BlindRead太变态了（1） (4千字)
几乎把FrogsICE中提到的检测SoftICE的方法都用上了。* Referenced by a CALL at Address:
|:00492F15
|
:00492B88 6A00 push 00000000
:00492B8A 6A00 push 00000000
:00492B8C 6A03 push 00000003
:00492B8E 6A00 push 00000000
:00492B90 6A02 push 00000002
:00492B92 6800000080 push 80000000
* Possible StringData Ref from Code Obj ->"\\.\NTICE"
|
:00492B97 683C2C4900 push 00492C3C
* Reference To: KERNEL32.CreateFileA, Ord:0000h
|
:00492B9C E84B39F7FF Call 004064EC
:00492BA1 83F8FF cmp eax, FFFFFFFF
:00492BA4 741D je 00492BC3
:00492BA6 6A10 push 00000010
* Possible StringData Ref from Code Obj ->"Error"
|
:00492BA8 68482C4900 push 00492C48
* Possible StringData Ref from Code Obj ->"This software is not designed "
->"to operate under a debugger. The "
->"application will stop."
|
:00492BAD 68502C4900 push 00492C50
:00492BB2 6A00 push 00000000
* Reference To: user32.MessageBoxA, Ord:0000h
|
:00492BB4 E86B41F7FF Call 00406D24
:00492BB9 B801000000 mov eax, 00000001
:00492BBE E83110F7FF call 00403BF4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492BA4(C)
|
:00492BC3 6A00 push 00000000
:00492BC5 6A00 push 00000000
:00492BC7 6A03 push 00000003
:00492BC9 6A00 push 00000000
:00492BCB 6A02 push 00000002
:00492BCD 6800000080 push 80000000
* Possible StringData Ref from Code Obj ->"\\.\SIWVID"
|
:00492BD2 68A82C4900 push 00492CA8
* Reference To: KERNEL32.CreateFileA, Ord:0000h
|
:00492BD7 E81039F7FF Call 004064EC
:00492BDC 83F8FF cmp eax, FFFFFFFF
:00492BDF 741D je 00492BFE
:00492BE1 6A10 push 00000010
* Possible StringData Ref from Code Obj ->"Error"
|
:00492BE3 68482C4900 push 00492C48
* Possible StringData Ref from Code Obj ->"This software is not designed "
->"to operate under a debugger. The "
->"application will stop."
|
:00492BE8 68502C4900 push 00492C50
:00492BED 6A00 push 00000000
* Reference To: user32.MessageBoxA, Ord:0000h
|
:00492BEF E83041F7FF Call 00406D24
:00492BF4 B801000000 mov eax, 00000001
:00492BF9 E8F60FF7FF call 00403BF4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492BDF(C)
|
:00492BFE 6A00 push 00000000
:00492C00 6A00 push 00000000
:00492C02 6A03 push 00000003
:00492C04 6A00 push 00000000
:00492C06 6A02 push 00000002
:00492C08 6800000080 push 80000000
* Possible StringData Ref from Code Obj ->"\\.\SICE"
|
:00492C0D 68B42C4900 push 00492CB4
* Reference To: KERNEL32.CreateFileA, Ord:0000h
|
:00492C12 E8D538F7FF Call 004064EC
:00492C17 83F8FF cmp eax, FFFFFFFF
:00492C1A 741D je 00492C39
:00492C1C 6A10 push 00000010
* Possible StringData Ref from Code Obj ->"Error"
|
:00492C1E 68482C4900 push 00492C48
* Possible StringData Ref from Code Obj ->"This software is not designed "
->"to operate under a debugger. The "
->"application will stop."
|
:00492C23 68502C4900 push 00492C50
:00492C28 6A00 push 00000000
* Reference To: user32.MessageBoxA, Ord:0000h
|
:00492C2A E8F540F7FF Call 00406D24
:00492C2F B801000000 mov eax, 00000001
:00492C34 E8BB0FF7FF call 00403BF4
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492C1A(C)
|
:00492C39 C3 ret
