在ollydbg中执行exe时msvbvm60.VbaExitProc的地址发生更改

时间:2018-07-07 17:04:29

标签: disassembly

在ollydbg中修补exe文件后 当第二次执行文件时, msvbvm60 .__ vbaI2I4 msvbvm60 .__ vbaExitProc msvbvm60 .__ vbaFreeStr

修补以下代码后如何同步这些地址

MOV DWORD PTR SS:[EBP-4],13
MOV EDI,DWORD PTR DS:[ESI]
XOR ECX,ECX
CALL DWORD PTR DS:[110011CC]    ;  msvbvm60.__vbaI2I4
PUSH EAX
PUSH ESI
CALL DWORD PTR DS:[EDI+A4]
FCLEX
MOV DWORD PTR SS:[EBP-4],14
CALL    myprg.110F3B50
CALL DWORD PTR DS:[11001104]    ;  msvbvm60.__vbaExitProc
WAIT
PUSH    myprg.1122F4B3
LEA ECX,DWORD PTR SS:[EBP-28]
CALL DWORD PTR DS:[11001434]    ;  msvbvm60.__vbaFreeStr
MOV EAX,DWORD PTR SS:[EBP+8]
MOV ECX,DWORD PTR DS:[EAX]
PUSH EAX
CALL DWORD PTR DS:[ECX+8]
MOV EAX,DWORD PTR SS:[EBP-10]
MOV ECX,DWORD PTR SS:[EBP-20]
MOV DWORD PTR FS:[0],ECX
POP EDI
POP ESI
POP EBX`
MOV ESP,EBP
POP EBP
RETN 8

预先感谢

0 个答案:

没有答案