c# dll c 类_dialogboxparam_msg结构

认识各语言的入口特征及加壳后的识别判断，及加密与压缩壳识别

C++

00408027 >/$ 55 push ebp

00408028 |. 8BEC mov ebp,esp

0040802A |. 6A FF push -0x1

0040802C |. 68 F0F14000 push C++.0040F1F0

00408031 |. 68 84AF4000 push C++.0040AF84 ; SE 处理程序安装

00408036 |. 64:A1 00000000 mov eax,dword ptr fs:[0]

0040803C |. 50 push eax

0040803D |. 64:8925 000000>mov dword ptr fs:[0],esp

00408044 |. 83EC 58 sub esp,0x58

00408047 |. 53 push ebx

00408048 |. 56 push esi

00408049 |. 57 push edi ; ntdll.7C930228

0040804A |. 8965 E8 mov [local.6],esp

0040804D |. FF15 E4F04000 call dword ptr ds:[<&KERNEL32.GetVersion>; kernel32.GetVersion

00408053 |. 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet

00408055 |. 8AD4 mov dl,ah

00408057 |. 8915 D06B4100 mov dword ptr ds:[0x416BD0],edx ; ntdll.KiFastSystemCallRet

0040805D |. 8BC8 mov ecx,eax

0040805F |. 81E1 FF000000 and ecx,0xFF

00408065 |. 890D CC6B4100 mov dword ptr ds:[0x416BCC],ecx

0040806B |. C1E1 08 shl ecx,0x8

C++的入口函数GetVersion

C++的字符串采用ASCII码查找

C++的按钮事件采用查找SUB EAX,0A

汇编的入口

0040285E >/$ 6A 00 push 0x0 ; /pModule = NULL

00402860 |. E8 970B0000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA

00402865 |. A3 28544000 mov dword ptr ds:[0x405428],eax

0040286A |. E8 F50C0000 call <jmp.&comctl32.InitCommonControls> ; [InitCommonControls

0040286F |. 68 9D334000 push 汇编.0040339D ; /pTopLevelFilter = 汇编.0040339D

00402874 |. E8 F50B0000 call <jmp.&kernel32.SetUnhandledExceptio>; \SetUnhandledExceptionFilter

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/jisuanjixue/article-33496-1.html