哪位大大讲讲 dll的加载细节，我脱execryptor壳后dll加载时候有问题，基址为10000000，带壳时加载于370000处，脱壳后基址10000000，用od可
以加载此dll（加载于10000000处），可是用od加载需要调用此dll的文件时有问题，中断于 7C93E4A7 8939 mov [ecx],
edi处（ecx=37003）
提示不能写[37003c]（看了pe格式此地址处是pe头的开始地址），看了下370000开始处的内容，dll已经在此地址处。alt+M看了如下：
Memory map
地址 大小 (十进制) 属主 区段 包含 类型 访问 初始访问 已映射为
00010000 00001000 (4096.) Priv RW RW
00020000 00001000 (4096.) Priv RW RW
0012D000 00001000 (4096.) Priv RW 保护 RW
0012E000 00002000 (8192.) 堆栈 于 主线 Priv RW 保护 RW
00130000 00003000 (12288.) Map R R
00140000 00003000 (12288.) Priv RW RW
00240000 00006000 (24576.) Priv RW RW
00250000 00003000 (12288.) Map RW RW
00260000 00016000 (90112.) Map R R \Device\HarddiskVolume1
\WINDOWS\System32\UNICODE.NLS
002800 0 0003D000 (249856.) Map R R \Device\HarddiskVolume1
\WINDOWS\System32\LOCALE.NLS
002C0000 00041000 (266240.) Map R R \Device\HarddiskVolume1
\WINDOWS\System32\SORTKEY.NLS
00310000 00006000 (24576.) Map R R \Device\HarddiskVolume1
\WINDOWS\System32\SORTTBLS.NLS
00320000 00041000 (266240.) Map R R
00370000 00016000 (90112.) Imag R RWE
00400000 05D6E000 (97968128.) Imag R RWE
10000000 000B3000 (733184.) Imag R RWE
5D170000 00097000 (618496.) Imag R RWE
72F70000 00026000 (155648.) Imag R RWE
76320000 00047000 (290816.) Imag R RWE
76990000 0013C000 (1294336.) Imag R RWE
770F0000 0008C000 (573440.) Imag R RWE
773A0000 007F1000 (8327168.) Imag R RWE
77BE0000 00058000 (360448.) Imag R RWE
77D10000 0008F000 (585728.) Imag R RWE
77DA0000 000A9000 (692224.) Imag R RWE
77E%0000 00091000 (593920.) Imag R RWE
77EF0000 00046000 (286720.) Imag R RWE
77F40000 00076000 (483328.) Imag R RWE
7C800000 0011C000 (1163264.) Imag RWE RWE
7C920000 00094000 (606208.) Imag R RWE
7F6F0000 00007000 (28672.) Map R E R E
7FFA0000 00033000 (208896.) Map R R
7FFD3000 00001000 (4096.) Priv RW RW
7FFDF000 00001000 (4096.) 数据块 于 主 Priv RW RW
7FFE0000 00001000 (4096.) Priv R R
370000处只读。改为可写之后溢出错误。
用dll_loadll和dll_loadex都不能加载此dll，我想可能是文件头里和加载基址有关的位置由问题，用loardPE查看好像没看出什么地方有问题
。
查看结果如下：->DOS Header
e_magic: 0x5A4D
e_cblp: 0x0090
e_cp: 0x0003
e_crlc: 0x0000
e_cparhdr: 0x0004
e_minalloc: 0x0000
e_maxalloc: 0xFFFF
e_ss: 0x0000
e_sp: 0x00B8
e_csum: 0x0000
e_ip: 0x0000
e_cs: 0x0000
e_lfarlc: 0x0040
e_ovno: 0x0000
e_res: 0x0000000000000000
e_oemid: 0x0000
e_oeminfo: 0x0000
e_res2: 0x0000000000000000000000 00000000000000000
e_lfanew: 0x00000050
->File Header
Machine: 0x014C (I386)
NumberOfSections: 0x0005
TimeDateStamp: 0x44263A2D (GMT: Sun Mar 26 06:52:29 2006)
PointerToSymbolTable: 0x00000000
NumberOfSymbols: 0x00000000
SizeOfOptionalHeader: 0x00E0
Chabacteristics: 0x210E
(EXECUTABLE_IMAGE)
(LINE_NUMS_STRIPPED)
(LOCAL_SYMS_STRIPPED)
(32BIT_MACHINE)
(DLL)
->Optional Header
Magic: 0x010B (HDR32_MAGIC)
MajorLinkerVersion: 0x06
MinorLinkerVersion: 0x00 -> 6.00
SizeOfCode: 0x0000C000
SizeOfInitializedData: 0x00008000
SizeOfUninitializedData: 0x00000000
AddressOfEntryPoint: 0x00004DBF
BaseOfCode: 0x00001000
BaseOfData: 0x0000D000
ImageBase: 0x10000000
SectionAlignment: 0x00001000
FileAlignment: 0x00001000
MajorOperatingSystemVersion: 0x0004
MinorOperatingSystemVersion: 0x0000 -> 4.00
MajorImageVersion: 0x0000
MinorImageVersion: 0x0000 -> 0.00
MajorSubsystemVersion: 0x0004
MinorSubsystemVersion: 0x0000 -> 4.00
Win32VersionValue: 0x00000000
SizeOfImage: 0x00016000
SizeOfHeaders: 0x00001000
CheckSum: 0x0004DAED
Subsystem: 0x0002 (WINDOWS_GUI)
DllCharacteristics: 0x0000
SizeOfStackReserve: 0x00100000
SizeOfStackCommit: 0x00001000
SizeOfHeapReserve: 0x00100000
SizeOfHeapCommit: 0x00001000
LoaderFlags: 0x00000000
NumberOfRvaAndSizes: 0x00000010
DataDirectory (16) RVA Size
------------- ---------- ----------
ExportTable 0x0000DE00 0x00000156 (".rdata")
ImportTable 0x00015000 0x00000028 (".mackt")
Resource 0x00000000 0x00000000
Exception 0x00000000 0x00000000
Security 0x00000000 0x00000000
Relocation 0x00013000 0x00000D1E (".reloc")
Debug 0x00000000 0x00000000
Copyright 0x00000000 0x00000000
GlobalPtr 0x00000000 0x00000000
TLSTable 0x00000000 0x00000000
LoadConfig 0x00000000 0x00000000
BoundImport 0x00000000 0x00000000
IAT 0x00000000 0x00000000
DelayImport 0x00000000 0x00000000
COM 0x00000 00 0x00000000
Reserved 0x00000000 0x00000000
我改了一个重定位表中一个数据后，加载时提示"无法定位序数20592于动态链接库kernel32.dll上",此文件已用ImportREC重建了输入表.
请各位指教一下.
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
