客服电话
APP下载
迪恩网络APP
随时随地掌握行业动态
官方微信
扫描二维码
关注迪恩网络微信公众号
|
//VC++6外衣 1 OEPCODEFIVE: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68, $53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58, $58, $58, $58, $8B, $E8, $E9, $07, $B9, $FE, $FF, $00, $00, $00, $00, $00, $00);
//VC++6外衣 2 OEPCODEFIVE: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68, $53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00);
1.直接将入口地址赋给寄存器eax,然后jmp eax 0046902A B8 304A4500 mov eax,Project1.00454A30 0046902F FFE0 jmp eax 00469031 90 nop 2. 直接跳转到入口地址 00469124 - E9 07B9FEFF jmp Project1.00454A30 两种效果实际上是一样的,但我们为了方便修改花指令跳转到原来的入口地址，通常取得原 pe header的AddressOfEntryPoint,然后给寄存器eax保存改值，所以第二种方法就不太方便， 所以一般采用第一种方法，JMPOFF为花指令代码到跳转指令的偏移，如对Visual C++的花指令 JMPOFF=54,其后免跟的是原入口地址，可以随便填写，程序加花指令是会自动修改，一般可以 默认设为00104000(即00401000). 通过汇编修改花指令跳转原入口地址的语句: asm //这里说明一下，这是嵌入的汇编代码,寄存器—CPU暂时储存数据的东西，比内存更快，以提高效率 PUSHAD LEA eax, OEPCODE //将OEPCODE的地址交给寄存器 ADD eax, JMPOFF //添加JMPOFF值给寄存器 MOV edx, AddressOfEntryPoint //转移指令，相当于付值语句，左边给右边 MOV DWORD ptr [eax], edx //同上 POPAD end; } unit Unit1;
interface
uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls, ExtCtrls, ShellAPI;
type TForm1 = class(TForm) Label1: TLabel; Edit1: TEdit; Button1: TButton; RadioGroup1: TRadioGroup; Label2: TLabel; Edit2: TEdit; Label3: TLabel; Edit3: TEdit; CheckBox1: TCheckBox; Button2: TButton; Label5: TLabel; OpenDialog1: TOpenDialog; Label4: TLabel; procedure Button1Click(Sender: TObject); procedure obtain; procedure Button2Click(Sender: TObject); procedure Label4Click(Sender: TObject); procedure Edit3KeyPress(Sender: TObject; var Key: Char); private { Private declarations } FImageBase: DWORD; procedure SetOepCode; public { Public declarations } end;
THEAD = array[0..63] of byte;
var Form1: TForm1;
const {MYSECTION = 'Fi7ke'; //添加的节名，自定义 JMPOFF = 43; //花指令的机器码,Ollydbg加载后随便取 //Microsoft Visual C++ OEPCODE: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38, $90, $0D, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00); }
//Nothing found * one OEPCODEONE: THEAD = ($55, $8B, $EC, $83, $C4, $F4, $83, $C4, $0C, $B8, $00, $10, $40, $00, $50, $C3, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//Nothing found * two OEPCODETWO: THEAD = ($55, $8B, $EC, $41, $52, $90, $5A, $49, $5D, $41, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//VC++外衣 OEPCODETHREE: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38, $90, $0D, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//VC++5外衣 OEPCODEFOUR: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $48, $54, $41, $00, $68, $A8, $21, $40, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $C4, $94, $53, $56, $57, $00, $00, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//VC++6外衣 OEPCODEFIVE: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68, $53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00);
//C外衣 OEPCODESIX: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $11, $11, $11, $00, $68, $22, $22, $22, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
OepCount = 6;
//OEPCODEARRAY :array[0..OepCount-1,0..63] of byte=( //OEPCODEARRAY :array[0..OepCount-1] of array[0..63] of byte=( OEPCODEARRAY :array[0..OepCount-1] of THEAD=( ($55, $8B, $EC, $83, $C4, $F4, $83, $C4, $0C, $B8, $00, $10, $40, $00, $50, $C3, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //Nothing found * one ($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38, $90, $0D, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //VC++外衣 ($55, $8B, $EC, $6A, $FF, $68, $48, $54, $41, $00, $68, $A8, $21, $40, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $C4, $94, $53, $56, $57, $00, $00, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //VC++5外衣 ($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68, $53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00), //VC++6外衣 ($55, $8B, $EC, $6A, $FF, $68, $11, $11, $11, $00, $68, $22, $22, $22, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //C外衣 ($55, $8B, $EC, $41, $52, $90, $5A, $49, $5D, $41, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00) //Nothing found * two );
JMPOFFARRAY :array[0..OepCount-1] of integer=(10,43,38,54,43,11);
{Nothing found * ONE： Borland Delphi 6.0 - 7.0
00469022 0055 8B add byte ptr ss:[ebp-75],dl 00469025 EC in al,dx 00469026 83C4 F4 add esp,-0C 00469029 83C4 0C add esp,0C 0046902C B8 304A4500 mov eax,Project1.00454A30 00469031 50 push eax 00469032 C3 retn
Nothing found * TWO
00454A72 55 push ebp 00454A73 8BEC mov ebp,esp 00454A75 41 inc ecx 00454A76 52 push edx 00454A77 90 nop 00454A78 5A pop edx 00454A79 49 dec ecx 00454A7A 5D pop ebp 00454A7B 41 inc ecx 0046902A B8 304A4500 mov eax,Project1.00454A30 0046902F FFE0 jmp eax 00469031 90 nop
C外衣：
00454A6C 55 push ebp 00454A6D 8BEC mov ebp,esp 00454A6F 6A FF push -1 00454A71 68 11111100 push 111111 00454A76 68 22222200 push 222222 00454A7B 64:A1 00000>mov eax,dword ptr fs:[0] 00454A81 50 push eax 00454A82 64:8925 000>mov dword ptr fs:[0],esp 00454A89 58 pop eax 00454A8A 64:A3 00000>mov dword ptr fs:[0],eax 00454A90 58 pop eax 00454A91 58 pop eax 00454A92 58 pop eax 00454A93 58 pop eax 00454A94 8BE8 mov ebp,eax 00454A96 - E9 65F5CAFF jmp 00104000
VC++5外衣:
0046905F P> 55 push ebp 00469060 8BEC mov ebp,esp 00469062 6A FF push -1 00469064 68 48544100 push Project1.00415448 00469069 68 A8214000 push Project1.004021A8 0046906E 64:A1 0000000>mov eax,dword ptr fs:[0] 00469074 50 push eax 00469075 64:8925 00000>mov dword ptr fs:[0],esp 0046907C 83C4 94 add esp,-6C 0046907F 53 push ebx 00469080 56 push esi 00469081 57 push edi 00469082 0000 add byte ptr ds:[eax],al 0046902A B8 304A4500 mov eax,Project1.00454A30 0046902F FFE0 jmp eax 00469031 90 nop
VC++外衣：
00469000 P> 55 push ebp 00469001 8BEC mov ebp,esp 00469003 6A FF push -1 00469005 68 2A2C0A00 push 0A2C2A 0046900A 68 38900D00 push 0D9038 0046900F 64:A1 0000000>mov eax,dword ptr fs:[0] 00469015 50 push eax 00469016 64:8925 00000>mov dword ptr fs:[0],esp 0046901D 58 pop eax 0046901E 64:A3 0000000>mov dword ptr fs:[0],eax 00469024 58 pop eax 00469025 58 pop eax 00469026 58 pop eax 00469027 58 pop eax 00469028 8BE8 mov ebp,eax 0046902A B8 304A4500 mov eax,Project1.00454A30 0046902F FFE0 jmp eax 00469031 90 nop
VC++6外衣：
004690EF P> 55 push ebp 004690F0 8BEC mov ebp,esp 004690F2 6A FF push -1 004690F4 68 00000000 push 0 004690F9 68 00000000 push 0 004690FE 64:A1 0000000>mov eax,dword ptr fs:[0] 00469104 50 push eax 00469105 64:8925 00000>mov dword ptr fs:[0],esp 0046910C 83EC 68 sub esp,68 0046910F 53 push ebx 00469110 56 push esi 00469111 57 push edi 00469112 58 pop eax 00469113 58 pop eax 00469114 58 pop eax 00469115 83C4 68 add esp,68 00469118 58 pop eax 00469119 67:64:A3 0000 mov dword ptr fs:[0],eax 0046911E 58 pop eax 0046911F 58 pop eax 00469120 58 pop eax 00469121 58 pop eax 00469122 8BE8 mov ebp,eax 0046902A B8 304A4500 mov eax,Project1.00454A30 0046902F FFE0 jmp eax 00469031 90 nop
}
function IntToHex(Int: Int64; IntSize: Byte): String; procedure AddSection(FName,MySection: string;SecSize:DWord);
implementation
{$R *.dfm}
var OEPCODE: THEAD; JMPOFF :integer;
function IntToHex(Int: Int64; IntSize: Byte): String; const HexChars: array[0..15] of Char = ('0', '1', '2', '3', '4', '5','6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'); var n: Byte; begin Result := ''; for n := 0 to IntSize - 1 do begin Result := HexChars[Int and $F] + Result; Int := Int shr $4; end; end;
procedure AddSection(FName,MySection: string;SecSize:DWord); var DOSHEADER: IMAGE_DOS_HEADER; //DOS MZ header PEHEADER: IMAGE_NT_HEADERS; //PE header SectionHeader: IMAGE_SECTION_HEADER; //节表 MySectionHeader: IMAGE_SECTION_HEADER; //自定义节表 fs: TFileStream; AddressOfEntryPoint: DWORD; //入口点 i:integer; begin fs := TFileStream.Create(FName, fmOpenReadWrite + fmShareDenyWrite); try {Tstream中定义的虚方法有四个： 1、Read:此方法实现将数据从流中读出。函数原形为： Function Read(var Buffer;Count:Longint):Longint;virtual;abstract; 参数Buffer为数据读出时放置的缓冲区， |
2023-10-27
2022-08-15
2022-08-17
2022-09-23
2022-08-13
六六分期app的软件客服如何联系？不知道吗？加qq群【895510560】即可！标题：六六分期
今天小编告诉大家如何处理win10系统火狐flash插件总是崩溃的问题，可能很多用户都不知
今天小编告诉大家如何对win10系统删除桌面回收站图标进行设置，可能很多用户都不知道
今天小编告诉大家如何对win10系统电脑设置节能降温的设置方法，想必大家都遇到过需要
我们在使用xp系统的过程中,经常需要对xp系统无线网络安装向导设置进行设置，可能很多
今天小编告诉大家如何处理win7系统玩cf老是与主机连接不稳定的问题，可能很多用户都不
电脑对日常生活的重要性小编就不多说了，可是一旦碰到win7系统设置cf烟雾头的问题，很
我们在日常使用电脑的时候，有的小伙伴们可能在打开应用的时候会遇见提示应用程序无法
今天小编告诉大家如何对win7系统打开vcf文件进行设置，可能很多用户都不知道怎么对win
今天小编告诉大家如何对win10系统s4开启USB调试模式进行设置，可能很多用户都不知道怎
请发表评论