[求助]VB编壳的困惑(版主快来看!!!)-编程技术-看雪-安全社区|安全招聘|kanxue.com

[求助]VB编壳的困惑(版主快来看!!!)

发表于: 2009-7-2 16:29 3589

[求助]VB编壳的困惑(版主快来看!!!)

tbc

2009-7-2 16:29

3589

我正在用VB6写壳，遇到了个不小的麻烦。
我已经解决了内存分配、跳转等问题，但程序跳转至OEP后，原程序发生了改变。
由：
00401090 .- FF25 28104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaChkstk>;  MSVBVM60.__vbaChkstk
00401096 $- FF25 34104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaExcept>;  MSVBVM60.__vbaExceptHandler; 结构异常处理程序
0040109C .- FF25 40104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFPExce>;  MSVBVM60.__vbaFPException
004010A2 .- FF25 1C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m16i
004010A8 .- FF25 14104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m32
004010AE .- FF25 48104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m32i
004010B4 .- FF25 0C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m64
004010BA .- FF25 54104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_r>;  MSVBVM60._adj_fdiv_r
004010C0 .- FF25 20104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m16i
004010C6 .- FF25 50104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m32
004010CC .- FF25 4C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m32i
004010D2 .- FF25 3C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m64
004010D8 .- FF25 2C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fpatan>;  MSVBVM60._adj_fpatan
004010DE .- FF25 38104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fprem>>;  MSVBVM60._adj_fprem
004010E4 .- FF25 10104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fprem1>;  MSVBVM60._adj_fprem1
004010EA .- FF25 04104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fptan>>;  MSVBVM60._adj_fptan
004010F0 .- FF25 60104000 JMP DWORD PTR DS:[<&MSVBVM60._CIatan>] ;  MSVBVM60._CIatan
004010F6 .- FF25 00104000 JMP DWORD PTR DS:[<&MSVBVM60._CIcos>] ;  MSVBVM60._CIcos
004010FC .- FF25 6C104000 JMP DWORD PTR DS:[<&MSVBVM60._CIexp>] ;  MSVBVM60._CIexp
00401102 .- FF25 44104000 JMP DWORD PTR DS:[<&MSVBVM60._CIlog>] ;  MSVBVM60._CIlog
00401108 .- FF25 24104000 JMP DWORD PTR DS:[<&MSVBVM60._CIsin>] ;  MSVBVM60._CIsin
0040110E .- FF25 30104000 JMP DWORD PTR DS:[<&MSVBVM60._CIsqrt>] ;  MSVBVM60._CIsqrt
00401114 .- FF25 68104000 JMP DWORD PTR DS:[<&MSVBVM60._CItan>] ;  MSVBVM60._CItan
0040111A .- FF25 64104000 JMP DWORD PTR DS:[<&MSVBVM60._allmul>] ;  MSVBVM60._allmul
00401120 .- FF25 08104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFreeVa>;  MSVBVM60.__vbaFreeVarList
00401126 .- FF25 5C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaVarDup>;  MSVBVM60.__vbaVarDup
0040112C .- FF25 18104000 JMP DWORD PTR DS:[<&MSVBVM60.#595>]    ;  MSVBVM60.rtcMsgBox
00401132 $- FF25 58104000 JMP DWORD PTR DS:[<&MSVBVM60.#100>]    ;  MSVBVM60.ThunRTMain
00401138 > $  68 B8114000 PUSH a.004011B8  //eip
0040113D .  E8 F0FFFFFF CALL <JMP.&MSVBVM60.#100>
00401142 .  0000       ADD BYTE PTR DS:[EAX],AL
00401144 .  0000       ADD BYTE PTR DS:[EAX],AL
变成了：
01241090  - FF25 28104000 JMP DWORD PTR DS:[<&MSVBVM60._CIsin>] ; MSVBVM60._CIsin
01241096  - FF25 34104000 JMP DWORD PTR DS:[<&MSVBVM60.EVENT_SINK_>; MSVBVM60.EVENT_SINK_AddRef
0124109C  - FF25 40104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fpatan>; MSVBVM60._adj_fpatan
012410A2  - FF25 1C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaAryDes>; MSVBVM60.__vbaAryDestruct
012410A8  - FF25 14104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaHresul>; MSVBVM60.__vbaHresultCheckObj
012410AE  - FF25 48104000 JMP DWORD PTR DS:[<&MSVBVM60.EVENT_SINK_>; MSVBVM60.EVENT_SINK_Release
012410B4  - FF25 0C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fprem1>; MSVBVM60._adj_fprem1
012410BA  - FF25 54104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaExcept>; MSVBVM60.__vbaExceptHandler
012410C0  - FF25 20104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>; MSVBVM60._adj_fdiv_m16i
012410C6  - FF25 50104000 JMP DWORD PTR DS:[<&MSVBVM60.EVENT_SINK_>; MSVBVM60.EVENT_SINK_QueryInterface
012410CC  - FF25 4C104000 JMP DWORD PTR DS:[<&MSVBVM60._CIsqrt>] ; MSVBVM60._CIsqrt
012410D2  - FF25 3C104000 JMP DWORD PTR DS:[<&MSVBVM60.DllFunction>; MSVBVM60.DllFunctionCall
012410D8  - FF25 2C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaChkstk>; MSVBVM60.__vbaChkstk
012410DE  - FF25 38104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaGenera>; MSVBVM60.__vbaGenerateBoundsError
012410E4  - FF25 10104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaSetSys>; MSVBVM60.__vbaSetSystemError
012410EA  - FF25 04104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fptan>>; MSVBVM60._adj_fptan
012410F0  - FF25 60104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFPExce>; MSVBVM60.__vbaFPException
012410F6  - FF25 00104000 JMP DWORD PTR DS:[<&MSVBVM60._CIcos>] ; MSVBVM60._CIcos
012410FC  - FF25 6C104000 JMP DWORD PTR DS:[<&MSVBVM60.#644>]    ; MSVBVM60.VarPtr
01241102  - FF25 44104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaRedim>>; MSVBVM60.__vbaRedim
01241108  - FF25 24104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>; MSVBVM60._adj_fdivr_m16i
0124110E  - FF25 30104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFileCl>; MSVBVM60.__vbaFileClose
01241114  - FF25 68104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaUbound>; MSVBVM60.__vbaUbound
0124111A  - FF25 64104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaGetOwn>; MSVBVM60.__vbaGetOwner3
01241120  - FF25 08104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>; MSVBVM60._adj_fdiv_m64
01241126  - FF25 5C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>; MSVBVM60._adj_fdivr_m64
0124112C  - FF25 18104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>; MSVBVM60._adj_fdiv_m32
01241132  - FF25 58104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fprem>>; MSVBVM60._adj_fprem
01241138 68 B8114000    PUSH 4011B8  //eip
0124113D E8 F0FFFFFF    CALL 01241132                         ; JMP 到 MSVBVM60._adj_fprem
01241142 0000          ADD BYTE PTR DS:[EAX],AL
01241144 0000          ADD BYTE PTR DS:[EAX],AL
虽然数都没变，但指令却全变了。怎么办？希望版主解答。

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

收藏・0

免费・0

支持