#include <windows.h>
\n#include <stdio.h>
\n#include <stdlib.h><\/p>\n
void PopMessageBox()
\n{
\n __asm
\n {
\n nop
\nnop
\nnop
\nnop
\nnop
\nnop
\njmp start
\nfind_function:
\n \t\/\/\u5bfb\u627ekernel32.dll\u7684\u57fa\u5740
\n \tmov eax,fs:[30h]
\nmov eax,[eax+0ch]
\nmov eax,[eax+14h]
\nmodule_loop:
\n \tmov eax,[eax]
\nmov esi,[eax+28h]
\ncmp byte ptr [esi+0ch],’3′ \/\/\u641c\u7d22kernel32.dll
\njne module_loop<\/p>\n
mov ebp,[eax+010h] \/\/ebx\u4e3akernel32.dll\u7684\u57fa\u5740<\/p>\n
mov eax,[ebp+03ch]
\nmov ecx,[ebp+eax+78h] \/\/\u8bfb\u53d6PE\u7ed3\u6784\u4e2d\u7684\u5bfc\u51fa\u8868\u5730\u5740
\nadd ecx,ebp \/\/ecx\u5b9a\u4f4d\u5230\u5bfc\u51fa\u8868<\/p>\n
mov ebx,[ecx+20h]
\nadd ebx,ebp \/\/ebx\u5b9a\u4f4d\u5230\u5bfc\u51fa\u540d\u79f0\u6307\u9488\u8868<\/p>\n
xor edi,edi
\npushad
\nname_loop:
\n popad
\nmov esi,[ebx+edi*4] \/\/\u8bfb\u53d6\u4e00\u4e2a\u6307\u5411\u51fd\u6570\u540d\u7684\u6307\u9488
\nadd esi,ebp \/\/\u5b9a\u4f4d\u5230\u51fd\u6570\u540d\u5b57\u7b26\u4e32
\ninc edi
\nmov edx,esp \/\/\u83b7\u53d6\u6808\u5185\u8981\u83b7\u53d6\u7684\u51fd\u6570\u540d\u8d77\u59cb\u5730\u5740
\nadd edx,4
\npushad \/\/\u5bc4\u5b58\u5668\u5165\u6808
\nmov eax,edx
\nmov ebx,esi
\nname_cmp_loop:
\n \txor edx,edx
\nmov cl,byte ptr [ebx]
\nmov ch,byte ptr [eax]
\ncmp cl,ch
\njne name_loop
\ninc ebx
\ninc eax
\ncmp cl,dl
\njz break_name_loop
\njmp name_cmp_loop
\nbreak_name_loop:
\n \tpopad
\n\/\/\u627e\u5230\u51fd\u6570\u540d
\nmov ebx,[ecx+24h] \/\/\u5b9a\u4f4d\u5230\u5bfc\u51fa\u5e8f\u6570\u8868RVA
\nadd ebx,ebp<\/p>\n
mov di,[ebx+2*edi]
\ndec di
\nmov ebx,[ecx+1ch] \/\/\u5b9a\u4f4d\u5230\u5bfc\u51fa\u5730\u5740\u8868RVA
\nadd ebx,ebp
\nadd ebp,[ebx+4*edi] \/\/\u8bfb\u53d6\u51fd\u6570\u5730\u5740
\nxchg eax,ebp<\/p>\n
ret
\nstart:
\n \/\/LoadLibraryA
\n push 0x00
\npush 0x41797261
\npush 0x7262694C
\n push 0x64616F4C
\ncall find_function
\npush eax \/\/\u5c06\u627e\u5230\u7684\u51fd\u6570\u5730\u5740\u5165\u6808<\/p>\n
\/\/GetProcAddress
\npush 0x00007373
\npush 0x65726464
\npush 0x41636F72
\npush 0x50746547
\ncall find_function
\npush eax<\/p>\n
push 0x00003233 \/\/32
\npush 0x72657375 \/\/user
\npush esp \/\/lpFileName<\/p>\n
mov eax,[esp+32]
\ncall eax \/\/call LoadLibraryA,\u8fd4\u56de\u503c\u5b58\u653e\u5728eax\u4e2d
\nmov edi,eax \/\/edi\u5b58\u653euser32.dll\u53e5\u67c4<\/p>\n
mov ebx,dword ptr [esp+8] \/\/\u83b7\u53d6GetProcAddress\u51fd\u6570\u5730\u5740<\/p>\n
push 0x0041786f \/\/oxA
\npush 0x42656761 \/\/ageB
\n push 0x7373654d \/\/Mess
\npush esp
\npush edi
\ncall ebx \/\/\u8fd4\u56de\u503c\u4fdd\u5b58\u5728eax\u4e2d<\/p>\n
push 0
\npush 0
\npush 0
\npush 0
\ncall eax<\/p>\n
push 0x00737365
\npush 0x636F7250
\npush 0x74697845
\ncall find_function<\/p>\n
push 0
\ncall eax
\nnop
\nnop
\nnop
\nnop
\nnop
\n }
\n}<\/p>\n
int main()
\n{
\n PopMessageBox();
\n return 0;
\n}<\/p>\n
#include <windows.h>
\n#include <stdio.h>
\n#include <stdlib.h><\/p>\n
void PopMessageBox()
\n{
\n __asm
\n {
\n nop
\nnop
\nnop
\n…<\/p>\n","protected":false},"author":1,"featured_media":578,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[329],"tags":[],"class_list":["post-97","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"yoast_head":"\n