dbh
msg "请忽略所有异常!"
gpa "VirtualAlloc","kernel32"
bp $RESULT
run
bc $RESULT
rtu
bphws 372226,"x"
run
bphwc 372226
mov [372226],#9090#
mov [3724F9],#555555555555555555555555#
go 3737C2
mov [372226],#300B#
mov !SF,1
mov [373BB9],#E942230000#
mov [375F00],#807F030075118B5F0466C740FAFF158958FCE9AEDCFFFF25FFFFFF7F8B5F0466C740FAFF258958FCE998DCFFFF90#
bprm 4010CC,1
run
run
bpmc
msg "现在可以DUMP了，然后用ImportREC修复IAT即可!"
ret
;FristThunk 00 01 02 03 ; we must patch this
;LengthOfDllName 04
;DllName 05 .. .. ..
;
;Null 00
;NumberOfThunks 01 02 03 04
;FakeThunkx 05 - Flag 0=Index, 1=String
;06 07 08 09 index
;06 xx xx xx string
mov edi, LoaderStart ; use old loader space for new IMPORT TABLE
add edi, LoaderSize ; skip loader,rsrc,othershit
; state 1 - build stringz & fake-thunkx
; recreate all of above, write new ptr in old pos
push esi
__x_s_1:
mov eax, [esi]
test eax, eax
jz __r_end1
movzx ecx, byte ptr[esi+4] ; name len
inc ecx
mov eax, edi
sub eax, FileBase ; rva
add esi, 4+1
push esi
rep_movsb
mov ecx, esi
pop esi
mov [esi], eax
xchg esi, ecx
lodsd
xchg ecx, eax ; # of thunkx
__r_1_big_loop:
push ecx
lodsb
test al, al
jz __bd_thunkx_i ; imported by index
mov ecx, edi
sub ecx, FileBase ; 2 rva
mov edx, esi
xor eax, eax
stosw ; no hint
@copysz
mov [edx-1], ecx
jmp __r_1_big_out
__bd_thunkx_i:
lodsd
or eax, 80000000h ; set MSB flag
mov [esi-5], eax
__r_1_big_out:
pop ecx
loop __r_1_big_loop
