[求助]奇怪的跳转-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

最新回复 (8)
killalarm 雪币： 342 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 25 回帖 142 粉丝 0 关注私信	killalarm 2 楼 mov dword ptr [400882],ebx 400882属于只读段? 你把ebx写入只读段是不安全的可能会出现无法写入错误建议写入data段地址去 2006-8-27 14:37 0
erge 雪币： 204 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 7 回帖 23 粉丝 0 关注私信	erge 3 楼我临时用那个段来放补丁代码，问题是执行的顺序不是执行jmp 479c64 ,而是跳到别的地方去了，我如果把mov dword ptr [400882],ebx去掉就正常。 2006-8-27 15:03 0
killalarm 雪币： 342 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 25 回帖 142 粉丝 0 关注私信	killalarm 4 楼最初由 erge* 发布* 我临时用那个段来放补丁代码，问题是执行的顺序不是执行jmp 479c64 ,而是跳到别的地方去了，我如果把mov dword ptr [400882],ebx去掉就正常。 400882不能为写导致的把400882换成data段的地址!!!!! 2006-8-27 15:21 0
erge 雪币： 204 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 7 回帖 23 粉丝 0 关注私信	erge 5 楼 No \| 名称 \| VSize \| VOffset \| RSize \| ROffset \| Charact. \| 01 \| .text \| 00118696 \| 00001000 \| 00119000 \| 00001000 \| 60000020 \| 02 \| .rdata \| 00013880 \| 0011A000 \| 00014000 \| 0011A000 \| 40000040 \| 03 \| .data \| 001B9178 \| 0012E000 \| 00003000 \| 0012E000 \| C0000040 \| 04 \| .rsrc \| 0001A140 \| 002E8000 \| 0001B000 \| 00131000 \| 40000040 \| 我用PE工具看的区段是上面，data段是不是从0012E000开始到002E8000间的地址啊,大小是1B9178 word？但时在2E7EEE附近没有90可以用啊。 2006-8-27 17:34 0
killalarm 雪币： 342 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 25 回帖 142 粉丝 0 关注私信	killalarm 6 楼最初由 erge* 发布* No \| 名称 \| VSize \| VOffset \| RSize \| ROffset \| Charact. \| 01 \| .text \| 00118696 \| 00001000 \| 00119000 \| 00001000 \| 60000020 \| 02 \| .rdata \| 00013880 \| 0011A000 \| 00014000 \| 0011A000 \| 40000040 \| 03 \| .data \| 001B9178 \| 0012E000 \| 00003000 \| 0012E000 \| C0000040 \| 04 \| .rsrc \| 0001A140 \| 002E8000 \| 0001B000 \| 00131000 \| 40000040 \| ........ 首先不是用pe工具看,工具看的只是物理内存地址.往往是不清晰的,如果你用od的话,请alt+m看可以清楚的看到内存景象找出data段 ,这样才比较准确!其次我说的那个地址是为了保存数据,就是说要把ebx存入那个地址,所有这个地址必须是可读可写,而在程序的区段中,很多区段的访问权限非常低,可能仅是可读,所以当你用mov命令往可读段里面写数据时就会产生不可写的异常,最安全的做法就是把数据写入data段的地址,这个段内存地址往往既可读也可写,不会出现错误!最后纠正你的错误内存补丁并不是打在90段,而是一大段00000000000000000000! 2006-8-27 21:17 0
erge 雪币： 204 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 7 回帖 23 粉丝 0 关注私信	erge 7 楼首先感谢你的多次解答。很多做补订的贴子都说用“90大法”找空白的地方放自己的代码，总以为00的地方是使用了的。我用的是SOFTICE，因为改软件有HOOK，用OD分析会不反应。我用OD载入后看了下内存映象，由于没用过，不大看得懂地址旁边的00130000 (itself) 是指什么,有很多都是R权限,总表里也看不出DATA段的具体地址内存镜像地址大小 Owner 区段包含类型访问初始访问映射为 00010000 00001000 00010000 (itself) Priv 00021004 RW RW 00020000 00001000 00020000 (itself) Priv 00021004 RW RW 0012C000 00001000 00030000 Priv 00021104 RW 防护 RW 0012D000 00003000 00030000 stack of Priv 00021104 RW 防护 RW 00130000 00005000 00130000 (itself) Map 00041002 R R 00140000 00016000 00140000 (itself) Priv 00021004 RW RW 00240000 00003000 00240000 (itself) Map 00041004 RW RW 00250000 00016000 00250000 (itself) Map 00041002 R R \Device\HarddiskVolume3\WIN2003\system32\unicode.nls 00270000 00034000 00270000 (itself) Map 00041002 R R \Device\HarddiskVolume3\WIN2003\system32\locale.nls 002B0000 00041000 002B0000 (itself) Map 00041002 R R \Device\HarddiskVolume3\WIN2003\system32\sortkey.nls 00300000 00006000 00300000 (itself) Map 00041002 R R \Device\HarddiskVolume3\WIN2003\system32\sorttbls.nls 00310000 00041000 00310000 (itself) Map 00041002 R R 00360000 00001000 xaudio 00360000 (itself) PE header Imag 01001002 R RWE 00361000 00022000 xaudio 00360000 .text code Imag 01001002 R RWE 00383000 00017000 xaudio 00360000 .rdata imports,e Imag 01001002 R RWE 0039A000 00006000 xaudio 00360000 .data data Imag 01001002 R RWE 003A0000 00001000 xaudio 00360000 .rsrc resources Imag 01001002 R RWE 003A1000 00002000 xaudio 00360000 .reloc relocatio Imag 01001002 R RWE 003B0000 00001000 MapManag 003B0000 (itself) PE header Imag 01001002 R RWE 003B1000 00006000 MapManag 003B0000 .text code Imag 01001002 R RWE 003B7000 00002000 MapManag 003B0000 .rdata imports,e Imag 01001002 R RWE 003B9000 00001000 MapManag 003B0000 .data data Imag 01001002 R RWE 003BA000 00001000 MapManag 003B0000 .rsrc resources Imag 01001002 R RWE 003BB000 00001000 MapManag 003B0000 .reloc relocatio Imag 01001002 R RWE 003C0000 00001000 MsgFlt 003C0000 (itself) PE header Imag 01001002 R RWE 003C1000 00002000 MsgFlt 003C0000 .text code Imag 01001002 R RWE 003C3000 00001000 MsgFlt 003C0000 .rdata imports,e Imag 01001002 R RWE 003C4000 00002000 MsgFlt 003C0000 .data data Imag 01001002 R RWE 003C6000 00001000 MsgFlt 003C0000 SHARDATA Imag 01001002 R RWE 003C7000 00001000 MsgFlt 003C0000 .rsrc resources Imag 01001002 R RWE 003C8000 00001000 MsgFlt 003C0000 .reloc relocatio Imag 01001002 R RWE 003D0000 00008000 003D0000 (itself) Priv 00021004 RW RW 003E0000 00008000 003E0000 (itself) Priv 00021004 RW RW 003F0000 00001000 003F0000 (itself) Priv 00021004 RW RW 00400000 00001000 复件_Som 00400000 (itself) PE header Imag 01001002 R RWE 00401000 00119000 复件_Som 00400000 .text code Imag 01001002 R RWE 0051A000 00014000 复件_Som 00400000 .rdata imports Imag 01001002 R RWE 0052E000 001BA000 复件_Som 00400000 .data data Imag 01001002 R RWE 006E8000 0001B000 复件_Som 00400000 .rsrc resources Imag 01001002 R RWE 00710000 00006000 00710000 (itself) Map 00041020 R E R E 007D0000 00002000 00710000 Map 00041020 R E R E 007E0000 00103000 007E0000 (itself) Map 00041002 R R 008F0000 0008A000 008F0000 (itself) Map 00041020 R E R E 00BF0000 00008000 00BF0000 (itself) Priv 00021004 RW RW 00CF0000 00001000 00CF0000 (itself) Priv 00021004 RW RW 00D00000 00003000 00D00000 (itself) Map 00041002 R R \Device\HarddiskVolume3\WIN2003\system32\ctype.nls 00D10000 00001000 00D10000 (itself) Priv 00021004 RW RW 00D90000 00002000 00D90000 (itself) Priv 00021004 RW RW 00DA0000 00004000 00DA0000 (itself) Priv 00021004 RW RW 00DB0000 00004000 00DB0000 (itself) Priv 00021004 RW RW 00DC0000 00002000 00DC0000 (itself) Map 00041002 R R 00DD0000 00002000 00DD0000 (itself) Map 00041002 R R 00DE0000 00002000 00DE0000 (itself) Priv 00021004 RW RW 00E20000 00001000 odbcint 00E20000 (itself) PE header Imag 01001002 R RWE 00E21000 00010000 odbcint 00E20000 .rsrc data,reso Imag 01001002 R RWE 00E31000 00001000 odbcint 00E20000 .reloc relocatio Imag 01001002 R RWE 00E40000 0000D000 00E40000 (itself) Map 00041002 R R \Device\HarddiskVolume3\WIN2003\system32\mfc42loc.dll 00E50000 00002000 00E50000 (itself) Map 00041002 R R 00E60000 00001000 00E60000 (itself) Priv 00021004 RW RW 00EA0000 00001000 00EA0000 (itself) Priv 00021004 RW RW 00EE0000 00001000 00EE0000 (itself) Priv 00021004 RW RW 10000000 00001000 DManage 10000000 (itself) PE header Imag 01001002 R RWE 10001000 00015000 DManage 10000000 .text code Imag 01001002 R RWE 10016000 00007000 DManage 10000000 .rdata imports,e Imag 01001002 R RWE 1001D000 000EB000 DManage 10000000 .data data Imag 01001002 R RWE 10108000 00001000 DManage 10000000 .rsrc resources Imag 01001002 R RWE 10109000 00002000 DManage 10000000 .reloc relocatio Imag 01001002 R RWE 4B750000 00001000 ODBC32 4B750000 (itself) PE header Imag 01001002 R RWE 4B751000 00036000 ODBC32 4B750000 .text code,impo Imag 01001002 R RWE 4B787000 00002000 ODBC32 4B750000 .data data Imag 01001002 R RWE 4B789000 00001000 ODBC32 4B750000 .sdbid Imag 01001002 R RWE 4B78A000 00001000 ODBC32 4B750000 .rsrc resources Imag 01001002 R RWE 4B78B000 00002000 ODBC32 4B750000 .reloc relocatio Imag 01001002 R RWE 63090000 00001000 LPK 63090000 (itself) PE header Imag 01001002 R RWE 63091000 00005000 LPK 63090000 .text code,impo Imag 01001002 R RWE 63096000 00001000 LPK 63090000 .data data Imag 01001002 R RWE 63097000 00001000 LPK 63090000 .rsrc resources Imag 01001002 R RWE 63098000 00001000 LPK 63090000 .reloc relocatio Imag 01001002 R RWE 71B10000 00001000 WSOCK32 71B10000 (itself) PE header Imag 01001002 R RWE 71B11000 00003000 WSOCK32 71B10000 .text code,impo Imag 01001002 R RWE 71B14000 00001000 WSOCK32 71B10000 .data data Imag 01001002 R RWE 71B15000 00005000 WSOCK32 71B10000 .rsrc resources Imag 01001002 R RWE 71B1A000 00001000 WSOCK32 71B10000 .reloc relocatio Imag 01001002 R RWE 71B50000 00001000 WS2HELP 71B50000 (itself) PE header Imag 01001002 R RWE 71B51000 00004000 WS2HELP 71B50000 .text code,impo Imag 01001002 R RWE 71B55000 00001000 WS2HELP 71B50000 .data data Imag 01001002 R RWE 71B56000 00001000 WS2HELP 71B50000 .rsrc resources Imag 01001002 R RWE 71B57000 00001000 WS2HELP 71B50000 .reloc relocatio Imag 01001002 R RWE 71B60000 00001000 WS2_32 71B60000 (itself) PE header Imag 01001002 R RWE 71B61000 00013000 WS2_32 71B60000 .text code,impo Imag 01001002 R RWE 71B74000 00001000 WS2_32 71B60000 .data data Imag 01001002 R RWE 71B75000 00001000 WS2_32 71B60000 .rsrc resources Imag 01001002 R RWE 71B76000 00001000 WS2_32 71B60000 .reloc relocatio Imag 01001002 R RWE 72200000 00001000 DINPUT 72200000 (itself) PE header Imag 01001002 R RWE 72201000 0001E000 DINPUT 72200000 .text code,impo Imag 01001002 R RWE 7221F000 00001000 DINPUT 72200000 .data data Imag 01001002 R RWE 72220000 00005000 DINPUT 72200000 .rsrc resources Imag 01001002 R RWE 72225000 00002000 DINPUT 72200000 .reloc relocatio Imag 01001002 R RWE 73730000 00001000 DDRAW 73730000 (itself) PE header Imag 01001002 R RWE 73731000 0003F000 DDRAW 73730000 .text code,impo Imag 01001002 R RWE 73770000 00007000 DDRAW 73730000 .data data Imag 01001002 R RWE 73777000 00001000 DDRAW 73730000 .rsrc resources Imag 01001002 R RWE 73778000 00004000 DDRAW 73730000 .reloc relocatio Imag 01001002 R RWE 73A60000 00001000 DCIMAN32 73A60000 (itself) PE header Imag 01001002 R RWE 73A61000 00002000 DCIMAN32 73A60000 .text code,impo Imag 01001002 R RWE 73A63000 00001000 DCIMAN32 73A60000 .data data Imag 01001002 R RWE 73A64000 00001000 DCIMAN32 73A60000 .rsrc resources Imag 01001002 R RWE 73A65000 00001000 DCIMAN32 73A60000 .reloc relocatio Imag 01001002 R RWE 73DA0000 00001000 DSOUND 73DA0000 (itself) PE header Imag 01001002 R RWE 73DA1000 00056000 DSOUND 73DA0000 .text code,impo Imag 01001002 R RWE 73DF7000 00003000 DSOUND 73DA0000 .data data Imag 01001002 R RWE 73DFA000 00001000 DSOUND 73DA0000 .rsrc resources Imag 01001002 R RWE 73DFB000 00003000 DSOUND 73DA0000 .reloc relocatio Imag 01001002 R RWE 74AE0000 00001000 USP10 74AE0000 (itself) PE header Imag 01001002 R RWE 74AE1000 00040000 USP10 74AE0000 .text code,impo Imag 01001002 R RWE 74B21000 0000A000 USP10 74AE0000 .data data Imag 01001002 R RWE 74B2B000 00002000 USP10 74AE0000 Shared Imag 01001002 R RWE 74B2D000 00012000 USP10 74AE0000 .rsrc resources Imag 01001002 R RWE 74B3F000 00002000 USP10 74AE0000 .reloc relocatio Imag 01001002 R RWE 754E0000 00001000 MFC42 754E0000 (itself) PE header Imag 01001002 R RWE 754E1000 000FC000 MFC42 754E0000 .text code,impo Imag 01001002 R RWE 755DD000 00007000 MFC42 754E0000 .data data Imag 01001002 R RWE 755E4000 0000B000 MFC42 754E0000 .rsrc resources Imag 01001002 R RWE 755EF000 00012000 MFC42 754E0000 .reloc relocatio Imag 01001002 R RWE 76080000 00001000 MSASN1 76080000 (itself) PE header Imag 01001002 R RWE 76081000 0000E000 MSASN1 76080000 .text code,impo Imag 01001002 R RWE 7608F000 00001000 MSASN1 76080000 .data data Imag 01001002 R RWE 76090000 00001000 MSASN1 76080000 .rsrc resources Imag 01001002 R RWE 76091000 00001000 MSASN1 76080000 .reloc relocatio Imag 01001002 R RWE 760A0000 00001000 CRYPT32 760A0000 (itself) PE header Imag 01001002 R RWE 760A1000 00083000 CRYPT32 760A0000 .text code,impo Imag 01001002 R RWE 76124000 00003000 CRYPT32 760A0000 .data data Imag 01001002 R RWE 76127000 00005000 CRYPT32 760A0000 .rsrc resources Imag 01001002 R RWE 7612C000 00005000 CRYPT32 760A0000 .reloc relocatio Imag 01001002 R RWE 76180000 00001000 IMM32 76180000 (itself) PE header Imag 01001002 R RWE 76181000 00015000 IMM32 76180000 .text code,impo Imag 01001002 R RWE 76196000 00001000 IMM32 76180000 .data data Imag 01001002 R RWE 76197000 00005000 IMM32 76180000 .rsrc resources Imag 01001002 R RWE 7619C000 00001000 IMM32 76180000 .reloc relocatio Imag 01001002 R RWE 761A0000 00001000 comdlg32 761A0000 (itself) PE header Imag 01001002 R RWE 761A1000 00031000 comdlg32 761A0000 .text code,impo Imag 01001002 R RWE 761D2000 00004000 comdlg32 761A0000 .data data Imag 01001002 R RWE 761D6000 0000F000 comdlg32 761A0000 .rsrc resources Imag 01001002 R RWE 761E5000 00003000 comdlg32 761A0000 .reloc relocatio Imag 01001002 R RWE 769E0000 00001000 WINMM 769E0000 (itself) PE header Imag 01001002 R RWE 769E1000 0001F000 WINMM 769E0000 .text code,impo Imag 01001002 R RWE 76A00000 00002000 WINMM 769E0000 .data data Imag 01001002 R RWE 76A02000 00006000 WINMM 769E0000 .rsrc resources Imag 01001002 R RWE 76A08000 00002000 WINMM 769E0000 .reloc relocatio Imag 01001002 R RWE 77370000 00001000 COMCTL32 77370000 (itself) PE header Imag 01001002 R RWE 77371000 0006E000 COMCTL32 77370000 .text code,impo Imag 01001002 R RWE 773DF000 00004000 COMCTL32 77370000 .data data Imag 01001002 R RWE 773E3000 0001F000 COMCTL32 77370000 .rsrc resources Imag 01001002 R RWE 77402000 00005000 COMCTL32 77370000 .reloc relocatio Imag 01001002 R RWE 774B0000 00001000 ole32 774B0000 (itself) PE header Imag 01001002 R RWE 774B1000 00116000 ole32 774B0000 .text code,impo Imag 01001002 R RWE 775C7000 00007000 ole32 774B0000 .orpc code Imag 01001002 R RWE 775CE000 00008000 ole32 774B0000 .data data Imag 01001002 R RWE 775D6000 00002000 ole32 774B0000 .rsrc resources Imag 01001002 R RWE 775D8000 0000C000 ole32 774B0000 .reloc relocatio Imag 01001002 R RWE 775F0000 00001000 OLEAUT32 775F0000 (itself) PE header Imag 01001002 R RWE 775F1000 00080000 OLEAUT32 775F0000 .text code,impo Imag 01001002 R RWE 77671000 00001000 OLEAUT32 775F0000 .orpc Imag 01001002 R RWE 77672000 00003000 OLEAUT32 775F0000 .data data Imag 01001002 R RWE 77675000 00001000 OLEAUT32 775F0000 .rsrc resources Imag 01001002 R RWE 77676000 00006000 OLEAUT32 775F0000 .reloc relocatio Imag 01001002 R RWE 779E0000 00001000 WININET 779E0000 (itself) PE header Imag 01001002 R RWE 779E1000 00089000 WININET 779E0000 .text code,impo Imag 01001002 R RWE 77A6A000 00007000 WININET 779E0000 .data data Imag 01001002 R RWE 77A71000 0000E000 WININET 779E0000 .rsrc resources Imag 01001002 R RWE 77A7F000 00005000 WININET 779E0000 .reloc relocatio Imag 01001002 R RWE 77B60000 00001000 VERSION 77B60000 (itself) PE header Imag 01001002 R RWE 77B61000 00004000 VERSION 77B60000 .text code,impo Imag 01001002 R RWE 77B65000 00001000 VERSION 77B60000 .data data Imag 01001002 R RWE 77B66000 00001000 VERSION 77B60000 .rsrc resources Imag 01001002 R RWE 77B67000 00001000 VERSION 77B60000 .reloc relocatio Imag 01001002 R RWE 77B70000 00001000 msvcrt 77B70000 (itself) PE header Imag 01001002 R RWE 77B71000 0004E000 msvcrt 77B70000 .text code,impo Imag 01001002 R RWE 77BBF000 00007000 msvcrt 77B70000 .data data Imag 01001002 R RWE 77BC6000 00001000 msvcrt 77B70000 .rsrc resources Imag 01001002 R RWE 77BC7000 00003000 msvcrt 77B70000 .reloc relocatio Imag 01001002 R RWE 77BD0000 00001000 GDI32 77BD0000 (itself) PE header Imag 01001002 R RWE 77BD1000 00042000 GDI32 77BD0000 .text code,impo Imag 01001002 R RWE 77C13000 00002000 GDI32 77BD0000 .data data Imag 01001002 R RWE 77C15000 00001000 GDI32 77BD0000 .rsrc resources Imag 01001002 R RWE 77C16000 00002000 GDI32 77BD0000 .reloc relocatio Imag 01001002 R RWE 77C20000 00001000 RPCRT4 77C20000 (itself) PE header Imag 01001002 R RWE 77C21000 00090000 RPCRT4 77C20000 .text code,impo Imag 01001002 R RWE 77CB1000 00007000 RPCRT4 77C20000 .orpc code Imag 01001002 R RWE 77CB8000 00001000 RPCRT4 77C20000 .data data Imag 01001002 R RWE 77CB9000 00001000 RPCRT4 77C20000 .rsrc resources Imag 01001002 R RWE 77CBA000 00005000 RPCRT4 77C20000 .reloc relocatio Imag 01001002 R RWE 77CD0000 00001000 comctl_1 77CD0000 (itself) PE header Imag 01001002 R RWE 77CD1000 00091000 comctl_1 77CD0000 .text code,impo Imag 01001002 R RWE 77D62000 00001000 comctl_1 77CD0000 .data data Imag 01001002 R RWE 77D63000 0006A000 comctl_1 77CD0000 .rsrc resources Imag 01001002 R RWE 77DCD000 00006000 comctl_1 77CD0000 .reloc relocatio Imag 01001002 R RWE 77E10000 00001000 USER32 77E10000 (itself) PE header Imag 01001002 R RWE 77E11000 00061000 USER32 77E10000 .text code,impo Imag 01001002 R RWE 77E72000 00002000 USER32 77E10000 .data data Imag 01001002 R RWE 77E74000 0002A000 USER32 77E10000 .rsrc resources Imag 01001002 R RWE 77E9E000 00003000 USER32 77E10000 .reloc relocatio Imag 01001002 R RWE 77EB0000 00001000 SHLWAPI 77EB0000 (itself) PE header Imag 01001002 R RWE 77EB1000 0004A000 SHLWAPI 77EB0000 .text code,impo Imag 01001002 R RWE 77EFB000 00002000 SHLWAPI 77EB0000 .data data Imag 01001002 R RWE 77EFD000 00002000 SHLWAPI 77EB0000 .rsrc resources Imag 01001002 R RWE 77EFF000 00003000 SHLWAPI 77EB0000 .reloc relocatio Imag 01001002 R RWE 77F30000 00001000 ADVAPI32 77F30000 (itself) PE header Imag 01001002 R RWE 77F31000 00070000 ADVAPI32 77F30000 .text code,impo Imag 01001002 R RWE 77FA1000 00004000 ADVAPI32 77F30000 .data data Imag 01001002 R RWE 77FA5000 00032000 ADVAPI32 77F30000 .rsrc resources Imag 01001002 R RWE 77FD7000 00005000 ADVAPI32 77F30000 .reloc relocatio Imag 01001002 R RWE 7C800000 00001000 kernel32 7C800000 (itself) PE header Imag 01001002 R RWE 7C801000 0008A000 kernel32 7C800000 .text code,impo Imag 01001002 R RWE 7C88B000 00005000 kernel32 7C800000 .data data Imag 01001002 R RWE 7C890000 00094000 kernel32 7C800000 .rsrc resources Imag 01001002 R RWE 7C924000 00007000 kernel32 7C800000 .reloc relocatio Imag 01001002 R RWE 7C930000 00001000 ntdll 7C930000 (itself) PE header Imag 01001002 R RWE 7C931000 00087000 ntdll 7C930000 .text code,expo Imag 01001002 R RWE 7C9B8000 00005000 ntdll 7C930000 .data data Imag 01001002 R RWE 7C9BD000 0003F000 ntdll 7C930000 .rsrc resources Imag 01001002 R RWE 7C9FC000 00004000 ntdll 7C930000 .reloc relocatio Imag 01001002 R RWE 7CA10000 00001000 SHELL32 7CA10000 (itself) PE header Imag 01001002 R RWE 7CA11000 00207000 SHELL32 7CA10000 .text code,impo Imag 01001002 R RWE 7CC18000 0001D000 SHELL32 7CA10000 .data data Imag 01001002 R RWE 7CC35000 005A1000 SHELL32 7CA10000 .rsrc resources Imag 01001002 R RWE 7D1D6000 0001B000 SHELL32 7CA10000 .reloc relocatio Imag 01001002 R RWE 7F6F0000 00007000 7F6F0000 (itself) Map 00041020 R E R E 7FFA0000 00033000 7FFA0000 (itself) Map 00041002 R R 7FFDE000 00001000 7FFDE000 (itself) data bloc Priv 00021004 RW RW 7FFDF000 00001000 7FFDF000 (itself) Priv 00021004 RW RW 7FFE0000 00001000 7FFE0000 (itself) Priv 00021002 R R 2006-8-27 23:26 0
killalarm 雪币： 342 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 25 回帖 142 粉丝 0 关注私信	killalarm 8 楼 4008A6 mov dword ptr [400882],ebx 改为 4008A6 mov dword ptr [6E7FF0],ebx 试试 2006-8-28 16:48 0
erge 雪币： 204 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 7 回帖 23 粉丝 0 关注私信	erge 9 楼选用你那个地址可以正确通过。我知道怎么选数据存放地址了，谢谢！ 2006-8-29 18:40 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

killalarm

雪币： 342

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

25

回帖

142

粉丝

0

关注

私信

killalarm: 2 楼

mov dword ptr [400882],ebx 400882属于只读段? 你把ebx写入只读段是不安全的可能会出现无法写入错误建议写入data段地址去

2006-8-27 14:37

0

erge

雪币： 204

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

7

回帖

23

粉丝

0

关注

私信

erge: 3 楼

我临时用那个段来放补丁代码，问题是执行的顺序不是执行jmp 479c64
,而是跳到别的地方去了，我如果把mov dword ptr [400882],ebx去掉就正常。

2006-8-27 15:03

0

killalarm

雪币： 342

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

25

回帖

142

粉丝

0

关注

私信

killalarm: 4 楼

最初由 erge 发布
我临时用那个段来放补丁代码，问题是执行的顺序不是执行jmp 479c64
,而是跳到别的地方去了，我如果把mov dword ptr [400882],ebx去掉就正常。

400882不能为写导致的把400882换成data段的地址!!!!!

2006-8-27 15:21

0

erge

雪币： 204

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

7

回帖

23

粉丝

0

关注

私信

erge: 5 楼

No  | 名称    | VSize    | VOffset | RSize    | ROffset | Charact. |
01  | .text    | 00118696 | 00001000 | 00119000 | 00001000 | 60000020 |
02  | .rdata | 00013880 | 0011A000 | 00014000 | 0011A000 | 40000040 |
03  | .data    | 001B9178 | 0012E000 | 00003000 | 0012E000 | C0000040 |
04  | .rsrc    | 0001A140 | 002E8000 | 0001B000 | 00131000 | 40000040 |

我用PE工具看的区段是上面，data段是不是从0012E000开始到002E8000间的地址啊,大小是1B9178 word？但时在2E7EEE附近没有90可以用啊。

2006-8-27 17:34

0

killalarm

雪币： 342

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

25

回帖

142

粉丝

0

关注

私信

killalarm: 6 楼

最初由 erge 发布
No | 名称 | VSize | VOffset | RSize | ROffset | Charact. |
01 | .text | 00118696 | 00001000 | 00119000 | 00001000 | 60000020 |
02 | .rdata | 00013880 | 0011A000 | 00014000 | 0011A000 | 40000040 |
03 | .data | 001B9178 | 0012E000 | 00003000 | 0012E000 | C0000040 |
04 | .rsrc | 0001A140 | 002E8000 | 0001B000 | 00131000 | 40000040 |
........

首先不是用pe工具看,工具看的只是物理内存地址.往往是不清晰的,如果你用od的话,请alt+m看可以清楚的看到内存景象找出data段 ,这样才比较准确!其次我说的那个地址是为了保存数据,就是说要把ebx存入那个地址,所有这个地址必须是可读可写,而在程序的区段中,很多区段的访问权限非常低,可能仅是可读,所以当你用mov命令往可读段里面写数据时就会产生不可写的异常,最安全的做法就是把数据写入data段的地址,这个段内存地址往往既可读也可写,不会出现错误!最后纠正你的错误内存补丁并不是打在90段,而是一大段00000000000000000000!

2006-8-27 21:17

0

erge

雪币： 204

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

7

回帖

23

粉丝

0

关注

私信

erge: 7 楼

首先感谢你的多次解答。
很多做补订的贴子都说用“90大法”找空白的地方放自己的代码，总以为00的地方是使用了的。

我用的是SOFTICE，因为改软件有HOOK，用OD分析会不反应。

我用OD载入后看了下内存映象，由于没用过，不大看得懂

地址旁边的00130000 (itself)  是指什么,有很多都是R权限,总表里也看不出DATA段的具体地址

内存镜像
地址    大小    Owner                               区段          包含    类型             访问       初始访问映射为
00010000 00001000          00010000 (itself)                                     Priv 00021004    RW          RW
00020000 00001000          00020000 (itself)                                     Priv 00021004    RW          RW
0012C000 00001000          00030000                                              Priv 00021104    RW  防护    RW
0012D000 00003000          00030000                                  stack of Priv 00021104    RW  防护    RW
00130000 00005000          00130000 (itself)                                     Map  00041002    R          R
00140000 00016000          00140000 (itself)                                     Priv 00021004    RW          RW
00240000 00003000          00240000 (itself)                                     Map  00041004    RW          RW
00250000 00016000          00250000 (itself)                                     Map  00041002    R          R          \Device\HarddiskVolume3\WIN2003\system32\unicode.nls
00270000 00034000          00270000 (itself)                                     Map  00041002    R          R          \Device\HarddiskVolume3\WIN2003\system32\locale.nls
002B0000 00041000          002B0000 (itself)                                     Map  00041002    R          R          \Device\HarddiskVolume3\WIN2003\system32\sortkey.nls
00300000 00006000          00300000 (itself)                                     Map  00041002    R          R          \Device\HarddiskVolume3\WIN2003\system32\sorttbls.nls
00310000 00041000          00310000 (itself)                                     Map  00041002    R          R
00360000 00001000 xaudio 00360000 (itself)                         PE header  Imag 01001002    R          RWE
00361000 00022000 xaudio 00360000                   .text          code    Imag 01001002    R          RWE
00383000 00017000 xaudio 00360000                   .rdata       imports,e  Imag 01001002    R          RWE
0039A000 00006000 xaudio 00360000                   .data          data    Imag 01001002    R          RWE
003A0000 00001000 xaudio 00360000                   .rsrc          resources  Imag 01001002    R          RWE
003A1000 00002000 xaudio 00360000                   .reloc       relocatio  Imag 01001002    R          RWE
003B0000 00001000 MapManag 003B0000 (itself)                         PE header  Imag 01001002    R          RWE
003B1000 00006000 MapManag 003B0000                   .text          code    Imag 01001002    R          RWE
003B7000 00002000 MapManag 003B0000                   .rdata       imports,e  Imag 01001002    R          RWE
003B9000 00001000 MapManag 003B0000                   .data          data    Imag 01001002    R          RWE
003BA000 00001000 MapManag 003B0000                   .rsrc          resources  Imag 01001002    R          RWE
003BB000 00001000 MapManag 003B0000                   .reloc       relocatio  Imag 01001002    R          RWE
003C0000 00001000 MsgFlt 003C0000 (itself)                         PE header  Imag 01001002    R          RWE
003C1000 00002000 MsgFlt 003C0000                   .text          code    Imag 01001002    R          RWE
003C3000 00001000 MsgFlt 003C0000                   .rdata       imports,e  Imag 01001002    R          RWE
003C4000 00002000 MsgFlt 003C0000                   .data          data    Imag 01001002    R          RWE
003C6000 00001000 MsgFlt 003C0000                   SHARDATA                Imag 01001002    R          RWE
003C7000 00001000 MsgFlt 003C0000                   .rsrc          resources  Imag 01001002    R          RWE
003C8000 00001000 MsgFlt 003C0000                   .reloc       relocatio  Imag 01001002    R          RWE
003D0000 00008000          003D0000 (itself)                                     Priv 00021004    RW          RW
003E0000 00008000          003E0000 (itself)                                     Priv 00021004    RW          RW
003F0000 00001000          003F0000 (itself)                                     Priv 00021004    RW          RW
00400000 00001000 复件_Som 00400000 (itself)                            PE header  Imag 01001002    R          RWE
00401000 00119000 复件_Som 00400000                      .text          code    Imag 01001002    R          RWE
0051A000 00014000 复件_Som 00400000                      .rdata       imports Imag 01001002    R          RWE
0052E000 001BA000 复件_Som 00400000                      .data          data    Imag 01001002    R          RWE
006E8000 0001B000 复件_Som 00400000                      .rsrc          resources  Imag 01001002    R          RWE
00710000 00006000          00710000 (itself)                                     Map  00041020    R E       R E
007D0000 00002000          00710000                                              Map  00041020    R E       R E
007E0000 00103000          007E0000 (itself)                                     Map  00041002    R          R
008F0000 0008A000          008F0000 (itself)                                     Map  00041020    R E       R E
00BF0000 00008000          00BF0000 (itself)                                     Priv 00021004    RW          RW
00CF0000 00001000          00CF0000 (itself)                                     Priv 00021004    RW          RW
00D00000 00003000          00D00000 (itself)                                     Map  00041002    R          R          \Device\HarddiskVolume3\WIN2003\system32\ctype.nls
00D10000 00001000          00D10000 (itself)                                     Priv 00021004    RW          RW
00D90000 00002000          00D90000 (itself)                                     Priv 00021004    RW          RW
00DA0000 00004000          00DA0000 (itself)                                     Priv 00021004    RW          RW
00DB0000 00004000          00DB0000 (itself)                                     Priv 00021004    RW          RW
00DC0000 00002000          00DC0000 (itself)                                     Map  00041002    R          R
00DD0000 00002000          00DD0000 (itself)                                     Map  00041002    R          R
00DE0000 00002000          00DE0000 (itself)                                     Priv 00021004    RW          RW
00E20000 00001000 odbcint  00E20000 (itself)                         PE header  Imag 01001002    R          RWE
00E21000 00010000 odbcint  00E20000                   .rsrc          data,reso  Imag 01001002    R          RWE
00E31000 00001000 odbcint  00E20000                   .reloc       relocatio  Imag 01001002    R          RWE
00E40000 0000D000          00E40000 (itself)                                     Map  00041002    R          R          \Device\HarddiskVolume3\WIN2003\system32\mfc42loc.dll
00E50000 00002000          00E50000 (itself)                                     Map  00041002    R          R
00E60000 00001000          00E60000 (itself)                                     Priv 00021004    RW          RW
00EA0000 00001000          00EA0000 (itself)                                     Priv 00021004    RW          RW
00EE0000 00001000          00EE0000 (itself)                                     Priv 00021004    RW          RW
10000000 00001000 DManage  10000000 (itself)                         PE header  Imag 01001002    R          RWE
10001000 00015000 DManage  10000000                   .text          code    Imag 01001002    R          RWE
10016000 00007000 DManage  10000000                   .rdata       imports,e  Imag 01001002    R          RWE
1001D000 000EB000 DManage  10000000                   .data          data    Imag 01001002    R          RWE
10108000 00001000 DManage  10000000                   .rsrc          resources  Imag 01001002    R          RWE
10109000 00002000 DManage  10000000                   .reloc       relocatio  Imag 01001002    R          RWE
4B750000 00001000 ODBC32 4B750000 (itself)                         PE header  Imag 01001002    R          RWE
4B751000 00036000 ODBC32 4B750000                   .text          code,impo  Imag 01001002    R          RWE
4B787000 00002000 ODBC32 4B750000                   .data          data    Imag 01001002    R          RWE
4B789000 00001000 ODBC32 4B750000                   .sdbid                   Imag 01001002    R          RWE
4B78A000 00001000 ODBC32 4B750000                   .rsrc          resources  Imag 01001002    R          RWE
4B78B000 00002000 ODBC32 4B750000                   .reloc       relocatio  Imag 01001002    R          RWE
63090000 00001000 LPK    63090000 (itself)                         PE header  Imag 01001002    R          RWE
63091000 00005000 LPK    63090000                   .text          code,impo  Imag 01001002    R          RWE
63096000 00001000 LPK    63090000                   .data          data    Imag 01001002    R          RWE
63097000 00001000 LPK    63090000                   .rsrc          resources  Imag 01001002    R          RWE
63098000 00001000 LPK    63090000                   .reloc       relocatio  Imag 01001002    R          RWE
71B10000 00001000 WSOCK32  71B10000 (itself)                         PE header  Imag 01001002    R          RWE
71B11000 00003000 WSOCK32  71B10000                   .text          code,impo  Imag 01001002    R          RWE
71B14000 00001000 WSOCK32  71B10000                   .data          data    Imag 01001002    R          RWE
71B15000 00005000 WSOCK32  71B10000                   .rsrc          resources  Imag 01001002    R          RWE
71B1A000 00001000 WSOCK32  71B10000                   .reloc       relocatio  Imag 01001002    R          RWE
71B50000 00001000 WS2HELP  71B50000 (itself)                         PE header  Imag 01001002    R          RWE
71B51000 00004000 WS2HELP  71B50000                   .text          code,impo  Imag 01001002    R          RWE
71B55000 00001000 WS2HELP  71B50000                   .data          data    Imag 01001002    R          RWE
71B56000 00001000 WS2HELP  71B50000                   .rsrc          resources  Imag 01001002    R          RWE
71B57000 00001000 WS2HELP  71B50000                   .reloc       relocatio  Imag 01001002    R          RWE
71B60000 00001000 WS2_32 71B60000 (itself)                         PE header  Imag 01001002    R          RWE
71B61000 00013000 WS2_32 71B60000                   .text          code,impo  Imag 01001002    R          RWE
71B74000 00001000 WS2_32 71B60000                   .data          data    Imag 01001002    R          RWE
71B75000 00001000 WS2_32 71B60000                   .rsrc          resources  Imag 01001002    R          RWE
71B76000 00001000 WS2_32 71B60000                   .reloc       relocatio  Imag 01001002    R          RWE
72200000 00001000 DINPUT 72200000 (itself)                         PE header  Imag 01001002    R          RWE
72201000 0001E000 DINPUT 72200000                   .text          code,impo  Imag 01001002    R          RWE
7221F000 00001000 DINPUT 72200000                   .data          data    Imag 01001002    R          RWE
72220000 00005000 DINPUT 72200000                   .rsrc          resources  Imag 01001002    R          RWE
72225000 00002000 DINPUT 72200000                   .reloc       relocatio  Imag 01001002    R          RWE
73730000 00001000 DDRAW 73730000 (itself)                         PE header  Imag 01001002    R          RWE
73731000 0003F000 DDRAW 73730000                   .text          code,impo  Imag 01001002    R          RWE
73770000 00007000 DDRAW 73730000                   .data          data    Imag 01001002    R          RWE
73777000 00001000 DDRAW 73730000                   .rsrc          resources  Imag 01001002    R          RWE
73778000 00004000 DDRAW 73730000                   .reloc       relocatio  Imag 01001002    R          RWE
73A60000 00001000 DCIMAN32 73A60000 (itself)                         PE header  Imag 01001002    R          RWE
73A61000 00002000 DCIMAN32 73A60000                   .text          code,impo  Imag 01001002    R          RWE
73A63000 00001000 DCIMAN32 73A60000                   .data          data    Imag 01001002    R          RWE
73A64000 00001000 DCIMAN32 73A60000                   .rsrc          resources  Imag 01001002    R          RWE
73A65000 00001000 DCIMAN32 73A60000                   .reloc       relocatio  Imag 01001002    R          RWE
73DA0000 00001000 DSOUND 73DA0000 (itself)                         PE header  Imag 01001002    R          RWE
73DA1000 00056000 DSOUND 73DA0000                   .text          code,impo  Imag 01001002    R          RWE
73DF7000 00003000 DSOUND 73DA0000                   .data          data    Imag 01001002    R          RWE
73DFA000 00001000 DSOUND 73DA0000                   .rsrc          resources  Imag 01001002    R          RWE
73DFB000 00003000 DSOUND 73DA0000                   .reloc       relocatio  Imag 01001002    R          RWE
74AE0000 00001000 USP10 74AE0000 (itself)                         PE header  Imag 01001002    R          RWE
74AE1000 00040000 USP10 74AE0000                   .text          code,impo  Imag 01001002    R          RWE
74B21000 0000A000 USP10 74AE0000                   .data          data    Imag 01001002    R          RWE
74B2B000 00002000 USP10 74AE0000                   Shared                   Imag 01001002    R          RWE
74B2D000 00012000 USP10 74AE0000                   .rsrc          resources  Imag 01001002    R          RWE
74B3F000 00002000 USP10 74AE0000                   .reloc       relocatio  Imag 01001002    R          RWE
754E0000 00001000 MFC42 754E0000 (itself)                         PE header  Imag 01001002    R          RWE
754E1000 000FC000 MFC42 754E0000                   .text          code,impo  Imag 01001002    R          RWE
755DD000 00007000 MFC42 754E0000                   .data          data    Imag 01001002    R          RWE
755E4000 0000B000 MFC42 754E0000                   .rsrc          resources  Imag 01001002    R          RWE
755EF000 00012000 MFC42 754E0000                   .reloc       relocatio  Imag 01001002    R          RWE
76080000 00001000 MSASN1 76080000 (itself)                         PE header  Imag 01001002    R          RWE
76081000 0000E000 MSASN1 76080000                   .text          code,impo  Imag 01001002    R          RWE
7608F000 00001000 MSASN1 76080000                   .data          data    Imag 01001002    R          RWE
76090000 00001000 MSASN1 76080000                   .rsrc          resources  Imag 01001002    R          RWE
76091000 00001000 MSASN1 76080000                   .reloc       relocatio  Imag 01001002    R          RWE
760A0000 00001000 CRYPT32  760A0000 (itself)                         PE header  Imag 01001002    R          RWE
760A1000 00083000 CRYPT32  760A0000                   .text          code,impo  Imag 01001002    R          RWE
76124000 00003000 CRYPT32  760A0000                   .data          data    Imag 01001002    R          RWE
76127000 00005000 CRYPT32  760A0000                   .rsrc          resources  Imag 01001002    R          RWE
7612C000 00005000 CRYPT32  760A0000                   .reloc       relocatio  Imag 01001002    R          RWE
76180000 00001000 IMM32 76180000 (itself)                         PE header  Imag 01001002    R          RWE
76181000 00015000 IMM32 76180000                   .text          code,impo  Imag 01001002    R          RWE
76196000 00001000 IMM32 76180000                   .data          data    Imag 01001002    R          RWE
76197000 00005000 IMM32 76180000                   .rsrc          resources  Imag 01001002    R          RWE
7619C000 00001000 IMM32 76180000                   .reloc       relocatio  Imag 01001002    R          RWE
761A0000 00001000 comdlg32 761A0000 (itself)                         PE header  Imag 01001002    R          RWE
761A1000 00031000 comdlg32 761A0000                   .text          code,impo  Imag 01001002    R          RWE
761D2000 00004000 comdlg32 761A0000                   .data          data    Imag 01001002    R          RWE
761D6000 0000F000 comdlg32 761A0000                   .rsrc          resources  Imag 01001002    R          RWE
761E5000 00003000 comdlg32 761A0000                   .reloc       relocatio  Imag 01001002    R          RWE
769E0000 00001000 WINMM 769E0000 (itself)                         PE header  Imag 01001002    R          RWE
769E1000 0001F000 WINMM 769E0000                   .text          code,impo  Imag 01001002    R          RWE
76A00000 00002000 WINMM 769E0000                   .data          data    Imag 01001002    R          RWE
76A02000 00006000 WINMM 769E0000                   .rsrc          resources  Imag 01001002    R          RWE
76A08000 00002000 WINMM 769E0000                   .reloc       relocatio  Imag 01001002    R          RWE
77370000 00001000 COMCTL32 77370000 (itself)                         PE header  Imag 01001002    R          RWE
77371000 0006E000 COMCTL32 77370000                   .text          code,impo  Imag 01001002    R          RWE
773DF000 00004000 COMCTL32 77370000                   .data          data    Imag 01001002    R          RWE
773E3000 0001F000 COMCTL32 77370000                   .rsrc          resources  Imag 01001002    R          RWE
77402000 00005000 COMCTL32 77370000                   .reloc       relocatio  Imag 01001002    R          RWE
774B0000 00001000 ole32 774B0000 (itself)                         PE header  Imag 01001002    R          RWE
774B1000 00116000 ole32 774B0000                   .text          code,impo  Imag 01001002    R          RWE
775C7000 00007000 ole32 774B0000                   .orpc          code    Imag 01001002    R          RWE
775CE000 00008000 ole32 774B0000                   .data          data    Imag 01001002    R          RWE
775D6000 00002000 ole32 774B0000                   .rsrc          resources  Imag 01001002    R          RWE
775D8000 0000C000 ole32 774B0000                   .reloc       relocatio  Imag 01001002    R          RWE
775F0000 00001000 OLEAUT32 775F0000 (itself)                         PE header  Imag 01001002    R          RWE
775F1000 00080000 OLEAUT32 775F0000                   .text          code,impo  Imag 01001002    R          RWE
77671000 00001000 OLEAUT32 775F0000                   .orpc                   Imag 01001002    R          RWE
77672000 00003000 OLEAUT32 775F0000                   .data          data    Imag 01001002    R          RWE
77675000 00001000 OLEAUT32 775F0000                   .rsrc          resources  Imag 01001002    R          RWE
77676000 00006000 OLEAUT32 775F0000                   .reloc       relocatio  Imag 01001002    R          RWE
779E0000 00001000 WININET  779E0000 (itself)                         PE header  Imag 01001002    R          RWE
779E1000 00089000 WININET  779E0000                   .text          code,impo  Imag 01001002    R          RWE
77A6A000 00007000 WININET  779E0000                   .data          data    Imag 01001002    R          RWE
77A71000 0000E000 WININET  779E0000                   .rsrc          resources  Imag 01001002    R          RWE
77A7F000 00005000 WININET  779E0000                   .reloc       relocatio  Imag 01001002    R          RWE
77B60000 00001000 VERSION  77B60000 (itself)                         PE header  Imag 01001002    R          RWE
77B61000 00004000 VERSION  77B60000                   .text          code,impo  Imag 01001002    R          RWE
77B65000 00001000 VERSION  77B60000                   .data          data    Imag 01001002    R          RWE
77B66000 00001000 VERSION  77B60000                   .rsrc          resources  Imag 01001002    R          RWE
77B67000 00001000 VERSION  77B60000                   .reloc       relocatio  Imag 01001002    R          RWE
77B70000 00001000 msvcrt 77B70000 (itself)                         PE header  Imag 01001002    R          RWE
77B71000 0004E000 msvcrt 77B70000                   .text          code,impo  Imag 01001002    R          RWE
77BBF000 00007000 msvcrt 77B70000                   .data          data    Imag 01001002    R          RWE
77BC6000 00001000 msvcrt 77B70000                   .rsrc          resources  Imag 01001002    R          RWE
77BC7000 00003000 msvcrt 77B70000                   .reloc       relocatio  Imag 01001002    R          RWE
77BD0000 00001000 GDI32 77BD0000 (itself)                         PE header  Imag 01001002    R          RWE
77BD1000 00042000 GDI32 77BD0000                   .text          code,impo  Imag 01001002    R          RWE
77C13000 00002000 GDI32 77BD0000                   .data          data    Imag 01001002    R          RWE
77C15000 00001000 GDI32 77BD0000                   .rsrc          resources  Imag 01001002    R          RWE
77C16000 00002000 GDI32 77BD0000                   .reloc       relocatio  Imag 01001002    R          RWE
77C20000 00001000 RPCRT4 77C20000 (itself)                         PE header  Imag 01001002    R          RWE
77C21000 00090000 RPCRT4 77C20000                   .text          code,impo  Imag 01001002    R          RWE
77CB1000 00007000 RPCRT4 77C20000                   .orpc          code    Imag 01001002    R          RWE
77CB8000 00001000 RPCRT4 77C20000                   .data          data    Imag 01001002    R          RWE
77CB9000 00001000 RPCRT4 77C20000                   .rsrc          resources  Imag 01001002    R          RWE
77CBA000 00005000 RPCRT4 77C20000                   .reloc       relocatio  Imag 01001002    R          RWE
77CD0000 00001000 comctl_1 77CD0000 (itself)                         PE header  Imag 01001002    R          RWE
77CD1000 00091000 comctl_1 77CD0000                   .text          code,impo  Imag 01001002    R          RWE
77D62000 00001000 comctl_1 77CD0000                   .data          data    Imag 01001002    R          RWE
77D63000 0006A000 comctl_1 77CD0000                   .rsrc          resources  Imag 01001002    R          RWE
77DCD000 00006000 comctl_1 77CD0000                   .reloc       relocatio  Imag 01001002    R          RWE
77E10000 00001000 USER32 77E10000 (itself)                         PE header  Imag 01001002    R          RWE
77E11000 00061000 USER32 77E10000                   .text          code,impo  Imag 01001002    R          RWE
77E72000 00002000 USER32 77E10000                   .data          data    Imag 01001002    R          RWE
77E74000 0002A000 USER32 77E10000                   .rsrc          resources  Imag 01001002    R          RWE
77E9E000 00003000 USER32 77E10000                   .reloc       relocatio  Imag 01001002    R          RWE
77EB0000 00001000 SHLWAPI  77EB0000 (itself)                         PE header  Imag 01001002    R          RWE
77EB1000 0004A000 SHLWAPI  77EB0000                   .text          code,impo  Imag 01001002    R          RWE
77EFB000 00002000 SHLWAPI  77EB0000                   .data          data    Imag 01001002    R          RWE
77EFD000 00002000 SHLWAPI  77EB0000                   .rsrc          resources  Imag 01001002    R          RWE
77EFF000 00003000 SHLWAPI  77EB0000                   .reloc       relocatio  Imag 01001002    R          RWE
77F30000 00001000 ADVAPI32 77F30000 (itself)                         PE header  Imag 01001002    R          RWE
77F31000 00070000 ADVAPI32 77F30000                   .text          code,impo  Imag 01001002    R          RWE
77FA1000 00004000 ADVAPI32 77F30000                   .data          data    Imag 01001002    R          RWE
77FA5000 00032000 ADVAPI32 77F30000                   .rsrc          resources  Imag 01001002    R          RWE
77FD7000 00005000 ADVAPI32 77F30000                   .reloc       relocatio  Imag 01001002    R          RWE
7C800000 00001000 kernel32 7C800000 (itself)                         PE header  Imag 01001002    R          RWE
7C801000 0008A000 kernel32 7C800000                   .text          code,impo  Imag 01001002    R          RWE
7C88B000 00005000 kernel32 7C800000                   .data          data    Imag 01001002    R          RWE
7C890000 00094000 kernel32 7C800000                   .rsrc          resources  Imag 01001002    R          RWE
7C924000 00007000 kernel32 7C800000                   .reloc       relocatio  Imag 01001002    R          RWE
7C930000 00001000 ntdll 7C930000 (itself)                         PE header  Imag 01001002    R          RWE
7C931000 00087000 ntdll 7C930000                   .text          code,expo  Imag 01001002    R          RWE
7C9B8000 00005000 ntdll 7C930000                   .data          data    Imag 01001002    R          RWE
7C9BD000 0003F000 ntdll 7C930000                   .rsrc          resources  Imag 01001002    R          RWE
7C9FC000 00004000 ntdll 7C930000                   .reloc       relocatio  Imag 01001002    R          RWE
7CA10000 00001000 SHELL32  7CA10000 (itself)                         PE header  Imag 01001002    R          RWE
7CA11000 00207000 SHELL32  7CA10000                   .text          code,impo  Imag 01001002    R          RWE
7CC18000 0001D000 SHELL32  7CA10000                   .data          data    Imag 01001002    R          RWE
7CC35000 005A1000 SHELL32  7CA10000                   .rsrc          resources  Imag 01001002    R          RWE
7D1D6000 0001B000 SHELL32  7CA10000                   .reloc       relocatio  Imag 01001002    R          RWE
7F6F0000 00007000          7F6F0000 (itself)                                     Map  00041020    R E       R E
7FFA0000 00033000          7FFA0000 (itself)                                     Map  00041002    R          R
7FFDE000 00001000          7FFDE000 (itself)                         data bloc  Priv 00021004    RW          RW
7FFDF000 00001000          7FFDF000 (itself)                                     Priv 00021004    RW          RW
7FFE0000 00001000          7FFE0000 (itself)                                     Priv 00021002    R          R

2006-8-27 23:26

0