在(zài )找到(dào )IAT之后,我们(men )只需(xū )在(zài )其中遍历,找到(dào )我们(men )需要的API地址,然(rán )后用我(wǒ )们自(zì )己的函数地址去(qù )覆盖它(tā ),下面给(gěi )出一段对(duì )应(yīng )的源码(mǎ ) procedure RedirectApiCall var ImportDescPIMAGE_IMPORT_DESCRIPTOR FirstThunkPIMAGE_THUNK_DATA32 szDWORD
Copyright © 2008-2018