[Asm] 纯文本查看 复制代码 744573EE | 68 3C066074 | push x32gui.7460063C | 7460063C:"SystemBreakpoint"===>用这个字符串定位
100FA8AF E8 B8E21200 call <JMP.&memset>
100FA8B4 8B2D 9C432710 mov ebp,dword ptr ds:[<&BridgeSettingGetUint
100FA8BA 8D7E 21 lea edi,dword ptr ds:[esi+21]
100FA8BD 83C4 0C add esp,C
100FA8C0 C603 00 mov byte ptr ds:[ebx],0 ================>01====>00
100FA8C3 C607 00 mov byte ptr ds:[edi],0
100FA8C6 8D46 74 lea eax,dword ptr ds:[esi+74]
100FA8C9 C646 22 01 mov byte ptr ds:[esi+22],1
100FA8CD C646 25 01 mov byte ptr ds:[esi+25],1
100FA8D1 C746 2C 01000000 mov dword ptr ds:[esi+2C],1
100FA8D8 C746 30 00000000 mov dword ptr ds:[esi+30],0
100FA8DF C646 34 01 mov byte ptr ds:[esi+34],1
100FA8E3 C646 36 00 mov byte ptr ds:[esi+36],0
100FA8E7 C646 39 01 mov byte ptr ds:[esi+39],1
100FA8EB 66:C746 3B 0000 mov word ptr ds:[esi+3B],0
100FA8F1 66:C746 3E 0100 mov word ptr ds:[esi+3E],1
100FA8F7 C746 40 50C30000 mov dword ptr ds:[esi+40],C350
100FA8FE C646 3D 00 mov byte ptr ds:[esi+3D],0
100FA902 8946 44 mov dword ptr ds:[esi+44],eax
100FA905 C746 48 00000000 mov dword ptr ds:[esi+48],0
100FA90C 66:C746 4C 0000 mov word ptr ds:[esi+4C],0
100FA912 C646 4E 00 mov byte ptr ds:[esi+4E],0
100FA916 C646 50 00 mov byte ptr ds:[esi+50],0
100FA91A 66:C746 52 0000 mov word ptr ds:[esi+52],0
100FA920 C646 54 00 mov byte ptr ds:[esi+54],0
100FA924 C746 58 FFFFFFFF mov dword ptr ds:[esi+58],FFFFFFFF
100FA92B 66:C746 61 0101 mov word ptr ds:[esi+61],101
100FA931 66:C746 66 0000 mov word ptr ds:[esi+66],0
100FA937 85DB test ebx,ebx
100FA939 74 22 je x32gui.100FA95D
100FA93B 8D4424 18 lea eax,dword ptr ss:[esp+18]
100FA93F 50 push eax
100FA940 68 FCE62810 push x32gui.1028E6FC 1028E6FC:"SystemBreakpoint"
64位的也可以用这种方法定位修改 |