68 0c 00 40 00 ;push 0x0040000c(imageBase+0xc) 也就是c处的字符串 user32.dll e8 53 1d 40 7c ;call LoadLibraryA(0x7c401d5c) PE装载完后,Kernel32.dll会加载所以可以直接调用,此指令后地址为imageBase+0x28(0x00400028) LoadLibraryA地址为0x7C801D7B 减去0x00400028 得到0x7C401D53 6a 00 ;push 0 eb 1c ;jmp 0x00400048 (0x00400048 - 0x0040002c = 0x1c) 6a 00 ;push 0 eb 10 ;jmp 0x0040005c (0x0040005c - 0x0040004c = 0x10) 6a 00 ;push 0 eb d0 ;jmp 0x00400030 6a 00 ;push 0 eb 1c ;jmp 0x00400050 e8 95079577 ;call MessageBoxA (此地址算法和LoadLibraryA同理) c3 ;ret
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
来支持的
