手动修改Restorator源文件告别繁琐：

来源：互联网发布：百度seo教程编辑：程序博客网时间：2024/06/01 10:42

作者：心灵代码原创

Restorator 这个东东来编辑源程序的资源文件无比的方便，可是这东东每次启动时候总出来

我们的目的是把它干掉！

开始怀疑应该用OD设断于，操作注册表动作之后，可惜没有跟到

于是一路跟下去，发现网址后能来到这样的地方

00572C3C /$ 55 push ebp

00572CA1 |. B9 CC2E5700 mov ecx, Restorat.00572ECC ; ASCII "ShowSplash" 比较可疑

=======================================

00572C3C /$ 55            push    ebp
00572C3D |. 8BEC          mov     ebp, esp
00572C3F |. 83C4 F8       add     esp, -0x8
00572C42 |. 53            push    ebx
00572C43 |. 56            push    esi
00572C44 |. 57            push    edi
00572C45 |. 33C0          xor     eax, eax
00572C47 |. 8945 F8       mov     [local.2], eax
00572C4A |. 33C0          xor     eax, eax
00572C4C |. 55            push    ebp
00572C4D |. 68 B62E5700   push    Restorat.00572EB6
00572C52 |. 64:FF30       push    dword ptr fs:[eax]
00572C55 |. 64:8920       mov     dword ptr fs:[eax], esp
00572C58 |. A1 08995900   mov     eax, dword ptr ds:[0x599908]
00572C5D |. 8B00          mov     eax, dword ptr ds:[eax]
00572C5F |. E8 6CDFF0FF   call    Restorat.00480BD0
00572C64 |. 8D45 F8       lea     eax, [local.2]
00572C67 |. E8 8C35F1FF   call    Restorat.004861F8
00572C6C |. 8B4D F8       mov     ecx, [local.2]
00572C6F |. B2 01         mov     dl, 0x1
00572C71 |. A1 048F4200   mov     eax, dword ptr ds:[0x428F04]
00572C76 |. E8 1D76EBFF   call    Restorat.0042A298
00572C7B |. 8945 FC       mov     [local.1], eax
00572C7E |. 33C0          xor     eax, eax
00572C80 |. 55            push    ebp
00572C81 |. 68 E72C5700   push    Restorat.00572CE7
00572C86 |. 64:FF30       push    dword ptr fs:[eax]
00572C89 |. 64:8920       mov     dword ptr fs:[eax], esp
00572C8C |. 8B45 FC       mov     eax, [local.1]
00572C8F |. 8B40 08       mov     eax, dword ptr ds:[eax+0x8]
00572C92 |. C740 18 19000>mov     dword ptr ds:[eax+0x18], 0x20019
00572C99 |. 0FB605 589259>movzx   eax, byte ptr ds:[0x599258]
00572CA0 |. 50            push    eax
00572CA1 |. B9 CC2E5700   mov     ecx, Restorat.00572ECC           ; ASCII "ShowSplash"
00572CA6 |. BA E02E5700   mov     edx, Restorat.00572EE0           ; ASCII "Main"
00572CAB |. 8B45 FC       mov     eax, [local.1]
00572CAE |. 8B18          mov     ebx, dword ptr ds:[eax]
00572CB0 |. FF53 10       call    near dword ptr ds:[ebx+0x10]
00572CB3 |. A2 58925900   mov     byte ptr ds:[0x599258], al
00572CB8 |. 803D 58925900>cmp     byte ptr ds:[0x599258], 0x0
00572CBF |. 74 10         je      short Restorat.00572CD1
00572CC1 |. E8 BEFEFFFF   call    Restorat.00572B84
00572CC6 |. 84C0          test    al, al
00572CC8 |. 74 07         je      short Restorat.00572CD1
00572CCA |. C605 58925900>mov     byte ptr ds:[0x599258], 0x0
00572CD1 |> 33C0          xor     eax, eax
00572CD3 |. 5A            pop     edx
00572CD4 |. 59            pop     ecx
00572CD5 |. 59            pop     ecx
00572CD6 |. 64:8910       mov     dword ptr fs:[eax], edx
00572CD9 |. 68 EE2C5700   push    Restorat.00572CEE
00572CDE |> 8B45 FC       mov     eax, [local.1]
00572CE1 |. E8 4A11E9FF   call    Restorat.00403E30
00572CE6 \. C3            retn
00572CE7   .^ E9 1819E9FF   jmp     Restorat.00404604
00572CEC   .^ EB F0         jmp     short Restorat.00572CDE
00572CEE   . E8 2185F8FF   call    Restorat.004FB214
00572CF3   . E8 3C84F8FF   call    Restorat.004FB134
00572CF8   . 84C0          test    al, al
00572CFA   . 75 76         jnz     short Restorat.00572D72
00572CFC   . A1 84945900   mov     eax, dword ptr ds:[0x599484]
00572D01   . 8B00          mov     eax, dword ptr ds:[eax]
00572D03   . E8 AC8EF8FF   call    Restorat.004FBBB4
00572D08   . A1 84945900   mov     eax, dword ptr ds:[0x599484]
00572D0D   . 8B00          mov     eax, dword ptr ds:[eax]
00572D0F   . 8078 15 00    cmp     byte ptr ds:[eax+0x15], 0x0
00572D13   . 75 46         jnz     short Restorat.00572D5B
00572D15   . 8B0D 08995900 mov     ecx, dword ptr ds:[0x599908]     ; Restorat.0059ECE0
00572D1B   . 8B09          mov     ecx, dword ptr ds:[ecx]
00572D1D   . B2 01         mov     dl, 0x1
00572D1F   . A1 A4725400   mov     eax, dword ptr ds:[0x5472A4]
00572D24   . E8 4346F0FF   call    Restorat.0047736C
00572D29   . 8B15 10975900 mov     edx, dword ptr ds:[0x599710]     ; Restorat.0059FF14
00572D2F   . 8902          mov     dword ptr ds:[edx], eax
00572D31   . A1 10975900   mov     eax, dword ptr ds:[0x599710]
00572D36   . 8B00          mov     eax, dword ptr ds:[eax]
00572D38   . E8 1F4EFDFF   call    Restorat.00547B5C
00572D3D   . A1 84945900   mov     eax, dword ptr ds:[0x599484]
00572D42   . 8B00          mov     eax, dword ptr ds:[eax]
00572D44   . 8078 15 00    cmp     byte ptr ds:[eax+0x15], 0x0
00572D48   . 75 11         jnz     short Restorat.00572D5B
00572D4A   . A1 08995900   mov     eax, dword ptr ds:[0x599908]
00572D4F   . 8B00          mov     eax, dword ptr ds:[eax]
00572D51   . E8 EEE0F0FF   call    Restorat.00480E44
00572D56   . E9 45010000   jmp     Restorat.00572EA0
00572D5B   > 803D 58925900>cmp     byte ptr ds:[0x599258], 0x0
00572D62      74 24         je      short Restorat.00572D88          ; 这里可以跳过
00572D64   . A1 08995900   mov     eax, dword ptr ds:[0x599908]
00572D69   . 8B00          mov     eax, dword ptr ds:[eax]
00572D6B   . E8 08E1FFFF   call    Restorat.00570E78                ; 这里出现的logo

结果修改之后，果然成功了。

0 0