讓偵測工具把殼識(shí)別為VC++

<BR>&nbsp;&nbsp;&nbsp;&nbsp;一時(shí)找不到好的例子程序,向朋友要了一個(gè)易語言編譯的窗口空程序演示一下-_-! <BR>&nbsp;&nbsp;&nbsp;&nbsp;目標(biāo)文件:Target.exe <BR>&nbsp;&nbsp;&nbsp;&nbsp;加個(gè)殼:SVKP&nbsp;1.3x&nbsp;-&gt;&nbsp;Pavol&nbsp;Cerven[注:Cracked],PEiD正確識(shí)別出來了.記下入口點(diǎn):5000 <BR>&nbsp;&nbsp;&nbsp;&nbsp;用ToPo增加大約128字節(jié)的空間[注:個(gè)人愛好而定],進(jìn)入LordPE的PE&nbsp;Editor,打開Target.exe, <BR>把.topo0段名改為.text,裝的更像一點(diǎn)[注:也可以個(gè)性一點(diǎn)改成自己的大名,不影響結(jié)果] <BR>&nbsp;&nbsp;&nbsp;&nbsp;記下VOffset:13000,把入口點(diǎn)改為這個(gè)值.OllyDbg載入Target.exe,轟~我們來到了一個(gè)異常, <BR>向上拉動(dòng)滾動(dòng)條,來到413000處改寫代碼: <BR>;---------------------------------------------------------------- <BR>;偽造VC++入口代碼特征 <BR>;assume&nbsp;&nbsp;fs:nothing <BR>push&nbsp;ebp <BR>mov&nbsp;ebp,esp <BR>push&nbsp;-1 <BR>push&nbsp;666666 <BR>push&nbsp;888888 <BR>mov&nbsp;eax,fs:[0] <BR>push&nbsp;eax <BR>mov&nbsp;fs:[0],esp <BR>;下邊再恢復(fù) <BR>pop&nbsp;eax <BR>mov&nbsp;fs:[0],eax <BR>pop&nbsp;eax <BR>pop&nbsp;eax <BR>pop&nbsp;eax <BR>pop&nbsp;eax <BR>mov&nbsp;ebp,eax <BR>;---------------------------------------------------------------- <BR>&nbsp;&nbsp;&nbsp;&nbsp;別忘了jmp&nbsp;405000,也就是殼的入口點(diǎn).選中修改過的代碼按右鍵,把它保存為newTarget.exe. <BR>PEiD偵測一下:Microsoft&nbsp;Visual&nbsp;C++,并且運(yùn)行正常,任務(wù)完成. <BR>&nbsp;&nbsp;&nbsp;&nbsp;感謝您耐心閱讀到這里.