小资料：ASPr API修复
kongfoo/2004.6.22
ASPr处理后有部分API已经面目全非，手动分析会毫无头绪，只能
靠经验或插件，下面记录一下ASPr对一些API的处理，手动分析起来就
事半功倍了。
kernel32.GetCommandLineA：
00D9139C 6A 00 PUSH 0
00D9139E E8 B53DFFFF CALL 00D85158 ; JMP to kernel32.GetModuleHandleA
00D913A3 FF35 E46CD900 PUSH DWORD PTR DS:[D96CE4]
00D913A9 58 POP EAX
00D913AA 8B05 F46CD900 MOV EAX,DWORD PTR DS:[D96CF4] ==d96cf4放的是命令行参数
00D913B0 C3 RETN
kernel32.GetModuleHandleA:
00D9133C 55 PUSH EBP
00D9133D 8BEC MOV EBP,ESP
00D9133F 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00D91342 85C0 TEST EAX,EAX
00D91344 75 07 JNZ SHORT 00D9134D
00D91346 A1 7869D900 MOV EAX,DWORD PTR DS:[D96978] ==d96978放的是40000，哪么这个是GetModuleHandleA的功能了
00D9134B EB 06 JMP SHORT 00D91353
00D9134D 50 PUSH EAX
00D9134E E8 053EFFFF CALL 00D85158 ; JMP to kernel32.GetModuleHandleA
00D91353 5D POP EBP
00D91354 C2 0400 RETN 4
kernel32.GetProcAddress:
00D90EE8 55 PUSH EBP
00D90EE9 8BEC MOV EBP,ESP
00D90EEB 8B55 0C MOV EDX,DWORD PTR SS:[EBP+C]
00D90EEE 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00D90EF1 8B0D 3C54D900 MOV ECX,DWORD PTR DS:[D9543C]
00D90EF7 8B09 MOV ECX,DWORD PTR DS:[ECX]
00D90EF9 3BC8 CMP ECX,EAX
00D90EFB 75 09 JNZ SHORT 00D90F06
00D90EFD 8B0495 5053D900 MOV EAX,DWORD PTR DS:[EDX*4+D95350]
00D90F04 EB 07 JMP SHORT 00D90F0D
00D90F06 52 PUSH EDX
00D90F07 50 PUSH EAX
00D90F08 E8 5342FFFF CALL 00D85160 ; JMP to kernel32.GetProcAddress
00D90F0D 5D POP EBP
00D90F0E C2 0800 RETN 8
kernel32.GetVersion:
00D91358 6A 00 PUSH 0
00D9135A E8 F93DFFFF CALL 00D85158 ; JMP to kernel32.GetModuleHandleA
00D9135F FF35 E46CD900 PUSH DWORD PTR DS:[D96CE4] ==d96ce4放的是版本信息，API是GetVersion
00D91365 58 POP EAX
00D91366 C3 RETN
kernel32.GetCurrentProcess:
00D91388 MOV EAX,[D96CE8] ==d96ce8放的是-1
00D9138D RETN
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
