问题是这样的
某文件Aspr2.X SKE 经脱壳(OllyDbg+一高人脚本)修复IAT(ImportRec),若在Win2003 脱壳修复只能在2003运行,若Vista脱壳修复只能运行在Vista
下面为部分 输入表数据
Win2003的
->导入表
2. 导入函数描述符:
OriginalFirstThunk: 0x00000000
时间日期戳: 0x00000000 (GMT: Thu Jan 01 00:00:00 1970)
正向连接索引: 0x00000000
Dll名称RVA: 0x0007355C ("kernel32.dll")
FirstThunk: 0x00073008
顺序/指示 API名称
------------ ---------------------------------------
0x0287 "OpenProcess"
0x01F4 "GetWindowsDirectoryA"
0x01A1 "GetProcAddress"
0x0054 "CreateFileA"
0x0073 "CreateToolhelp32Snapshot"
0x0297 "Process32First"
0x0299 "Process32Next"
0x0035 "CloseHandle"
0x0180 "GetModuleHandleA"
0x01E0 "GetTickCount"
0x03AB "WritePrivateProfileStringA"
0x019D "GetPrivateProfileStringA"
0x03CD "lstrlen"
0x0276 "MultiByteToWideChar"
0x01EA "GetVersionExA"
0x01DB "GetThreadLocale"
0x0175 "GetLocaleInfoA"
0x00FE "GetACP"
0x022A "InterlockedExchange"
0x03AF "WriteProcessMemory"
0x0144 "GetCurrentProcessId"
0x0224 "InitializeCriticalSection"
0x0082 "DeleteCriticalSection"
0x00BA "ExitProcess"
0x01B8 "GetStartupInfoA"
0x02A4 "QueryPerformanceCounter"
0x0147 "GetCurrentThreadId"
0x01CB "GetSystemTimeAsFileTime"
0x0067 "CreateProcessA"
0x02D3 "ResumeThread"
0x0253 "LoadLibraryA"
Vista 的
2. 导入函数描述符:
OriginalFirstThunk: 0x00073008
时间日期戳: 0x00000000 (GMT: Thu Jan 01 00:00:00 1970)
正向连接索引: 0x00000000
Dll名称RVA: 0x00073568 ("kernel32.dll")
FirstThunk: 0x00073008
顺序/指示 API名称
------------ ---------------------------------------
0x0334 "OpenProcess"
0x0282 "GetWindowsDirectoryA"
0x0222 "GetProcAddress"
0x007A "CreateFileA"
0x00AE "CreateToolhelp32Snapshot"
0x0344 "Process32First"
0x0346 "Process32Next"
0x0045 "CloseHandle"
0x0180 "GetModuleHandleA"
0x0269 "GetTickCount"
0x0493 "WritePrivateProfileStringA"
0x021E "GetPrivateProfileStringA"
0x04B5 "lstrlen"
0x031B "MultiByteToWideChar"
0x0277 "GetVersionExA"
0x0261 "GetThreadLocale"
0x01EA "GetLocaleInfoA"
0x0154 "GetACP"
0x02BF "InterlockedExchange"
0x0497 "WriteProcessMemory"
0x01AC "GetCurrentProcessId"
0x02B6 "InitializeCriticalSection"
0x00C0 "DeleteCriticalSection"
0x0106 "ExitProcess"
0x023B "GetStartupInfoA"
0x0355 "QueryPerformanceCounter"
0x01AF "GetCurrentThreadId"
0x0251 "GetSystemTimeAsFileTime"
0x0096 "CreateProcessA"
0x038E "ResumeThread"
0x02F2 "LoadLibraryA"
请问若要跨系统这样的该如何修复,问题是处在Hint 吗?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课