iat.txt

一个简单的加壳CrackMe的破解,体现了破解一般做法,查询加壳类型,脱壳,分析,写出注册机.

; Syntax for each function in a thunk (the separator is a TAB)
; ------------------------------------------------------------
; Flag   RVA   ModuleName   Ordinal   Name
;
; Details for <Valid> parameter:
; ------------------------------
; Flag:  0 = valid: no  -> - Name contains the address of the redirected API (you can set
;                            it to zero if you edit it).
;                          - Ordinal is not considered but you should let '0000' as value.
;                          - ModuleName is not considered but you should let '?' as value.
;
;        1 = valid: yes -> All next parameters on the line will be considered.
;                          Function imported by ordinal must have no name (the 4th TAB must
;                                                                          be there though).
;
;        2 = Equivalent to 0 but it is for the loader.
;
;        3 = Equivalent to 1 but it is for the loader.
;
;        4 = Equivalent to 0 with (R) tag.
;
;        5 = Equivalent to 1 with (R) tag.
;
; And finally, edit this file as your own risk! :-)

Target: C:\Documents and Settings\Fire\桌面\14\tsrh-crackme.exe
OEP: 00001000	IATRVA: 00001FFC	IATSize: 00000040

FThunk: 00002000	NbFunc: 00000005
1	00002000	kernel32.dll	00B7	ExitProcess
1	00002004	kernel32.dll	03B3	lstrlen
1	00002008	kernel32.dll	0176	GetModuleHandleA
1	0000200C	kernel32.dll	0169	GetLastError
1	00002010	kernel32.dll	005D	CreateMutexA

FThunk: 00002018	NbFunc: 00000001
1	00002018	shell32.dll	0167	ShellExecuteA

FThunk: 00002020	NbFunc: 00000006
1	00002020	user32.dll	0254	SetDlgItemTextA
1	00002024	user32.dll	01DD	MessageBoxA
1	00002028	user32.dll	0114	GetDlgItemTextA
1	0000202C	user32.dll	00C7	EndDialog
1	00002030	user32.dll	009F	DialogBoxParamA
1	00002034	user32.dll	02D9	wsprintfA