patch6.idc

刚接触逆向的

#include "idc.idc"

static main() {
   auto MyByteO,MyByteT,MyWordO,MyWordT,MyBuffer,Addr,al,DeCodeAddr,Counter,EAX,ECX,ESI;

ESI = 0x447000 - 0x46000;
DeCodeAddr = ESI;
Counter = Byte(DeCodeAddr);
DeCodeAddr++;
Counter = 0;

Addr = MaxEA() - 4;
MyBuffer = Dword (Addr);

for (ECX = 0x16D5;ECX !=0;ECX--){
while (Counter != 1){
al = Byte(DeCodeAddr);
DeCodeAddr++;
al = al - 0xe8;
if (al >= 0) if (al <= 1) if (Byte(DeCodeAddr) == 1) break; 
			}
EAX = Dword(DeCodeAddr);

PatchDword(Addr,EAX);

MyByteO = Byte(Addr + 1);
PatchByte (Addr,MyByteO);
PatchByte (Addr+1,0);

MyWordO = Word(Addr);
MyWordT = Word(Addr+2);
PatchWord (Addr,MyWordT);
PatchWord (Addr+2,MyWordO);

MyByteO = Byte(Addr);
MyByteT = Byte(Addr+1);
PatchByte (Addr,MyByteT);
PatchByte (Addr+1,MyByteO);

EAX = Dword(Addr) - DeCodeAddr;

EAX = EAX + ESI;

PatchDword(DeCodeAddr,EAX);

DeCodeAddr = DeCodeAddr + 4;

				}
PatchDword (Addr,MyBuffer);
}