能力值：
( LV9，RANK：210 )
|
-
-
2 楼
摸索了下，自己找到方法了，申请一段内存，把字符串拷贝过去，然后查找API地址，用寄存器传过去，然后在exec中调用即可：
#log
var pszEncrypt
var pMem
var dwSize
var dwEax
var dwEcx
mov pszEncrypt, "test"
len pszEncrypt
mov dwSize, $RESULT
inc dwSize
alloc dwSize
test $RESULT, $RESULT
jz l_End
mov pMem, $RESULT
mov [pMem], pszEncrypt
gpa "MessageBoxA", "user32.dll"
//store eax, ecx
mov dwEax, eax
mov dwEcx, ecx
mov ecx, $RESULT
mov eax, pMem
exec
pushad
push 0
push eax
push eax
push 0
call ecx
popad
ende
free pMem
mov eax, dwEax
mov ecx, dwEcx
l_End:
ret
|
|
|
|
