菜鸟注释PEMaker6源代码（四）
这是最后一篇了，最近被调去急诊科，三天一个夜班，头都大了，注释的很乱，连自己都搞晕了。
#include "stdafx.h"
#include "loader.h"
#include "itmaker.h"
#ifdef _DEBUG
#define DEBUG_NEW
#endif
__stdcall void DynLoader();
//---------------------------------------------------------
// Thanks FEUERRADER [AHTeam] for idea about using _emit 0!
//---------------------------------------------------------
// byte ptr (1 bytes)
//定义一个字节
#define byte_type(x) __asm _emit x
// word ptr (2 bytes)
//低位放低字节
#define word_type(x) byte_type((x>>(0*8))&0xFF) byte_type((x>>(1*8))&0xFF)
// dword ptr (4 bytes)
#define dword_type(x) byte_type((x>>(0*8))&0xFF) byte_type((x>>(1*8))&0xFF) byte_type((x>>(2*8))&0xFF) byte_type((x>>(3*8))&0xFF)
// dword64 ptr (8 bytes)
#define dword64_type(x) dword_type(x) dword_type(x)
// dword64 ptr (16 bytes)
#define dword128_type(x) dword64_type(x) dword64_type(x)
//---------------------------------------------------------
//定义字节
#define bb(x) __asm _emit x
#define db byte_type(0xCC)
#define __random_code1__ dword64_type(0X90909090) // Reserve for random code generation
//jmp
#define __jmp_api byte_type(0xFF) byte_type(0x25)
//----------------------------------------------------------------
__stdcall void DynLoader()
{
_asm
{
//----------------------------------
dword_type(DYN_LOADER_START_MAGIC)
//----------------------------------
_main_0:
pushad // save the registers context in stack
//重定向编码放EBP
call _main_1
_main_1:
pop ebp
sub ebp,offset _main_1 // get base ebp
//----------------------------------------------------
//====================================================
//---------------- support dll, ocx -----------------
_support_dll_0:
jmp _support_dll_1 // nop; nop; // in the secon time OEP
jmp _support_dll_2
_support_dll_1:
//定义在下面，就是那个类似t_DATA_1结构的东西
test [ebp+_p_dwFileType],IMPORT_TABLE_OCX
jz _no_dll_pe_file_0
//esp怎么来的？
mov eax,[esp+24h]// imagebase
//AddressOfEntryPoint成员
mov ebx,[esp+30h]// oep
cmp eax,ebx
ja _no_dll_pe_file_0
cmp word ptr [eax],IMAGE_DOS_SIGNATURE
jne _no_dll_pe_file_0
//存入镜像地址
mov [ebp+_p_dwImageBase],eax
//无DLL的PE文件？
_no_dll_pe_file_0:
//----------------------------------------------------
//====================================================
mov eax,[ebp+_p_dwImageBase]
add eax,[eax+03Ch]
add eax,080h
//获取导入表RVA
mov ecx,[eax] // image_nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress
//ecx为导入表地址
add ecx,[ebp+_p_dwImageBase]
add ecx,010h // image_import_descriptor.FirstThunk
//取FirstTHUNk值
mov eax,[ecx]
add eax,[ebp+_p_dwImageBase]
mov ebx,[eax]
//存入API地址
mov [ebp+_p_LoadLibrary],ebx
add eax,04h
mov ebx,[eax]
//存入API地址
mov [ebp+_p_GetProcAddress],ebx
//----------------------------------------------------
//------- load library and build api call-jmp --------
call _api_load
//----------------------------------------------------
push MB_OK | MB_ICONINFORMATION
lea eax,[ebp+_p_szCaption]
push eax
lea eax,[ebp+_p_szText]
push eax
push NULL
call _jmp_MessageBox
// MessageBox(NULL, szText, szCaption, MB_OK | MB_ICONINFORMATION) ;
//...
//...
//...
// Place your code here ...
//...
//...
//...
//----------------------------------------------------
//====================================================
//----------- get write access for headers -----------
mov edi,[ebp+_p_dwImageBase]
add edi,[edi+03Ch]// edi -> IMAGE_NT_HEADERS
// get write permission by VirtualProtect()
lea eax,[ebp+_p_ptempbuffer]
push eax
push PAGE_READWRITE
push [edi+0x54]//IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders
push [ebp+_p_dwImageBase]
call _jmp_VirtualProtect
//VirtualProtect(dwImageBase,image_nt_header.OptionalHeader.SizeOfHeaders,PAGE_READWRITE,ptempbuffer);
//----------------------------------------------------
//----------------------------------------------------
//--------------- import table fix up ----------------
lea eax,[ebp+_p_szKERNEL32_r]
push eax
push [ebp+_p_dwImportVirtualAddress]
push [ebp+_p_dwImageBase]
//以上传递参数
call _it_fixup_1
//--------------- import table fix up ----------------
//call _it_fixup
//----------------------------------------------------
//====================================================
//---------------- support dll, ocx 1 ---------------
//by set second way to oep and relocation table effect
mov edi,[ebp+_p_dwImageBase]
add edi,[edi+03Ch]// edi -> IMAGE_NT_HEADERS
mov ax,word ptr [edi+016h]// edi -> image_nt_headers->FileHeader.Characteristics
// .IF ((image_nt_headers->FileHeader.Characteristics&IMAGE_FILE_DLL) ==IMAGE_FILE_DLL)
test ax,IMAGE_FILE_DLL
jz _no_dll_pe_file_1
//--------------- relocation fix up --------------
call _reloc_fixup
//------------------------------------------------
mov ax,9090h
mov word ptr [ebp+_support_dll_0],ax
// .ENDIF
_no_dll_pe_file_1:
//----------------------------------------------------
//====================================================
_support_dll_2:
//----------------------------------------------------
//====================================================
//--------- Prepare the SEH for OEP approach ---------
mov eax,[ebp+_p_dwImageBase]
add eax,[ebp+_p_dwOrgEntryPoint]
mov [esp+10h],eax // pStack.Ebx <- eax
lea eax,[ebp+_except_handler1_OEP_Jump]
mov [esp+1Ch],eax // pStack.Eax <- eax
popad // restore the first registers context from stack
//----------------------------------------------------
// the structured exception handler (SEH) installation
push eax
xor eax, eax
push dword ptr fs:[0] // NT_TIB32.ExceptionList
mov fs:[0],esp // NT_TIB32.ExceptionList <-ESP
dword_type(0xCCCCCCCC)// raise a (int 3) exception
//----------------------------------------------------
//====================================================
//--------------------------------------------------------
//========================================================
//------------- t_size strlen(LPCTSTR lpStr) -------------
__strlen:
push ebp
mov ebp,esp
push ecx
push esi
push ebx
//取得参数
mov esi,[ebp+08h]// -> destination
mov ecx,255// -> length
xor ebx,ebx
_strlenloop:
lods byte ptr ds:[esi]
cmp al,00h
jz _endbufstrlen
//ebx计数
inc ebx
loop _strlenloop
_endbufstrlen:
mov eax,ebx
//返回值在eax
inc eax
pop ebx
pop esi
pop ecx
mov esp,ebp
pop ebp
ret
//--------------------------------------------------------
//========================================================
//------------------- fix up relocation ------------------
// I have stolen this reloc fix-up code from Morphine 2.7 !!
// so Thanks Holy_Father && Ratter/29A for it. (www.hxdef.org)
_reloc_fixup:
mov eax,[ebp+_p_dwImageBase]
//edx首地址
mov edx,eax
mov ebx,eax
//ebx-->NT文件头
add ebx,[ebx+3Ch] // edi -> IMAGE_NT_HEADERS
//其实RVA等于FC
mov ebx,[ebx+034h]// ebx ->image_nt_headers->OptionalHeader.ImageBase
//有可能为0
sub edx,ebx // edx -> reloc_correction
je _reloc_fixup_end
mov ebx,[ebp+_p_dwRelocationVirtualAddress]
test ebx,ebx
jz _reloc_fixup_end
//ebx是RVA
add ebx,eax
_reloc_fixup_block:
//一个32位的“SizeOfBlock（块大小）”
mov eax,[ebx+004h] //ImageBaseRelocation.SizeOfBlock
test eax,eax
jz _reloc_fixup_end
lea ecx,[eax-008h] //ImageBaseRelocation.SizeOfBlock - sizeof(TImageBaseRelocation)
//ecx为跟在后面的重定位的数目
shr ecx,001h //WORD((ImageBaseRelocation.SizeOfBlock - sizeof(TImageBaseRelocation)) / sizeof(Word))
//edi为重定位数据开始地址
lea edi,[ebx+008h] //PImageBaseRelocation + sizeof(TImageBaseRelocation)
_reloc_fixup_do_entry:
movzx eax,word ptr [edi]//Entry
push edx
mov edx,eax
//高4位的重定位类型
shr eax,00Ch //Type = Entry >> 12
mov esi,[ebp+_p_dwImageBase]//ImageBase
//低12位的重定位位置
and dx,00FFFh
//得到计算后的偏移地址
add esi,[ebx] //ImageBase + ImageBaseRelocation.VirtualAddress
//得到重定位数据的偏移地址
add esi,edx //ImageBase + ImageBaseRelocation.VirtualAddress+Entry & 0x0FFF
pop edx
//------------------------------
//---- IMAGE_REL_BASED_HIGH 重定位的高16位必须被用于被偏移量所指向的那个16位的WORD单元，
//此WORD是一个32位的DWORD的高位WORD----
_reloc_fixup_HIGH:
//重定位类型
dec eax
jnz _reloc_fixup_LOW
//edx重定位偏移
mov eax,edx
//取高字节
shr eax,010h //HIWORD(Delta)
jmp _reloc_fixup_LOW_fixup
//------------------------------
//---- IMAGE_REL_BASED_LOW -----
_reloc_fixup_LOW:
dec eax
jnz _reloc_fixup_HIGHLOW
movzx eax,dx //LOWORD(Delta)
_reloc_fixup_LOW_fixup:
//
add word ptr [esi],ax
jmp _reloc_fixup_next_entry
//------------------------------
//-- IMAGE_REL_BASED_HIGHLOW ---
_reloc_fixup_HIGHLOW:
dec eax
jnz _reloc_fixup_next_entry
add [esi],edx
//------------------------------
_reloc_fixup_next_entry:
inc edi
inc edi //Entry++
loop _reloc_fixup_do_entry
_reloc_fixup_next_base:
add ebx,[ebx+004h] //ImageBaseRelocation + ImageBaseRelocation.SizeOfBlock
jmp _reloc_fixup_block
_reloc_fixup_end:
// clean relocation table
/* mov eax,[ebp+_p_dwImageBase]
add eax,[ebp+_p_dwRelocationVirtualAddress]
lea edi,[eax]
xor eax,eax
add ecx,[ebp+_p_dwRelocationSize]
rep stos byte ptr [edi]*/
ret
//--------------------------------------------------------
//========================================================
//--------------- 修复导入表 ----------------
/*
ebp+10h [ebp+_p_szKERNEL32_r]
ebp+0ch _p_dwImportVirtualAddress
ebp+08h _p_dwImageBase
---------------------------------
ebp-04h _p_dwNewITaddress
ebp-08h _p_dwThunk
ebp-0ch _p_dwHintName
ebp-10h _p_dwLibraryName
ebp-14h _p_dwAPIaddress
*/
_it_fixup_1:
push ebp
mov ebp,esp
add esp,-14h
push PAGE_READWRITE
push MEM_COMMIT
push 01D000h
push 0
call _jmp_VirtualAlloc
//NewITaddress=VirtualAlloc(NULL, 0x01D000, MEM_COMMIT, PAGE_READWRITE);
//存入地址
mov [ebp-04h],eax
mov ebx,[ebp+0ch]
test ebx,ebx
jz _it_fixup_1_end
//esi:_p_dwImageBase
mov esi,[ebp+08h]
//导入表地址
add ebx,esi // dwImageBase + dwImportVirtualAddress
_it_fixup_1_get_lib_address_loop:
//名称
mov eax,[ebx+0ch] // image_import_descriptor.Name
test eax,eax
jz _it_fixup_1_end
//FirstThunk RVA
mov ecx,[ebx+10h] // image_import_descriptor.FirstThunk
add ecx,esi
//FirstThunk指向的RVA数组
mov [ebp-08h],ecx // dwThunk
mov ecx,[ebx] // image_import_descriptor.Characteristics
//有些编译器会将此置0
test ecx,ecx
jnz _it_fixup_1_table
// image_import_descriptor.FirstThunk
mov ecx,[ebx+10h]
_it_fixup_1_table:
//esi:_p_dwImageBase
add ecx,esi
mov [ebp-0ch],ecx // dwHintName
add eax,esi // image_import_descriptor.Name + dwImageBase = ModuleName
push eax // lpLibFileName
mov [ebp-10h],eax
call _jmp_LoadLibrary // LoadLibrary(lpLibFileName);
test eax,eax
jz _it_fixup_1_end
//edi:动态链接库句柄
mov edi,eax
_it_fixup_1_get_proc_address_loop:
//指向一个 IMAGE_THUNK_DATA 结构数组
mov ecx,[ebp-0ch] // dwHintName
mov edx,[ecx] // image_thunk_data.Ordinal
test edx,edx
jz _it_fixup_1_next_module
//以序数方式
test edx,080000000h // .IF( import by ordinal )
//对于每个数组元素，我们比对元素值是否等于IMAGE_ORDINAL_FLAG32。
//如果该元素值的最高二进位为1，
//那么函数是由序数引入的，可以从该值的低字节提取序数。
jz _it_fixup_1_by_name
//取出序数
and edx,07FFFFFFFh // get ordinal
jmp _it_fixup_1_get_addr
_it_fixup_1_by_name:
add edx,esi // image_thunk_data.Ordinal + dwImageBase = OrdinalName
inc edx
//取出API名称
inc edx // OrdinalName.Name
_it_fixup_1_get_addr:
push edx // lpProcName
push edi // hModule
call _jmp_GetProcAddress // GetProcAddress(hModule, lpProcName);
//获得API地址
mov [ebp-14h],eax //_p_dwAPIaddress
//================================================================
//mov [ecx],eax//<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
//hModule
push edi
// dwImageBase
push esi
//ebx=引入表地址
push ebx
mov ebx,[ebp-10h]
push ebx
push ebx
//大写
call _char_upper
//esi=_p_dwLibraryName
mov esi,[ebp-10h]
mov edi,[ebp+010h] // [ebp+_p_szKernel32]
_it_fixup_1_check_dll_redirected:
push edi
call __strlen
add esp, 4
mov ebx,eax
mov ecx,eax
push edi
push esi
//比较两个动态库字符串
repe cmps //byte ptr [edi], byte ptr [esi]
jz _it_fixup_1_do_normal_it_0
pop esi
pop edi
//下一个
add edi,ebx
//是否结束
cmp byte ptr [edi],0
jnz _it_fixup_1_check_dll_redirected
//_p_dwThunk
mov ecx,[ebp-08h]
//api地址
mov eax,[ebp-014h]
//FirstThunk指向的数组被填充为真正的函数地址
mov [ecx],eax
jmp _it_fixup_1_do_normal_it_1
_it_fixup_1_do_normal_it_0:
//对应repe之前的push
pop esi
pop edi
//新申请的内存空间
mov edi,[ebp-04h]
//插入JMP
mov byte ptr [edi], 0e9h
//API地址
mov eax,[ebp-14h]
//计算跳转偏移
sub eax, edi
sub eax,05h
//插入偏移
mov [edi+1],eax
//0c8bh-->mov eax,eax,对齐
mov word ptr [edi+05],0c8bh
//THUNK
mov ecx,[ebp-08h]
//将原程序的THUNK指向我们的内存地址
mov [ecx],edi
//下一个位置
add dword ptr [ebp-04h],07h
_it_fixup_1_do_normal_it_1:
pop ebx
pop esi
pop edi
//================================================================
add dword ptr [ebp-08h],004h // dwThunk => next dwThunk
add dword ptr [ebp-0ch],004h// dwHintName => next dwHintName
jmp _it_fixup_1_get_proc_address_loop
_it_fixup_1_next_module:
add ebx,014h // sizeof(IMAGE_IMPORT_DESCRIPTOR)
jmp _it_fixup_1_get_lib_address_loop
_it_fixup_1_end:
mov esp,ebp
pop ebp
ret 0ch
//--------------------------------------------------------
//========================================================
//-- char_upper(LPCTSTR lpDestination, LPCTSTR lpSource )
_char_upper:
push ebp
mov ebp,esp
push ecx
push eax
push esi
push edi
mov edi,dword ptr [ebp+08h]// -> Destination
mov esi,dword ptr [ebp+0Ch]// -> Source
mov ecx,255// -> Length
xor eax,eax
__makeupperloop:
lods byte ptr [esi]//ESI
cmp al,00h
jz endofbuffer
cmp al,60h
jc notinlowerfield
cmp al,7bh
jnc notinlowerfield
sub al,20h
notinlowerfield:
stos byte ptr [edi]//EDI
loop __makeupperloop
endofbuffer:
pop edi
pop esi
pop eax
pop ecx
pop ebp
retn 08h
//--------------------------------------------------------
//========================================================
//------------- load necessary api functions -------------
//以下都是重定位之后的地址
_api_load:
//取得_p_szKernel32字符串地址
lea edi,[ebp+_p_szKernel32]
//取得_p_GetModuleHandle的地址
lea ebx,[ebp+_p_GetModuleHandle]
//取得_jmp_GetModuleHandle地址
lea ecx,[ebp+_jmp_GetModuleHandle]
//取得_jmp_GetModuleFileName的地址？
add ecx,02h
_api_get_lib_address_loop:
//保存ECX
push ecx
push edi
mov eax,offset _p_LoadLibrary
//加载kernel32.dll
call [ebp+eax]// LoadLibrary(lpLibFileName);
//-------------------
pop ecx
//kernel32.dll模块地址
mov esi,eax // esi -> hModule
//字符串长度
push edi
call __strlen
//平衡堆栈,弹出参数
add esp,04h
//指向下一个字符串
add edi,eax
_api_get_proc_address_loop:
push ecx
//edi=getmodulhanda
push edi
//esi=hmodule
push esi
mov eax,offset _p_GetProcAddress
call [ebp+eax]// GetModuleHandle=GetProcAddress(hModule, lpProcName);
//--------------------
pop ecx
//存入GetModuleHandle的实际地址
mov [ebx],eax
//注意看这里！！
mov [ecx],ebx
//下一个
add ebx,04h
//下一个
add ecx,06h
//下一个
push edi
call __strlen
add esp,04h
add edi,eax
mov al,byte ptr [edi]
test al,al
//不为0继续循环
jnz _api_get_proc_address_loop
//edi地址加一
inc edi
mov al,byte ptr [edi]
test al,al
//不为0则载入user32.dll
jnz _api_get_lib_address_loop
ret
//----------------------------------------------------------
//--------------------------------------------------------
//========================================================
// -------- exception handler expression filter ----------
_except_handler1_OEP_Jump:
push ebp
mov ebp,esp
mov eax,[ebp+010h] // PCONTEXT: pContext <- eax
//---------------
push edi
// restore original SEH
mov edi,[eax+0C4h] // pContext.Esp
push dword ptr ds:[edi]
pop dword ptr fs:[0]
add dword ptr [eax+0C4h],8 // pContext.Esp
// set the Eip to the OEP
mov edi,[eax+0A4h] // edi <- pContext.Ebx
mov [eax+0B8h],edi // pContext.Eip <- edi
//
pop edi
//---------------
mov eax, EXCEPTION_CONTINUE_SEARCH
leave
ret
//--------------------------------------------------------
//========================================================
dword_type(DYN_LOADER_START_DATA1)
//0xcccccccc自填充----------------------------------
_p_dwFileType: dword_type(0xCCCCCCCC)
_p_dwImageBase: dword_type(0xCCCCCCCC)
_p_dwOrgEntryPoint: dword_type(0xCCCCCCCC)
_p_dwImportVirtualAddress: dword_type(0xCCCCCCCC)
_p_dwRelocationVirtualAddress: dword_type(0xCCCCCCCC)
_p_dwRelocationSize: dword_type(0xCCCCCCCC)
//----------------------------------
_tls_dwStartAddressOfRawData: dword_type(0xCCCCCCCC)
_tls_dwEndAddressOfRawData: dword_type(0xCCCCCCCC)
_tls_dwAddressOfIndex: dword_type(0xCCCCCCCC)
_tls_dwAddressOfCallBacks: dword_type(0xCCCCCCCC)
_tls_dwSizeOfZeroFill: dword_type(0xCCCCCCCC)
_tls_dwCharacteristics: dword_type(0xCCCCCCCC)
//----------------------------------
_p_szKernel32: //db "Kernel32.dll",0,13
db db db db db db db db db db db db db
_p_szGetModuleHandle: //db "GetModuleHandleA",0,17
db db db db db db db db db db db db db db db db db
_p_szVirtualProtect: //db "VirtualProtect",0,15
db db db db db db db db db db db db db db db
_p_szGetModuleFileName: //db "GetModuleFileNameA",0,19
db db db db db db db db db db db db db db db db db db db
_p_szCreateFile: //db "CreateFileA",0,12
db db db db db db db db db db db db
_p_szGlobalAlloc: //db "GlobalAlloc",0,12
db db db db db db db db db db db db
_p_szVirtualAlloc: //db "VirtualAlloc",0,13
db db db db db db db db db db db db db
_p_szLoadLibrary: //db "LoadLibraryA",0,13
db db db db db db db db db db db db db
_p_szGetProcAddress: //db "GetProcAddress",0,15
db db db db db db db db db db db db db db db
byte_type(0)
_p_szUser32: //db "User32.dll",0,11
db db db db db db db db db db db
_p_szMessageBox: //db "MessageBoxA",0,12
db db db db db db db db db db db db
byte_type(0)
byte_type(0)
//----------------------------------
_p_LoadLibrary: dword_type(0xCCCCCCCC)
_p_GetProcAddress: dword_type(0xCCCCCCCC)
_p_GetModuleHandle:
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
dword_type(0xCCCCCCCC)
_jmp_GetModuleHandle: __jmp_api dword_type(0xCCCCCCCC)
_jmp_VirtualProtect: __jmp_api dword_type(0xCCCCCCCC)
_jmp_GetModuleFileName: __jmp_api dword_type(0xCCCCCCCC)
_jmp_CreateFile: __jmp_api dword_type(0xCCCCCCCC)
_jmp_GlobalAlloc: __jmp_api dword_type(0xCCCCCCCC)
_jmp_VirtualAlloc: __jmp_api dword_type(0xCCCCCCCC)
_jmp_LoadLibrary: __jmp_api dword_type(0xCCCCCCCC)
_jmp_GetProcAddress: __jmp_api dword_type(0xCCCCCCCC)
_jmp_MessageBox: __jmp_api dword_type(0xCCCCCCCC)
_p_szKERNEL32_r:
//db "KERNEL32.DLL",0,13
bb('K') bb('E') bb('R') bb('N') bb('E') bb('L') bb('3') bb('2') bb('.') bb('D') bb('L') bb('L') bb(0)
//db "USER32.DLL",0,11
bb('U') bb('S') bb('E') bb('R') bb('3') bb('2') bb('.') bb('D') bb('L') bb('L') bb(0)
//db "GDI32.DLL",0,10
bb('G') bb('D') bb('I') bb('3') bb('2') bb('.') bb('D') bb('L') bb('L') bb(0)
//db "ADVAPI32.DLL",0,13
bb('A') bb('D') bb('V') bb('A') bb('P') bb('I') bb('3') bb('2') bb('.') bb('D') bb('L') bb('L') bb(0)
//db "SHELL32.DLL",0,12
bb('S') bb('H') bb('E') bb('L') bb('L') bb('3') bb('2') bb('.') bb('D') bb('L') bb('L') bb(0)
byte_type(0)
_p_szCaption:
bb('A') bb('s') bb('h') bb('k') bb('b') bb('i') bb('z') bb(0)
_p_szText:
bb('T') bb('h') bb('i') bb('s') bb(' ') bb('E') bb('x') bb('a') bb('m') bb('p') bb('l')
bb('e') bb(' ') bb('s') bb('h') bb('o') bb('w') bb('s') bb(' ') bb('h') bb('o') bb('w')
bb(' ') bb('A') bb('P') bb('I') bb(' ') bb('r') bb('e') bb('d') bb('i') bb('r') bb('e')
bb('c') bb('t') bb('i') bb('o') bb('n') bb(' ') bb('t') bb('e') bb('c') bb('h') bb('n')
bb('i') bb('q') bb('u') bb('e') bb(' ') bb('w') bb('o') bb('r') bb('k') bb('s') bb('.')
bb(0)
_p_dwThunk: dword_type(0xCCCCCCCC)
_p_dwHintName: dword_type(0xCCCCCCCC)
_p_ptempbuffer: dword_type(0xCCCCCCCC)
//----------------------------------
dword_type(DYN_LOADER_END_MAGIC)
//----------------------------------
}
}
//----------------------------------------------------------------
