13146707 /EB 0C jmp short 13146715 ; 改成jmp short 13146715
1314673E /EB 04 jmp short 13146744 ; 改成 jmp short 13146744
1314734D /E9 93000000 jmp 131473E5 ; 改成jmp 131473E5
13147352 |90 nop
13147353 |90 nop
13147354 |90 nop
13147355 |90 nop
13147356 |90 nop
13147A6A 90 nop ; NOP掉
13147A6B 90 nop
13147A6C 8B8D D0FEFFFF mov ecx, dword ptr [ebp-130]
13147A72 83C1 6C add ecx, 6C
13147A75 E8 B6380000 call 1314B330
13147A7A E9 D8010000 jmp 13147C57 ; 改成jmp 13147C57
13147A7F 90 nop
13147A80 90 nop
13147A81 90 nop
13147A82 90 nop
13149DFA 90 nop ; NOP掉
13149DFB 90 nop
13149DFC 90 nop
13149DFD 90 nop
13149DFE 90 nop
13149DFF 90 nop
13149E00 83BD 38FFFFFF 0>cmp dword ptr [ebp-C8], 0F
13149E07 90 nop ; NOP掉
13149E08 90 nop
13149E09 90 nop
13149E0A 90 nop
13149E0B 90 nop
13149E0C 90 nop
13149E0D 68 48084713 push 13470848
13149E12 68 30074713 push 13470730
13149E17 E8 A61B0000 call 1314B9C2
13149E1C 83C4 04 add esp, 4
13149E1F 83E8 01 sub eax, 1
13149E22 50 push eax
13149E23 68 30074713 push 13470730
13149E28 E8 2E130000 call 1314B15B
13149E2D 83C4 0C add esp, 0C
13149E30 8B85 28FFFFFF mov eax, dword ptr [ebp-D8]
13149E36 0385 38FFFFFF add eax, dword ptr [ebp-C8]
13149E3C 8B8D E8FEFFFF mov ecx, dword ptr [ebp-118]
13149E42 2B8D 38FFFFFF sub ecx, dword ptr [ebp-C8]
13149E48 3BC1 cmp eax, ecx
13149E4A 90 nop ; NOP掉
13149E4B 90 nop
13149E4C 90 nop
13149E4D 90 nop
13149E4E 90 nop
13149E4F 90 nop
13149F6E /E9 A5000000 jmp 1314A018 ; 改成
13149F73 |90 nop
1314A043 90 nop ; NOP掉
1314A044 90 nop
1314A045 90 nop
1314A046 90 nop
1314A047 90 nop
1314A048 90 nop
1314A049 837D E0 64 cmp dword ptr [ebp-20], 64
1314A04D 90 nop ; NOP掉
1314A04E 90 nop
1314A04F 90 nop
1314A050 90 nop
1314A051 90 nop
1314A052 90 nop
1314A053 837D B0 C6 cmp dword ptr [ebp-50], -3A
1314A057 90 nop ; NOP掉
1314A058 90 nop
1314A059 817D DC 01FFFFF>cmp dword ptr [ebp-24], -0FF
1314A060 E9 F5000000 jmp 1314A15A ; 改成jmp 1314A15A
1314A065 90 nop
1314A163 90 nop ; nop掉
1314A164 90 nop ; nop掉
1314A165 90 nop ; nop掉
1314A166 90 nop ; nop掉
1314A167 90 nop ; nop掉
1314A168 90 nop ; nop掉
1314A169 83BD 48FFFFFF 5>cmp dword ptr [ebp-B8], 55
1314A170 90 nop ; nop掉
1314A171 90 nop ; nop掉
1314A172 90 nop ; nop掉
1314A173 90 nop ; nop掉
1314A174 90 nop ; nop掉
1314A175 90 nop ; nop掉
1314A176 81BD 60FFFFFF E>cmp dword ptr [ebp-A0], 0EA
1314A180 90 nop ; nop掉
1314A181 90 nop ; nop掉
1314A182 90 nop ; nop掉
1314A183 90 nop ; nop掉
1314A184 90 nop ; nop掉
1314A185 90 nop ; nop掉
1314A186 8D8D 34FFFFFF lea ecx, dword ptr [ebp-CC]
1314A18C E8 6F130000 call 1314B500
1314A191 25 FF000000 and eax, 0FF
1314A196 85C0 test eax, eax
1314A198 0F84 D7000000 je 1314A275
1314A19E 83BD 28FFFFFF 0>cmp dword ptr [ebp-D8], 0
1314A1A5 75 27 jnz short 1314A1CE
1314A1A7 C785 38FFFFFF 6>mov dword ptr [ebp-C8], 6E
1314A1B1 C785 E8FEFFFF D>mov dword ptr [ebp-118], 0DC
1314A1BB C785 14FFFFFF 4>mov dword ptr [ebp-EC], 14A
1314A1C5 C745 E0 B801000>mov dword ptr [ebp-20], 1B8
1314A1CC EB 1C jmp short 1314A1EA
1314A1CE C745 E8 9402000>mov dword ptr [ebp-18], 294
1314A1D5 C745 B0 0203000>mov dword ptr [ebp-50], 302
1314A1DC C745 DC 7003000>mov dword ptr [ebp-24], 370
1314A1E3 C745 A8 DE03000>mov dword ptr [ebp-58], 3DE
1314A1EA 817D 90 E803000>cmp dword ptr [ebp-70], 3E8
1314A1F1 75 45 jnz short 1314A238
1314A1F3 C785 38FFFFFF D>mov dword ptr [ebp-C8], 0DC
1314A1FD C785 E8FEFFFF 4>mov dword ptr [ebp-118], 14A
1314A207 C785 14FFFFFF B>mov dword ptr [ebp-EC], 1B8
1314A211 C745 E0 2602000>mov dword ptr [ebp-20], 226
1314A218 C785 48FFFFFF 9>mov dword ptr [ebp-B8], 294
1314A222 C785 60FFFFFF 0>mov dword ptr [ebp-A0], 302
1314A22C C785 2CFFFFFF 7>mov dword ptr [ebp-D4], 370
1314A236 EB 3D jmp short 1314A275
1314A238 C785 3CFFFFFF A>mov dword ptr [ebp-C4], 5A0
1314A242 C785 ECFEFFFF 0>mov dword ptr [ebp-114], 60E
1314A24C C785 18FFFFFF 7>mov dword ptr [ebp-E8], 67C
1314A256 C745 E4 EA06000>mov dword ptr [ebp-1C], 6EA
1314A25D C745 EC 5807000>mov dword ptr [ebp-14], 758
1314A264 C745 B4 C607000>mov dword ptr [ebp-4C], 7C6
1314A26B C785 40FFFFFF D>mov dword ptr [ebp-C0], 7D0
1314A275 8B95 2CFFFFFF mov edx, dword ptr [ebp-D4]
1314A27B 0395 3CFFFFFF add edx, dword ptr [ebp-C4]
1314A281 81FA 8D0C0000 cmp edx, 0C8D
1314A287 90 nop ; nop掉
1314A288 90 nop ; nop掉
1314A289 90 nop ; nop掉
1314A28A 90 nop ; nop掉
1314A28B 90 nop ; nop掉
1314A28C 90 nop ; nop掉
1314A28D 81BD ECFEFFFF B>cmp dword ptr [ebp-114], 1EB4
1314A297 90 nop ; nop掉
1314A298 90 nop ; nop掉
1314A299 90 nop ; nop掉
1314A29A 90 nop ; nop掉
1314A29B 90 nop ; nop掉
1314A29C 90 nop ; nop掉
1314A29D 8D8D D4FEFFFF lea ecx, dword ptr [ebp-12C]
1314A2A3 E8 24160000 call 1314B8CC
1314A2A8 C645 FC 02 mov byte ptr [ebp-4], 2
1314A2AC 8B85 28FFFFFF mov eax, dword ptr [ebp-D8]
1314A2B2 0385 38FFFFFF add eax, dword ptr [ebp-C8]
1314A2B8 0385 E8FEFFFF add eax, dword ptr [ebp-118]
1314A2BE 0385 14FFFFFF add eax, dword ptr [ebp-EC]
1314A2C4 0345 B0 add eax, dword ptr [ebp-50]
1314A2C7 8B4D A8 mov ecx, dword ptr [ebp-58]
1314A2CA 68 AE080000 push 8AE ; 改成push 8AE
1314A2CF 58 pop eax ; 改成pop eax
1314A2D0 90 nop ; nop掉
1314A2D1 90 nop ; nop掉
1314A2D2 90 nop ; nop掉
1314A2D3 90 nop ; nop掉
用户名：1
注册码：1
[课程]Android-CTF解题方法汇总！
