我参照FLY的文章
http://bbs.pediy.com/showthread.php?threadid=1316&highlight=Armadillo+2.51+3.xx+DLL
找到了这个Dll的OEP,但是走到OEP时是这样的
00871458 /EB 10 jmp short Cake.0087146A----->OEP
0087145A |66:623A bound di,dword ptr ds:[edx]
0087145D |43 inc ebx
0087145E |2B2B sub ebp,dword ptr ds:[ebx]
00871460 |48 dec eax
00871461 |4F dec edi
00871462 |4F dec edi
00871463 |4B dec ebx
00871464 |90 nop
00871465 -|E9 F8909700 jmp 011EA562
0087146A \A1 7F909700 mov eax,dword ptr ds:[97907F]
0087146F C1E0 02 shl eax,2
00871472 A3 83909700 mov dword ptr ds:[979083],eax
00871477 8B4424 08 mov eax,dword ptr ss:[esp+8]
0087147B A3 F1909700 mov dword ptr ds:[9790F1],eax
00871480 FF1485 E1909700 call dword ptr ds:[eax*4+9790E1]
00871487 833D F1909700 01 cmp dword ptr ds:[9790F1],1
0087148E 75 5E jnz short Cake.008714EE
00871490 803D 8B909700 00 cmp byte ptr ds:[97908B],0
00871497 74 24 je short Cake.008714BD
00871499 E8 64651000 call Cake.00977A02 ; jmp to kernel32.GetVersion
0087149E BA 8C909700 mov edx,Cake.0097908C ; ASCII "Nonshared DATA segment required"
008714A3 25 00000080 and eax,80000000
008714A8 74 05 je short Cake.008714AF
008714AA BA AC909700 mov edx,Cake.009790AC ; ASCII "Cannot run multiple instances of a DLL under WIN32s"
这个是怎么回事儿?应该怎么解决?
点击下载DLL文件
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)