用ESP定律走两步就到。
OEP：00403280 68 C85A4000 push 3dp3xgj.00405AC8
看网上的教材我就跟OEP附近的CALL，RVA应该是401100,IR老报错，搞不明白。
疑似IAT的地址：
00402FB6 - FF25 00114000 jmp dword ptr ds:[401100] ; MSVBVM60.__vbaExceptHandler
00402FBC - FF25 20114000 jmp dword ptr ds:[401120] ; MSVBVM60.__vbaFPException
00402FC2 - FF25 7C104000 jmp dword ptr ds:[40107C] ; MSVBVM60._adj_fdiv_m16i
00402FC8 - FF25 60104000 jmp dword ptr ds:[401060] ; MSVBVM60._adj_fdiv_m32
00402FCE - FF25 4C114000 jmp dword ptr ds:[40114C] ; MSVBVM60._adj_fdiv_m32i
00402FD4 - FF25 34104000 jmp dword ptr ds:[401034] ; MSVBVM60._adj_fdiv_m64
00402FDA - FF25 6C114000 jmp dword ptr ds:[40116C] ; MSVBVM60._adj_fdiv_r
00402FE0 - FF25 84104000 jmp dword ptr ds:[401084] ; MSVBVM60._adj_fdivr_m16i
00402FE6 - FF25 60114000 jmp dword ptr ds:[401160] ; MSVBVM60._adj_fdivr_m32
00402FEC - FF25 50114000 jmp dword ptr ds:[401150] ; MSVBVM60._adj_fdivr_m32i
00402FF2 - FF25 14114000 jmp dword ptr ds:[401114] ; MSVBVM60._adj_fdivr_m64
00402FF8 - FF25 D0104000 jmp dword ptr ds:[4010D0] ; MSVBVM60._adj_fpatan
00402FFE - FF25 10114000 jmp dword ptr ds:[401110] ; MSVBVM60._adj_fprem
00403004 - FF25 40104000 jmp dword ptr ds:[401040] ; MSVBVM60._adj_fprem1
0040300A - FF25 10104000 jmp dword ptr ds:[401010] ; MSVBVM60._adj_fptan
00403010 - FF25 B0114000 jmp dword ptr ds:[4011B0] ; MSVBVM60._CIatan
00403016 - FF25 0C104000 jmp dword ptr ds:[40100C] ; MSVBVM60._CIcos
0040301C - FF25 D0114000 jmp dword ptr ds:[4011D0] ; MSVBVM60._CIexp
00403022 - FF25 30114000 jmp dword ptr ds:[401130] ; MSVBVM60._CIlog
00403028 - FF25 9C104000 jmp dword ptr ds:[40109C] ; MSVBVM60._CIsin
0040302E - FF25 EC104000 jmp dword ptr ds:[4010EC] ; MSVBVM60._CIsqrt
00403034 - FF25 C4114000 jmp dword ptr ds:[4011C4] ; MSVBVM60._CItan
0040303A - FF25 BC114000 jmp dword ptr ds:[4011BC] ; MSVBVM60._allmul
00403040 - FF25 C8104000 jmp dword ptr ds:[4010C8] ; MSVBVM60.DllFunctionCall
00403046 - FF25 28104000 jmp dword ptr ds:[401028] ; MSVBVM60.__vbaLateIdCall
0040304C - FF25 B8104000 jmp dword ptr ds:[4010B8] ; MSVBVM60.__vbaStrCmp
00403052 - FF25 78104000 jmp dword ptr ds:[401078] ; MSVBVM60.__vbaObjSet
00403058 - FF25 D8114000 jmp dword ptr ds:[4011D8] ; MSVBVM60.__vbaFreeObj
0040305E - FF25 80104000 jmp dword ptr ds:[401080] ; MSVBVM60.__vbaObjSetAddref
00403064 - FF25 30104000 jmp dword ptr ds:[401030] ; MSVBVM60.__vbaFreeVarList
0040306A - FF25 28114000 jmp dword ptr ds:[401128] ; MSVBVM60.__vbaVarCat
00403070 - FF25 8C114000 jmp dword ptr ds:[40118C] ; MSVBVM60.__vbaVarDup
00403076 - FF25 74104000 jmp dword ptr ds:[401074] ; MSVBVM60.rtcMsgBox
0040307C - FF25 1C114000 jmp dword ptr ds:[40111C] ; MSVBVM60.rtcVarBstrFromAnsi
00403082 - FF25 44114000 jmp dword ptr ds:[401144] ; MSVBVM60.__vbaNew2
00403088 - FF25 58104000 jmp dword ptr ds:[401058] ; MSVBVM60.__vbaHresultCheckObj
0040308E - FF25 6C104000 jmp dword ptr ds:[40106C] ; MSVBVM60.__vbaExitProc
00403094 - FF25 D4104000 jmp dword ptr ds:[4010D4] ; MSVBVM60.__vbaR4Var
0040309A - FF25 70104000 jmp dword ptr ds:[401070] ; MSVBVM60.__vbaOnError
004030A0 - FF25 24104000 jmp dword ptr ds:[401024] ; MSVBVM60.rtcRgb
004030A6 - FF25 98104000 jmp dword ptr ds:[401098] ; MSVBVM60.__vbaFpR8
004030AC - FF25 DC114000 jmp dword ptr ds:[4011DC] ; MSVBVM60.rtcR8ValFromBstr
004030B2 - FF25 04104000 jmp dword ptr ds:[401004] ; MSVBVM60.__vbaVarSub
004030B8 - FF25 A8114000 jmp dword ptr ds:[4011A8] ; MSVBVM60.__vbaVarTstGe
004030BE - FF25 8C104000 jmp dword ptr ds:[40108C] ; MSVBVM60.rtcTrimVar
004030C4 - FF25 2C114000 jmp dword ptr ds:[40112C] ; MSVBVM60.__vbaI2Var
004030CA - FF25 B0104000 jmp dword ptr ds:[4010B0] ; MSVBVM60.__vbaGenerateBoundsError
004030D0 - FF25 90114000 jmp dword ptr ds:[401190] ; MSVBVM60.rtcVarStrFromVar
004030D6 - FF25 20104000 jmp dword ptr ds:[401020] ; MSVBVM60.__vbaStrVarMove
004030DC - FF25 A8104000 jmp dword ptr ds:[4010A8] ; MSVBVM60.__vbaFileClose
004030E2 - FF25 C0104000 jmp dword ptr ds:[4010C0] ; MSVBVM60.__vbaVarTstEq
004030E8 - FF25 0C114000 jmp dword ptr ds:[40110C] ; MSVBVM60.__vbaInputFile
004030EE - FF25 48114000 jmp dword ptr ds:[401148] ; MSVBVM60.rtcEndOfFile
004030F4 - FF25 58114000 jmp dword ptr ds:[401158] ; MSVBVM60.__vbaFreeStrList
004030FA - FF25 48104000 jmp dword ptr ds:[401048] ; MSVBVM60.__vbaStrCat
00403100 - FF25 B4114000 jmp dword ptr ds:[4011B4] ; MSVBVM60.__vbaStrMove
00403106 - FF25 38114000 jmp dword ptr ds:[401138] ; MSVBVM60.__vbaFileOpen
0040310C - FF25 14104000 jmp dword ptr ds:[401014] ; MSVBVM60.__vbaVarMove
00403112 - FF25 38104000 jmp dword ptr ds:[401038] ; MSVBVM60.__vbaFreeObjList
00403118 - FF25 DC104000 jmp dword ptr ds:[4010DC] ; MSVBVM60.__vbaLateIdCallLd
0040311E - FF25 F4104000 jmp dword ptr ds:[4010F4] ; MSVBVM60.__vbaLateIdCallSt
00403124 - FF25 34114000 jmp dword ptr ds:[401134] ; MSVBVM60.__vbaErrorOverflow
0040312A - FF25 CC114000 jmp dword ptr ds:[4011CC] ; MSVBVM60.__vbaVarForNext
00403130 - FF25 68104000 jmp dword ptr ds:[401068] ; MSVBVM60.__vbaVarForInit
00403136 - FF25 18104000 jmp dword ptr ds:[401018] ; MSVBVM60.__vbaFreeVar
0040313C - FF25 84114000 jmp dword ptr ds:[401184] ; MSVBVM60.__vbaVarAdd
00403142 - FF25 78114000 jmp dword ptr ds:[401178] ; MSVBVM60.__vbaI4Var
00403148 - FF25 C0114000 jmp dword ptr ds:[4011C0] ; MSVBVM60.__vbaLateIdSt
0040314E - FF25 50104000 jmp dword ptr ds:[401050] ; MSVBVM60.__vbaWriteFile
00403154 - FF25 5C114000 jmp dword ptr ds:[40115C] ; MSVBVM60.rtcFileCopy
0040315A - FF25 B4104000 jmp dword ptr ds:[4010B4] ; MSVBVM60.rtcKillFiles
00403160 - FF25 88104000 jmp dword ptr ds:[401088] ; MSVBVM60.rtcDoEvents
00403166 - FF25 40114000 jmp dword ptr ds:[401140] ; MSVBVM60.__vbaVarLateMemCallLdRf
0040316C - FF25 A4114000 jmp dword ptr ds:[4011A4] ; MSVBVM60.__vbaVarLateMemCallLd
00403172 - FF25 D4114000 jmp dword ptr ds:[4011D4] ; MSVBVM60.__vbaFreeStr
00403178 - FF25 08114000 jmp dword ptr ds:[401108] ; MSVBVM60.__vbaPrintFile
0040317E - FF25 AC114000 jmp dword ptr ds:[4011AC] ; MSVBVM60.rtcLeftCharVar
00403184 - FF25 44104000 jmp dword ptr ds:[401044] ; MSVBVM60.__vbaVarCmpNe
0040318A - FF25 F0104000 jmp dword ptr ds:[4010F0] ; MSVBVM60.__vbaVarAnd
00403190 - FF25 7C114000 jmp dword ptr ds:[40117C] ; MSVBVM60.__vbaVarCmpEq
00403196 - FF25 CC104000 jmp dword ptr ds:[4010CC] ; MSVBVM60.__vbaVarOr
0040319C - FF25 94104000 jmp dword ptr ds:[401094] ; MSVBVM60.__vbaBoolVarNull
004031A2 - FF25 A0114000 jmp dword ptr ds:[4011A0] ; MSVBVM60.__vbaVarCopy
004031A8 - FF25 A0104000 jmp dword ptr ds:[4010A0] ; MSVBVM60.rtcMidCharVar
004031AE - FF25 5C104000 jmp dword ptr ds:[40105C] ; MSVBVM60.__vbaLenVar
004031B4 - FF25 04114000 jmp dword ptr ds:[401104] ; MSVBVM60.__vbaStrToUnicode
004031BA - FF25 4C104000 jmp dword ptr ds:[40104C] ; MSVBVM60.__vbaLsetFixstr
004031C0 - FF25 D8104000 jmp dword ptr ds:[4010D8] ; MSVBVM60.__vbaFixstrConstruct
004031C6 - FF25 54104000 jmp dword ptr ds:[401054] ; MSVBVM60.__vbaSetSystemError
004031CC - FF25 88114000 jmp dword ptr ds:[401188] ; MSVBVM60.__vbaStrToAnsi
004031D2 - FF25 1C104000 jmp dword ptr ds:[40101C] ; MSVBVM60.__vbaLenBstr
004031D8 - FF25 68114000 jmp dword ptr ds:[401168] ; MSVBVM60.__vbaPowerR8
004031DE - FF25 54114000 jmp dword ptr ds:[401154] ; MSVBVM60.__vbaStrCopy
004031E4 - FF25 64104000 jmp dword ptr ds:[401064] ; MSVBVM60.__vbaAryDestruct
004031EA - FF25 9C114000 jmp dword ptr ds:[40119C] ; MSVBVM60.__vbaFpI4
004031F0 - FF25 C8114000 jmp dword ptr ds:[4011C8] ; MSVBVM60.__vbaAryUnlock
004031F6 - FF25 80114000 jmp dword ptr ds:[401180] ; MSVBVM60.__vbaAryLock
004031FC - FF25 B8114000 jmp dword ptr ds:[4011B8] ; MSVBVM60.rtcRightCharVar
00403202 - FF25 24114000 jmp dword ptr ds:[401124] ; MSVBVM60.__vbaStrVarVal
00403208 - FF25 3C104000 jmp dword ptr ds:[40103C] ; MSVBVM60.rtcAnsiValueBstr
0040320E - FF25 E4104000 jmp dword ptr ds:[4010E4] ; MSVBVM60.__vbaRedim
00403214 - FF25 74114000 jmp dword ptr ds:[401174] ; MSVBVM60.__vbaVarTstNe
0040321A - FF25 BC104000 jmp dword ptr ds:[4010BC] ; MSVBVM60.__vbaAryConstruct2
00403220 - FF25 C4104000 jmp dword ptr ds:[4010C4] ; MSVBVM60.__vbaI2I4
00403226 - FF25 08104000 jmp dword ptr ds:[401008] ; MSVBVM60.__vbaStrI2
0040322C - FF25 98114000 jmp dword ptr ds:[401198] ; MSVBVM60.__vbaFpI2
00403232 - FF25 E0104000 jmp dword ptr ds:[4010E0] ; MSVBVM60.__vbaStrR8
00403238 - FF25 00104000 jmp dword ptr ds:[401000] ; MSVBVM60.__vbaVarTstGt
0040323E - FF25 2C104000 jmp dword ptr ds:[40102C] ; MSVBVM60.__vbaVarIdiv
00403244 - FF25 FC104000 jmp dword ptr ds:[4010FC] ; MSVBVM60.__vbaVarMul
0040324A - FF25 90104000 jmp dword ptr ds:[401090] ; MSVBVM60.__vbaVarTstLt
00403250 - FF25 18114000 jmp dword ptr ds:[401118] ; MSVBVM60.__vbaVarDiv
00403256 - FF25 3C114000 jmp dword ptr ds:[40113C] ; MSVBVM60.__vbaInStr
0040325C - FF25 64114000 jmp dword ptr ds:[401164] ; MSVBVM60.__vbaR8Var
00403262 - FF25 94114000 jmp dword ptr ds:[401194] ; MSVBVM60.rtcSqr
00403268 - FF25 F8104000 jmp dword ptr ds:[4010F8] ; MSVBVM60.EVENT_SINK_QueryInterface
0040326E - FF25 AC104000 jmp dword ptr ds:[4010AC] ; MSVBVM60.EVENT_SINK_AddRef
00403274 - FF25 E8104000 jmp dword ptr ds:[4010E8] ; MSVBVM60.EVENT_SINK_Release
0040327A - FF25 70114000 jmp dword ptr ds:[401170] ; MSVBVM60.ThunRTMain
大小我减了就是11,可这太小了。。。研究一个星期了还是没搞懂IAT.
下面的附件是没安装的不知能运行不，不能运行就下去下载了：http://tjgwbn.skycn.com:82/down/3dp3xgj60a.zip
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
