XP变脸王5.8.1.0(Armadillo-COPYMEM) ZZHZIHUI 21:54
序列号:XS-ZZHZIHUI@163.NET
注册码:7C4A7-A6269-2AC26-7D48B-BB0F3
CRK过程:
序列号格式:XS--------... (注意这个程序有黑名单-盗版序列号)如果开头不是XS则提示盗版
序列号填:XSHLS777777777
注册码填:aaaaa-bbbbb-ccccc-ddddd-eeeee
aaaaa-3D4C2
bbbbb-2DD48
ccccc-2E279
ddddd-39EBB
eeeee-AD158
跟踪得出注册码:3D4C2-2DD48-2E279-39EBB-AD158
------
载入主窗口时
00632D64 BA 28316300 MOV EDX,XPSTYLE.00633128 ; ASCII "Software\Holer\XPStyle"
00632D69 B9 90316300 MOV ECX,XPSTYLE.00633190 ; ASCII "Key1"
00632D6E B8 01000080 MOV EAX,80000001
00632D73 E8 AC9FE9FF CALL XPSTYLE.004CCD24
00632D78 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
00632D7B 50 PUSH EAX
00632D7C BA 28316300 MOV EDX,XPSTYLE.00633128 ; ASCII "Software\Holer\XPStyle"
00632D81 B9 A0316300 MOV ECX,XPSTYLE.006331A0 ; ASCII "sn"
00632D86 B8 01000080 MOV EAX,80000001
00632D8B E8 949FE9FF CALL XPSTYLE.004CCD24
00632D90 837D F8 00 CMP DWORD PTR SS:[EBP-8],0
00632D94 0F84 ED000000 JE XPSTYLE.00632E87
00632D9A 837D F4 00 CMP DWORD PTR SS:[EBP-C],0
00632D9E 0F84 E3000000 JE XPSTYLE.00632E87
00632DA4 8D85 48FEFFFF LEA EAX,DWORD PTR SS:[EBP-1B8]
00632DAA 50 PUSH EAX
00632DAB 8D8D 44FEFFFF LEA ECX,DWORD PTR SS:[EBP-1BC]
00632DB1 BA AC316300 MOV EDX,XPSTYLE.006331AC ; ASCII "Do NOT crack me!Merci!"
00632DB6 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00632DB9 E8 3654EBFF CALL XPSTYLE.004E81F4
00632DBE 8B85 44FEFFFF MOV EAX,DWORD PTR SS:[EBP-1BC]
00632DC4 B9 05000000 MOV ECX,5
00632DC9 BA 0E000000 MOV EDX,0E
00632DCE E8 D11FDDFF CALL XPSTYLE.00404DA4
00632DD3 8B95 48FEFFFF MOV EDX,DWORD PTR SS:[EBP-1B8]
00632DD9 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
00632DDC E8 AF1EDDFF CALL XPSTYLE.00404C90 ; 第一个注册码
00632DE1 0F85 A0000000 JNZ XPSTYLE.00632E87 ; 不跳注册版
00632DE7 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
------
桌面图标
0056610D B9 05000000 MOV ECX,5
00566112 BA 11000000 MOV EDX,11
00566117 E8 88ECE9FF CALL XPSTYLE.00404DA4
0056611C 8B95 B0FEFFFF MOV EDX,DWORD PTR SS:[EBP-150]
00566122 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00566125 E8 66EBE9FF CALL XPSTYLE.00404C90 ; 第二个注册码
0056612A 0F84 64010000 JE XPSTYLE.00566294
00566130 6A 10 PUSH 10
00566132 8D95 A4FEFFFF LEA EDX,DWORD PTR SS:[EBP-15C]
00566138 A1 146A6400 MOV EAX,DWORD PTR DS:[646A14]
0056613D E8 2E0AEAFF CALL XPSTYLE.00406B70
------
00569DD2 E8 CDAFE9FF CALL XPSTYLE.00404DA4
00569DD7 8B95 98FEFFFF MOV EDX,DWORD PTR SS:[EBP-168]
00569DDD 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00569DE0 E8 ABAEE9FF CALL XPSTYLE.00404C90 ; 这里可看到第三个注册码
00569DE5 0F84 64010000 JE XPSTYLE.00569F4F ; 跳转更换鼠标成功
00569DEB 6A 10 PUSH 10
00569DED 8D95 8CFEFFFF LEA EDX,DWORD PTR SS:[EBP-174]
00569DF3 A1 146A6400 MOV EAX,DWORD PTR DS:[646A14]
-------
动态桌面:
00629288 E8 17BBDDFF CALL XPSTYLE.00404DA4
0062928D 8B95 B8FEFFFF MOV EDX,DWORD PTR SS:[EBP-148] ; 注册码
00629293 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
00629296 E8 F5B9DDFF CALL XPSTYLE.00404C90 ; 第4个注册码
0062929B 0F84 64010000 JE XPSTYLE.00629405
006292A1 6A 10 PUSH 10
006292A3 8D95 ACFEFFFF LEA EDX,DWORD PTR SS:[EBP-154]
------
开机画面:
00623A6B 8D8D 1CFEFFFF LEA ECX,DWORD PTR SS:[EBP-1E4]
00623A71 BA 28466200 MOV EDX,XPSTYLE.00624628 ; ASCII "www.holersoft.com"
00623A76 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18]
00623A79 E8 7647ECFF CALL XPSTYLE.004E81F4
00623A7E 8B85 1CFEFFFF MOV EAX,DWORD PTR SS:[EBP-1E4]
00623A84 B9 05000000 MOV ECX,5
00623A89 BA 14000000 MOV EDX,14
00623A8E E8 1113DEFF CALL XPSTYLE.00404DA4
00623A93 8B95 20FEFFFF MOV EDX,DWORD PTR SS:[EBP-1E0]
00623A99 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00623A9C E8 EF11DEFF CALL XPSTYLE.00404C90 ;
第五个注册码
00623AA1 0F84 8F010000 JE XPSTYLE.00623C36
00623AA7 6A 40 PUSH 40
00623AA9 8D95 14FEFFFF LEA EDX,DWORD PTR SS:[EBP-1EC]
00623AAF A1 08726400 MOV EAX,DWORD PTR DS:[647208]
00623AB4 E8 B730DEFF CALL XPSTYLE.00406B70
00623AB9 8B95 14FEFFFF MOV EDX,DWORD PTR SS:[EBP-1EC]
00623ABF 8D8D 18FEFFFF LEA ECX,DWORD PTR SS:[EBP-1E8]
-----------
下BP MessageBoxA,在确认更换时中断,返回,然后自动步过,知道出现 未注册提示,按NUM-向后倒转查看代码,可看到诸如Key1,Key2,Key3,Key4,Key5和sn字样,注意这后面不久就有注册码比较了.
由于我是2K所以没法验证可视风格这个功能,但是我强制更改跳转.来到这里:
00561191 BA 38145600 MOV EDX,XPSTYLE.00561438; ASCII "Software\Holer\XPStyle"
00561196 B9 64145600 MOV ECX,XPSTYLE.00561464; ASCII "Key5"
0056119B B8 01000080 MOV EAX,80000001
005611A0 E8 7FBBF6FF CALL XPSTYLE.004CCD24
005611A5 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
.....
00561230 8B95 6CFEFFFF MOV EDX,DWORD PTR SS:[EBP-194]
00561236 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00561239 E8 523AEAFF CALL XPSTYLE.00404C90 ;关键CALL,比较
0056123E 74 46 JE SHORT XPSTYLE.00561286
00561240 6A 40 PUSH 40
00561242 8D95 60FEFFFF LEA EDX,DWORD PTR SS:[EBP-1A0]
所以这个功能还是通过KEY5来保护的.
这个程序比较奇怪,每段KEY管理一个功能:
KEY1-显示注册成功,退出无提示
KEY2-桌面图标
KEY3-鼠标主题
KEY4-动态桌面
KEY5-开机画面,可视风格
看他的帮助:*****
注册后您将获得以下功能和支持： CRK后功能
・无限制使用图标主题功能！ OK!!
・无限制使用鼠标指针主题功能！ OK!!
・无限制使用动态桌面功能！ OK!!
・无限制使用可视风格功能！ OK!!
・无限制使用开机画面功能！ OK!!
・取消退出本软件时弹出的注册提醒对话框！ OK!!
・获取桌面资源网站无限积分... SORRY
・得到完善和优先的技术支持！ SORRY
・永久免费升级到XP变脸王的最新版本。 SORRY
・以极其优惠的注册价格获取洪亮软件的其它共享软件SORRY
********
==========
脱壳参考：Armadillo v3.x for copymem-II 脱壳完全篇（xyang[OCN][BCG][FCG]2003.11.26)
注:凡标记(zzh:...)的是我加的注解.此过程中断点建议全用硬件断点,还好断点不多:)
OD1.10载入目标程序
★1,IsDebuggerPresent 隐藏调试器
★2,BP WaitForDebugEvent ,取消断点,改为硬件执行中断
运行一下就会来到函数的入口：
77E605B6 >-停在入口?PUSH EBP
在堆栈(Stack)窗口我们可以见到在此 API 函数有关参数的全部信息
0012E220 0043776E /CALL 到 WaitForDebugEvent
0012E224 0012EFF4 |pDebugEvent = 0012EFF4 //注意这个地址
0012E228 000003E8 \Timeout = 1000. ms
这个函数的作用我不知道，但我知道0012EFF4地址就是OEP将会出现的地方。来到转存窗口 G 0012EFF4 ：
0012EFF4 01 00 00 00 10 00 00 00 ... ...
0012EFFC 00 00 00 00 A8 F0 12 00 ....? .
0012F004 00 00 50 00 64 EF 12 00 ..P.d?.
0012F00C 5C F0 12 00 00 00 00 00 \?.....
0012F014 5C F1 12 00 00 00 00 01 \?....
0012F01C 58 EF 12 00 AC F0 12 00 X?.? .
0012F024 AC F2 12 00 34 5A F3 77 ? .4Z篦
0012F02C 58 BB F7 77 FF FF FF FF X击w??
0012F034 E7 DF F3 77 E1 26 F4 77 邕篦?赭
这一步的作用就是通过函数找到这个内存地址，因为他会出现真正的OEP入口。为什么？我也不知道。
取消这个硬件断点.
★3,硬件断点 WriteProcessMemory
那你可以通过按下 Shift + F9 顺利地绕过。这个软件还会出现未注册的Armadillo加壳提示，越过他。只要我们在 WriteProcessMemory API 停下了，千万不要触动任何键，来看看能有什么收获??
堆栈窗口可以看到第一个块的全部信息：
0012E0C0 0043AFC2 /CALL 到 WriteProcessMemory 来自 armadill.0043AFBC
0012E0C4 00000044 |hProcess = 00000044 (window)
0012E0C8 00425000 |Address = 425000
0012E0CC 003A2630 |Buffer = 003A2630
0012E0D0 00001000 |BytesToWrite = 1000 (4096.)
0012E0D4 0012E1DC \pBytesWritten = 0012E1DC
这个块开始在 425000 一直到 425FFF。OEP 必定在其值之内。让我们来留意刚才的那个转存窗口：
0012EFF4 01 00 00 00 B0 0E 00 00 ...?..
0012EFFC B8 0E 00 00 01 00 00 80 ?.. ..?
0012F004 00 00 00 00 00 00 00 00 ........
0012F00C D0 51 42 00 02 00 00 00 醒B. ...
0012F014 00 00 00 00 D0 51 42 00 ....醒B.
0012F01C D0 51 42 00 00 00 00 00 醒B.....
0012F024 00 00 00 00 00 00 00 00 ........
0012F02C 13 00 00 00 94 10 00 C0 ...?.
注意窗口中蓝色的字节004251D0（应该倒过来），这个值是在425000到 425FFF之间的值。那么软件的OEP应该的004251D0
取消这个硬件断点.
★4, NOP 填充 Cripter?Call (不让程序破坏解密的代码)
.L父进程会为他的子进程解密一个块。但是仍有 Cripter Call 那些加密或破坏旧块来避免被转储。现在就以实际操作来查找这样的 Call 然后用 NOP 填充替换它。这是个艰苦和复杂的工作
首先在cpu窗口中右击鼠标出现功能菜单，选择中断的〔条件记录〕窗口。在条件表达式中填(ESP+U)然后选择〔永远记录条件表达式〕。这个用来检查复制的数据块。
怎么查找Cripter Call呢？
在WriteProcessMemory函数的入口处停下。Alt+K打开调用堆栈窗口：
呼叫堆栈
地址 堆栈 例程 / 参数 调用来自 Frame
0012E0C0 0043AFC2 ? kernel32.WriteProcessMemory armadill.0043AFBC
0012E0C4 00000044 hProcess = 00000044 (window)
0012E0C8 00425000 Address = 425000
0012E0CC 003A2630 Buffer = 003A2630
0012E0D0 00001000 BytesToWrite = 1000 (4096.)
0012E0D4 0012E1DC pBytesWritten = 0012E1DC
0012E1E8 00439D34 ? armadill.0043A07B armadill.00439D2F
0012E21C 00437CA8 armadill.004398F5 armadill.00437CA3 0012E218
0012F5BC 00434384 armadill.00436099 armadill.0043437F 0012F5B8
0012FD20 00434BDA armadill.00433CF4 armadill.00434BD5 0012FD1C
0012FF38 0043CF87 armadill.00434940 armadill.<ModuleEntryPoint>+0C9 0012FF34
0012FF3C 00400000 Arg1 = 00400000 ASCII "MZP"
0012FF40 00000000 Arg2 = 00000000
0012FF44 00141EFB Arg3 = 00141EFB
0012FF48 0000000A Arg4 = 0000000A
看看这里：
0012E0C0 0043AFC2 ? kernel32.WriteProcessMemory armadill.0043AFBC
现在父进程的0043AFC2地址处调用了这个函数，向下看看：
0012E1E8 00439D34 ? armadill.0043A07B armadill.00439D2F
通过这个我们知道程序在00439D2F处也调用了这个函数。双击来到：
00439D27 MOV ECX,DWORD PTR SS:[EBP+C]
00439D2A PUSH ECX
00439D2B MOV EDX,DWORD PTR SS:[EBP+8]
00439D2E PUSH EDX
00439D2F CALL armadill.0043A07B //这里调用了上面的函数
00439D34 ADD ESP,0C
00439D37 AND EAX,0FF
00439D3C TEST EAX,EAX
00439D3E JNZ SHORT armadill.00439D47
00439D40 XOR AL,AL
00439D42 JMP armadill.0043A074
00439D2F CALL armadill.0043A07B 这个Call 是个解密的函数，那么肯定有一个破坏解密的函数。查找另外一个同样的Call的地方就是我们要找的地方，在OD中的：
00439D2F CALL armadill.0043A07B 处右击功能菜单，选择〔查找参考〕……〔调用目标〕选项就会打开全部的调用什么Call的地方：
参考位于armadill:.text 到 0043A07B
地址 反汇编 注释
00439D2F CALL armadill.0043A07B (初始 CPU 选择)
00439FEA CALL armadill.0043A07B //原来这里有一个^_^
双击00439FEA CALL armadill.0043A07B就会来到这个梦中的地方：
00439FDA MOV ECX,DWORD PTR DS:[462AAC]
00439FE0 MOV EDX,DWORD PTR DS:[462AB0]
00439FE6 MOV EAX,DWORD PTR DS:[EDX+ECX*4]
00439FE9 PUSH EAX
00439FEA CALL armadill.0043A07B //这里 这里 这里 (zzh:这行NOP掉)
00439FEF ADD ESP,0C
00439FF2 PUSHFD
00439FF3 PUSHAD
00439FF4 JMP SHORT armadill.0043A021
没有别的说了，nop他。
★5,运行该 API 然后在 OEP 中生成一个死循环
现在是时侯要执行 WriteProcessMemory 一次了。执行到返回,然后按一次 F7。
反正回到API的调用处就可以了：
0043AFB3 PUSH EDX ; |Address
0043AFB4 MOV EAX,DWORD PTR DS:[462A9C] ; |
0043AFB9 MOV ECX,DWORD PTR DS:[EAX] ; |
0043AFBB PUSH ECX ; |hProcess
0043AFBC CALL NEAR DWORD PTR DS:[<&KERNEL32.WriteProcessMe>; \WriteProcessMemory ********
0043AFC2 TEST EAX,EAX
0043AFC4 JNZ SHORT armadill.0043B001
0043AFC6 PUSHFD
0043AFC7 PUSHAD
0043AFC8 JMP SHORT armadill.0043AFF5
现在是 PUPE 运作的时候了，PUPE 修改内存中程序指令的工具.
到OEP然后将指令改为EBFE ,就是JMP EIP 死循环了.
(zzh:这个工具可能大家没有,不过可以用WINHEX或者其他游戏修改工具的 内存编辑 功能来完成
不过,要记着OEP的原是指令代码,以便以后改回.)
★6,硬件断点WaitForDebugEvent 和 NOP 填充 API
在命令行中键入 BP WaitForDebugEvent 然后按回车键，最后点击 RUN
（为什么要下这个API请参照leo_cyl1大虾的文章）
当停止后，会来到这里：
77E605B6 >PUSH EBP //停在这里
77E605B7 MOV EBP,ESP
你要切记：在任何时候都绝对不要运行这个 API！留意一下在 (转储)窗口中的报表，然后转到 STACK (堆栈)窗口。这段我也只能抄，我太菜了。现在来看看堆栈窗口中的信息：
0012E220 0043776E /CALL 到 WaitForDebugEvent //调用信息
0012E224 0012EFF4 |pDebugEvent = 0012EFF4
0012E228 000003E8 \Timeout = 1000. ms
可以看到，如果我们运行这个 API，我们将要转到0043776E所以在主窗口用Go to|Expression =0043776E能到达那里。
0043776E TEST EAX,EAX
再一次提醒你：不要运行这个 API！因而在0043776E内按右键然后选择[新建起源]。这是跳过该 API 的正确做法。现在我们必须用 NOP 来填充调用到该 API 及其有关 Push。
把下面的代码用nop修改掉：
00437759 MOV AL,BYTE PTR DS:[E8686133]
0043775E ADD EAX,DWORD PTR DS:[EAX]
00437760 ADD BYTE PTR DS:[EBX+FFFA3895],CL
00437766 CALL NEAR DWORD PTR DS:[EDX-1]
00437769 ADC EAX,<&KERNEL32.WaitForDebugEvent>
（不知道为什么这段代码是动态的）
改为：
00437759 NOP
0043775A NOP
0043775B NOP
0043775C NOP
0043775D NOP
0043775E NOP
0043775F NOP
00437760 NOP
00437761 NOP
00437762 NOP
00437763 NOP
00437764 NOP
00437765 NOP
00437766 NOP
00437767 NOP
00437768 NOP
00437769 NOP
0043776A NOP
0043776B NOP
0043776C NOP
0043776D NOP
0043776E TEST EAX,EAX (zzh:就是NOP这行前的21字节)
★7, 打补丁
“当处理这个步骤时要特别小心! 多数人并不知道究竟是如何打补钉的正确方法，所以要尽力领会我在这里是怎样做，并且你还需要在其它情况下会完成。” 我是试了几次才成功的！
第一步是更改此跳转：
0043776E TEST EAX,EAX
00437770 JE armadill.004398A5 //把这里修改为 Jmp 00401000
Why？ 因为父进程的偏移是00401000 我们需要在那里打补丁。
现在go 00401000 准备打补丁了：
00401000 ADD BYTE PTR DS:[EAX],AL
00401002 ADD BYTE PTR DS:[EAX],AL
00401004 ADD BYTE PTR DS:[EAX],AL
00401006 ADD BYTE PTR DS:[EAX],AL
00401008 ADD BYTE PTR DS:[EAX],AL
来看看内存镜象中的数据，Alt+M 打开内存镜象窗口：
00400000 00001000 armadill PE header Imag R RWE
00401000 00025000 armadill CODE Imag R RWE
00426000 00001000 armadill DATA Imag R RWE(zzh:代码段)
00427000 00001000 armadill BSS Imag R RWE
...
看看程序的代码段开始于00401000 结束于00425FFF
在转存窗口中把OEP的入口修改为400000，修改后是这样的：
0012EFF4 01 00 00 00 B0 0E 00 00 ...?..
0012EFFC B8 0E 00 00 01 00 00 80 ?.. ..?
0012F004 00 00 00 00 00 00 00 00 ........
0012F00C 00 00 40 00 02 00 00 00 ..@. ... //*******
0012F014 00 00 00 00 00 00 40 00 ......@. //*******
0012F01C 00 00 40 00 00 00 00 00 ..@..... //*******
因为每个块循环以 1000作增量补钉，所以要解压的第一块必须是401000。
现在我们必须在主窗口下以 401000 作开始行，并写入
00401000 8105 0CF01200 00100000 ADD DWORD PTR DS:[12F00C],1000
0040100A 8105 18F01200 00100000 ADD DWORD PTR DS:[12F018],1000
00401014 8105 1CF01200 00100000 ADD DWORD PTR DS:[12F01C],1000
这里补丁要和转存窗口中的地址一致。
(zzh:其中12f00c,12f018,12f01c就是数据窗保存OEP的地方,有三个;
1000是写入数据块大小,和前面WriteProcessMemory调用的BytesToWrite = 1000 (4096.) 一致)
下一行就要这样写∶
0040101E CMP DWORD PTR DS:[12F01C],armadill.00426000
(zzh: ^^最后一个OEP ^^CODE段的大小,就是起始地址401000+大小25000=426000)
//测试代码段结束了吗？
要知道何时我们已经解压了全部块。
则必须写入∶
00401028 - 0F85 F6341F00 JNZ 00437775 //没有完成就继续
(zzh:这个437775实际是第七步中
"00437770 JE armadill.004398A5 //把这里修改为 Jmp 00401000"
的下一句.)
如果比较结果不是 True，那这个循环返回到的位置紧挨着哪里是调用该循环。然后我们必须写入下一行写 NOP ，我们将放置一个 BP，是要在完成转储操作时来停止它。
下面是打好补丁的全部代码：
00401000 ADD DWORD PTR DS:[12F00C],1000
0040100A ADD DWORD PTR DS:[12F018],1000
00401014 ADD DWORD PTR DS:[12F01C],1000
0040101E CMP DWORD PTR DS:[12F01C],armadill.00426000
00401028 JNZ armadill.00437775
0040102E NOP //这里下个中断，如果完成了就断在这里。
0040102F NOP
好了，最关键的部分完成了，下面就可以脱壳了。
★8,脱壳了
检查一下前面的几步，保证他的正确后就运行这个程序了。F9一下，哈哈中断在：
0040102E NOP //这里下个中断，如果完成了就断在这里
好像成功了耶！
看看记录里有些什么，Alt+L打开记录窗口：
77E65A12 COND: 未知的标示符
77E65A12 COND: 未知的标示符
77E65A12 COND: 未知的标示符
......
0040102E 中断在 armadill.0040102E
★9,由父进程解出子进程
先用OD的附加功能查看子进程的句柄，打开附加窗口，看到没有变色的那个armadillo3.exe就是子进程，他的句柄是OBDC （这个值每次加载后就会变）
在程序中写入下面的代码：
0040102E PUSH 0BDC //PUSH (子进程句柄)
00401033 CALL kernel32.DebugActiveProcessStop
00401038 NOP // 这里下个中断
运行程序。看看寄存器窗口，如果当 程序 在 EAX = 1 停下时，可以确定子进程与他的父进程已经分离，然后我们可以关闭 OllyDbg。而如果 EAX = 0，那是因为你写入有点不对劲（可能是句柄），则你必须要从头到尾核对那些行。你可以重新写入代码，再来一次。
现在关闭 OllyDbg 然后再次打开它。不要装入任何东西。转到菜单 文件|附加 然后寻找子进程并且 附加上 它(我们已经杀死他的父进程 :X)。
只要成功附加上，运行一下，程序就会在死循环运行，因此按 F12 来暂停程序，然后在PUPE中把OEP的代码还原成55 8B ，再“Parchear”一下就会还原成原来的代码了。
打开 LordPE 然后搜索armadillo3.exe这个进程。选择这进程以及选择〔active dump engine〕| 〔IntelliDump〕|〔select〕，然后点击 Dump full ，一旦保存完成，立即运行 PEditor (，然后再写入这个有效的入口点( ENTRY POINT)。计算一下是4251D0-400000＝251D0 修复即可。
(zzh:很可惜我用的是2K,根本没有DebugActiveProcessStop这个api,实际上我们可以让父进程跑飞,就是按F9运行,虽然OD提示异常等等,不要管他,用LordPE可以DUMP子进程了,不过记着改回OEP还有OEP处的JMP EIP指令)
(zzh:IAT修复找出MAGIC跳转就可以了.)
＝＝＝＝＝＝
2k环境:
本程序补丁.
00401000 8105 A0EB1200 00100>ADD DWORD PTR DS:[12EBA0],1000
0040100A 8105 ACEB1200 00100>ADD DWORD PTR DS:[12EBAC],1000
00401014 8105 B0EB1200 00100>ADD DWORD PTR DS:[12EBB0],1000
0040101E 813D B0EB1200 00806>CMP DWORD PTR DS:[12EBB0],XPSTYLE.00638000
00401028 - 0F85 03BD2A00 JNZ XPSTYLE.006ACD31
0040102E 90 NOP
0040102F 90 NOP
kernel32.DebugActiveProcessStop 这个api只有xp以上的系统才有，MD
=======
//waitdebugevent..
006ACD31 90 NOP
=========
006AF827 . 50 PUSH EAX
006AF828 90 NOP ;破坏代码
006AF829 90 NOP
006AF82A 90 NOP
006AF82B 90 NOP
006AF82C 90 NOP
006AF82D . 83C4 0C ADD ESP,0C
006AF830 . 9C PUSHFD
006AF831 . 60 PUSHAD
内存镜像, 项目 12
地址=00401000
大小=00237000 (2322432.)
Owner=XPSTYLE 00400000
Section=CODE
类型=Imag 01001002
访问=R
初始访问=RWE
401000-637fff
MD这是个COPYMEMii的壳
637e98 字节558b
..
416000- 421fff
425000- 436fff
438000- 439fff
43b000- 43efff
442000- 445fff
447000- 44afff
尝试用WINHEX拷贝代码块,再粘贴,太多了,放弃,居然没发现是COPYMEMII
==========
附:2K下的IAT表:
; Syntax for each function in a thunk (the separator is a TAB)
; ------------------------------------------------------------
; Flag RVA ModuleName Ordinal name
;
; Details for <Valid> parameter:
; ------------------------------
; Flag: 0 = valid: no -> - Name contains the address of the redirected API (you can set
; it to zero if you edit it).
; - Ordinal is not considered but you should let '0000' as value.
; - ModuleName is not considered but you should let '?' as value.
;
; 1 = valid: yes -> All next parameters on the line will be considered.
; Function imported by ordinal must have no name (the 4th TAB must
; be there though).
;
; 2 = Equivalent to 0 but it is for the loader.
;
; 3 = Equivalent to 1 but it is for the loader.
;
; 4 = Equivalent to 0 with (R) tag.
;
; 5 = Equivalent to 1 with (R) tag.
;
; And finally, edit this file as your own risk! :-)
Target: C:\Program Files\XP变脸王\XPStyle.exe
OEP: 00237E98 IATRVA: 0028022C IATSize: 00000968
FThunk: 00280230 NbFunc: 00000030
1 00280230 kernel32.dll 005B DeleteCriticalSection
1 00280234 kernel32.dll 01DF LeaveCriticalSection
1 00280238 kernel32.dll 0070 EnterCriticalSection
1 0028023C kernel32.dll 01C6 InitializeCriticalSection
1 00280240 kernel32.dll 02F2 VirtualFree
1 00280244 kernel32.dll 02EF VirtualAlloc
1 00280248 kernel32.dll 01EA LocalFree
1 0028024C kernel32.dll 01E6 LocalAlloc
1 00280250 kernel32.dll 0187 GetTickCount
1 00280254 kernel32.dll 022C QueryPerformanceCounter
1 00280258 kernel32.dll 018F GetVersion
1 0028025C kernel32.dll 010D GetCurrentThreadId
1 00280260 kernel32.dll 01C9 InterlockedDecrement
1 00280264 kernel32.dll 01CC InterlockedIncrement
1 00280268 kernel32.dll 02F7 VirtualQuery
1 0028026C kernel32.dll 0302 WideCharToMultiByte
1 00280270 kernel32.dll 0289 SetCurrentDirectoryA
1 00280274 kernel32.dll 0203 MultiByteToWideChar
1 00280278 kernel32.dll 0335 lstrlen
1 0028027C kernel32.dll 0332 lstrcpyn
1 00280280 kernel32.dll 01E1 LoadLibraryExA
1 00280284 kernel32.dll 0182 GetThreadLocale
1 00280288 kernel32.dll 0167 GetStartupInfoA
1 0028028C kernel32.dll 0154 GetProcAddress
1 00280290 kernel32.dll 013B GetModuleHandleA
1 00280294 kernel32.dll 0139 GetModuleFileNameA
1 00280298 kernel32.dll 0131 GetLocaleInfoA
1 0028029C kernel32.dll 012E GetLastError
1 002802A0 kernel32.dll 0108 GetCurrentDirectoryA
1 002802A4 kernel32.dll 00DB GetCommandLineA
1 002802A8 kernel32.dll 00C4 FreeLibrary
1 002802AC kernel32.dll 00A4 FindFirstFileA
1 002802B0 kernel32.dll 00A0 FindClose
1 002802B4 kernel32.dll 008D ExitProcess
1 002802B8 kernel32.dll 008E ExitThread
1 002802BC kernel32.dll 004E CreateThread
1 002802C0 kernel32.dll 030F WriteFile
1 002802C4 kernel32.dll 02DC UnhandledExceptionFilter
1 002802C8 kernel32.dll 0296 SetFilePointer
1 002802CC kernel32.dll 028D SetEndOfFile
1 002802D0 kernel32.dll 0258 RtlUnwind
1 002802D4 kernel32.dll 023E ReadFile
1 002802D8 kernel32.dll 0231 RaiseException
1 002802DC kernel32.dll 0169 GetStdHandle
1 002802E0 kernel32.dll 0126 GetFileSize
1 002802E4 kernel32.dll 0129 GetFileType
1 002802E8 kernel32.dll 0038 CreateFileA
1 002802EC kernel32.dll 001F CloseHandle
FThunk: 002802F4 NbFunc: 00000004
1 002802F4 user32.dll 011C GetKeyboardType
1 002802F8 user32.dll 01B0 LoadStringA
1 002802FC user32.dll 01C4 MessageBoxA
1 00280300 user32.dll 0026 CharNextA
FThunk: 00280308 NbFunc: 00000003
1 00280308 advapi32.dll 01A9 RegQueryValueExA
1 0028030C advapi32.dll 019F RegOpenKeyExA
1 00280310 advapi32.dll 0186 RegCloseKey
FThunk: 00280318 NbFunc: 00000003
1 00280318 oleaut32.dll 0006 SysFreeString
1 0028031C oleaut32.dll 0005 SysReAllocStringLen
1 00280320 oleaut32.dll 0004 SysAllocStringLen
FThunk: 00280328 NbFunc: 00000004
1 00280328 kernel32.dll 02D4 TlsSetValue
1 0028032C kernel32.dll 02D3 TlsGetValue
1 00280330 kernel32.dll 01E6 LocalAlloc
1 00280334 kernel32.dll 013B GetModuleHandleA
FThunk: 0028033C NbFunc: 0000000A
1 0028033C advapi32.dll 01B4 RegSetValueExA
1 00280340 advapi32.dll 01A9 RegQueryValueExA
1 00280344 advapi32.dll 01A4 RegQueryInfoKeyA
1 00280348 advapi32.dll 019F RegOpenKeyExA
1 0028034C advapi32.dll 0198 RegFlushKey
1 00280350 advapi32.dll 0193 RegEnumKeyExA
1 00280354 advapi32.dll 018F RegDeleteValueA
1 00280358 advapi32.dll 018D RegDeleteKeyA
1 0028035C advapi32.dll 018A RegCreateKeyExA
1 00280360 advapi32.dll 0186 RegCloseKey
FThunk: 00280368 NbFunc: 0000007B
1 00280368 kernel32.dll 0335 lstrlen
1 0028036C kernel32.dll 032F lstrcpy
1 00280370 kernel32.dll 0329 lstrcmp
1 00280374 kernel32.dll 0320 _lclose
1 00280378 kernel32.dll 0314 WritePrivateProfileStringA
1 0028037C kernel32.dll 030F WriteFile
1 00280380 kernel32.dll 0303 WinExec
1 00280384 kernel32.dll 0302 WideCharToMultiByte
1 00280388 kernel32.dll 02FE WaitForSingleObject
1 0028038C kernel32.dll 02FC WaitForMultipleObjects
1 00280390 kernel32.dll 02F7 VirtualQuery
1 00280394 kernel32.dll 02EF VirtualAlloc
1 00280398 kernel32.dll 02DF UnmapViewOfFile
1 0028039C kernel32.dll 02C6 SuspendThread
1 002803A0 kernel32.dll 02C4 Sleep
1 002803A4 kernel32.dll 02C3 SizeofResource
1 002803A8 kernel32.dll 02B4 SetThreadLocale
1 002803AC kernel32.dll 0298 SetFileTime
1 002803B0 kernel32.dll 0296 SetFilePointer
1 002803B4 kernel32.dll 0294 SetFileAttributesA
1 002803B8 kernel32.dll 0291 SetEvent
1 002803BC kernel32.dll 0290 SetErrorMode
1 002803C0 kernel32.dll 028D SetEndOfFile
1 002803C4 kernel32.dll 0289 SetCurrentDirectoryA
1 002803C8 kernel32.dll 0255 ResumeThread
1 002803CC kernel32.dll 0253 ResetEvent
1 002803D0 kernel32.dll 024A ReleaseMutex
1 002803D4 kernel32.dll 023E ReadFile
1 002803D8 kernel32.dll 022D QueryPerformanceFrequency
1 002803DC kernel32.dll 022C QueryPerformanceCounter
1 002803E0 kernel32.dll 0219 OutputDebugStringA
1 002803E4 kernel32.dll 020B OpenFile
1 002803E8 kernel32.dll 0203 MultiByteToWideChar
1 002803EC kernel32.dll 0202 MulDiv
1 002803F0 kernel32.dll 01FC MoveFileA
1 002803F4 kernel32.dll 01F6 MapViewOfFile
1 002803F8 kernel32.dll 01F3 LockResource
1 002803FC kernel32.dll 01E8 LocalFileTimeToFileTime
1 00280400 kernel32.dll 01E5 LoadResource
1 00280404 kernel32.dll 01E1 LoadLibraryExA
1 00280408 kernel32.dll 01E0 LoadLibraryA
1 0028040C kernel32.dll 01DF LeaveCriticalSection
1 00280410 kernel32.dll 01C6 InitializeCriticalSection
1 00280414 kernel32.dll 01AF GlobalUnlock
1 00280418 kernel32.dll 01AC GlobalSize
1 0028041C kernel32.dll 01AB GlobalReAlloc
1 00280420 kernel32.dll 01A9 GlobalMemoryStatus
1 00280424 kernel32.dll 01A7 GlobalHandle
1 00280428 kernel32.dll 01A8 GlobalLock
1 0028042C kernel32.dll 01A4 GlobalFree
1 00280430 kernel32.dll 01A0 GlobalFindAtomA
1 00280434 kernel32.dll 019F GlobalDeleteAtom
1 00280438 kernel32.dll 019D GlobalAlloc
1 0028043C kernel32.dll 019B GlobalAddAtomA
1 00280440 kernel32.dll 0198 GetWindowsDirectoryA
1 00280444 kernel32.dll 0192 GetVolumeInformationA
1 00280448 kernel32.dll 0190 GetVersionExA
1 0028044C kernel32.dll 018F GetVersion
1 00280450 kernel32.dll 018B GetUserDefaultLCID
1 00280454 kernel32.dll 018A GetTimeZoneInformation
1 00280458 kernel32.dll 0187 GetTickCount
1 0028045C kernel32.dll 0182 GetThreadLocale
1 00280460 kernel32.dll 017F GetTempPathA
1 00280464 kernel32.dll 017D GetTempFileNameA
1 00280468 kernel32.dll 0173 GetSystemInfo
1 0028046C kernel32.dll 0171 GetSystemDirectoryA
1 00280470 kernel32.dll 016B GetStringTypeExA
1 00280474 kernel32.dll 0169 GetStdHandle
1 00280478 kernel32.dll 0154 GetProcAddress
1 0028047C kernel32.dll 0150 GetPrivateProfileStringA
1 00280480 kernel32.dll 013B GetModuleHandleA
1 00280484 kernel32.dll 0139 GetModuleFileNameA
1 00280488 kernel32.dll 0135 GetLogicalDrives
1 0028048C kernel32.dll 0131 GetLocaleInfoA
1 00280490 kernel32.dll 0130 GetLocalTime
1 00280494 kernel32.dll 012E GetLastError
1 00280498 kernel32.dll 012A GetFullPathNameA
1 0028049C kernel32.dll 0128 GetFileTime
1 002804A0 kernel32.dll 0126 GetFileSize
1 002804A4 kernel32.dll 0121 GetFileAttributesA
1 002804A8 kernel32.dll 0120 GetExitCodeThread
1 002804AC kernel32.dll 011F GetExitCodeProcess
1 002804B0 kernel32.dll 0118 GetDriveTypeA
1 002804B4 kernel32.dll 0114 GetDiskFreeSpaceA
1 002804B8 kernel32.dll 010E GetDateFormatA
1 002804BC kernel32.dll 010D GetCurrentThreadId
1 002804C0 kernel32.dll 010B GetCurrentProcessId
1 002804C4 kernel32.dll 0108 GetCurrentDirectoryA
1 002804C8 kernel32.dll 00DF GetComputerNameA
1 002804CC kernel32.dll 00D0 GetCPInfo
1 002804D0 kernel32.dll 00CA GetACP
1 002804D4 kernel32.dll 00C6 FreeResource
1 002804D8 kernel32.dll 01CC InterlockedIncrement
1 002804DC kernel32.dll 01CA InterlockedExchange
1 002804E0 kernel32.dll 01C9 InterlockedDecrement
1 002804E4 kernel32.dll 00C4 FreeLibrary
1 002804E8 kernel32.dll 00BF FormatMessageA
1 002804EC kernel32.dll 00B3 FindResourceA
1 002804F0 kernel32.dll 00AD FindNextFileA
1 002804F4 kernel32.dll 00AC FindNextChangeNotification
1 002804F8 kernel32.dll 00A4 FindFirstFileA
1 002804FC kernel32.dll 00A2 FindFirstChangeNotificationA
1 00280500 kernel32.dll 00A1 FindCloseChangeNotification
1 00280504 kernel32.dll 00A0 FindClose
1 00280508 kernel32.dll 009A FileTimeToSystemTime
1 0028050C kernel32.dll 0099 FileTimeToLocalFileTime
1 00280510 kernel32.dll 0098 FileTimeToDosDateTime
1 00280514 kernel32.dll 0071 EnumCalendarInfoA
1 00280518 kernel32.dll 0070 EnterCriticalSection
1 0028051C kernel32.dll 0069 DosDateTimeToFileTime
1 00280520 kernel32.dll 0064 DeviceIoControl
1 00280524 kernel32.dll 005D DeleteFileA
1 00280528 kernel32.dll 005B DeleteCriticalSection
1 0028052C kernel32.dll 004E CreateThread
1 00280530 kernel32.dll 0048 CreateProcessA
1 00280534 kernel32.dll 0043 CreateMutexA
1 00280538 kernel32.dll 0039 CreateFileMappingA
1 0028053C kernel32.dll 0038 CreateFileA
1 00280540 kernel32.dll 0035 CreateEventA
1 00280544 kernel32.dll 0031 CreateDirectoryA
1 00280548 kernel32.dll 002C CopyFileA
1 0028054C kernel32.dll 0025 CompareStringA
1 00280550 kernel32.dll 001F CloseHandle
FThunk: 00280558 NbFunc: 00000003
1 00280558 version.dll 000B VerQueryValueA
1 0028055C version.dll 0002 GetFileVersionInfoSizeA
1 00280560 version.dll 0001 GetFileVersionInfoA
FThunk: 00280568 NbFunc: 0000005D
1 00280568 gdi32.dll 0211 UnrealizeObject
1 0028056C gdi32.dll 0209 StretchDIBits
1 00280570 gdi32.dll 0208 StretchBlt
1 00280574 gdi32.dll 0202 SetWindowOrgEx
1 00280578 gdi32.dll 0201 SetWindowExtEx
1 0028057C gdi32.dll 0200 SetWinMetaFileBits
1 00280580 gdi32.dll 01FE SetViewportOrgEx
1 00280584 gdi32.dll 01FD SetViewportExtEx
1 00280588 gdi32.dll 01FB SetTextColor
1 0028058C gdi32.dll 01F7 SetStretchBltMode
1 00280590 gdi32.dll 01F4 SetROP2
1 00280594 gdi32.dll 01F0 SetPixel
1 00280598 gdi32.dll 01EF SetPaletteEntries
1 0028059C gdi32.dll 01EA SetMapMode
1 002805A0 gdi32.dll 01E1 SetEnhMetaFileBits
1 002805A4 gdi32.dll 01DD SetDIBColorTable
1 002805A8 gdi32.dll 01D8 SetBrushOrgEx
1 002805AC gdi32.dll 01D6 SetBkMode
1 002805B0 gdi32.dll 01D5 SetBkColor
1 002805B4 gdi32.dll 01D0 SelectPalette
1 002805B8 gdi32.dll 01CF SelectObject
1 002805BC gdi32.dll 01CD SelectClipRgn
1 002805C0 gdi32.dll 01C8 SaveDC
1 002805C4 gdi32.dll 01C2 RoundRect
1 002805C8 gdi32.dll 01C1 RestoreDC
1 002805CC gdi32.dll 01B7 Rectangle
1 002805D0 gdi32.dll 01B6 RectVisible
1 002805D4 gdi32.dll 01B4 RealizePalette
1 002805D8 gdi32.dll 01B1 PtInRegion
1 002805DC gdi32.dll 01AF Polyline
1 002805E0 gdi32.dll 01AE Polygon
1 002805E4 gdi32.dll 01AB PolyPolyline
1 002805E8 gdi32.dll 01A1 PlayEnhMetaFile
1 002805EC gdi32.dll 019E PatBlt
1 002805F0 gdi32.dll 0195 OffsetRgn
1 002805F4 gdi32.dll 0192 MoveToEx
1 002805F8 gdi32.dll 018F MaskBlt
1 002805FC gdi32.dll 018E LineTo
1 00280600 gdi32.dll 018D LineDDA
1 00280604 gdi32.dll 018C LPtoDP
1 00280608 gdi32.dll 018A IntersectClipRect
1 0028060C gdi32.dll 0186 GetWindowOrgEx
1 00280610 gdi32.dll 0184 GetWinMetaFileBits
1 00280614 gdi32.dll 017F GetTextMetricsA
1 00280618 gdi32.dll 0179 GetTextExtentPointA
1 0028061C gdi32.dll 0178 GetTextExtentPoint32W
1 00280620 gdi32.dll 0177 GetTextExtentPoint32A
1 00280624 gdi32.dll 016C GetSystemPaletteEntries
1 00280628 gdi32.dll 0168 GetStockObject
1 0028062C gdi32.dll 0167 GetRgnBox
1 00280630 gdi32.dll 015F GetPixel
1 00280634 gdi32.dll 015D GetPaletteEntries
1 00280638 gdi32.dll 0158 GetObjectA
1 0028063C gdi32.dll 0138 GetEnhMetaFilePaletteEntries
1 00280640 gdi32.dll 0137 GetEnhMetaFileHeader
1 00280644 gdi32.dll 0135 GetEnhMetaFileDescriptionA
1 00280648 gdi32.dll 0134 GetEnhMetaFileBits
1 0028064C gdi32.dll 012E GetDeviceCaps
1 00280650 gdi32.dll 012D GetDIBits
1 00280654 gdi32.dll 012C GetDIBColorTable
1 00280658 gdi32.dll 012A GetDCOrgEx
1 0028065C gdi32.dll 0128 GetCurrentPositionEx
1 00280660 gdi32.dll 0127 GetCurrentObject
1 00280664 gdi32.dll 0123 GetClipBox
1 00280668 gdi32.dll 0113 GetBrushOrgEx
1 0028066C gdi32.dll 010E GetBitmapBits
1 00280670 gdi32.dll 00E0 GdiFlush
1 00280674 gdi32.dll 00A3 ExtTextOutA
1 00280678 gdi32.dll 009F ExtCreateRegion
1 0028067C gdi32.dll 009E ExtCreatePen
1 00280680 gdi32.dll 009D ExcludeClipRect
1 00280684 gdi32.dll 005A Ellipse
1 00280688 gdi32.dll 0055 DeleteObject
1 0028068C gdi32.dll 0053 DeleteEnhMetaFile
1 00280690 gdi32.dll 0052 DeleteDC
1 00280694 gdi32.dll 004F CreateSolidBrush
1 00280698 gdi32.dll 004A CreateRectRgn
1 0028069C gdi32.dll 0047 CreatePenIndirect
1 002806A0 gdi32.dll 0044 CreatePalette
1 002806A4 gdi32.dll 003E CreateHalftonePalette
1 002806A8 gdi32.dll 0039 CreateFontIndirectA
1 002806AC gdi32.dll 0036 CreateEnhMetaFileA
1 002806B0 gdi32.dll 0032 CreateDIBitmap
1 002806B4 gdi32.dll 0031 CreateDIBSection
1 002806B8 gdi32.dll 002D CreateDCA
1 002806BC gdi32.dll 002C CreateCompatibleDC
1 002806C0 gdi32.dll 002B CreateCompatibleBitmap
1 002806C4 gdi32.dll 0028 CreateBrushIndirect
1 002806C8 gdi32.dll 0026 CreateBitmap
1 002806CC gdi32.dll 0022 CopyEnhMetaFileA
1 002806D0 gdi32.dll 0020 CombineRgn
1 002806D4 gdi32.dll 001B CloseEnhMetaFile
1 002806D8 gdi32.dll 0013 BitBlt
FThunk: 002806E0 NbFunc: 000000C9
1 002806E0 user32.dll 005B CreateWindowExA
1 002806E4 user32.dll 02B6 wvsprintfA
1 002806E8 user32.dll 02B1 WindowFromPoint
1 002806EC user32.dll 02AE WinHelpA
1 002806F0 user32.dll 02AC WaitMessage
1 002806F4 user32.dll 02A1 ValidateRect
1 002806F8 user32.dll 0297 UpdateWindow
1 002806FC user32.dll 0291 UnregisterClassA
1 00280700 user32.dll 028D UnionRect
1 00280704 user32.dll 028C UnhookWindowsHookEx
1 00280708 user32.dll 0288 TranslateMessage
1 0028070C user32.dll 0287 TranslateMDISysAccel
1 00280710 user32.dll 0282 TrackPopupMenu
1 00280714 user32.dll 0277 SystemParametersInfoA
1 00280718 user32.dll 0270 ShowWindow
1 0028071C user32.dll 026E ShowScrollBar
1 00280720 user32.dll 026D ShowOwnedPopups
1 00280724 user32.dll 026C ShowCursor
1 00280728 user32.dll 026B ShowCaret
1 0028072C user32.dll 0262 SetWindowRgn
1 00280730 user32.dll 0268 SetWindowsHookExA
1 00280734 user32.dll 0264 SetWindowTextA
1 00280738 user32.dll 0261 SetWindowPos
1 0028073C user32.dll 0260 SetWindowPlacement
1 00280740 user32.dll 025E SetWindowLongA
1 00280744 user32.dll 0258 SetTimer
1 00280748 user32.dll 0251 SetSysColors
1 0028074C user32.dll 024E SetScrollRange
1 00280750 user32.dll 024D SetScrollPos
1 00280754 user32.dll 024C SetScrollInfo
1 00280758 user32.dll 024A SetRect
1 0028075C user32.dll 0248 SetPropA
1 00280760 user32.dll 0244 SetParent
1 00280764 user32.dll 0240 SetMenuItemInfoA
1 00280768 user32.dll 023B SetMenu
1 0028076C user32.dll 0237 SetKeyboardState
1 00280770 user32.dll 0235 SetForegroundWindow
1 00280774 user32.dll 0234 SetFocus
1 00280778 user32.dll 022B SetCursor
1 0028077C user32.dll 0228 SetClipboardData
1 00280780 user32.dll 0225 SetClassLongA
1 00280784 user32.dll 0224 SetCaretPos
1 00280788 user32.dll 0222 SetCapture
1 0028078C user32.dll 0221 SetActiveWindow
1 00280790 user32.dll 021C SendMessageTimeoutA
1 00280794 user32.dll 0219 SendMessageA
1 00280798 user32.dll 0213 ScrollWindowEx
1 0028079C user32.dll 0212 ScrollWindow
1 002807A0 user32.dll 020F ScreenToClient
1 002807A4 user32.dll 020A RemovePropA
1 002807A8 user32.dll 0209 RemoveMenu
1 002807AC user32.dll 0208 ReleaseDC
1 002807B0 user32.dll 0207 ReleaseCapture
1 002807B4 user32.dll 01FB RegisterClipboardFormatA
1 002807B8 user32.dll 01FB RegisterClipboardFormatA
1 002807BC user32.dll 01F7 RegisterClassA
1 002807C0 user32.dll 01F6 RedrawWindow
1 002807C4 user32.dll 01EF PtInRect
1 002807C8 user32.dll 01E6 PostQuitMessage
1 002807CC user32.dll 01E4 PostMessageA
1 002807D0 user32.dll 01E2 PeekMessageA
1 002807D4 user32.dll 01D9 OpenClipboard
1 002807D8 user32.dll 01D8 OffsetRect
1 002807DC user32.dll 01D4 OemToCharA
1 002807E0 user32.dll 01D3 OemKeyScan
1 002807E4 user32.dll 01D0 MsgWaitForMultipleObjects
1 002807E8 user32.dll 01C4 MessageBoxA
1 002807EC user32.dll 01C3 MessageBeep
1 002807F0 user32.dll 01BF MapWindowPoints
1 002807F4 user32.dll 01BB MapVirtualKeyA
1 002807F8 user32.dll 01B4 LockWindowUpdate
1 002807FC user32.dll 01B0 LoadStringA
1 00280800 user32.dll 01A7 LoadKeyboardLayoutA
1 00280804 user32.dll 01A5 LoadImageA
1 00280808 user32.dll 01A3 LoadIconA
1 0028080C user32.dll 01A0 LoadCursorFromFileA
1 00280810 user32.dll 019F LoadCursorA
1 00280814 user32.dll 019D LoadBitmapA
1 00280818 user32.dll 019A KillTimer
1 0028081C user32.dll 0198 IsZoomed
1 00280820 user32.dll 0197 IsWindowVisible
1 00280824 user32.dll 0195 IsWindowEnabled
1 00280828 user32.dll 0194 IsWindow
1 0028082C user32.dll 0193 IsRectEmpty
1 00280830 user32.dll 0191 IsIconic
1 00280834 user32.dll 018C IsDialogMessage
1 00280838 user32.dll 018B IsClipboardFormatAvailable
1 0028083C user32.dll 018A IsChild
1 00280840 user32.dll 0183 IsCharAlphaNumericA
1 00280844 user32.dll 0182 IsCharAlphaA
1 00280848 user32.dll 017F InvalidateRect
1 0028084C user32.dll 017E IntersectRect
1 00280850 user32.dll 017A InsertMenuItemA
1 00280854 user32.dll 0179 InsertMenuA
1 00280858 user32.dll 0176 InflateRect
1 0028085C user32.dll 016B HideCaret
1 00280860 user32.dll 0167 GetWindowThreadProcessId
1 00280864 user32.dll 0163 GetWindowTextA
1 00280868 user32.dll 0162 GetWindowRgn
1 0028086C user32.dll 0161 GetWindowRect
1 00280870 user32.dll 0160 GetWindowPlacement
1 00280874 user32.dll 015B GetWindowLongA
1 00280878 user32.dll 0159 GetWindowDC
1 0028087C user32.dll 0150 GetTopWindow
1 00280880 user32.dll 014A GetSystemMetrics
1 00280884 user32.dll 0149 GetSystemMenu
1 00280888 user32.dll 0148 GetSysColorBrush
1 0028088C user32.dll 0147 GetSysColor
1 00280890 user32.dll 0146 GetSubMenu
1 00280894 user32.dll 0144 GetScrollRange
1 00280898 user32.dll 0143 GetScrollPos
1 0028089C user32.dll 0142 GetScrollInfo
1 002808A0 user32.dll 013E GetPropA
1 002808A4 user32.dll 0139 GetParent
1 002808A8 user32.dll 0157 GetWindow
1 002808AC user32.dll 0131 GetMessageTime
1 002808B0 user32.dll 0130 GetMessagePos
1 002808B4 user32.dll 012E GetMessageA
1 002808B8 user32.dll 012C GetMenuStringA
1 002808BC user32.dll 012B GetMenuState
1 002808C0 user32.dll 0128 GetMenuItemInfoA
1 002808C4 user32.dll 0127 GetMenuItemID
1 002808C8 user32.dll 0126 GetMenuItemCount
1 002808CC user32.dll 0120 GetMenu
1 002808D0 user32.dll 011D GetLastActivePopup
1 002808D4 user32.dll 011B GetKeyboardState
1 002808D8 user32.dll 0118 GetKeyboardLayoutList
1 002808DC user32.dll 0117 GetKeyboardLayout
1 002808E0 user32.dll 0116 GetKeyState
1 002808E4 user32.dll 0114 GetKeyNameTextA
1 002808E8 user32.dll 010F GetIconInfo
1 002808EC user32.dll 010C GetForegroundWindow
1 002808F0 user32.dll 010B GetFocus
1 002808F4 user32.dll 010A GetDoubleClickTime
1 002808F8 user32.dll 0106 GetDlgItem
1 002808FC user32.dll 0103 GetDesktopWindow
1 00280900 user32.dll 0102 GetDCEx
1 00280904 user32.dll 0101 GetDC
1 00280908 user32.dll 0100 GetCursorPos
1 0028090C user32.dll 00FD GetCursor
1 00280910 user32.dll 00F6 GetClipboardData
1 00280914 user32.dll 00F4 GetClientRect
1 00280918 user32.dll 00F1 GetClassNameA
1 0028091C user32.dll 00EB GetClassInfoA
1 00280920 user32.dll 00EA GetCaretPos
1 00280924 user32.dll 00E8 GetCapture
1 00280928 user32.dll 00E7 GetAsyncKeyState
1 0028092C user32.dll 00E0 GetActiveWindow
1 00280930 user32.dll 00DE FrameRect
1 00280934 user32.dll 00D9 FindWindowExA
1 00280938 user32.dll 00D8 FindWindowA
1 0028093C user32.dll 00D7 FillRect
1 00280940 user32.dll 00D4 EqualRect
1 00280944 user32.dll 00D3 EnumWindows
1 00280948 user32.dll 00D0 EnumThreadWindows
1 0028094C user32.dll 00C8 EnumDisplaySettingsA
1 00280950 user32.dll 00C1 EnumClipboardFormats
1 00280954 user32.dll 00BE EndPaint
1 00280958 user32.dll 00BA EnableWindow
1 0028095C user32.dll 00B9 EnableScrollBar
1 00280960 user32.dll 00B8 EnableMenuItem
1 00280964 user32.dll 00B7 EmptyClipboard
1 00280968 user32.dll 00B5 DrawTextW
1 0028096C user32.dll 00B2 DrawTextA
1 00280970 user32.dll 00AE DrawMenuBar
1 00280974 user32.dll 00AD DrawIconEx
1 00280978 user32.dll 00AC DrawIcon
1 0028097C user32.dll 00AB DrawFrameControl
1 00280980 user32.dll 00A9 DrawFocusRect
1 00280984 user32.dll 00A8 DrawEdge
1 00280988 user32.dll 0098 DispatchMessageA
1 0028098C user32.dll 0091 DestroyWindow
1 00280990 user32.dll 0090 DestroyMenu
1 00280994 user32.dll 008E DestroyCursor
1 00280998 user32.dll 008E DestroyCursor
1 0028099C user32.dll 008D DestroyCaret
1 002809A0 user32.dll 008A DeleteMenu
1 002809A4 user32.dll 0087 DefWindowProcA
1 002809A8 user32.dll 0085 DefMDIChildProcA
1 002809AC user32.dll 0083 DefFrameProcA
1 002809B0 user32.dll 005A CreatePopupMenu
1 002809B4 user32.dll 0059 CreateMenu
1 002809B8 user32.dll 0053 CreateIcon
1 002809BC user32.dll 004A CreateCaret
1 002809C0 user32.dll 0045 CopyImage
1 002809C4 user32.dll 003E CloseClipboard
1 002809C8 user32.dll 003C ClientToScreen
1 002809CC user32.dll 0038 ChildWindowFromPoint
1 002809D0 user32.dll 0035 CheckMenuItem
1 002809D4 user32.dll 001C ChangeDisplaySettingsA
1 002809D8 user32.dll 0017 CallWindowProcA
1 002809DC user32.dll 0016 CallNextHookEx
1 002809E0 user32.dll 000D BeginPaint
1 002809E4 user32.dll 0026 CharNextA
1 002809E8 user32.dll 0023 CharLowerBuffA
1 002809EC user32.dll 0022 CharLowerA
1 002809F0 user32.dll 0031 CharUpperBuffA
1 002809F4 user32.dll 002D CharToOemBuffA
1 002809F8 user32.dll 002C CharToOemA
1 002809FC user32.dll 0003 AdjustWindowRectEx
1 00280A00 user32.dll 0001 ActivateKeyboardLayout
FThunk: 00280A08 NbFunc: 00000001
1 00280A08 kernel32.dll 02C4 Sleep
FThunk: 00280A10 NbFunc: 00000008
1 00280A10 oleaut32.dll 0094 SafeArrayPtrOfIndex
1 00280A14 oleaut32.dll 0013 SafeArrayGetUBound
1 00280A18 oleaut32.dll 0014 SafeArrayGetLBound
1 00280A1C oleaut32.dll 000F SafeArrayCreate
1 00280A20 oleaut32.dll 000C VariantChangeType
1 00280A24 oleaut32.dll 000A VariantCopy
1 00280A28 oleaut32.dll 0009 VariantClear
1 00280A2C oleaut32.dll 0008 VariantInit
FThunk: 00280A34 NbFunc: 0000000F
1 00280A34 ole32.dll 0077 CreateStreamOnHGlobal
1 00280A38 ole32.dll 00BB IsAccelerator
1 00280A3C ole32.dll 00DB OleDraw
1 00280A40 ole32.dll 00F7 OleSetMenuDescriptor
1 00280A44 ole32.dll 00F9 OleUninitialize
1 00280A48 ole32.dll 00E2 OleInitialize
1 00280A4C ole32.dll 0060 CoTaskMemFree
1 00280A50 ole32.dll 005F CoTaskMemAlloc
1 00280A54 ole32.dll 00FB ProgIDFromCLSID
1 00280A58 ole32.dll 0124 StringFromCLSID
1 00280A5C ole32.dll 0019 CoCreateInstance
1 00280A60 ole32.dll 002A CoGetClassObject
1 00280A64 ole32.dll 0064 CoUninitialize
1 00280A68 ole32.dll 003C CoInitialize
1 00280A6C ole32.dll 00BC IsEqualGUID
FThunk: 00280A74 NbFunc: 00000003
1 00280A74 oleaut32.dll 00C8 GetErrorInfo
1 00280A78 oleaut32.dll 0023 GetActiveObject
1 00280A7C oleaut32.dll 0006 SysFreeString
FThunk: 00280A84 NbFunc: 00000019
1 00280A84 comctl32.dll 004F ImageList_SetIconSize
1 00280A88 comctl32.dll 003B ImageList_GetIconSize
1 00280A8C comctl32.dll 0052 ImageList_Write
1 00280A90 comctl32.dll 0043 ImageList_Read
1 00280A94 comctl32.dll 0038 ImageList_GetDragImage
1 00280A98 comctl32.dll 0031 ImageList_DragShowNolock
1 00280A9C comctl32.dll 004C ImageList_SetDragCursorImage
1 00280AA0 comctl32.dll 0030 ImageList_DragMove
1 00280AA4 comctl32.dll 002F ImageList_DragLeave
1 00280AA8 comctl32.dll 002E ImageList_DragEnter
1 00280AAC comctl32.dll 0036 ImageList_EndDrag
1 00280AB0 comctl32.dll 002A ImageList_BeginDrag
1 00280AB4 comctl32.dll 003A ImageList_GetIcon
1 00280AB8 comctl32.dll 0044 ImageList_Remove
1 00280ABC comctl32.dll 0033 ImageList_DrawEx
1 00280AC0 comctl32.dll 0045 ImageList_Replace
1 00280AC4 comctl32.dll 0032 ImageList_Draw
1 00280AC8 comctl32.dll 0037 ImageList_GetBkColor
1 00280ACC comctl32.dll 004B ImageList_SetBkColor
1 00280AD0 comctl32.dll 0046 ImageList_ReplaceIcon
1 00280AD4 comctl32.dll 0027 ImageList_Add
1 00280AD8 comctl32.dll 003C ImageList_GetImageCount
1 00280ADC comctl32.dll 002D ImageList_Destroy
1 00280AE0 comctl32.dll 002C ImageList_Create
1 00280AE4 comctl32.dll 0011 InitCommonControls
FThunk: 00280AEC NbFunc: 00000005
1 00280AEC imm32.dll 005E ImmSetCompositionWindow
1 00280AF0 imm32.dll 005A ImmSetCompositionFontA
1 00280AF4 imm32.dll 001E ImmGetCompositionStringW
1 00280AF8 imm32.dll 0051 ImmReleaseContext
1 00280AFC imm32.dll 0020 ImmGetContext
FThunk: 00280B04 NbFunc: 00000006
1 00280B04 shell32.dll 0175 Shell_NotifyIcon
1 00280B08 shell32.dll 0170 ShellExecuteEx
1 00280B0C shell32.dll 016F ShellExecuteA
1 00280B10 shell32.dll 013A SHGetFileInfo
1 00280B14 shell32.dll 012F SHFileOperation
1 00280B18 shell32.dll 0108 ExtractIconA
FThunk: 00280B20 NbFunc: 00000001
1 00280B20 wininet.dll 00EC InternetGetConnectedState
FThunk: 00280B28 NbFunc: 00000001
1 00280B28 urlmon.dll 0040 URLDownloadToFileA
FThunk: 00280B30 NbFunc: 00000004
1 00280B30 shell32.dll 0149 SHGetSpecialFolderLocation
1 00280B34 shell32.dll 0145 SHGetPathFromIDList
1 00280B38 shell32.dll 0143 SHGetMalloc
1 00280B3C shell32.dll 0136 SHGetDesktopFolder
FThunk: 00280B44 NbFunc: 00000002
1 00280B44 comdlg32.dll 0065 ChooseColorA
1 00280B48 comdlg32.dll 006E GetOpenFileNameA
FThunk: 00280B50 NbFunc: 00000001
1 00280B50 shell32.dll 003E
FThunk: 00280B58 NbFunc: 00000001
1 00280B58 shell32.dll 0158 SHUpdateRecycleBinIcon
FThunk: 00280B60 NbFunc: 00000001
1 00280B60 kernel32.dll 0202 MulDiv
FThunk: 00280B68 NbFunc: 00000001
1 00280B68 shell32.dll 003B
FThunk: 00280B70 NbFunc: 00000004
1 00280B70 avifil32.dll 0029 AVIStreamGetFrameClose
1 00280B74 avifil32.dll 0014 AVIFileRelease
1 00280B78 avifil32.dll 0014 AVIFileRelease
1 00280B7C avifil32.dll 000A AVIFileExit
FThunk: 00280B84 NbFunc: 00000004
1 00280B84 msvfw32.dll 000C DrawDibRealize
1 00280B88 msvfw32.dll 000A DrawDibOpen
1 00280B8C msvfw32.dll 0006 DrawDibDraw
1 00280B90 msvfw32.dll 0005 DrawDibClose
[课程]Linux pwn 探索篇！
