CE7.5 新编译过一般检测

蒙娜丽莎

执行下面这个lua脚本即可

1. 
   
2. symbols = createSymbolList();
   
3. symbols.register();
   
4. 
   
5. function onOpenProcess(pid)
   
6. symbols.unregister();
   
7. symbols = createSymbolList();
   
8. symbols.register();
   
9. 
   
10. reinitializeSymbolhandler();
    
11. 
    
12. if (pid == 4) then
    
13. return;
    
14. end
    
15. 
    
16. local proc = dbk_getPEProcess(pid);
    
17. --printf("proc: %08X", proc);
    
18. 
    
19. local peb = readQword(proc + 0x550);
    
20. --printf("peb: %08X", peb);
    
21. 
    
22. local ldr = readQword(peb + 0x18);
    
23. --printf("ldr: %08X", ldr);
    
24. 
    
25. local index = readQword(ldr + 0x10);
    
26. --printf("index: %08X\\n", index);
    
27. 
    
28. while (index ~= ldr + 0x10) do
    
29. local mod = readQword(index);
    
30. --printf("mod: %08X", mod);
    
31. 
    
32. local name = readString(readQword(mod + 0x58 + 0x8), readSmallInteger(mod + 0x58), true);
    
33. --printf("name: %s", name);
    
34. 
    
35. local base = readQword(mod + 0x30);
    
36. --printf("base: %08X", base);
    
37. 
    
38. local size = readInteger(mod + 0x40);
    
39. --printf("size: %04X\\n", size);
    
40. 
    
41. symbols.addModule(name, "", base, size, true);
    
42. 
    
43. index = readQword(mod);
    
44. end
    
45. 
    
46. local name = readString(proc + 0x5A8, 15);
    
47. --print("name:", name);
    
48. 
    
49. local base = readQword(proc + 0x520);
    
50. --printf("base: %08X", base);
    
51. 
    
52. local size = readQword(proc + 0x498);
    
53. --printf("size: %04X", size);
    
54. 
    
55. symbols.addModule(name, "", base, size);
    
56. 
    
57. reinitializeSymbolhandler();
    
58. 
    
59. --print("finished!");
    
60. end
    

复制代码

链接：https://pan.baidu.com/s/1QM90y9CHrRwtvDVJZte26A?pwd=52pj
提取码：52pj