<FONT face=宋體>避免殼運(yùn)行時(shí)處理</FONT><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">能被跳過的弊端。達(dá)到原程序沒有一刻是完好的的目的。</SPAN><SPAN lang=EN-US> </SPAN>8 p2 o! t# ]$ {8 \3 j
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">加殼時(shí)處理</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">要的是找到文件中</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">所在位置和大小。</SPAN><SPAN lang=EN-US> </SPAN></P>% x# I3 T7 m) |5 a( E' T3 j
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序不同。</SPAN><SPAN lang=EN-US> </SPAN></P>
$ |" O$ l- [# a' ]<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 一、</SPAN><SPAN lang=EN-US>VC notepad.exe</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">分析</SPAN><SPAN lang=EN-US> </SPAN></P>7 B( g3 |# x* n* I' Z
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>PE header(eifanew)</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>e8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處。</SPAN><SPAN lang=EN-US> </SPAN></P>
2 }# G' y$ `' a/ N0 U; e& K<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+d8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>1000 </SPAN></P>
3 a! {- L% ~" C' T: r% k- B% u9 X) z<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+dc</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>324</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值是系統(tǒng)參考值,系統(tǒng)在裝入文件時(shí)就會(huì)參考這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值。</SPAN><SPAN lang=EN-US> </SPAN></P>% y& y, B9 h6 g
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 物理位置上的</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">放在第一個(gè)節(jié)。即</SPAN><SPAN lang=EN-US>400</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處。</SPAN><SPAN lang=EN-US> </SPAN></P>
: j% ~/ w* p- a- p. F<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>PE</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">頭接著就是第一個(gè)節(jié),所以取</SPAN><SPAN lang=EN-US>SizeOfHeader</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">值就可以定位到第一個(gè)節(jié)。</SPAN><SPAN lang=EN-US> </SPAN></P>
" N, t5 j/ H! Y<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>SizeOfHeader</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+54</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>400</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">。</SPAN><SPAN lang=EN-US> </SPAN></P>7 D* P0 a3 m9 @8 q/ K; g
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 現(xiàn)在有了</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的物理位置和大小。</SPAN><SPAN lang=EN-US> </SPAN></P>
% S0 r9 Q# L/ I8 r" v& ~; R<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 二、</SPAN><SPAN lang=EN-US>DELPHI project1.exe</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">分析</SPAN><SPAN lang=EN-US> </SPAN></P>' ~; Y- s, i0 d6 t; ^
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>eifanew+d8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>eifanew+dc</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處都為</SPAN><SPAN lang=EN-US>0</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">。</SPAN><SPAN lang=EN-US> </SPAN></P>0 }! i1 {; I) U! [
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+80</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>54000</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,即目錄表的</SPAN><SPAN lang=EN-US>IMPORT_DIR.VirtualAddress </SPAN></P>
: ^; i+ O( }+ c) z+ c5 c8 Q, @7 |<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">在</SPAN><SPAN lang=EN-US>eifanew+84</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">處,</SPAN><SPAN lang=EN-US>1f4</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,即目錄表的</SPAN><SPAN lang=EN-US>IMPORT_DIR.Size </SPAN></P>1 V4 ?& w# p/ S S* I% s5 c
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值也是系統(tǒng)參考值,系統(tǒng)在裝入文件時(shí)參考這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值,把</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">放進(jìn)去。</SPAN><SPAN lang=EN-US> </SPAN></P>. m# _* v2 U ]. a
<P class=MsoNormal><SPAN lang=EN-US> <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></SPAN></P>
3 h: f- E1 L! E( J4 j" c<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 跳轉(zhuǎn)表在第一個(gè)節(jié)開始。</SPAN><SPAN lang=EN-US> </SPAN></P>
- ~- L' B, l* B; ?& c9 w1 w" \9 y<P class=MsoNormal><SPAN lang=EN-US> <o:p></o:p></SPAN></P>+ X! f, Y" Q" N; i! Z
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 三、系統(tǒng)裝入</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">工作流程猜測(cè)</SPAN><SPAN lang=EN-US> </SPAN></P>
$ U& P+ n, D3 ~" p" }: u<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 先在</SPAN><SPAN lang=EN-US>eifanew+d8</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>eifanew+dc</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">取</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,值非空即將第一個(gè)節(jié)</SPAN><SPAN lang=EN-US>IAT Size </SPAN></P>$ x& u* z' u! e- H% I. c* {1 E
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)字節(jié)裝入</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">指向的地址。</SPAN><SPAN lang=EN-US> </SPAN></P>
9 N+ d+ q0 l1 w. Z3 }<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 若取得的</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">為</SPAN><SPAN lang=EN-US>0</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">即取</SPAN><SPAN lang=EN-US>eifanew+80</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>eifanew+84</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的</SPAN><SPAN lang=EN-US>IMPORT_DIR.VirtualAddress </SPAN></P>
9 o3 J( n8 v' n0 q; K( v6 }<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IMPORT_DIR.Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">值,將這</SPAN><SPAN lang=EN-US>2</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">個(gè)值作為</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">參考值。再去</SPAN><SPAN lang=EN-US>BaseOfData </SPAN></P>. X; c+ H9 }, n+ d- n9 X' D
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">取各</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的字串和</SPAN><SPAN lang=EN-US>DLL</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">字串,根據(jù)字串取</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">地址,再把地址放到</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">中。</SPAN><SPAN lang=EN-US> </SPAN></P>$ {5 N, C( m2 [. X) E: o
<P class=MsoNormal><SPAN lang=EN-US> <o:p></o:p></SPAN></P>7 [$ K! T: R; U+ t
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 四、加殼時(shí)加密</SPAN><SPAN lang=EN-US>IAT </SPAN></P>
5 N! q; J% u" n, U<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 要在加殼時(shí)加密</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">,對(duì)</SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的程序很簡(jiǎn)單。對(duì)</SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">復(fù)雜很多。一:取</SPAN><SPAN lang=EN-US>IMPORT_DIR</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">值,</SPAN><SPAN lang=EN-US> </SPAN></P>6 L" H; s9 i' q
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">再用取各</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">地址,把地址寫回第一個(gè)節(jié),再把</SPAN><SPAN lang=EN-US>IAT RVA</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">和</SPAN><SPAN lang=EN-US>IAT Size</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的值改成</SPAN><SPAN lang=EN-US>IMPORT_DIR</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">的值。</SPAN><SPAN lang=EN-US> </SPAN></P>; E3 U2 b* G8 b+ M( w
<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">這樣就完成了</SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">向</SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序的轉(zhuǎn)變。再用對(duì)</SPAN><SPAN lang=EN-US>VC</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">程序</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">加密的方法對(duì)其進(jìn)行加密。</SPAN><SPAN lang=EN-US> </SPAN></P>
6 f& X B# S6 e2 Z<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">但有一難點(diǎn),原來的第一個(gè)節(jié)沒辦法處理。所以加殼時(shí)加密</SPAN><SPAN lang=EN-US>IAT</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">只能針對(duì)個(gè)別程序。</SPAN><SPAN lang=EN-US> </SPAN></P>$ \+ P n: l% Q% |5 K; V
<P class=MsoNormal><SPAN lang=EN-US> <o:p></o:p></SPAN></P>
7 C" @+ `' q( n7 H# H<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> 五、其它</SPAN><SPAN lang=EN-US> </SPAN></P>
5 V$ n8 C$ Q0 Z<P class=MsoNormal><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'"> </SPAN><SPAN lang=EN-US>DELPHI</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">這種對(duì)</SPAN><SPAN lang=EN-US>API</SPAN><SPAN style="FONT-FAMILY: 宋體; mso-ascii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Roman'">地址處理的方式也有其好處,跨平臺(tái)。</SPAN></P> |