【原创】游戏csol2 X64反直接附加运行游戏

0088B000 > 56 push esi

0088B001 50 push eax basethaedinitThunk

0088B002 53 push ebx

0088B003 E8 01000000 call 0088B009

0088B008 CC int3 利用ueh处理 未处理 崩溃

0088B009 58 pop eax basethaedinitThunk

0088B00A 89C3 mov ebx,eax basethaedinitThunk传递给EBX了

0088B00C 40 inc eax

0088B00D 2D 00301400 sub eax,0x143000

0088B012 2D 60EA0C10 sub eax,0x100CEA60

0088B017 05 57EA0C10 add eax,0x100CEA57

0088B01C 803B CC cmp byte ptr ds:[ebx],0xCC 对比是否是0XCC

0088B01F 75 19 jnz short 0088B03A不是就跳

0088B021 C603 00 mov byte ptr ds:[ebx],0x0

0088B024 BB 00100000 mov ebx,0x1000

0088B029 68 E1DE9E2D push 0x2D9EDEE1

0088B02E 68 F5957301 push 0x17395F5

0088B033 53 push ebx

0088B034 50 push eax

0088B035 E8 0A000000 call 0088B044

0088B03A 83C0 00 add eax,0x0 是0则是没有被HOOK 让这里恒定返回

0088B03D 894424 08 mov dword ptr ss:[esp+0x8],eax 输出

0088B041 5B pop ebx

0088B042 58 pop eax

0088B043 C3 retn c