15 Mar 07 蹦过skype对softice的检测-第一部分[待续]

不用qq了, 想用Skype,但我机器上装着SoftICE, Skype不工作,Google之,改之. 用之.

Thanks scz & hume &pediy 我只是更新了一下.呵呵.
文件版本 : 3.0.0.218
产品版本 : 3.0
BuildTime : 22.02.2007 23:31:13
文件大小 : 25,388,584 字节
语言 : 英语(美国)
Ctrl-F2加载Skype.exe,Alt-E调出Executable modules窗口,选中user32,Ctrl-N调出Names in user32窗口,选中MessageBoxA按F2下断点,F9运行,
00D891A1 |. BA A895D800 mov edx, 00D895A8 ; ASCII “Skype.main”
00D891A6 |. A1 0C1C7700 mov eax, [771C0C]
00D891AB |. E8 94E89EFF call 00777A44
00D891B0 |> E8 BFC086FF call 005F5274
00D891B5 |. 84C0 test al, al
00D891B7 74 1A je short 00D891D3
00D891B9 |. 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
00D891BB |. 68 C895D800 push 00D895C8 ; |Title = “Skype”
00D891C0 |. 68 D095D800 push 00D895D0 ; |Text = “Skype is not compatible with system debuggers like SoftICE.”
00D891C5 |. 6A 00 push 0 ; |hOwner = NULL
00D891C7 |. E8 D0FB67FF call <jmp.&user32.MessageBoxA> ; \MessageBoxA
00D891CC |. 6A 00 push 0 ; /ExitCode = 0
00D891CE |. E8 79EF67FF call <jmp.&kernel32.ExitProcess> ; \ExitProcess

将00D891B7 74 1A je short 00D891D3改成00D891B7 EB 1A jmp short 00D891D3　无条件跳转.