<span class="pediy"><span class="pediy"> 收集IAT
第一次写脚本，不妥之处敬请指教
代码:<hr> <font color=green>//Script for yoda's Protector v1.01 <font color=green>//by cyclotron [BCG][DFCG][FCG][OCN] <font color=green>//收集IAT <font color=green>//━━━━━━━━━━━━━━━━━━━━━━━━━━━ gpa "Process32Next","kernel32.dll" <font color=#0000FF>bp $RESULT run <font color=green>//F9 bc $RESULT <font color=green>//clear bp rtu <font color=green>//run to user code find eip,#3BC374# <font color=green>//cmp eax,ebx <font color=#000099>add $RESULT,2 <font color=green>//next instruction <font color=#0000FF>bp $RESULT run bc $RESULT <font color=#000099>mov !ZF,1 <font color=green>//置Z标志 <font color=green>//━━━━━━━━━━━━━━━━━━━━━━━━━━━ gpa "Process32Next","kernel32.dll" <font color=#0000FF>bp $RESULT run <font color=green>//F9 bc $RESULT <font color=green>//clear bp rtu <font color=green>//run to user code find eip,#3BC374# <font color=green>//cmp eax,ebx <font color=#000099>add $RESULT,2 <font color=green>//next instruction <font color=#0000FF>bp $RESULT run bc $RESULT <font color=#000099>mov !ZF,1 <font color=green>//置Z标志 <font color=green>//━━━━━━━━━━━━━━━━━━━━━━━━━━━ gpa "Process32Next","kernel32.dll" <font color=#0000FF>bp $RESULT run <font color=green>//F9 bc $RESULT <font color=green>//clear bp rtu <font color=green>//run to user code find eip,#3BC374# <font color=green>//cmp eax,ebx <font color=#000099>add $RESULT,2 <font color=green>//next instruction <font color=#0000FF>bp $RESULT run bc $RESULT <font color=#000099>mov !ZF,1 <font color=green>//置Z标志 <font color=green>//━━━━━━━━━━━━━━━━━━━━━━━━━━━ gpa "LoadLibraryA","kernel32.dll" <font color=#0000FF>bp $RESULT run <font color=green>//F9 bc $RESULT <font color=green>//clear bp rtu <font color=green>//run to user code gpa "GetProcAddress","kernel32.dll" <font color=#0000FF>bp $RESULT run <font color=green>//F9 bc $RESULT <font color=green>//clear bp rtu <font color=green>//run to user code <font color=green>//━━━━━━━━━━━━━━━━━━━━━━━━━━━ bp 451599 run bc 451599 asm eip,"<font color=#000099>MOV <font color=#0000FF>DWORD <font color=#0000FF>PTR [<font color=#0000FF>EDX],<font color=#0000FF>EAX" <font color=#000099>add eip,2 <font color=#0000FF>bp eip run msg "IAT收集开始" pause <hr>
