-
-
[求助]关于Hying的八连环SEH
-
发表于: 2006-9-17 04:04
-
今天弄这么个壳
应该是0.7X的
前面还是很顺利，到了第4个异常就不对劲了
遂找兄弟们的文章参考之，但是还是不明就理
这个流程是具体如何操作的？
我已得到一张类似的表
下面操作就老异常，感谢各位兄弟回答
应该是0.7X的
前面还是很顺利，到了第4个异常就不对劲了
遂找兄弟们的文章参考之，但是还是不明就理
见simonzh2000兄弟文
流程如下:
1. 34EFA8 内存访问异常, regEIP = 34EFAA, dr0=34EFAB, 结束, F9
2. 34EFAB 单步异常(由于Dr0), regEIP = 34EFAB, drx=0, 结束, F9
3. 34EFAC INT3 regEIP = 34CDAD, dr0=34CDAE, 结束, F9
4. 34CDAE 单步异常(由于Dr0), regEIP = 34CDAE, drx=0, 结束, F9
5. 34CDB5 单步异常(由于34cdb0) regEIP = 34CABB, drx=0, 结束, F9
6. 34CABD DIV0 regEIP = 34BDB9, drx=0, 结束, F9
7. 34BDBC INT0 regEIP = 34BD43, drx=0, 结束, F9
8. 34BD43 数组超限 regEIP = 34A32B, drx=0, OK, 不能用 F9 了, SHIFT+F9 到 34A32B
这个流程是具体如何操作的？
我已得到一张类似的表
003A1201 05 00 00 C0 29 EF 39 00 2A EF 39 00 00 00 00 00 ..??.*?.....
003A1211 00 00 00 00 00 00 00 00 00 00 00 00 01 01 00 00 ..............
003A1221 04 00 00 80 2A EF 39 00 00 00 00 00 00 00 00 00 ..??.........
003A1231 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A1241 03 00 00 80 2C CD 39 00 2D CD 39 00 00 00 00 00 ..??.-?.....
003A1251 00 00 00 00 00 00 00 00 00 00 00 00 01 01 00 00 ..............
003A1261 04 00 00 80 2D CD 39 00 00 00 00 00 00 00 00 00 ..??.........
003A1271 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A1281 04 00 00 80 3A CA 39 00 00 00 00 00 00 00 00 00 ..??.........
003A1291 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A12A1 94 00 00 C0 38 BD 39 00 00 00 00 00 00 00 00 00 ?.??.........
003A12B1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A12C1 95 00 00 C0 C2 BC 39 00 00 00 00 00 00 00 00 00 ?.缆?.........
003A12D1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A12E1 8C 00 00 C0 AA A2 39 00 00 00 00 00 00 00 00 ?.廓?.........
C0000005 80000004 80000003 80000004 80000004 C0000094 C0000095 C000008C
下面操作就老异常，感谢各位兄弟回答
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
最初由 pendan2001 发布 谢谢兄弟回答  原来这样就可以了我把问题想复杂了。。。郁闷  PS：To pendan2001 兄弟的那篇文章怎么没下篇IAT处理啊 |
|
|
老大,你土盾盾到这里来了
找你找得好苦!
|
