程序脱壳后有自校验,在如下地方修改一下即可,

00459A1E 8B10 mov edx, dword ptr ds:[eax]
00459A20 FF12 call dword ptr ds:[edx]
00459A22 83FA 00 cmp edx, 0
00459A25 0F85 5D010000 jnz dumped_.00459B88 => nop掉 1
00459A2B 3D 00F40300 cmp eax, 3F400
00459A30 0F85 52010000 jnz dumped_.00459B88 => nop掉 2
.
.
.

00459B82 74 06 je short dumped_.00459B8A => jmp 00459B8A 3
00459B84 33DB xor ebx, ebx
00459B86 EB 02 jmp short dumped_.00459B8A
00459B88 33DB xor ebx, ebx
00459B8A 8BC6 mov eax, esi
00459B8C E8 379CFAFF call dumped_.004037C8
00459B91 E8 F6CAFAFF call <jmp.&kernel32.GetTickCount> ; [GetTickCount
00459B96 2B45 F0 sub eax, dword ptr ss:[ebp-10]
00459B99 3D 18010000 cmp eax, 118
00459B9E 76 05 jbe short dumped_.00459BA5 => jmp 00459BA5 4
00459BA0 E8 7FFAFFFF call dumped_.00459624
00459BA5 84DB test bl, bl
00459BA7 75 27 jnz short dumped_.00459BD0 =>jmp 00459BD0 5
00459BA9 8D45 D8 lea eax, dword ptr ss:[ebp-28]
00459BAC 50 push eax
00459BAD 6A FF push -1
00459BAF 8D55 D4 lea edx, dword ptr ss:[ebp-2C]
00459BB2 A1 3CD24500 mov eax, dword ptr ds:[45D23C]
00459BB7 E8 10C5FAFF call dumped_.004060CC
00459BBC 8B4D D4 mov ecx, dword ptr ss:[ebp-2C]
00459BBF B2 01 mov dl, 1
00459BC1 A1 B0774000 mov eax, dword ptr ds:[4077B0]
00459BC6 E8 E91FFBFF call dumped_.0040BBB4
00459BCB E8 84A3FAFF call dumped_.00403F54
00459BD0 33C0 xor eax, eax
00459BD2 5A pop edx

[培训]科锐逆向工程师培训第53期2025年7月8日开班！