能力值:
( LV9,RANK:200 )
|
-
-
2 楼
00424A30 64 8B 35 30 00 00 00 mov esi,dword ptr fs:[30h] //将PEB结构地址赋值给esi
00424A37 8B 76 0C mov esi,dword ptr [esi+0Ch] //得到PEB_LDR_DATA结构地址赋值给esi
00424A3A 8B 76 1C mov esi,dword ptr [esi+1Ch] //得到InInitializationOrderModuleList地址赋值给esi
00424A3D 8B 56 08 mov edx,dword ptr [esi+8] //0x18,get DllBase.
00424A40 8B 7E 20 mov edi,dword ptr [esi+20h] //esi自身在结构体偏移为0x10,+0x20则定位至_LDR_DATA_TABLE_ENTRY::BaseDllName::Buffer
00424A43 8B 36 mov esi,dword ptr [esi] //to next entry
00424A45 81 7F 0C 33 00 32 00 cmp dword ptr [edi+0Ch],320033h //偏移Buffer第六个字符(C/2 -> 6)后是否为"32",也即是寻找kernel32.dll
00424A4C 75 EF jne PIshellcode+0Dh (00424a3d) //进行下一个判断
00424A4E 89 95 3F FB FF FF mov dword ptr [ebp-4C1h],edx //get it , done
00424A54 C3 ret
|
|
|