1、。DLL。PE。Windows。PE。Import Table。DLL。DLL。DLL。Windows。DLL。API。LoadLibrary。GetProcAddress。API 。LoadLibrary。GetProcAddress。Windows。PE。DLL。PE。DLL。DLL。(Import Address Table)。IAT。API。IAT。Windows。IAT。IAT。IAT。CALL DWORD PTR 00402010。00402010。00402010h。IAT。CALL 00401164:00401164jmp dword ptr 00402010。CALL。JMP
2、。IAT。00402010h。5。JMP。CALL。CALL XXXXXXXXXXXXXXXX。XXXXXXXX。JMP Stub。_declspec(dllimport)。DLL。CALL DWORD PTR XXXXXXXX。CALL XXXXXXXX。_imp_。_imp_xxx。IAT。JMP Stub。Hello World。(。invoke MessageBox,NULL,offset szText,offset szCaption,MB_OKinvoke ExitProcess,NULL。W32Dasm。MessageBox。ExitProcess。0040101A。004010
3、20。DLL。Jmp dword ptr xxxxxxxx。xxxxxxxx。00402000。ExitProcess。PE。00402000。PEID。00400000h,。00402000h。RVA。2000h。2000h。.rdata。Raw_。600h,。00402000h。PE。600h。0600h。UE。00002076h。ExitProcess。RVA。RVA。00002076h。.rdata。00002000h。RVA。76h。0676h。0676h。“ExitProcess”。Call ExitProcess。Call aaaaaaaa。aaaaaaaa。Jmp dword
4、ptr xxxxxxxx。xxxxxxxx。RVA。PE。Windows。xxxxxxxx。RVA。xxxxxxxx。PE。IMAGE_OPTIONAL_HEADER32。DataDirectory。2。IMAGE_DATA_DIRECTORY。IMAGE_DATA_DIRECTORY。VirtualAddress。RVA。RVA。PE。PE。RVA。File Offset。IMAGE_IMPORT_DESCRIPTOR。DLL。DLL。PE。10。DLL。10。IMAGE_IMPORT_DESCRIPTOR。DLL。0。IMAGE_IMPORT_DESCRIPTOR。PE。DLL。IID。N
5、ULL。IMAGE_IMPORT_DESCRIPTOR STRUCTunionCharacteristics dd ?OriginalFirstThunk dd ?endsTimeDateStamp dd ?ForwarderChain dd ?Name1 dd ?FirstThunk dd ?IMAGE_IMPORT_DESCRIPTOR ENDS。Name1。Name1。Name。MASM。RVA。DLL。NULL。OriginalFirstThunk。FirstThunk。“。”。IMAGE_THUNK_DATA。IMAGE_THUNK_DATA。0。IMAGE_THUNK_DATA。I
6、MAGE_THUNK_DATA。IMAGE_THUNK_DATA STRUCTunion u1ForwarderString dd ?Function dd ?Ordinal dd ?AddressOfData dd ?endsIMAGE_THUNK_DATA ENDS。IMAGE_THUNK_DATA。1。IMAGE_ORDINAL_FLAG32。80000000h。0。RVA。IMAGE_IMPORT_BY_NAME。IMAGE_IMPORT_BY_NAME STRUCTHint dw ?Name1 db ?IMAGE_IMPORT_BY_NAME ENDS。Hint。0。Name1。0。
7、Kernel32.dll。ExitProcess,ReadFile,WriteFile。lstcmp。3。lstrcmp。02f6h,0111h,002bh。0010h。IMAGE_IMPORT_DESCRIPTOR。Name1。“Kernel32.dll”。Kernel32.dll。OriginalFirstThunk。FirstThunk。IMAGE_THUNK_DATA。4。4。0。4。lstrcmp。IMAGE_THUNK_DATA。1。0010h。80000010h。3。IMAGE_THUNK_DATA。RVA。3。IMAGE_IMPORT_BY_NAME。IMAGE_IMPORT_
8、BY_NAME。IMAGE_IMPORT_BY_NAME。PE。Hello World。Windows。JMP DWORD PTR XXXXXXXX。XXXXXXXX。RVA。XXXXXXXX。FirstThunk。PE。Windows。FirstThunk。PE。IMAGE_THUNK_DATA。FirstWindows。PE.EXE。360。PE。80h。PE。C0h,。C0h+80h=140h。140h。90200000。00002090。2090h。2090h。RVA。RVA。File Offset。LoadPE。RVA。00002090h。File Offset。690h,。UE。F
9、irstWindow。690h。IID。5。DLL。NULL。IID。IID。DLL。IID。DLL。IID。0。IID。DLL。IID。0E220000。RVA。0000220Eh。File Offset。80Eh,。IID。DLL。RVA。0000224Ch,。File Offset。84Ch,。DLL。EXE。80Eh。user32.dll,84Ch。kernel32.dll。DLL。RVA。USER32.dll。IID。OrignalFirstThunk。ASCII。OriginalFirstThunk。0。FirstThunk。IID。IID。USER32.DLL。IID。Origi
10、nalFirstThunk。000020DC。File Offset。6DC。6DCh。IMAGE_THUNK_DATA。IMAGE_IMPORT_BY_NAME。00。IMAGE_THUNK_DATA。IID。FirstThunk。USER32.dll。IID。FirstThunk。2010h,。File Offset。610h。610h。IMAGE_THUNK_DATA。OrignalFirstThunk。15。IMAGE_THUNK_DATA。15。4E210000。0000214E。File Offset。74Eh。74Eh。DestroyWindow。ASCII。(Hint)。0。I
11、ID。API。FirstWindow。IID。FirstThunk。OrignalFirstThunk。INT。OrignalFirstThunk。GetProcAddress。FirstThunk。(IAT)。dumped.exe。PE。RVA。RVA。2040h。00002040。8C200000。0000208C。208C。IMAGE_THUNK_DATA。FirstThunk。2010h,。IAT。IID。IAT。USER32.dl。USER32.dll。77D216DDh。Exproted fn():LoadIconA -Ord:01BCh:77D216DD 8BC0 mov eax
12、,eax:77D216DF 55 push ebp:77D216E0 8BEC mov ebp,esp:77D216E2 66F7450EFFFF test ebp+0E,FFFF:77D216E8 0F8529170200 jne 77D42E17:77D216EE 5D pop ebp:77D216EF EBB6 jmp 77D216A7:77D216F1 90 nop:77D216F2 90 nop。,77D216DD。USER32.dll。LoadIconA。PE.EXE。IAT。LoadIconA。IAT。IAT。USER32.dll。LoadIconA。LoadIconA。CALL 00401164:00401164JMP DWORD PTR 00402010 ;。77D216DD。USER32.dll。LoadIconA。
