今天脱了个ASP的壳。
脱完壳后用C32SM修改了一个跳转，但是运行软件，任意输入后点“注册”后电脑就自动关机了。
现在知道是这软件控制了关机，但是不知道问题出现在哪里？
::004ED007:: B9 20D24E00 MOV ECX,4ED220 \->: 错误
::004ED00C:: BA 28D24E00 MOV EDX,4ED228 \->: 请输入正确的帐号！
::004ED011:: A1 38C54F00 MOV EAX,DWORD PTR [4FC538]
::004ED016:: 8B00 MOV EAX,DWORD PTR [EAX]
::004ED018:: E8 7B72F9FF CALL 00484298 \:JMPUP
::004ED01D:: E9 84010000 JMP 004ED1A6 \:JMPDOWN
::004ED022:: 8D55 D8 LEA EDX,DWORD PTR [EBP-28] \:BYJMP JmpBy:004ECFC5,
::004ED025:: 8B86 40030000 MOV EAX,DWORD PTR [ESI+340]
::004ED02B:: E8 2872F7FF CALL 00464258 \:JMPUP
::004ED030:: 8B45 D8 MOV EAX,DWORD PTR [EBP-28]
::004ED033:: E8 3475F1FF CALL 0040456C \:JMPUP
::004ED038:: 83F8 12 CMP EAX,12
::004ED03B:: 74 5B JE SHORT 004ED098 \:JMPDOWN
::004ED03D:: B2 01 MOV DL,1
::004ED03F:: 8B86 4C030000 MOV EAX,DWORD PTR [ESI+34C]
::004ED045:: 8B08 MOV ECX,DWORD PTR [EAX]
::004ED047:: FF51 64 CALL DWORD PTR [ECX+64]
::004ED04A:: 8B86 40030000 MOV EAX,DWORD PTR [ESI+340]
::004ED050:: 8B10 MOV EDX,DWORD PTR [EAX]
::004ED052:: FF92 E0000000 CALL DWORD PTR [EDX+E0]
::004ED058:: 8BC6 MOV EAX,ESI
::004ED05A:: E8 41FBFFFF CALL 004ECBA0 \:JMPUP
::004ED05F:: 84C0 TEST AL,AL
::004ED061:: 75 18 JNZ SHORT 004ED07B \:JMPDOWN //我把74 改 75了
::004ED063:: 8BC6 MOV EAX,ESI
::004ED065:: E8 9AF2FFFF CALL 004EC304 \:JMPUP
::004ED06A:: A1 38C54F00 MOV EAX,DWORD PTR [4FC538]
::004ED06F:: 8B00 MOV EAX,DWORD PTR [EAX]
::004ED071:: E8 7E71F9FF CALL 004841F4 \:JMPUP
::004ED076:: E9 2B010000 JMP 004ED1A6 \:JMPDOWN
::004ED07B:: 6A 10 PUSH 10 \:BYJMP JmpBy:004ED061,
::004ED07D:: B9 20D24E00 MOV ECX,4ED220 \->: 错误
::004ED082:: BA 40D24E00 MOV EDX,4ED240 \->: 您输入的卡号不正确，请仔细查看后再输入
::004ED087:: A1 38C54F00 MOV EAX,DWORD PTR [4FC538]
::004ED08C:: 8B00 MOV EAX,DWORD PTR [EAX]
::004ED08E:: E8 0572F9FF CALL 00484298 \:JMPUP
::004ED093:: E9 0E010000 JMP 004ED1A6 \:JMPDOWN
::004ED098:: 8D55 D4 LEA EDX,DWORD PTR [EBP-2C] \:BYJMP JmpBy:004ED03B,
::004ED09B:: 8B86 44030000 MOV EAX,DWORD PTR [ESI+344]
::004ED0A1:: E8 B271F7FF CALL 00464258 \:JMPUP
::004ED0A6:: 8B55 D4 MOV EDX,DWORD PTR [EBP-2C]
::004ED0A9:: B8 78D24E00 MOV EAX,4ED278 \->:
::004ED0AE:: E8 FD77F1FF CALL 004048B0 \:JMPUP
::004ED0B3:: 85C0 TEST EAX,EAX
::004ED0B5:: 7E 38 JLE SHORT 004ED0EF \:JMPDOWN
::004ED0B7:: B2 01 MOV DL,1
::004ED0B9:: 8B86 4C030000 MOV EAX,DWORD PTR [ESI+34C]
::004ED0BF:: 8B08 MOV ECX,DWORD PTR [EAX]
::004ED0C1:: FF51 64 CALL DWORD PTR [ECX+64]
::004ED0C4:: 8B86 44030000 MOV EAX,DWORD PTR [ESI+344]
::004ED0CA:: 8B10 MOV EDX,DWORD PTR [EAX]
::004ED0CC:: FF92 E0000000 CALL DWORD PTR [EDX+E0]
::004ED0D2:: 6A 10 PUSH 10
::004ED0D4:: B9 20D24E00 MOV ECX,4ED220 \->: 错误
::004ED0D9:: BA 7CD24E00 MOV EDX,4ED27C \->: 请输入正确的帐号！不要输入空格.
::004ED0DE:: A1 38C54F00 MOV EAX,DWORD PTR [4FC538]
::004ED0E3:: 8B00 MOV EAX,DWORD PTR [EAX]
::004ED0E5:: E8 AE71F9FF CALL 00484298 \:JMPUP
::004ED0EA:: E9 B7000000 JMP 004ED1A6 \:JMPDOWN
::004ED0EF:: 8BC6 MOV EAX,ESI \:BYJMP JmpBy:004ED0B5,
::004ED0F1:: E8 AAFAFFFF CALL 004ECBA0 \:JMPUP
::004ED0F6:: 84C0 TEST AL,AL
::004ED0F8:: 74 18 JE SHORT 004ED112 \:JMPDOWN
::004ED0FA:: 8BC6 MOV EAX,ESI
::004ED0FC:: E8 03F2FFFF CALL 004EC304 \:JMPUP
::004ED101:: A1 38C54F00 MOV EAX,DWORD PTR [4FC538]
::004ED106:: 8B00 MOV EAX,DWORD PTR [EAX]
::004ED108:: E8 E770F9FF CALL 004841F4 \:JMPUP
::004ED10D:: E9 94000000 JMP 004ED1A6 \:JMPDOWN
::004ED112:: 6A 24 PUSH 24 \:BYJMP JmpBy:004ED0F8,
::004ED114:: 68 A8D24E00 PUSH 4ED2A8 \->: 帐号:
::004ED119:: 8D55 CC LEA EDX,DWORD PTR [EBP-34]
::004ED11C:: 8B86 44030000 MOV EAX,DWORD PTR [ESI+344]
::004ED122:: E8 3171F7FF CALL 00464258 \:JMPUP
::004ED127:: FF75 CC PUSH DWORD PTR [EBP-34]
::004ED12A:: 68 BCD24E00 PUSH 4ED2BC \->: \x0D
::004ED12F:: 68 C8D24E00 PUSH 4ED2C8 \->: 确定要充值吗？
::004ED134:: 8D45 D0 LEA EAX,DWORD PTR [EBP-30]
::004ED137:: BA 04000000 MOV EDX,4
::004ED13C:: E8 EB74F1FF CALL 0040462C \:JMPUP
::004ED141:: 8B45 D0 MOV EAX,DWORD PTR [EBP-30]
::004ED144:: E8 2376F1FF CALL 0040476C \:JMPUP
::004ED149:: 8BD0 MOV EDX,EAX
::004ED14B:: B9 E4D24E00 MOV ECX,4ED2E4 \->: 确认
::004ED150:: A1 38C54F00 MOV EAX,DWORD PTR [4FC538]
::004ED155:: 8B00 MOV EAX,DWORD PTR [EAX]
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
