窗口程序集名 | 保 留 | 保 留 | 备 注 | Version劫持 | | | 变量名 | 类 型 | 数组 | 备 注 | dll | 整数型 | | GetFileVersionInfoA | 整数型 | | GetFileVersionInfoByHandle | 整数型 | | GetFileVersionInfoExW | 整数型 | | GetFileVersionInfoSizeA | 整数型 | | GetFileVersionInfoSizeExW | 整数型 | | GetFileVersionInfoSizeW | 整数型 | | GetFileVersionInfoW | 整数型 | | VerFindFileA | 整数型 | | VerFindFileW | 整数型 | | VerInstallFileA | 整数型 | | VerInstallFileW | 整数型 | | VerLanguageNameA | 整数型 | | VerLanguageNameW | 整数型 | | VerQueryValueA | 整数型 | | VerQueryValueW | 整数型 | |
如果真 (dll = 0 ) 初始化DLL () 信息框 (“劫持成功”, 0, , )返回 (0 ) |
Dll入口函数 | 逻辑型 | √ | |
DLL实例句柄 | 整数型 | | | | 调用类型 | 整数型 | | | | 保留 | 整数型 | | | |
判断 (调用类型 = 1 ) 返回 (初始化DLL ()) 判断 (调用类型 = 0 ) 释放DLL ()  返回 (真) 如果真 (dll ≠ 0 ) FreeLibrary (dll ) dll = LoadLibrary (读环境变量 (“SystemRoot”) + “\system32\version.dll”) 如果真 (dll = 0 ) 返回 (假) GetFileVersionInfoA = GetProcAddress (dll, “GetFileVersionInfoA”) 如果真 (GetFileVersionInfoA = 0 ) FreeLibrary (dll ) 返回 (假) GetFileVersionInfoByHandle = GetProcAddress (dll, “GetFileVersionInfoByHandle”) 如果真 (GetFileVersionInfoByHandle = 0 ) FreeLibrary (dll ) 返回 (假) GetFileVersionInfoExW = GetProcAddress (dll, “GetFileVersionInfoExW”) 如果真 (GetFileVersionInfoExW = 0 ) FreeLibrary (dll ) 返回 (假) GetFileVersionInfoSizeA = GetProcAddress (dll, “GetFileVersionInfoSizeA”) 如果真 (GetFileVersionInfoSizeA = 0 ) FreeLibrary (dll ) 返回 (假) GetFileVersionInfoSizeExW = GetProcAddress (dll, “GetFileVersionInfoSizeExW”) 如果真 (GetFileVersionInfoSizeExW = 0 ) FreeLibrary (dll ) 返回 (假) GetFileVersionInfoSizeW = GetProcAddress (dll, “GetFileVersionInfoSizeW”) 如果真 (GetFileVersionInfoSizeW = 0 ) FreeLibrary (dll ) 返回 (假) GetFileVersionInfoW = GetProcAddress (dll, “GetFileVersionInfoW”) 如果真 (GetFileVersionInfoW = 0 ) FreeLibrary (dll ) 返回 (假) VerFindFileA = GetProcAddress (dll, “VerFindFileA”) 如果真 (VerFindFileA = 0 ) FreeLibrary (dll ) 返回 (假) VerFindFileW = GetProcAddress (dll, “VerFindFileW”) 如果真 (VerFindFileW = 0 ) FreeLibrary (dll ) 返回 (假) VerInstallFileA = GetProcAddress (dll, “VerInstallFileA”) 如果真 (VerInstallFileA = 0 ) FreeLibrary (dll ) 返回 (假) VerInstallFileW = GetProcAddress (dll, “VerInstallFileW”) 如果真 (VerInstallFileW = 0 ) FreeLibrary (dll ) 返回 (假) VerLanguageNameA = GetProcAddress (dll, “VerLanguageNameA”) 如果真 (VerLanguageNameA = 0 ) FreeLibrary (dll ) 返回 (假) VerLanguageNameW = GetProcAddress (dll, “VerLanguageNameW”) 如果真 (VerLanguageNameW = 0 ) FreeLibrary (dll ) 返回 (假) VerQueryValueA = GetProcAddress (dll, “VerQueryValueA”) 如果真 (VerQueryValueA = 0 ) FreeLibrary (dll ) 返回 (假) VerQueryValueW = GetProcAddress (dll, “VerQueryValueW”) 如果真 (VerQueryValueW = 0 ) FreeLibrary (dll ) 返回 (假) 返回 (真)jmp = GetFileVersionInfoA 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })|
GetFileVersionInfoByHandle | | √ |
jmp = GetFileVersionInfoByHandle 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = GetFileVersionInfoExW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = GetFileVersionInfoSizeA 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })|
GetFileVersionInfoSizeExW | | √ |
jmp = GetFileVersionInfoSizeExW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = GetFileVersionInfoSizeW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = GetFileVersionInfoW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerFindFileA 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerFindFileW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerInstallFileA 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerInstallFileW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerLanguageNameA 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerLanguageNameW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerQueryValueA 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })jmp = VerQueryValueW 置入代码 ({ 201, 88, 139, 68, 36, 244, 91, 95, 94, 255, 224 })
|