IDM退出机制研究
来源:互联网 发布:linux终端装中文输入法 编辑:程序博客网 时间:2024/04/18 14:20
改这里有效果,但还会退出
P6N3Q-2839G-P203I-P2ED8
00412407 90 nop
0041241C 90 nop
004509AC 90 nop
004509D7 90 nop
00450A2D 90 nop
004509A5 . A148116B00 mov eax,dword ptr ds:[0x6B1148]
004509A5 B801000000 mov eax,0x1
004483EE . A1 48116B00 mov eax,dword ptr ds:[0x6B1148]
===============================
00460632 /EB 1D jmp short IDMan_ex.00460651 改这里有效果,但还会退出
于是再改另外的 3处
下bp MessageBoxA
断下后,发现
堆栈 ss:[00BC92C0]=02932D20, (ASCII "Internet Download Manager has been registered with a counterfeit Serial Number or the Serial Number has been blocked. IDM is exiting...")
ecx=02932D20, (ASCII "Internet Download Manager has been registered with a counterfeit Serial Number or the Serial Number has been blocked. IDM is exiting...")
跳转来自 00444BC2, 00444BC8, 00444DB0, 00444DB9
比如看 00444BC2
往前能来到段首00444BA0 /$ 64:A1 0000000>mov eax,dword ptr fs:[0]
本地调用来自 0040142E, 004467C0, 0045965D, 0046063D
这4处call前的jXX跳过去,似乎一上午也没有出来对话框!
====================================以下搞启动的的注册给谁?
查找所有命令
mov ecx, dword ptr ds:[0x6DC980]
全下断
ctrl+F2后,断在004E1005 . 8B0D 80C96D00 mov ecx,dword ptr ds:[0x6DC980]
004509E2 > \8B15 24D16D00 mov edx,dword ptr ds:[0x6DD124]这地方 看到serial
00450A14 . 51 push ecx ; /pBufSize = 000000F8
00450A15 . 8B0D 80C96D00 mov ecx,dword ptr ds:[0x6DC980] ; |
00450A1B . 52 push edx ; |Buffer = 00BCDDF4
00450A1C . 6A 00 push 0x0 ; |pValueType = NULL
00450A1E . 6A 00 push 0x0 ; |Reserved = NULL
00450A20 . 50 push eax ; |ValueName = "Serial"
00450A21 . 51 push ecx ; |hKey = 0xF8
Patches
地址 大小 状态 旧 新 注释
0040174A 2. 已删除 je short IDMan_ex.0040177A jmp short IDMan_ex.0040177A
00401781 6. 已删除 jnz IDMan_ex.004018C6 nop
004017B0 2. 激活 je short IDMan_ex.004017BB nop
0040180C 2. 激活 jnz short IDMan_ex.0040182A nop
00401848 2. 激活 je short IDMan_ex.0040186C nop
0040186A 2. 激活 jnz short IDMan_ex.00401878 nop
0040189B 2. 已删除 je short IDMan_ex.004018BA nop
00412407 2. 已删除 jnz short IDMan_ex.0041240F nop
0041241C 2. 已删除 jnz short IDMan_ex.00412475 nop
004509A5 5. 已删除 mov eax,dword ptr ds:[0x6B1148] mov eax,0x1
004509AC 6. 激活 jnz IDMan_ex.00450ADF nop
004509D7 2. 已删除 je short IDMan_ex.004509E2 nop
00450A04 2. 激活 je short IDMan_ex.00450A33 nop
00450A2D 6. 激活 jnz IDMan_ex.00450AC4 nop
00450C6E 2. 激活 je short IDMan_ex.00450C79 nop
00450CD4 6. 激活 je IDMan_ex.00450D71 nop
0580174A 2. ??? je short 0580177A jmp short 0580177A
05801781 6. ??? jnz 058018C6 nop
058017B0 2. ??? je short 058017BB nop
0580180C 2. ??? jnz short 0580182A nop
0580186A 2. ??? jnz short 05801878 nop
0580189B 2. ??? je short 058018BA nop
05812407 2. ??? jnz short winine_1.0581240F nop
0581241C 2. ??? jnz short winine_1.05812475 nop
058509A5 5. ??? mov eax,dword ptr ds:[0x6B1148] mov eax,0x1
058509AC 6. ??? jnz winine_1.05850ADF nop
058509D7 2. ??? je short winine_1.058509E2 nop
05850A2D 6. ??? jnz winine_1.05850AC4 nop
- IDM退出机制研究
- IDM
- android退出机制方法
- IDM序列号
- IDM序列号
- IDM赵丽颖版
- IDM刘涛版
- IDM张檬版
- IDM张馨予版
- IDM唐嫣版
- IDM郑爽版
- IDM刘亦菲版
- IDM杨幂版
- IDM王鸥版
- IDM霍思燕版
- 破解IDM
- 破解IDM
- Activity退出机制探究[1]
- Android Studio 添加动态库
- TakePhoto-轻量级Android照片处理框架
- Android Eclipse安装Ant插件
- MYSQL向日期添加指定的时间间隔
- window.open代替window.showModalDialog(非标准的BOM方法)
- IDM退出机制研究
- Java创建线程的两个方法
- 【Oh-Hard】瘦人增肌是不是要先吃胖?怎么练怎么吃?
- [LeetCode][11]Container With Most Water解析 时间复杂度为O(n) -Java实现
- iMindMap是怎样在学术研究上做贡献的
- CentOS 上通过 yum 快速安装最新版 Transmission
- PCA求解思路
- eclipse, Log4j配置(真心的详细~)
- jmp指令的机器码编写