在找到(dào )IAT之后,我们(men )只需在其中遍历(lì ),找到(dào )我们需要(yào )的(de )API地(dì )址(zhǐ ),然后用(yòng )我们(men )自己(jǐ )的函数地址(zhǐ )去覆盖它(tā ),下面(miàn )给出(chū )一(yī )段对应的源码 procedure RedirectApiCall var ImportDescPIMAGE_IMPORT_DESCRIPTOR FirstThunkPIMAGE_THUNK_DATA32 szDWORD
Copyright © 2008-2018