回复 #3 babyyoonako 的帖子
不好意思,6.1没接触过。。。刚刚下了一个试着改了一下,按照毅大的代码改的,步骤一二三基本方法不变,只是地址不同。步骤四如下,红字为修改处。供参考
0047815D /$ 55 PUSH EBP
0047815E |. 8BEC MOV EBP,ESP
00478160 |. 6A 00 PUSH 0
00478162 |. 6A 00 PUSH 0
00478164 |. 50 PUSH EAX
00478165 |. 83EC 08 SUB ESP,8
00478168 |. FF75 08 PUSH DWORD PTR SS:[EBP+8]
0047816B |. 0FB648 2B MOVZX ECX,BYTE PTR DS:[EAX+2B]
0047816F |. E8 0D36FAFF CALL Ekd6_1.0041B781
00478174 |. E8 2AEBFBFF CALL Ekd6_1.00436CA3
00478179 |. 8845 FC MOV BYTE PTR SS:[EBP-4],AL
0047817C |. E8 29EBF8FF CALL Ekd6_1.00406CAA
00478181 |. 8845 F8 MOV BYTE PTR SS:[EBP-8],AL
00478184 |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; /Arg1
00478187 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] ; |
0047818A |. E8 63F1F8FF CALL Ekd6_1.004072F2 ; \Ekd6_1.004072F2
0047818F |. 0245 FC ADD AL,BYTE PTR SS:[EBP-4]
00478192 |. D0E8 SHR AL,1
00478194 |. E8 11EBF8FF CALL Ekd6_1.00406CAA
00478199 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0047819C |. BA E12D4700 MOV EDX,Ekd6_1.00472DE1 //步骤三选用地址减2
004781A1 |. 3AC1 CMP AL,CL
004781A3 |. 74 2F JE SHORT Ekd6_1.004781D4
004781A5 |. 52 PUSH EDX ; /Arg2 => 00472DE1
004781A6 |. 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4] ; |
004781A9 |. 52 PUSH EDX ; |Arg1
004781AA |. E8 3149F9FF CALL Ekd6_1.0040CAE0 ; \Ekd6_1.0040CAE0
004781AF |. 52 PUSH EDX
004781B0 |. 51 PUSH ECX
004781B1 |. 90 NOP
004781B2 |. 90 NOP
004781B3 |. 90 NOP
004781B4 |. 90 NOP
004781B5 |. 90 NOP
004781B6 |. 90 NOP
004781B7 |. 90 NOP
004781B8 |. 90 NOP
004781B9 |. 90 NOP
004781BA |. 90 NOP
004781BB |. 90 NOP
004781BC |. 90 NOP
004781BD |. 90 NOP
004781BE |. 90 NOP
004781BF |. 90 NOP
004781C0 |. 90 NOP
004781C1 |. 50 PUSH EAX ; |Format
004781C2 |. 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14] ; |
004781C5 |. 52 PUSH EDX ; |s
004781C6 |. FF15 C0624800 CALL DWORD PTR DS:[<&USER32.wsprintfA>] ; \wsprintfA
004781CC |. 83C4 10 ADD ESP,10
004781CF |. 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
004781D2 |. EB 07 JMP SHORT Ekd6_1.004781DB
004781D4 |> 8D0442 LEA EAX,DWORD PTR DS:[EDX+EAX*2]
004781D7 |. C645 FC 5B MOV BYTE PTR SS:[EBP-4],5B
004781DB |> 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
004781DF |. 74 0D JE SHORT Ekd6_1.004781EE
004781E1 |. 50 PUSH EAX ; /Text
004781E2 |. FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |ControlID
004781E5 |. FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |hWnd
004781E8 |. FF15 D8624800 CALL DWORD PTR DS:[<&USER32.SetDlgItemTe>; \SetDlgItemTextA
004781EE |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004781F1 |. 8BE5 MOV ESP,EBP
004781F3 |. 5D POP EBP
004781F4 \. C2 0C00 RETN 0C
0040CAE0 /$ 55 PUSH EBP
0040CAE1 |. 8BEC MOV EBP,ESP
0040CAE3 |. 51 PUSH ECX
0040CAE4 |. 50 PUSH EAX
0040CAE5 |. 8B55 0C MOV EDX,DWORD PTR SS:[EBP+C]
0040CAE8 |. 8D0442 LEA EAX,DWORD PTR DS:[EDX+EAX*2]
0040CAEB |. 50 PUSH EAX
0040CAEC |. 8D0C4A LEA ECX,DWORD PTR DS:[EDX+ECX*2]
0040CAEF |. 51 PUSH ECX
0040CAF0 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0040CAF3 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
0040CAF6 |. 3AC1 CMP AL,CL
0040CAF8 |. 77 0D JA SHORT Ekd6_1.0040CB07
0040CAFA |. 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
0040CAFD |. C602 2B MOV BYTE PTR DS:[EDX],2B
0040CB00 |. B8 A7035000 MOV EAX,Ekd6_1.005003A7
0040CB05 |. EB 0B JMP SHORT Ekd6_1.0040CB12
0040CB07 |> 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
0040CB0A |. C602 3B MOV BYTE PTR DS:[EDX],3B
0040CB0D |. B8 A0035000 MOV EAX,Ekd6_1.005003A0
0040CB12 |> 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
0040CB15 |. 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]
0040CB18 |. 8BE5 MOV ESP,EBP
0040CB1A |. 5D POP EBP
0040CB1B \. C2 0800 RETN 8
|