为什么ImportREC会错认函数。
脱壳后用ImportREC修复时,发现在Kernel32.dll中有许多API错认了。
系统:WINME
ImportREC :V1.6汉化版
壳:ASProtect 1.22 - 1.23 Beta 21
OEP正确。
求教:这种情况要怎样处理,总不会是一个一个核对吧。
这个跟系统有关吗?为什么会这样呢?
以下是用ImportREC提取的IAT-------错误。
1 0010A1B4 kernel32.dll 0081 BackupSeek
1 0010A1BC kernel32.dll 00B8 CreateEventW
1 0010A1C4 kernel32.dll 0220 IsBadHugeReadPtr
1 0010A1D4 kernel32.dll 0081 BackupSeek
1 0010A1DC kernel32.dll 0221 IsBadHugeWritePtr
1 0010A208 kernel32.dll 00A2 CloseProfileUserMapping
1 0010A20C kernel32.dll 0172 GetEnvironmentStrings
1 0010A294 kernel32.dll 0314 TlsFree
1 0010A2A0 kernel32.dll 0312 TlsAlloc
1 0010A2A8 kernel32.dll 01F3 GlobalAlloc
1 0010A310 kernel32.dll 00A1 CloseHandle
1 0010A350 kernel32.dll 036C lstrcpyn
1 0010A354 kernel32.dll 0363 lstrcmp
1 0010A384 kernel32.dll 0366 lstrcmpi
1 0010A3A0 kernel32.dll 0360 lstrcat
1 0010A3A4 kernel32.dll 036F lstrlen
0 0010A3A8 ? 0000 86C5A7F8
1 0010A3AC kernel32.dll 0369 lstrcpy
0 0010A3B4 ? 0000 86C5A828
==================
以下是Olly中显示的IAT――正确,修复后程序正常运行。
1 0010A1B4 kernel32.dll 0326 UpdateResourceW
1 0010A1BC kernel32.dll 034B WritePrivateProfileStringA
1 0010A1C4 kernel32.dll 0222 IsBadReadPtr
1 0010A1D4 kernel32.dll 0326 UpdateResourceW
1 0010A1DC kernel32.dll 0225 IsBadWritePtr
1 0010A208 kernel32.dll 030A SwitchToThread
1 0010A20C kernel32.dll 0173 GetEnvironmentStringsA
1 0010A294 kernel32.dll 0315 TlsFreeInternal
1 0010A2A0 kernel32.dll 0313 TlsAllocInternal
1 0010A2A8 kernel32.dll 023F LocalAlloc
1 0010A310 kernel32.dll 0121 FindCloseChangeNotification
1 0010A350 kernel32.dll 036D lstrcpynA
1 0010A354 kernel32.dll 0364 lstrcmpA
1 0010A384 kernel32.dll 0367 lstrcmpiA
1 0010A3A0 kernel32.dll 0361 lstrcatA
1 0010A3A4 kernel32.dll 0370 lstrlenA
1 0010A3A8 kernel32.dll 033C WinExec
1 0010A3AC kernel32.dll 036A lstrcpyA
1 0010A3B4 kernel32.dll 0239 LoadLibraryA
[课程]FART 脱壳王!加量不加价!FART作者讲授!