-
-
用OD学习LoadPE内存转存方法
-
发表于:
2008-11-21 00:22
12321
-
00402C2C |. E8 4B560100 call <jmp.&procs.GetProcessPath>
00402C31 |. EB 17 jmp short 00402C4A
00402C33 |> 8B4C24 18 mov ecx, dword ptr [esp+18]
00402C37 |. 8B5424 30 mov edx, dword ptr [esp+30]
00402C3B |. 8D8424 B40100>lea eax, dword ptr [esp+1B4]
00402C42 |. 50 push eax
00402C43 |. 51 push ecx
00402C44 |. 52 push edx
00402C45 |. E8 3E560100 call <jmp.&procs.GetModulePath>
|> push 0 ; /pOverlapped = NULL
|> push ecx ; |pBytesRead
|> lea edx,dword ptr [esp+1C] ; |
|> push 40 ; |BytesToRead = 40 (64.)
|> push edx ; |Buffer
|> push esi ; |hFile
|> call edi ; \ReadFile
|> test eax, eax
|> je 00406CFE
|> cmp word ptr [esp+14], 5A4D ;比较MZ
|> je short 00406C8C
]
|. 6A 00 push 0
|. 51 push ecx
|. 8D5424 5C lea edx, dword ptr [esp+5C]
|. 68 F8000000 push 0F8
|. 52 push edx
|. 56 push esi
|. FFD7 call edi ; ReadFile
|. 85C0 test eax, eax
|. 74 48 je short 00406CFE
|. 817C24 54 50450000 cmp dword ptr [esp+54], 4550 ; 比较PE标志
|. 75 3E jnz short 00406CFE
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
以下几处不懂
