首页
社区
课程
招聘
[原创]处理标准导入目录表的idc脚本
发表于: 2008-11-9 09:44 10964

[原创]处理标准导入目录表的idc脚本

2008-11-9 09:44
10964

帖一个近期开发的IDA脚本程序dllentry.idc,专门用于处理标准PE文件中的导入目录信息(Import Directory), 对于加壳或加密的PE文件无效。本脚本在IDA Free version 4.9下调试通过,下面以Windows XP Pro SP2 中文版的notepad.exe为例给出运行dllentry.idc前后的实际效果:

运行dllentry.idc前的IDA输出情况(用PETOOLS的Directory Editor查出Import Directory的RVA=00008C0C,然后将光标定位在.text:01008C0C这一行):

; Notepad.exe from Windows XP Pro SP2 Chinese Edition (filesize=151040 bytes, time stamp=2006-11-02 20:32:28)
.text:01008C0B align 4
.text:01008C0C dd 8DC8h, 2 dup(0FFFFFFFFh), 8D24h, 1000h, 8DE0h, 2 dup(0FFFFFFFFh)
.text:01008C0C dd 8D32h, 1018h, 8ED4h, 2 dup(0FFFFFFFFh), 8D40h, 110Ch
.text:01008C0C dd 8F38h, 2 dup(0FFFFFFFFh), 8D4Ah, 1170h, 9058h, 2 dup(0FFFFFFFFh)
.text:01008C0C dd 8D56h, 1290h, 90BCh, 2 dup(0FFFFFFFFh), 8D62h, 12F4h
.text:01008C0C dd 90E4h, 2 dup(0FFFFFFFFh), 8D70h, 131Ch, 90FCh, 2 dup(0FFFFFFFFh)
.text:01008C0C dd 8D7Ch, 1334h, 910Ch, 2 dup(0FFFFFFFFh), 8D8Ah, 1344h
.text:01008C0C dd 9124h, 2 dup(0FFFFFFFFh), 8D94h, 135Ch, 9130h, 2 dup(0FFFFFFFFh)
.text:01008C0C dd 8DA0h, 1368h, 913Ch, 2 dup(0FFFFFFFFh), 8DAEh, 1374h
.text:01008C0C dd 9148h, 2 dup(0FFFFFFFFh), 8DBCh, 1380h, 5 dup(0)
.text:01008D24 dd 41564441h, 32334950h, 6C6C642Eh, 454B0000h, 4C454E52h
.text:01008D24 dd 642E3233h, 6C6Ch, 33494447h, 6C642E32h, 5355006Ch, 32335245h
.text:01008D24 dd 6C6C642Eh, 736D0000h, 74726376h, 6C6C642Eh, 4F430000h
.text:01008D24 dd 474C444Dh, 642E3233h, 6C6Ch, 4C454853h, 2E32334Ch, 6C6C64h
.text:01008D24 dd 534E4957h, 4C4F4F50h, 5652442Eh, 6C6F0000h, 2E323365h
.text:01008D24 dd 6C6C64h, 574C4853h, 2E495041h, 6C6C64h, 434D4F43h, 32334C54h
.text:01008D24 dd 6C6C642Eh, 4C4F0000h, 54554145h, 642E3233h, 6C6Ch, 6C64746Eh
.text:01008D24 dd 6C642E6Ch, 9090006Ch, 9150h, 9164h, 9172h, 9182h, 9192h
.text:01008D24 dd 0
.text:01008DE0 dd 91A4h, 91C2h, 91D2h, 91E0h, 91F0h, 91FEh, 9214h, 9226h
.text:01008DE0 dd 9236h, 9244h, 9254h, 926Ah, 927Ch, 928Ch, 9296h, 92A4h
.text:01008DE0 dd 92B4h, 92C0h, 92D2h, 92E8h, 92F8h, 9304h, 9314h, 9320h
.text:01008DE0 dd 9334h, 933Eh, 9350h, 9366h, 937Ch, 938Ah, 9396h, 93ACh
.text:01008DE0 dd 93BEh, 93CAh, 93DCh, 93F0h, 9404h, 941Eh, 9434h, 9444h
.text:01008DE0 dd 945Eh, 9472h, 9490h, 94A2h, 94C0h, 94C8h, 94DEh, 94EAh
.text:01008DE0 dd 94FCh, 950Ah, 9516h, 9526h, 9534h, 9540h, 954Eh, 955Ch
.text:01008DE0 dd 9574h, 9580h, 9598h, 95B4h, 0
.text:01008ED4 dd 95D0h, 95E0h, 95EEh, 9602h, 9614h, 961Eh, 962Ah, 963Ch
.text:01008ED4 dd 964Ch, 9658h, 9664h, 966Eh, 967Ah, 9684h, 9690h, 969Ch
.text:01008ED4 dd 96B4h, 96C0h, 96D0h, 96DEh, 96F0h, 96FEh, 970Eh, 9724h
.text:01008ED4 dd 0
.text:01008F38 dd 9734h, 9744h, 9750h, 975Ch, 9764h, 9776h, 9788h, 979Ch
.text:01008F38 dd 97AEh, 97C0h, 97D6h, 97E2h, 97F2h, 9800h, 9816h, 9824h
.text:01008F38 dd 9838h, 9846h, 9854h, 9866h, 987Ah, 988Ah, 98A0h, 98B2h
.text:01008F38 dd 98CCh, 98E2h, 98F2h, 9900h, 9912h, 9922h, 9932h, 9940h
.text:01008F38 dd 9956h, 9968h, 9976h, 9988h, 9998h, 99A4h, 99B4h, 99C6h
.text:01008F38 dd 99E4h, 99F4h, 9A04h, 9A16h, 9A24h, 9A2Eh, 9A40h, 9A4Eh
.text:01008F38 dd 9A5Eh, 9A6Ch, 9A78h, 9A84h, 9A94h, 9AA0h, 9AB8h, 9AC4h
.text:01008F38 dd 9AD8h, 9AF0h, 9B04h, 9B18h, 9B28h, 9B3Ah, 9B52h, 9B64h
.text:01008F38 dd 9B76h, 9B82h, 9B94h, 9BA0h, 9BAEh, 9BC4h, 9BD4h, 0
.text:01009058 dd 9BE6h, 9BFAh, 9C08h, 9C16h, 9C20h, 9C28h, 9C32h, 9C3Eh
.text:01009058 dd 9C4Ah, 9C64h, 9C76h, 9C84h, 9C94h, 9CA4h, 9CB2h, 9CBEh
.text:01009058 dd 9CC8h, 9CD0h, 9CD8h, 9CE8h, 9CF6h, 9D04h, 9D0Ch, 9D16h
.text:01009058 dd 0
.text:010090BC dd 9D2Ah, 9D3Eh, 9D4Ah, 9D5Ah, 9D6Ah, 9D78h, 9D8Ch, 9DA4h
.text:010090BC dd 9DB2h, 0
.text:010090E4 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:010090E4 retn 9Dh
.text:010090E4 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:010090E7 align 4
.text:010090E8 dd 9DD4h, 9DE6h, 9DF4h, 9E12h, 0
.text:010090FC dd 9E20h, 9E34h, 9E44h, 0
.text:0100910C dd 9E54h, 9E66h, 9E7Ah, 9E8Ah, 9E9Ch, 0
.text:01009124 dd 9EAEh, 9EC0h, 0
.text:01009130 dd 9ECCh, 80000159h, 0
.text:0100913C dd 80000002h, 80000006h, 0
.text:01009148 dd 9EE2h, 0
.text:01009150 db 68h ; h
.text:01009151 db 2, 52h, 65h
.text:01009154 aGqueryvalueexw db 'gQueryValueExW',0
.text:01009163 align 4
.text:01009164 db 2Ah ; *
.text:01009165 db 2, 52h, 65h
.text:01009168 aGclosekey db 'gCloseKey',0
.text:01009172 dw 236h
.text:01009174 aRegcreatekeyw db 'RegCreateKeyW',0
.text:01009182 dw 17Ah
.text:01009184 aIstextunicode db 'IsTextUnicode',0
.text:01009192 dw 278h
.text:01009194 aRegsetvalueexw db 'RegSetValueExW',0
.text:010091A3 align 4
.text:010091A4 db 0D0h ; ?
.text:010091A5 db 1, 47h, 65h
.text:010091A8 aTfileinformati db 'tFileInformationByHandle',0
.text:010091C1 align 2
.text:010091C2 dw 12Bh
.text:010091C4 aFindnlsstring db 'FindNLSString',0
.text:010091D2 dw 285h
.text:010091D4 aGlobalalloc db 'GlobalAlloc',0
.text:010091E0 dd 6C470297h, 6C61626Fh, 6F6C6E55h, 6B63h, 6C470290h, 6C61626Fh
.text:010091E0 dd 6B636F4Ch, 7C0000h
.text:01009200 aCreatefilemapp db 'CreateFileMappingW',0
.text:01009213 align 4
.text:01009214 db 0B0h ; ?
.text:01009215 db 1, 47h, 65h
.text:01009218 aTdateformatw db 'tDateFormatW',0
.text:01009225 align 2
.text:01009226 dw 1E7h
.text:01009228 aGetlocaltime db 'GetLocalTime',0
.text:01009235 align 2
.text:01009236 dw 303h
.text:01009238 aLocalunlock db 'LocalUnlock',0
.text:01009244 db 0Ah
.text:01009245 db 3, 4Dh, 61h
.text:01009248 aPviewoffile db 'pViewOfFile',0
.text:01009254 db 1Ah
.text:01009255 db 3, 4Dh, 75h
.text:01009258 aLtibytetowidec db 'ltiByteToWideChar',0
.text:0100926A dw 441h
.text:0100926C aUnmapviewoffil db 'UnmapViewOfFile',0
.text:0100927C dd 6F4C0300h, 526C6163h, 6C6C4165h, 636Fh, 65470152h, 50434174h
.text:0100927C dd 0C30000h, 656C6544h, 69466574h, 57656Ch, 655303CDh
.text:0100927C dd 646E4574h, 6946664Fh, 656Ch, 6F4C02FFh, 4C6C6163h, 6B636Fh
.text:0100927C dd 6F460148h, 74616D72h, 7373654Dh, 57656761h, 47A0000h
.text:010092D4 aWidechartomult db 'WideCharToMultiByte',0
.text:010092E8 db 0ECh ; ?
.text:010092E9 db 3, 53h, 65h
.text:010092EC aTlasterror db 'tLastError',0
.text:010092F7 align 4
.text:010092F8 db 8Dh ; ?
.text:010092F9 db 4, 57h, 72h
.text:010092FC aItefile db 'iteFile',0
.text:01009304 db 0E6h ; ?
.text:01009305 db 1, 47h, 65h
.text:01009308 aTlasterror_0 db 'tLastError',0
.text:01009313 align 4
.text:01009314 db 2
.text:01009315 db 3, 4Ch, 6Fh
.text:01009318 aCalsize db 'calSize',0
.text:01009320 db 0DFh ; ?
.text:01009321 db 1, 47h, 65h
.text:01009324 aTfullpathnamew db 'tFullPathNameW',0
.text:01009333 align 4
.text:01009334 db 19h
.text:01009335 db 3, 4Dh, 75h
.text:01009338 aLdiv db 'lDiv',0
.text:0100933D align 2
.text:0100933E dw 170h
.text:01009340 aGetcommandline db 'GetCommandLineW',0
.text:01009350 db 0A5h ; ?
.text:01009351 db 2, 48h, 65h
.text:01009354 aApsetinformati db 'apSetInformation',0
.text:01009365 align 2
.text:01009366 dw 1AAh
.text:01009368 aGetcurrentproc db 'GetCurrentProcessId',0
.text:0100937C dd 6F460146h, 7453646Ch, 676E6972h, 4AA0057h, 7274736Ch
.text:0100937C dd 57706D63h, 1CE0000h
.text:01009398 aGetfileattribu db 'GetFileAttributesW',0
.text:010093AB align 4
.text:010093AC db 24h ; $
.text:010093AD db 1, 46h, 69h
.text:010093B0 aNdfirstfilew db 'ndFirstFileW',0
.text:010093BD align 2
.text:010093BE dw 119h
.text:010093C0 aFindclose db 'FindClose',0
.text:010093CA dw 26Ah
.text:010093CC aGettimeformatw db 'GetTimeFormatW',0
.text:010093DB align 4
.text:010093DC db 0A9h ; ?
.text:010093DD db 1, 47h, 65h
.text:010093E0 aTcurrentproces db 'tCurrentProcess',0
.text:010093F0 db 2Dh ; -
.text:010093F1 db 4, 54h, 65h
.text:010093F4 aRminateprocess db 'rminateProcess',0
.text:01009403 align 4
.text:01009404 db 4Fh ; O
.text:01009405 db 2, 47h, 65h
.text:01009408 aTsystemtimeasf db 'tSystemTimeAsFileTime',0
.text:0100941E dw 1ADh
.text:01009420 aGetcurrentthre db 'GetCurrentThreadId',0
.text:01009433 align 4
.text:01009434 db 66h ; f
.text:01009435 db 2, 47h, 65h
.text:01009438 aTtickcount db 'tTickCount',0
.text:01009443 align 4
.text:01009444 db 54h ; T
.text:01009445 db 3, 51h, 75h
.text:01009448 aEryperformance db 'eryPerformanceCounter',0
.text:0100945E dw 1F6h
.text:01009460 aGetmodulehandl db 'GetModuleHandleA',0
.text:01009471 align 2
.text:01009472 dw 415h
.text:01009474 aSetunhandledex db 'SetUnhandledExceptionFilter',0
.text:01009490 dd 65470239h, 61745374h, 70757472h, 6F666E49h, 2BA0041h
.text:010094A4 aInterlockedcom db 'InterlockedCompareExchange',0
.text:010094BF align 10h
.text:010094C0 db 21h ; !
.text:010094C1 db 4, 53h, 6Ch
.text:010094C4 db 65h ; e
.text:010094C5 db 65h, 70h, 0
.text:010094C8 db 0BDh ; ?
.text:010094C9 db 2, 49h, 6Eh
.text:010094CC aTerlockedexcha db 'terlockedExchange',0
.text:010094DE dw 4B6h
.text:010094E0 aLstrlenw db 'lstrlenW',0
.text:010094E9 align 2
.text:010094EA dw 1EAh
.text:010094EC aGetlocaleinfow db 'GetLocaleInfoW',0
.text:010094FB align 4
.text:010094FC db 8Ch ; ?
.text:010094FD db 2, 47h, 6Ch
.text:01009500 aObalfree db 'obalFree',0
.text:01009509 align 2
.text:0100950A dw 4ADh
.text:0100950C aLstrcmpiw db 'lstrcmpiW',0
.text:01009516 dw 3D2h
.text:01009518 aSeterrormode db 'SetErrorMode',0
.text:01009525 align 2
.text:01009526 dw 7Fh
.text:01009528 aCreatefilew db 'CreateFileW',0
.text:01009534 db 68h ; h
.text:01009535 db 3, 52h, 65h
.text:01009538 aAdfile db 'adFile',0
.text:0100953F align 10h
.text:01009540 aC db 'C',0
.text:01009542 aClosehandle db 'CloseHandle',0
.text:0100954E dw 2F9h
.text:01009550 aLocalalloc db 'LocalAlloc',0
.text:0100955B align 4
.text:0100955C db 0BCh ; ?
.text:0100955D db 2, 49h, 6Eh
.text:01009560 aTerlockeddecre db 'terlockedDecrement',0
.text:01009573 align 4
.text:01009574 db 0FDh ; ?
.text:01009575 db 2, 4Ch, 6Fh
.text:01009578 aCalfree db 'calFree',0
.text:01009580 db 0C0h ; ?
.text:01009581 db 2, 49h, 6Eh
.text:01009584 aTerlockedincre db 'terlockedIncrement',0
.text:01009597 align 4
.text:01009598 db 70h ; p
.text:01009599 db 2, 47h, 65h
.text:0100959C aTuserdefaultui db 'tUserDefaultUILanguage',0
.text:010095B3 align 4
.text:010095B4 db 3Eh ; >
.text:010095B5 db 4, 55h, 6Eh
.text:010095B8 aHandledexcepti db 'handledExceptionFilter',0
.text:010095CF align 10h
.text:010095D0 db 5Eh ; ^
.text:010095D1 db 2, 53h, 65h
.text:010095D4 aLectobject db 'lectObject',0
.text:010095DF align 10h
.text:010095E0 db 7Bh ; {
.text:010095E1 db 2, 53h, 65h
.text:010095E4 aTmapmode db 'tMapMode',0
.text:010095ED align 2
.text:010095EE dw 28Fh
.text:010095F0 aSetviewportext db 'SetViewportExtEx',0
.text:01009601 align 2
.text:01009602 dw 293h
.text:01009604 aSetwindowextex db 'SetWindowExtEx',0
.text:01009613 align 4
.text:01009614 db 1Bh
.text:01009615 db 2, 4Ch, 50h
.text:01009618 aTodp db 'toDP',0
.text:0100961D align 2
.text:0100961E dw 266h
.text:01009620 aSetbkmode db 'SetBkMode',0
.text:0100962A dw 20Dh
.text:0100962C aGettextmetrics db 'GetTextMetricsW',0
.text:0100963C db 60h ; `
.text:0100963D db 2, 53h, 65h
.text:01009640 aTabortproc db 'tAbortProc',0
.text:0100964B align 4
.text:0100964C db 97h ; ?
.text:0100964D db 2, 53h, 74h
.text:01009650 aArtdocw db 'artDocW',0
.text:01009658 db 99h ; ?
.text:01009659 db 2, 53h, 74h
.text:0100965C aArtpage db 'artPage',0
.text:01009664 db '?,0
.text:01009666 aEndpage db 'EndPage',0
.text:0100966E align 10h
.text:01009670 aAbortdoc db 'AbortDoc',0
.text:01009679 align 2
.text:0100967A db '?,0
.text:0100967C aEnddoc db 'EndDoc',0
.text:01009683 align 4
.text:01009684 db '?,0
.text:01009686 aDeletedc db 'DeleteDC',0
.text:0100968F align 10h
.text:01009690 db 0A0h ; ?
.text:01009691 db 2, 54h, 65h
.text:01009694 aXtoutw db 'xtOutW',0
.text:0100969B align 4
.text:0100969C db 5
.text:0100969D db 2, 47h, 65h
.text:010096A0 aTtextextentpoi db 'tTextExtentPoint32W',0
.text:010096B4 a0 db '0',0
.text:010096B6 aCreatedcw db 'CreateDCW',0
.text:010096C0 dd 6547020Bh, 78655474h, 63614674h, 5765h, 6E450113h, 6F466D75h
.text:010096C0 dd 5773746Eh, 1F40000h, 53746547h, 6B636F74h, 656A624Fh
.text:010096C0 dd 7463h, 654701E4h, 6A624F74h, 57746365h, 1B50000h, 44746547h
.text:010096C0 dd 63697665h, 70614365h, 3E0073h
.text:01009710 aCreatefontindi db 'CreateFontIndirectW',0
.text:01009724 db '?,0
.text:01009726 aDeleteobject db 'DeleteObject',0
.text:01009733 align 4
.text:01009734 dd 6547010Dh, 696C4374h, 52746E65h, 746365h, 65530270h
.text:01009734 dd 72754374h, 726F73h, 6552024Ch, 7361656Ch, 434465h, 6547011Ah
.text:01009734 dd 434474h, 694400A6h, 676F6C61h, 50786F42h, 6D617261h
.text:01009734 dd 2660057h, 41746553h, 76697463h, 6E695765h, 776F64h
.text:01009734 dd 65470132h, 79654B74h, 72616F62h, 79614C64h, 74756Fh
.text:01009734 dd 6F500220h, 75517473h, 654D7469h, 67617373h, 960065h
.text:01009734 dd 57666544h, 6F646E69h, 6F725077h, 5763h, 65470125h, 726F4674h
.text:01009734 dd 6F726765h, 57646E75h, 6F646E69h, 1BD0077h, 63497349h
.text:01009734 dd 63696E6Fh, 0A00000h, 74736544h, 57796F72h, 6F646E69h
.text:01009734 dd 1F70077h, 7373654Dh, 42656761h, 706565h, 65470187h
.text:01009734 dd 6E695774h, 50776F64h, 6563616Ch, 746E656Dh, 3A0000h
.text:01009734 dd 72616843h, 65707055h, 5772h, 65520235h, 74736967h, 6C437265h
.text:01009734 dd 45737361h, 5778h, 6F4C01D9h, 6D496461h, 57656761h, 1D50000h
.text:01009734 dd 64616F4Ch, 73727543h, 57726Fh, 655302A5h, 6E695774h
.text:01009734 dd 4C776F64h, 57676E6Fh, 1CF0000h, 64616F4Ch, 65636341h
.text:01009734 dd 6172656Ch, 73726F74h, 16E0057h, 53746547h, 65747379h
.text:01009734 dd 6E654D6Dh, 2A60075h, 57746553h, 6F646E69h, 616C5077h
.text:01009734 dd 656D6563h, 746Eh, 72430068h, 65746165h, 646E6957h, 7845776Fh
.text:01009734 dd 24A0057h, 69676552h, 72657473h, 646E6957h, 654D776Fh
.text:01009734 dd 67617373h, 5765h, 6553028Bh, 6F725074h, 73736563h, 41495044h
.text:01009734 dd 65726177h, 2940000h, 53746553h, 6C6F7263h, 736F506Ch
.text:01009734 dd 2B80000h, 776F6853h, 646E6957h, 776Fh, 65470182h, 6E695774h
.text:01009734 dd 4C776F64h, 57676E6Fh, 21C0000h, 6B656550h, 7373654Dh
.text:01009734 dd 57656761h, 0D10000h, 62616E45h, 6957656Ch, 776F646Eh
.text:01009734 dd 0C70000h, 77617244h, 74786554h, 577845h, 7243005Dh
.text:01009734 dd 65746165h, 6C616944h, 6150676Fh, 576D6172h, 18F0000h
.text:01009734 dd 57746547h, 6F646E69h, 78655477h, 5774h, 6F4D0205h, 69576576h
.text:01009734 dd 776F646Eh, 1AA0000h, 61766E49h, 6164696Ch, 65526574h
.text:01009734 dd 7463h, 65530263h, 654D646Eh, 67617373h, 5765h, 6843002Fh
.text:01009734 dd 654E7261h, 577478h, 6843003Dh, 4D6B6365h, 49756E65h
.text:01009734 dd 6D6574h, 6C430047h, 4365736Fh, 6270696Ch, 6472616Fh
.text:01009734 dd 1B60000h, 6C437349h, 6F627069h, 46647261h, 616D726Fh
.text:01009734 dd 61764174h, 62616C69h, 656Ch, 704F020Fh, 6C436E65h, 6F627069h
.text:01009734 dd 647261h, 65470147h, 6E654D74h, 61745375h, 6574h, 6E4500CFh
.text:01009734 dd 656C6261h, 756E654Dh, 6D657449h, 16B0000h, 53746547h
.text:01009734 dd 654D6275h, 756Eh, 6547013Ch, 6E654D74h, 2A20075h, 57746553h
.text:01009734 dd 76456E69h, 48746E65h, 6B6F6Fh, 6547014Eh, 73654D74h
.text:01009734 dd 65676173h, 21F0057h, 74736F50h, 7373654Dh, 57656761h
.text:01009734 dd 1FF0000h, 7373654Dh, 42656761h, 57786Fh, 65470124h
.text:01009734 dd 636F4674h, 7375h, 69570300h, 6C65486Eh, 5770h, 6547011Eh
.text:01009734 dd 676C4474h, 6C727443h, 4449h, 6E4500D3h, 61694464h, 676F6Ch
.text:01009734 dd 6547018Eh, 6E695774h, 54776F64h, 4C747865h, 74676E65h
.text:01009734 dd 5768h, 6F4C01D7h, 63496461h, 576E6Fh, 734901B9h, 6C616944h
.text:01009734 dd 654D676Fh, 67617373h, 5765h, 725402D3h, 6C736E61h, 41657461h
.text:01009734 dd 6C656363h, 74617265h, 57726Fh, 725402D5h, 6C736E61h
.text:01009734 dd 4D657461h, 61737365h, 6567h, 694400A9h, 74617073h, 654D6863h
.text:01009734 dd 67617373h, 5765h, 705502E9h, 65746164h, 646E6957h, 776Fh
.text:01009734 dd 6E5502D7h, 6B6F6F68h, 456E6957h, 746E6576h, 410000h
.text:01009734 dd 6C696843h, 6E695764h, 46776F64h, 506D6F72h, 746E696Fh
.text:01009734 dd 1220000h, 44746547h, 7449676Ch, 65546D65h, 577478h
.text:01009734 dd 65530277h, 676C4474h, 6D657449h, 74786554h, 2790057h
.text:01009734 dd 46746553h, 7375636Fh, 2AC0000h, 57746553h, 6F646E69h
.text:01009734 dd 78655477h, 5774h, 65470155h, 72615074h, 746E65h, 6F4C01E4h
.text:01009734 dd 74536461h, 676E6972h, 25A0057h, 646E6553h, 49676C44h
.text:01009734 dd 4D6D6574h, 61737365h, 576567h, 65470119h, 72754374h
.text:01009734 dd 50726F73h, 736Fh, 63530254h, 6E656572h, 6C436F54h, 746E6569h
.text:01009734 dd 370000h, 7265743Fh, 616E696Dh, 40406574h, 58584159h
.text:01009734 dd 127005Ah, 6E6F635Fh, 6C6F7274h, 7066h, 765F03CEh, 70776E73h
.text:01009734 dd 746E6972h, 4EE0066h, 736D656Dh, 7465h, 775F046Dh, 6C6F74h
.text:01009734 dd 656D04EAh, 7970636Dh, 4CC0000h, 63777369h, 65707974h
.text:01009734 dd 4DA0000h, 61636F6Ch, 6D69746Ch, 1590065h, 6378655Fh
.text:01009734 dd 5F747065h, 646E6168h, 3472656Ch, 6D6F635Fh, 6E6F6Dh
.text:01009734 dd 5F5F00D2h, 5F746573h, 5F707061h, 65707974h, 0BE0000h
.text:01009734 dd 5F705F5Fh, 6F6D665Fh, 6564h, 5F5F00B9h, 635F5F70h, 6F6D6D6Fh
.text:01009734 dd 6564h, 615F00F5h, 73756A64h, 64665F74h, 7669h, 615F0101h
.text:01009734 dd 5F67736Dh, 74697865h, 1D50000h, 696E695Fh, 72657474h
.text:01009734 dd 0E7006Dh, 6D63615Fh, 6E6C64h, 7865048Fh, 7469h, 69740534h
.text:01009734 dd 656Dh, 5F5F0091h, 6D746567h, 616E6961h, 736772h, 695F01F4h
.text:01009734 dd 62626D73h, 6461656Ch, 6A0000h, 7063585Fh, 6C694674h
.text:01009734 dd 726574h, 655F0162h, 746978h, 635F0114h, 74697865h, 0D40000h
.text:01009734 dd 65735F5Fh, 65737574h, 74616D72h, 72726568h, 0E0000h
.text:01009734 dd 53746547h, 46657661h, 4E656C69h, 57656D61h, 80000h
.text:01009734 dd 646E6946h, 74786554h, 170057h, 6C706552h, 54656361h
.text:01009734 dd 57747865h, 110000h, 65676150h, 75746553h, 676C4470h
.text:01009734 dd 140057h, 6E697250h, 676C4474h, 577845h, 6547000Ch, 65704F74h
.text:01009734 dd 6C69466Eh, 6D614E65h, 5765h, 6F430004h, 6C446D6Dh, 74784567h
.text:01009734 dd 65646E65h, 72724564h, 726Fh, 68430003h, 65736F6Fh, 746E6F46h
.text:01009734 dd 0A0057h, 46746547h, 54656C69h, 656C7469h, 1B0057h, 67617244h
.text:01009734 dd 65636341h, 69467470h, 73656Ch, 72440020h, 75516761h
.text:01009734 dd 46797265h, 57656C69h, 1C0000h, 67617244h, 696E6946h
.text:01009734 dd 6873h, 4853008Dh, 61657243h, 74496574h, 72466D65h, 61506D6Fh
.text:01009734 dd 6E697372h, 6D614E67h, 1100065h, 6C656853h, 6F62416Ch
.text:01009734 dd 577475h, 65470085h, 69725074h, 7265746Eh, 76697244h
.text:01009734 dd 577265h, 6C43001Dh, 5065736Fh, 746E6972h, 7265h, 704F008Fh
.text:01009734 dd 72506E65h, 65746E69h, 5772h, 6F430066h, 6B736154h, 416D654Dh
.text:01009734 dd 636F6C6Ch, 100000h, 72436F43h, 65746165h, 74736E49h
.text:01009734 dd 65636E61h, 670000h, 61546F43h, 654D6B73h, 6572466Dh
.text:01009734 dd 6B0065h, 6E556F43h, 74696E69h, 696C6169h, 657Ah, 6F43003Eh
.text:01009734 dd 74696E49h, 696C6169h, 7845657Ah, 5D0000h, 68746150h
.text:01009734 dd 69467349h, 7053656Ch, 576365h, 485300FDh, 44727453h
.text:01009734 dd 577075h, 7243000Ch, 65746165h, 74617453h, 69577375h
.text:01009734 dd 776F646Eh, 5480057h, 536E6957h, 64416D71h, 536F5464h
.text:01009734 dd 61657274h, 9090006Dh, 0
.text:01009EFC dd 4549B0BEh, 0
.text:01009F04 dd 2, 24h, 9F34h, 9334h, 0
.text:01009F18 dd 4549B0BEh, 10DE022Bh, 0Ah, 4, 9F30h, 9330h, 0BB0310DEh
.text:01009F18 dd 53445352h, 0A38D071Fh, 48F5FAAFh, 340A5198h, 631E44C7h
.text:01009F18 dd 2, 65746F6Eh, 2E646170h, 626470h, 2Ah dup(0)
.text:01009F18 _text ends

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

上传的附件:
收藏
免费 7
支持
分享
最新回复 (8)
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
好,收下。。。。。。。。。。。。。。。。。
2008-11-9 17:33
0
雪    币: 1062
活跃值: (1466)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
谢谢楼主,马上收藏。
2008-11-14 16:38
0
雪    币: 141
活跃值: (1135)
能力值: ( LV2,RANK:150 )
在线值:
发帖
回帖
粉丝
4
解决了ImageBase问题,可以直接从PE文件中获取。

修改后的dllentry脚本附件: dllentry1.rar
上传的附件:
2008-11-18 23:03
0
雪    币: 199
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
5
看懂了部分。
2009-1-8 10:41
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
初次接触,冒昧地问一句,"将光标定位在.text:01008C0C处执行dllentry.idc"具体如何操作?
谢谢!
2009-1-28 07:34
0
雪    币: 259
活跃值: (98)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
7
好东西,下载收藏了.
2009-3-6 13:24
0
雪    币: 141
活跃值: (1135)
能力值: ( LV2,RANK:150 )
在线值:
发帖
回帖
粉丝
8
将光标定位在起始地址后,点击“File”->“IDC file...”弹出“Please enter the IDC file name to execute”对话框,选中要执行的IDC文件运行即可。
2009-3-10 18:56
0
雪    币: 141
活跃值: (1135)
能力值: ( LV2,RANK:150 )
在线值:
发帖
回帖
粉丝
9
现在可以自动定位imoprt directory了,只需运行dllentry.idc即可。
脚本附件: dllentry.rar
上传的附件:
2009-3-22 00:56
0
游客
登录 | 注册 方可回帖
返回
//