<FONT face=宋體>避免殼運(yùn)行時(shí)處理</FONT><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">能被跳過(guò)的弊端。達(dá)到原程序沒有一刻是完好的的目的。</SPAN><SPAN lang=EN-US> </SPAN>
/ s3 M2 E$ r# y4 H<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">加殼時(shí)處理</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">要的是找到文件中</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">所在位置和大小。</SPAN><SPAN lang=EN-US> </SPAN></P>5 Z8 S! J/ T3 P; u
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序不同。</SPAN><SPAN lang=EN-US> </SPAN></P>% r, q2 R; ^% J- P7 q2 P
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 一、</SPAN><SPAN lang=EN-US>VC notepad.exe</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">分析</SPAN><SPAN lang=EN-US> </SPAN></P>
: r2 P2 @0 h# t8 f* D$ n& a<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>PE header(eifanew)</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>e8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處。</SPAN><SPAN lang=EN-US> </SPAN></P>, ?8 ]1 I& w! I9 ]3 V* W1 L
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+d8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>1000 </SPAN></P>
/ _. [' `, c, i" R9 X<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+dc</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>324</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值是系統(tǒng)參考值,系統(tǒng)在裝入文件時(shí)就會(huì)參考這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值。</SPAN><SPAN lang=EN-US> </SPAN></P>
6 P& O; s( Z' x8 I5 E<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 物理位置上的</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">放在第一個(gè)節(jié)。即</SPAN><SPAN lang=EN-US>400</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處。</SPAN><SPAN lang=EN-US> </SPAN></P>3 d: I4 G+ }! o" }
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>PE</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">頭接著就是第一個(gè)節(jié),所以取</SPAN><SPAN lang=EN-US>SizeOfHeader</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">值就可以定位到第一個(gè)節(jié)。</SPAN><SPAN lang=EN-US> </SPAN></P>. D7 c; _8 B8 f. K9 l
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>SizeOfHeader</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+54</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>400</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">。</SPAN><SPAN lang=EN-US> </SPAN></P>% X# E. y R- L3 ~
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 現(xiàn)在有了</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的物理位置和大小。</SPAN><SPAN lang=EN-US> </SPAN></P>
1 ^! @/ S, V6 c& v9 X& g d: \ Y<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 二、</SPAN><SPAN lang=EN-US>DELPHI project1.exe</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">分析</SPAN><SPAN lang=EN-US> </SPAN></P>; u+ U. ^ V1 [1 i$ q
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>eifanew+d8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>eifanew+dc</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處都為</SPAN><SPAN lang=EN-US>0</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">。</SPAN><SPAN lang=EN-US> </SPAN></P>$ p6 V9 p3 F4 i& A
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+80</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>54000</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,即目錄表的</SPAN><SPAN lang=EN-US>IMPORT_DIR.VirtualAddress </SPAN></P>5 b; B0 B+ B- r) w4 w6 V+ V5 O4 y
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+84</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>1f4</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,即目錄表的</SPAN><SPAN lang=EN-US>IMPORT_DIR.Size </SPAN></P>
& J% V8 N6 o. M5 ^* n- @<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值也是系統(tǒng)參考值,系統(tǒng)在裝入文件時(shí)參考這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值,把</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">放進(jìn)去。</SPAN><SPAN lang=EN-US> </SPAN></P>% E# `, e6 \2 l& M% l
<P class=MsoNormal><SPAN lang=EN-US> <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></SPAN></P>( Z( }! X- X8 F
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 跳轉(zhuǎn)表在第一個(gè)節(jié)開始。</SPAN><SPAN lang=EN-US> </SPAN></P>
a+ C. H% p {3 T4 X! E5 H" X' w<P class=MsoNormal><SPAN lang=EN-US> <o:p></o:p></SPAN></P>" Z/ G9 Y5 A; X# U% B
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 三、系統(tǒng)裝入</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">工作流程猜測(cè)</SPAN><SPAN lang=EN-US> </SPAN></P>
& z4 O% r4 i8 G! m/ B6 z<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 先在</SPAN><SPAN lang=EN-US>eifanew+d8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>eifanew+dc</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">取</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,值非空即將第一個(gè)節(jié)</SPAN><SPAN lang=EN-US>IAT Size </SPAN></P>/ W! k+ `1 g2 h
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)字節(jié)裝入</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">指向的地址。</SPAN><SPAN lang=EN-US> </SPAN></P>- U) s. N+ j! n2 ^6 L$ @+ ?; b
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 若取得的</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">為</SPAN><SPAN lang=EN-US>0</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">即取</SPAN><SPAN lang=EN-US>eifanew+80</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>eifanew+84</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的</SPAN><SPAN lang=EN-US>IMPORT_DIR.VirtualAddress </SPAN></P>
" Y* S4 |/ q+ _2 C6 @4 @$ |<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IMPORT_DIR.Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">值,將這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值作為</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">參考值。再去</SPAN><SPAN lang=EN-US>BaseOfData </SPAN></P>; i& s. x! t' Z( i5 B, m
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">取各</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的字串和</SPAN><SPAN lang=EN-US>DLL</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">字串,根據(jù)字串取</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">地址,再把地址放到</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">中。</SPAN><SPAN lang=EN-US> </SPAN></P>8 P: t# k7 j u( |: Z! q5 U2 m
<P class=MsoNormal><SPAN lang=EN-US> <o:p></o:p></SPAN></P>
3 M8 O& O% L5 }8 v<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 四、加殼時(shí)加密</SPAN><SPAN lang=EN-US>IAT </SPAN></P>
* \# O5 ]0 n) y) [<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 要在加殼時(shí)加密</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,對(duì)</SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的程序很簡(jiǎn)單。對(duì)</SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">復(fù)雜很多。一:取</SPAN><SPAN lang=EN-US>IMPORT_DIR</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">值,</SPAN><SPAN lang=EN-US> </SPAN></P>
( y5 ~) k4 }, r, _9 ~0 H" p/ k7 C<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">再用取各</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">地址,把地址寫回第一個(gè)節(jié),再把</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的值改成</SPAN><SPAN lang=EN-US>IMPORT_DIR</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的值。</SPAN><SPAN lang=EN-US> </SPAN></P>/ @+ Y# v' C& U; N# n6 p$ |9 S4 @
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">這樣就完成了</SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">向</SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序的轉(zhuǎn)變。再用對(duì)</SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">加密的方法對(duì)其進(jìn)行加密。</SPAN><SPAN lang=EN-US> </SPAN></P>
# [2 F5 [' d% ^8 T# C<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">但有一難點(diǎn),原來(lái)的第一個(gè)節(jié)沒辦法處理。所以加殼時(shí)加密</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">只能針對(duì)個(gè)別程序。</SPAN><SPAN lang=EN-US> </SPAN></P>5 ^7 F; K4 j8 i/ l( V
<P class=MsoNormal><SPAN lang=EN-US> <o:p></o:p></SPAN></P>) t1 e- `( F2 X, E2 D5 m! x
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 五、其它</SPAN><SPAN lang=EN-US> </SPAN></P>
" m$ T% }- {9 i8 {<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">這種對(duì)</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">地址處理的方式也有其好處,跨平臺(tái)。</SPAN></P> |