问题是这样的
某文件Aspr2.X SKE 经脱壳(OllyDbg+一高人脚本)修复IAT(ImportRec),若在Win2003 脱壳修复只能在2003运行,若Vista脱壳修复只能运行在Vista
下面为部分 输入表数据
Win2003的
->导入表
2. 导入函数描述符:
OriginalFirstThunk: 0x00000000
时间日期戳: 0x00000000 (GMT: Thu Jan 01 00:00:00 1970)
正向连接索引: 0x00000000
Dll名称RVA: 0x0007355C ("kernel32.dll")
FirstThunk: 0x00073008
顺序/指示 API名称
------------ ---------------------------------------
0x0287 "OpenProcess"
0x01F4 "GetWindowsDirectoryA"
0x01A1 "GetProcAddress"
0x0054 "CreateFileA"
0x0073 "CreateToolhelp32Snapshot"
0x0297 "Process32First"
0x0299 "Process32Next"
0x0035 "CloseHandle"
0x0180 "GetModuleHandleA"
0x01E0 "GetTickCount"
0x03AB "WritePrivateProfileStringA"
0x019D "GetPrivateProfileStringA"
0x03CD "lstrlen"
0x0276 "MultiByteToWideChar"
0x01EA "GetVersionExA"
0x01DB "GetThreadLocale"
0x0175 "GetLocaleInfoA"
0x00FE "GetACP"
0x022A "InterlockedExchange"
0x03AF "WriteProcessMemory"
0x0144 "GetCurrentProcessId"
0x0224 "InitializeCriticalSection"
0x0082 "DeleteCriticalSection"
0x00BA "ExitProcess"
0x01B8 "GetStartupInfoA"
0x02A4 "QueryPerformanceCounter"
0x0147 "GetCurrentThreadId"
0x01CB "GetSystemTimeAsFileTime"
0x0067 "CreateProcessA"
0x02D3 "ResumeThread"
0x0253 "LoadLibraryA"
Vista 的
2. 导入函数描述符:
OriginalFirstThunk: 0x00073008
时间日期戳: 0x00000000 (GMT: Thu Jan 01 00:00:00 1970)
正向连接索引: 0x00000000
Dll名称RVA: 0x00073568 ("kernel32.dll")
FirstThunk: 0x00073008
顺序/指示 API名称
------------ ---------------------------------------
0x0334 "OpenProcess"
0x0282 "GetWindowsDirectoryA"
0x0222 "GetProcAddress"
0x007A "CreateFileA"
0x00AE "CreateToolhelp32Snapshot"
0x0344 "Process32First"
0x0346 "Process32Next"
0x0045 "CloseHandle"
0x0180 "GetModuleHandleA"
0x0269 "GetTickCount"
0x0493 "WritePrivateProfileStringA"
0x021E "GetPrivateProfileStringA"
0x04B5 "lstrlen"
0x031B "MultiByteToWideChar"
0x0277 "GetVersionExA"
0x0261 "GetThreadLocale"
0x01EA "GetLocaleInfoA"
0x0154 "GetACP"
0x02BF "InterlockedExchange"
0x0497 "WriteProcessMemory"
0x01AC "GetCurrentProcessId"
0x02B6 "InitializeCriticalSection"
0x00C0 "DeleteCriticalSection"
0x0106 "ExitProcess"
0x023B "GetStartupInfoA"
0x0355 "QueryPerformanceCounter"
0x01AF "GetCurrentThreadId"
0x0251 "GetSystemTimeAsFileTime"
0x0096 "CreateProcessA"
0x038E "ResumeThread"
0x02F2 "LoadLibraryA"
请问若要跨系统这样的该如何修复,问题是处在Hint 吗?
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
