我用ollydbg手动脱壳,在popad后,跳转后dump的程序,执行报“无法定位程序输入点ImageLi于动态连接库comctl32.dll”,
我把dump的程序反编译后发现:
Import Module 015: comctl32.dll
Addr:0015EAFC hint(004F) Name: ImageList_SetIconSize
Addr:0015EB14 hint(003B) Name: ImageList_GetIconSize
Addr:0015EB2C hint(0052) Name: ImageList_Write
Addr:0015EB3E hint(0043) Name: ImageList_Read
Addr:0015EB4F hint(0038) Name: ImageList_GetDragImage
Addr:0015EB68 hint(0031) Name: ImageList_DragShowNolock
Addr:0015EB83 hint(004C) Name: ImageList_SetDragCursorImage
Addr:0015EBA2 hint(0030) Name: ImageList_DragMove
Addr:0015EBB7 hint(002F) Name: ImageList_DragLeave
Addr:0015EBCD hint(002E) Name: ImageList_DragEnter
Addr:0015EBE3 hint(0036) Name: ImageList_EndDrag
Addr:0015EBF7 hint(002A) Name: ImageList_EndDrag
Addr:0015EC0D hint(0000) Name: ImageList_EndDrag
Addr:0015EC20 hint(0000) Name: ImageList_EndDrag
Addr:0015EC33 hint(0000) Name: ImageList_EndDrag
Addr:0015EC47 hint(0000) Name: ImageList_EndDrag
Addr:0015EC58 hint(0000) Name: ImageList_EndDrag
Addr:0015EC6F hint(0000) Name: ImageList_EndDrag
Addr:0015EC86 hint(0000) Name: ImageList_EndDrag
Addr:0015EC9E hint(0000) Name: ImageList_EndDrag
Addr:0015ECAE hint(0000) Name: ImageList_EndDrag
Addr:0015ECC8 hint(0000) Name: ImageList_EndDrag
Addr:0015ECDC hint(0000) Name: ImageList_EndDrag
Addr:0015ECEF hint(0000) Name: ImageList_EndDrag
Import Module 016: ImageList_EndDrag
Addr:0015ED10 hint(0000) Name: ImageList_EndDrag
+++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++
我该咱办呢?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课