for IE的 (1千字)
看看下面的代码。很显然它在DS:[004679D4]中设了个标志，强行将该标志置为9并跳过显示Nag的代码应该可行。
跟一下它在哪里置这个标志，应该可以找到它把时间藏在什么地方。
:004628BF cmp dword ptr [004679D4], 00000009
:004628C6 jne 00462928
* Possible StringData Ref from Code Obj ->"You currently have "
|
:004628C8 push 00463740
:004628CD push dword ptr [004679D8]
* Possible StringData Ref from Code Obj ->" left in your trial."
|
:004628D3 push 0046375C
:004628D8 lea eax, dword ptr [ebp-14]
................
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004628C6(C)
|
:00462928 cmp dword ptr [004679D4], 0000000A
:0046292F jne 004629B7
:00462935 mov eax, dword ptr [00466EA8]
:0046293A mov eax, dword ptr [eax]
:0046293C mov eax, dword ptr [eax+000001E0]
* Possible StringData Ref from Code Obj ->" Sorry! Your 30 day trial "
->"has expired."
|
:00462942 mov edx, 0046377C
:00462947 call 00420444
