我們?cè)谄平廛浖臅r(shí)候,經(jīng)常會(huì)見到這樣的經(jīng)典語(yǔ)句:
            Call		  00405432
00401234:   Je		00402310
            Call		00402410        ;顯示注冊(cè)失敗
            …
            …
            …
00402310:   call		00402510        ;顯示注冊(cè)成功

很顯然,我們只要將je		00402310改為jmp		00402310就可以完成簡(jiǎn)單的破解.
我們知道指令je對(duì)應(yīng)的機(jī)器碼是74,而jmp對(duì)應(yīng)EB,因此我們可以編寫如下補(bǔ)丁程序:

;內(nèi)存補(bǔ)丁實(shí)例(一)   Code bY eLaNce@crsky
.386
.model flat, stdcall
option casemap :none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 數(shù)據(jù)
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include        \masm32\include\windows.inc
include        \masm32\include\user32.inc
include        \masm32\include\kernel32.inc
includelib     \masm32\lib\user32.lib
includelib     \masm32\lib\kernel32.lib
;宏定義
      CTEXT MACRO quoted_text:VARARG
        EXITM <ADDR literal(quoted_text)>
      ENDM
      literal MACRO quoted_text:VARARG
        LOCAL local_text
        .data
          local_text db quoted_text,0
        .code
        EXITM <local_text>
      ENDM
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
BREAK_POINT1   equ 00401234h ;第一個(gè)斷點(diǎn)
.data?
dbOldByte	db	?
stStartUp	STARTUPINFO	<?>
stProcInfo	PROCESS_INFORMATION	<?>
.const
dbPatch		db	74h
dbPatched	db	0ebh
szExecFilename db 'test.exe',0           ;文件名
.code
start:
invoke GetStartupInfo,addr stStartUp
invoke CreateProcess,offset szExecFilename,NULL,NULL,NULL,NULL,NORMAL_PRIORITY_CLASS or CREATE_SUSPENDED,0,\
0,offset stStartUp,offset stProcInfo
.if eax
;讀取進(jìn)程內(nèi)存
invoke ReadProcessMemory,stProcInfo.hProcess,BREAK_POINT1,addr dbOldByte,1,NULL
	.IF EAX
mov ax,WORD ptr dbOldByte
		.if ax == WORD ptr dbPatch
			invoke WriteProcessMemory,stProcInfo.hProcess,BREAK_POINT1,addr dbPatched,1,NULL
			invoke ResumeThread,stProcInfo.hThread
		.else
			invoke TerminateProcess,stProcInfo.hProcess,-1
			invoke MessageBox,NULL,CTEXT("補(bǔ)丁出錯(cuò)"),CTEXT("ERROR"),MB_OK
		.endif
	.endif
invoke CloseHandle,stProcInfo.hProcess
invoke CloseHandle,stProcInfo.hThread
.else 
invoke MessageBox,NULL,CTEXT("無法裝載目標(biāo)文件"),CTEXT("ERROR"),MB_OK
.endif
invoke ExitProcess,NULL
end start


也許很多人會(huì)說,有這個(gè)必要嗎?直接將00401234:   Je 00402310改為:00401234:   Jmp 00402310不就行了嗎?何必為此再編程?可是,如果軟件帶有文件自校驗(yàn)的話,你說的那種文件補(bǔ)丁不就不能用了嗎?
當(dāng)然,現(xiàn)在這種只是最簡(jiǎn)單的內(nèi)存補(bǔ)丁方法,又很多的不足,如,倘若我們欲補(bǔ)丁的程序加過殼,我們的補(bǔ)丁就沒法用了,因?yàn)槌绦虻暮枚啻a都是在殼中才解密出來的,我將在下一篇文章中給出改進(jìn)方案.