- 帖子
- 3
- 积分
- 5
- 威望
- 6
- 金钱
- 6
- 在线时间
- 0 小时
|
4楼
发表于 2008-7-20 23:24
| 只看该作者
最近偶刚写了一个,5k,穿墙,免杀..
自己构件一个URLDownloadToFileA
反汇编urlmon.dll,把里面的代码提取出来,重新构造一个URLDownloadToSaveFileA:
.text:75CBB12F URLDownloadToFileA proc near
.text:75CBB12F mov edi, edi
.text:75CBB131 push ebp
.text:75CBB132 mov ebp, esp
.text:75CBB134 sub esp, 110h
.text:75CBB13A mov eax, dword_75CD30F8
.text:75CBB13F push ebx
.text:75CBB140 mov ebx, [ebp+10h]
.text:75CBB143 mov [ebp-4], eax
.text:75CBB146 mov eax, [ebp+8]
.text:75CBB149 push esi
.text:75CBB14A mov esi, [ebp+0Ch]
.text:75CBB14D push edi
.text:75CBB14E mov edi, ds:lstrlenA
.text:75CBB154 mov [ebp-10Ch], eax
.text:75CBB15A mov eax, [ebp+18h]
.text:75CBB15D push esi
.text:75CBB15E mov [ebp-110h], eax
.text:75CBB164 call edi ; lstrlenA
.text:75CBB166 lea eax, [eax+eax+2]
.text:75CBB16A push eax
.text:75CBB16B lea ecx, [ebp-104h]
.text:75CBB171 mov [ebp-108h], eax
.text:75CBB177 call loc_75CB9CB2
.text:75CBB177
.text:75CBB17C xor eax, eax
.text:75CBB17E cmp [ebp-104h], eax
.text:75CBB184 jnz short loc_75CBB190
.text:75CBB184
.text:75CBB186 mov esi, 8007000Eh
.text:75CBB18B jmp loc_75CBB214
.text:75CBB18B
.text:75CBB190 ; ---------------------------------------------------------------------------
.text:75CBB190
.text:75CBB190 loc_75CBB190: ; CODE XREF: URLDownloadToFileA+55j
.text:75CBB190 push dword ptr [ebp-108h]
.text:75CBB196 push dword ptr [ebp-104h]
.text:75CBB19C push 0FFFFFFFFh
.text:75CBB19E push esi
.text:75CBB19F mov esi, ds:MultiByteToWideChar
.text:75CBB1A5 push eax
.text:75CBB1A6 push eax
.text:75CBB1A7 call esi ; MultiByteToWideChar
.text:75CBB1A9 mov eax, [ebp-104h]
.text:75CBB1AF push ebx
.text:75CBB1B0 mov [ebp-108h], eax
.text:75CBB1B6 call edi ; lstrlenA
.text:75CBB1B8 lea edi, [eax+eax+2]
.text:75CBB1BC push edi
.text:75CBB1BD lea ecx, [ebp-84h]
.text:75CBB1C3 call loc_75CB9CB2
.text:75CBB1C3
.text:75CBB1C8 xor eax, eax
.text:75CBB1CA cmp [ebp-84h], eax
.text:75CBB1D0 jnz short loc_75CBB1D9
.text:75CBB1D0
.text:75CBB1D2 mov esi, 8007000Eh
.text:75CBB1D7 jmp short loc_75CBB209
.text:75CBB1D7
.text:75CBB1D9 ; ---------------------------------------------------------------------------
.text:75CBB1D9
.text:75CBB1D9 loc_75CBB1D9: ; CODE XREF: URLDownloadToFileA+A1j
.text:75CBB1D9 push edi
.text:75CBB1DA push dword ptr [ebp-84h]
.text:75CBB1E0 push 0FFFFFFFFh
.text:75CBB1E2 push ebx
.text:75CBB1E3 push eax
.text:75CBB1E4 push eax
.text:75CBB1E5 call esi
.text:75CBB1E7 push dword ptr [ebp-110h]
.text:75CBB1ED push dword ptr [ebp+14h]
.text:75CBB1F0 push dword ptr [ebp-84h]
.text:75CBB1F6 push dword ptr [ebp-108h]
.text:75CBB1FC push dword ptr [ebp-10Ch]
.text:75CBB202 call URLDownloadToFileW
.text:75CBB202
.text:75CBB207 mov esi, eax
.text:75CBB207
.text:75CBB209
.text:75CBB209 loc_75CBB209: ; CODE XREF: URLDownloadToFileA+A8j
.text:75CBB209 lea ecx, [ebp-84h]
.text:75CBB20F call loc_75CB9D06
.text:75CBB20F
.text:75CBB214
.text:75CBB214 loc_75CBB214: ; CODE XREF: URLDownloadToFileA+5Cj
.text:75CBB214 lea ecx, [ebp-104h]
.text:75CBB21A call loc_75CB9D06
.text:75CBB21A
.text:75CBB21F mov ecx, [ebp-4]
.text:75CBB222 pop edi
.text:75CBB223 mov eax, esi
.text:75CBB225 pop esi
.text:75CBB226 pop ebx
.text:75CBB227 call sub_75C61670
.text:75CBB227
.text:75CBB22C leave
.text:75CBB22D retn 14h
.text:75CBB22D
.text:75CBB22D URLDownloadToFileA endp ; sp = 34h游戏吧 http://www.game8.cc/MyBlog http://www.asm32.cn
帖子1598 精华30 积分8742 阅读权限150 性别男 在线时间954 小时 注册时间2006-9-21 最后登录2008-7-20 查看详细资料引用 报告 回复 TOP
1种痛
晶莹剔透§烈日灼然 |
|