ??
.textidx:00536355 add esp, 0Ch
.textidx:00536358 mov edx, [ebp+arg_0]
.textidx:0053635B mov eax, [edx+19Ch]
.textidx:00536361 add eax, 0CF8h
.textidx:00536366 push 0
.textidx:00536368 push eax
.textidx:00536369 call _setjmp3
.textidx:0053636E add esp, 8
.textidx:00536371 test eax, eax
.textidx:00536373 jz short loc_536380
.textidx:00536375 mov ecx, [ebp+arg_0]
.textidx:00536378 mov eax, [ecx+80h]
.textidx:0053637E jmp short loc_5363C2
小弟已经找到 lm_ckout.c 的位置在 00536347 ,但是依照 前辈的说法应该在堆栈里出现 feature 与 版本 ...但是我却找不到 请问是否能指点一下呢
.textidx:00536320 ; Attributes: bp-based frame
.textidx:00536320
.textidx:00536320 sub_536320 proc near ; CODE XREF: sub_40CC10+35p
.textidx:00536320 ; sub_44F480+47p ...
.textidx:00536320
.textidx:00536320 var_4= dword ptr -4
.textidx:00536320 arg_0= dword ptr 8
.textidx:00536320 arg_4= dword ptr 0Ch
.textidx:00536320 arg_8= dword ptr 10h
.textidx:00536320
.textidx:00536320 push ebp
.textidx:00536321 mov ebp, esp
.textidx:00536323 push ecx
.textidx:00536324 mov eax, [ebp+arg_0]
.textidx:00536327 push eax
.textidx:00536328 call sub_54D2D9
.textidx:0053632D add esp, 4
.textidx:00536330 mov ecx, [ebp+arg_0]
.textidx:00536333 mov edx, [ecx+138h]
.textidx:00536339 or dh, 40h
.textidx:0053633C mov eax, [ebp+arg_0]
.textidx:0053633F mov [eax+138h], edx
.textidx:00536345 push 4Ah
.textidx:00536347 push offset aCCygwinHomeN_4 ; "C:\\cygwin\\home\\nightly\\FNP-11.6.0.0\\tie"... >>> chkout.c
.textidx:0053634C mov ecx, [ebp+arg_0]
.textidx:0053634F push ecx
.textidx:00536350 call __initp_misc_winxfltr_3 ??
.textidx:00536355 add esp, 0Ch
.textidx:00536358 mov edx, [ebp+arg_0]
.textidx:0053635B mov eax, [edx+19Ch]
.textidx:00536361 add eax, 0CF8h
.textidx:00536366 push 0
.textidx:00536368 push eax
.textidx:00536369 call _setjmp3
.textidx:0053636E add esp, 8
.textidx:00536371 test eax, eax
.textidx:00536373 jz short loc_536380
.textidx:00536375 mov ecx, [ebp+arg_0]
.textidx:00536378 mov eax, [ecx+80h]
.textidx:0053637E jmp short loc_5363C2
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
赞赏
他的文章
看原图
赞赏
雪币:
留言: