夸克 浏览器 去升级（和升级相关文件夹）

冥界3大法王

win10启动之后发现任务管理器有一个进程叫updater.exe
立刻转到此文件夹，发现位于 QuarkUpdater 文件夹下
转到之后就可以结束 进程了。。。
记录下文件名、升级的这个进程名。。。并顺便把QuarkUpdater 文件夹删除掉又节约了20多M
用TC搜索该文件夹



第二次，仅在选中的之中搜索文件夹名称呢？ 还是8个
可以肯定修改目标是哪些了。
先尝试把下面的放到回收站：
x:\QuarkBrowser\Quark\6.9.1.868\Installer\quark_swap_util.exe
x:\QuarkBrowser\Quark\6.9.1.868\Installer\QuarkUpdaterSetup.exe( 节约10多M）
为什么？ 不喜欢这种与Installer相关的文件夹呗，统统扔回收站

再使用WinHEX打开另外的那些文件，搜索相关关键字，发现没有（只在 X:\QuarkBrowser\Quark\6.9.1.868\quark.dll发现目标）
现在打开x64dbg拖入quark.exe
Alt+E来到模块窗口发现quark.dll 还没加载呢
甭理会，直接F9运行。。。发现程序直接跑飞，调试进程已经结束了。
干脆直接打开该dll，定位该字符串

发现下面的 圈1 处改成JMP 保存一份补丁
圈2处回车进入，修改为mov al, 0 ;ret 保存一份补丁
或者圈3下两行JNE 。。。NOP掉 保存一份补丁   ，看哪个补丁正常使用即可。

冥界3大法王

未完继续修改
去垃圾文件夹

显然都与注册表相关
依次定位过去查看下

[Asm] 纯文本查看 复制代码

00007FF8A211EAB0 <quark | 56                              | push rsi                                                                                                                                                                                                                                                  |
00007FF8A211EAB1        | 57                              | push rdi                                                                                                                                                                                                                                                  |
00007FF8A211EAB2        | 53                              | push rbx                                                                                                                                                                                                                                                  |
00007FF8A211EAB3        | 48:83EC 40                      | sub rsp,40                                                                                                                                                                                                                                                |
00007FF8A211EAB7        | 48:89D7                         | mov rdi,rdx                                                                                                                                                                                                                                               |
00007FF8A211EABA        | 48:89CE                         | mov rsi,rcx                                                                                                                                                                                                                                               | rcx:"MZx"
00007FF8A211EABD        | 48:8B05 BC955F10                | mov rax,qword ptr ds:[7FF8B2718080]                                                                                                                                                                                                                       | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EAC4        | 48:31E0                         | xor rax,rsp                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EAC7        | 48:894424 38                    | mov qword ptr ss:[rsp+38],rax                                                                                                                                                                                                                             | [rsp+38]:L"SSPICLI.DLL", rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EACC        | B9 58000000                     | mov ecx,58                                                                                                                                                                                                                                                | 58:'X'
00007FF8A211EAD1        | E8 BAB48405                     | call <quark.sub_7FF8A7969F90>                                                                                                                                                                                                                             |
00007FF8A211EAD6        | 48:89C3                         | mov rbx,rax                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EAD9        | 48:894424 20                    | mov qword ptr ss:[rsp+20],rax                                                                                                                                                                                                                             | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EADE        | 48:C74424 28 29000000           | mov qword ptr ss:[rsp+28],29                                                                                                                                                                                                                              | 29:')'
00007FF8A211EAE7        | 48:B8 2C00000000000080          | mov rax,800000000000002C                                                                                                                                                                                                                                  | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EAF1        | 48:894424 30                    | mov qword ptr ss:[rsp+30],rax                                                                                                                                                                                                                             | [rsp+30]:LdrGetProcedureAddressEx+39C, rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EAF6        | 48:8D43 52                      | lea rax,qword ptr ds:[rbx+52]                                                                                                                                                                                                                             | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EAFA        | 48:39D8                         | cmp rax,rbx                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A211EAFD        | 0F82 AD000000                   | jb quark.7FF8A211EBB0                                                                                                                                                                                                                                     |
00007FF8A211EB03        | 48:8D0D 1A9B650F                | lea rcx,qword ptr ds:[7FF8B1778624]                                                                                                                                                                                                                       | rcx:"MZx", 00007FF8B1778624:L"Software\\QuarkUpdater\\Update\\ClientState\\"
00007FF8A211EB0A        | 48:39CB                         | cmp rbx,rcx                                                                                                                                                                                                                                               | rcx:"MZx"
00007FF8A211EB0D        | 0F97C2                          | seta dl                                                                                                                                                                                                                                                   |
00007FF8A211EB10        | 48:39C8                         | cmp rax,rcx                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720, rcx:"MZx"
00007FF8A211EB13        | 0F96C0                          | setbe al                                                                                                                                                                                                                                                  |
00007FF8A211EB16        | 08D0                            | or al,dl                                                                                                                                                                                                                                                  |
00007FF8A211EB18        | 0F84 92000000                   | je quark.7FF8A211EBB0                                                                                                                                                                                                                                     |
00007FF8A211EB1E        | 48:8D15 FF9A650F                | lea rdx,qword ptr ds:[7FF8B1778624]                                                                                                                                                                                                                       | 00007FF8B1778624:L"Software\\QuarkUpdater\\Update\\ClientState\\"



00007FF8A2496890 <quark | 56                              | push rsi                                                                                                                                                                                                                                                  |
00007FF8A2496891        | 57                              | push rdi                                                                                                                                                                                                                                                  |
00007FF8A2496892        | 53                              | push rbx                                                                                                                                                                                                                                                  |
00007FF8A2496893        | 48:83EC 40                      | sub rsp,40                                                                                                                                                                                                                                                |
00007FF8A2496897        | 48:89D7                         | mov rdi,rdx                                                                                                                                                                                                                                               |
00007FF8A249689A        | 48:89CE                         | mov rsi,rcx                                                                                                                                                                                                                                               | rcx:"MZx"
00007FF8A249689D        | 48:8B05 DC172810                | mov rax,qword ptr ds:[7FF8B2718080]                                                                                                                                                                                                                       | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968A4        | 48:31E0                         | xor rax,rsp                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968A7        | 48:894424 38                    | mov qword ptr ss:[rsp+38],rax                                                                                                                                                                                                                             | [rsp+38]:L"SSPICLI.DLL", rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968AC        | B9 50000000                     | mov ecx,50                                                                                                                                                                                                                                                | 50:'P'
00007FF8A24968B1        | E8 DA364D05                     | call <quark.sub_7FF8A7969F90>                                                                                                                                                                                                                             |
00007FF8A24968B6        | 48:89C3                         | mov rbx,rax                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968B9        | 48:894424 20                    | mov qword ptr ss:[rsp+20],rax                                                                                                                                                                                                                             | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968BE        | 48:C74424 28 25000000           | mov qword ptr ss:[rsp+28],25                                                                                                                                                                                                                              | 25:'%'
00007FF8A24968C7        | 48:B8 2800000000000080          | mov rax,8000000000000028                                                                                                                                                                                                                                  | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968D1        | 48:894424 30                    | mov qword ptr ss:[rsp+30],rax                                                                                                                                                                                                                             | [rsp+30]:LdrGetProcedureAddressEx+39C, rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968D6        | 48:8D43 4A                      | lea rax,qword ptr ds:[rbx+4A]                                                                                                                                                                                                                             | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968DA        | 48:39D8                         | cmp rax,rbx                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720
00007FF8A24968DD        | 0F82 AD000000                   | jb quark.7FF8A2496990                                                                                                                                                                                                                                     |
00007FF8A24968E3        | 48:8D0D EE1C2E0F                | lea rcx,qword ptr ds:[7FF8B17785D8]                                                                                                                                                                                                                       | rcx:"MZx", 00007FF8B17785D8:L"Software\\QuarkUpdater\\Update\\Clients\\"
00007FF8A24968EA        | 48:39CB                         | cmp rbx,rcx                                                                                                                                                                                                                                               | rcx:"MZx"
00007FF8A24968ED        | 0F97C2                          | seta dl                                                                                                                                                                                                                                                   |
00007FF8A24968F0        | 48:39C8                         | cmp rax,rcx                                                                                                                                                                                                                                               | rax:public: class v8::internal::compiler::CompilationDependency const * __cdecl v8::internal::compiler::CompilationDependencies::TransitionDependencyOffTheRecord(class v8::internal::compiler::MapRef) const+257720, rcx:"MZx"
00007FF8A24968F3        | 0F96C0                          | setbe al                                                                                                                                                                                                                                                  |
00007FF8A24968F6        | 08D0                            | or al,dl                                                                                                                                                                                                                                                  |
00007FF8A24968F8        | 0F84 92000000                   | je quark.7FF8A2496990                                                                                                                                                                                                                                     |
00007FF8A24968FE        | 48:8D15 D31C2E0F                | lea rdx,qword ptr ds:[7FF8B17785D8]                                                                                                                                                                                                                       | 00007FF8B17785D8:L"Software\\QuarkUpdater\\Update\\Clients\\"

直接段首 ret 即可 ； 上面调用4处，实则两处，顶部push rsi  都改成ret就行了。


X:\QuarkBrowser\Quark\components 这个目录有个英文叫 加速器的东西  也删除掉（游戏加速器） 垃圾！

smile1110

古法逆向，哈哈哈，还nop

lufei2002

继续学习

shc1221

学习中.......

wuzhenghong

求成品。感谢

冥界3大法王

wuzhenghong 发表于 2026-6-19 15:33
求成品。感谢

违规又快+1了。。。
求成品在本论坛是犯罪行为。。
请配合组织。。。

kyrzy0416

太强了，来支持下大佬

wangxu0515

前排学习中

凌云科技

现在的新版本太过臃肿，占用太高，老电脑直接吃不消啊