Îá°®Æƽâ - 52pojie.cn

 ÕÒ»ØÃÜÂë
 ×¢²á[Register]

QQ怬

Ö»ÐèÒ»²½£¬¿ìËÙ¿ªÊ¼

²é¿´: 4878|»Ø¸´: 2
ÊÕÆð×ó²à

[תÌù] ΪʲôijЩ¿ÇÍѿǺóÐèÒªÐÞ¸´IAT£¿

  [¸´ÖÆÁ´½Ó]
LzSkyline ·¢±íÓÚ 2016-2-4 18:18
±¾ÎÄת×Ô ¿´Ñ©-Сñû,¸Ð¾õдµÄºÜ²»´í¾ÍתÔØÁË,ÈçÓв»Í×ÇëÁªÏµÎÒ»ò¹ÜÀíɾ³ý
ÒÔÏÂÊÇÔ­ÎÄ:
Ç°ÑÔ£º

    Ò²ÐíÔÚÍѿdzõѧÕßÖж¼»áÓÐÕâÑùµÄÒÉ»ó¡°ÎªÊ²Ã´Ä³Ð©¿ÇÍѿǺóÐèÒªÐÞ¸´IAT£¿¡±¡£
ÔÚÎÒ¸ÕѧÍѿǵÄʱºòÒ²ÊÇ°Ù˼²»½â£¬ÍøÉÏËÑË÷¸ö±éÒ²ÄÑÕÒµ½¸öËùÒÔÈ»À´¡£
ºóÃæ¾­¹ý¶ÔPE¼Ó¿Ç»úµÄÉè¼Æºó²ÅÃ÷°×ÆäÔ­ÀíÊÇÕâô¸öËùÒÔÈ»¡£
    Ê×Ïȱ¾È˺ÜÀÁ£¬²»Ï²»¶Ð´ÎÄ×Ö£¬ÏÂÎç5µã¶àÓÖÊÇѧУʳÌÿª·¹µÄʱ¼ä£¬
ÓÉÓÚ½ñÌ컹û³Ô·¹Ö»³ÔÁËÁ½¸ùÀ±Ìõ£¬¶Ç×Ó¼¢¶öÄÑÈÌ£¬Õý×¼±¸È¥Ñ§Ð£Ê³ÌÃÇÀ·¹£¬
ÔڹػúÇ°´ò¿ª¿´Ñ©ÂÛ̳¿´ÁËÏÂÌû×Ó£¬ÓÚÊÇ¿´µ½ÕâÌû×Ó£º
http://bbs.pediy.com/showthread.php?p=1079078
ÓÚÊǾÍÓÐÁ˲»»Ø´ðÕâÎÊÌâ²»³Ô·¹µÄ¾öÐÄ¡£¡£
»¹ºÃÔÚ18:19:31дÍ꣬ʳÌû¹ÓÐЩʣ·¹¡£¡£‡å
ÒòΪºÜ¶àÍѿdzõѧÕß¿ÉÄܶ¼»áÓÐÕâÑùµÄÒÉ»ó£¬ÔÚÄÇÌû×ӵĻظ´ºÜ¿ÉÄܾÍʯ³Á´óº£ÁË£¬
ËùÒÔÎÒ¾ö¶¨Áí¿ªÌù½«»Ø¸´ÄÚÈÝдµ½ÕâÀ
Ò²Ðí»áÓиü¶àÍѿdzõѧÕß¿´µ½£¬¶ÔËûÃÇѧÍÑ¿ÇÓеã°ïÖú°É¡£
ÒòΪÔںͼ¢¶ö×÷¶·Õù¸Ïʱ¼äд³öÀ´µÄÄÚÈÝ£¬
©´íµÄµØ·½ÔÚËùÄÑÃ⣬»¶Ó­Ö¸Õý£¡

ÕýÎÄ£º

ΪʲôҪÐÞ¸´IAT?

Ê×ÏȵÃ˵һϳÌÐòµ÷ÓÃDLLµ¼³öº¯ÊýµÄÔ­Àí£¬
PEµ÷ÓÃDLLÀïµÄº¯Êý£¬Ò»°ãÊÇÏȼÓÔØÕâ¸öDLLÄ£¿éµ½ËüµÄ½ø³ÌµØÖ·¿Õ¼ä£¬
È»ºóÔÚ¼ÓÔغóµÄµØÖ··¶Î§ÄÚÕÒµ½Ã¿¸öµ÷Óú¯ÊýµÄµØÖ·£¬
ÔÚ³ÌÐòÖÐÄã¿ÉÒÔʹÓÃLoadLibrary()Õâ¸öϵͳAPIÈ¥¶¯Ì¬È¥¼ÓÔØij¸öDLL£¬
ÔÙͨ¹ýGetProcAddress()ϵͳAPIÀ´ÕÒµ½DLLµ¼³öµÄij¸öº¯ÊýµØÖ·£¬
µÃµ½º¯ÊýµØÖ·ÁËÄã²ÅÄÜʹÓÃÕâ¸öº¯Êý¡£
Óû§DLL±»¼ÓÔغóµÄ»ùÖ·¿É·¢Éú±ä»¯£¬µ¼ÈëµÄº¯ÊýµØÖ·²»Êǹ̶¨µÄ£¬Äã²»ÄÜʹÓù̶¨µÄµØÖ·¡£
ϵͳDLLËäÈ»»ùÖ·¹Ì¶¨£¬º¯ÊýµØÖ·¹Ì¶¨£¬µ«ÊÇÒ»°ã²»»áÖ±½ÓʹÓú¯ÊýÓ²µØÖ·£¬
»¹ÊÇÒªGetProcAddress()Õâ¸öAPIÀ´µÃµ½µØÖ·£¬ÒòΪXP¡¢win7µÈÿ¸öϵͳµÄÕâЩµØÖ·
ÊDz»Ò»ÑùµÄ£¬»áµ¼Ö¼æÈÝÐÔÎÊÌâ¡£

¹ØÓÚµ¼Èë±í£¬
¶øΪÁË¿ª·¢¸ü·½±ãºÍ¸üÈËÐÔ»¯£¬±àÒëÆ÷ÌṩÁËÕâ¸ö¾²Ì¬µ¼È뺯ÊýµÄ¹¦ÄÜ£¬
Ò²¾ÍÊÇ˵ÄãÔÚ±à³ÌµÄʱºò²»ÐèÒªLoadLibrary()£¬²»±Øÿ´Îµ÷ÓÃÒ»¸öº¯Êý¶¼GetProcAddress()£¬
ÄãÖ»ÐèÒªÔÚÔ´´úÂëÖÐдº¯ÊýÃûºÍ²ÎÊý¼´¿É£¬±àÒëÆ÷»á½«ÄãʹÓõÄ<º¯ÊýÃû>ºÍº¯ÊýËùÔÚµÄ<DLLÎļþÃû>
Á½¸öÐÅÏ¢Ìîдµ½ÊäÈë±íÀµ±³ÌÐòÆô¶¯ÔËÐÐʱÓɲÙ×÷ϵͳ¸ù¾ÝÕâÁ½¸öÐÅÏ¢¸ø³ÌÐò¼ÓÔØ
ËùÐèµÄDLL£¬²¢½«ËùÐèÒªµÄº¯ÊýµØַдÈëIAT¡£
    IATÊÇÖ¸PEµ¼ÈëµØÖ·±í£¬Ã¿¸öIAT¾Í¶ÔÓ¦ÁËÒ»¸öDLLÎļþµ¼È뺯ÊýµÄµØÖ·±í£¬
ÄãµÄ³ÌÐòÀïµ÷ÓõĵØÖ·²»ÊÇÖ±½Óµ÷ÓÃDLLÀﺯÊýµÄµØÖ·£¬ÒòΪÄã²»ÖªµÀµØÖ·ÊǶàÉÙ£¬
¶øÊÇÖ±½Óµ÷ÓÃÁËIATÀïµÄµØÖ·¡£³ÌÐòÆô¶¯Ê±²Ù×÷ϵͳ¼ÓÔØËùÐèµÄDLL²¢Ìî³äµ¼ÈëÃû³Æ±íINT¶ÔÓ¦µÄ
º¯ÊýµØÖ·µ½µØÖ·±íIAT¶ÔÓ¦PIMAGE_THUNK_DATA½á¹¹ÀȻºó³ÌÐò¾Í¿ÉÒÔÕý³£µ÷ÓÃIATÖÐÕâЩº¯ÊýµØÖ·ÁË¡£

¿ÇµÄ¹¤×÷Ô­Àí£¬
ijЩ¼Ó¿Ç³ÌÐò¼Ó¿Çºó»áÐÞ¸ÄÁËÔ­À´µ¼ÈëĿ¼±íµÄλÖÃΪ¿ÇµÄµ¼Èë±í£¬
ÕâÑùĬÈϵĵ¼Èë±íÖ¸Ïò¿Ç²¿·ÖµÄµ¼Èë±í£¬Äã¾Í¿´²»µ½Ô­À´µÄµ¼Èë±íµÄÄÚÈÝÁË¡£
³ÌÐòÆô¶¯ºó£¬²Ù×÷ϵͳΪ¿ÇµÄµ¼Èë±í¼ÓÔØ£¬
ÔÚ¿Ç´úÂëÔËÐÐÍê³ÉÖ®ºó£¬¿Ç´úÂë»áÌøµ½Ô­³ÌÐòµÄÈë¿ÚµãOEP£¬¿ÇÄ£Äâ²Ù×÷ϵͳÌî³ä
Ô­À´µ¼Èë±íIAT£¬ÕâÑù±£Ö¤´úÂë¶ÎÄÜÕý³£µ÷Óú¯Êý¡£
Ò»°ã¿ÇµÄ¹¤×÷Ô­ÀíÒ²¾ÍÊÇÕâÑùÁË£¬Ëæ×ÅÏÖÔڼӿǼÓÃܼ¼ÊõµÄ½ø²½£¬²»ÊÇËùÓмӿÇÈí¼þ¶¼»áÕâÑù¡£

ÍÑ¿ÇÔ­Àí£¬
Ê×ÏÈÐ޸ı»¼Ó¿Ç³ÌÐòµÄÈë¿Úµãµ½³ÌÐòÔ­À´µÄOEP£¬
È»ºóÐÞ¸ÄPE³ÌÐòµ¼Èë±íĿ¼µØַΪԭÀ´µ¼Èë±íµØÖ·£¬»òÕßн¨Ò»¸ö½Ú£¬
½«Õâ¸öнÚ×÷Ϊµ¼Èë±í½Ú£¬²¢½«Ô­µ¼Èë±íÄÚÈÝдÈëнڵ¼Èë±í¡£

Íѿǹý³Ì£¬
OD¸ú×Ù£¬ÈÿÇÔËÐе½Ô­³ÌÐòOEP£¨²»Ò»¶¨·ÇµÃOEP£¬³ÌÐòÁì¿Õµ¼Èë±íÒ»°ã¶¼ÊÇ´¦ÓÚ»¹Ô­×´Ì¬£¬
OEPÒªÖªµÀ£©£¬Õâʱºò¿ÉÒÔÓÃPE DUMPÍѿDzå¼þ»òÕßÓÃLordPeµÈ¹¤¾ßÍÑ¿Ç£¬
³ÌÐòµ±Ç°µÄÄÚ´æÓ³Ïñ±»dump³öÀ´£¬ÀïÃæIAT½á¹¹ÍêÕûºÜÈÝÒ×±»·¢ÏÖ¡£
dumpºó³ÌÐò²»ÄÜÕý³£ÔËÐкܿÉÄÜÊǵ¼Èë±íλÖôíÎó£¨Ò²¿ÉÄÜÊdzÌÐòÓÐ×ÔУÑ飩£¬
ÒòΪdump³öÀ´µÄÖ»ÊÇÄÚ´æÖеÄÓ³Ïñ¿ìÕÕ£¬µ¼Èë±íĿ¼»¹ÊÇÖ¸Ïò¿ÇµÄµ¼Èë±í£¬
Õâʱ£¬ÐèÒªÓõ¼Èë±íÐÞ¸´Èí¼þ²éÕÒdump³öµÄPEÎļþÔ­µ¼Èë±íÊ×µØÖ·£¬
È»ºóÐÞÕýµ¼Èë±íĿ¼Öе¼Èë±íµÄλÖ㬻òÖؽ¨µ¼Èë±í¡£
Import Fixµ¼Èë±íÐÞ¸´Èí¼þ»áн¨Ò»¸ö½ÚÀ´±£´æÔ­µ¼Èë±íÊý¾Ý£¬²¢½«µ¼Èë±íĿ¼ָÏòнڵ¼Èë±íλÖá£
ÔÚËÑË÷µ¼Èë±íʱ¿ÉÄܵ¼Èë±í±»ÆÆ»µ£¬Import Fix»áʶ±ð³öһЩÎÞЧµÄIATÏ¿ÉÒÔ½«ÆäÌÞ³ýµô¡£

by Сñû 2012,06,10 ¿´Ñ©ÂÛ̳



Ãâ·ÑÆÀ·Ö

²ÎÓëÈËÊý 3ÈÈÐÄÖµ +3 ÊÕÆð ÀíÓÉ
likang + 1 ÎÒºÜÔÞͬ£¡
K_Yond + 1 ¹ÄÀøתÌùÓÅÐãÈí¼þ°²È«¹¤¾ßºÍÎĵµ£¡
·ãMapleLCG + 1 лл@Thanks£¡

²é¿´È«²¿ÆÀ·Ö

·¢ÌûÇ°ÒªÉÆÓá¾ÂÛ̳ËÑË÷¡¿¹¦ÄÜ£¬ÄÇÀï¿ÉÄÜ»áÓÐÄãÒªÕҵĴ𰸻òÕßÒѾ­ÓÐÈË·¢²¼¹ýÏàͬÄÚÈÝÁË£¬ÇëÎðÖظ´·¢Ìû¡£

·ãMapleLCG ·¢±íÓÚ 2016-2-4 18:59
(¡Ño¡Ñ)Ŷ£¬¶ÔºÃÆ汦±¦Óкܴó½â»ó£¬»òÐíÎòÐԸߵĻ¹ÄÜÀí½âʲôÄØ¡£ÔÞÒ»¸ö
121890575 ·¢±íÓÚ 2016-2-4 19:11
ÄúÐèÒªµÇ¼ºó²Å¿ÉÒÔ»ØÌû µÇ¼ | ×¢²á[Register]

±¾°æ»ý·Ö¹æÔò

·µ»ØÁбí

RSS¶©ÔÄ|СºÚÎÝ|´¦·£¼Ç¼|ÁªÏµÎÒÃÇ|Îá°®Æƽâ - LCG - LSG ( ¾©ICP±¸16042023ºÅ | ¾©¹«Íø°²±¸ 11010502030087ºÅ )

GMT+8, 2024-11-17 15:32

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

¿ìËٻظ´ ·µ»Ø¶¥²¿ ·µ»ØÁбí