¹ýÄêÔÚ¼ÒÎÞÊ¿É×ö£¬ÐÒºÃÓб¾¿´Ñ©ÀÏ´ó±àдµÄ¡¶¼ÓÃÜÓë½âÃÜ¡·ºÍ´ÓÍøÉÏϵġ¶Èí¼þÆƽ⹤¾ßÐÂÄê´óÀñ°ü2004¡·£¬¾Í°Ñ×Ô¼º¹ØÔÚÎÝÀïÍæÆðÁËÍÑ¿ÇÆƽ⡣ÔÚÖÚλ¸ßÊÖÎÄÕµÄÖ¸µãÏ£¬´Ó¼òµ¥µÄupx£¬Aspackµ½¸´ÔÓµÄTelock98¡¢Krypton¡¢Asprotect£¬¶¼Ç×ÊÖÍÑÁËһϣ¬¸øÎҵĸоõ¾ÍÊÇOllydbg¼òÖ±¾ÍÊÇΪÁËÍѿǽâÃܶø¿ª·¢µÄ£¬ÓÃËû¿ÉÇáËɶԸ¶ÕâЩ¼ÓÃÜ¿Ç¡£¸üÖ÷ÒªµÄÊÇ¿ÉÒÔ±ßÆƽ⣬±ßÌý¸è£¬Óöµ½²»Àí½âµÄµØ·½¿ÉÒÔ°ÑËû·ÅÒ»±ßÀ´¿´ÀÏ´óÃǵÄÎÄÕºͷÔÄMSDN¡£µ«ÊÇÔÚÓÃOllydbgÍÑarmadilloʱȴ½øÐв»ÏÂÈ¥ÁË¡£¹ØÓÚarmadillo¿ÇÒѾÓкܶàÎÄÕÂÔÚ½éÉÜËûµÄÔÀíÁË£¬´ó¼Ò¶¼ÖªµÀollydbgÊǵ÷ÓÃwindowsϵͳµÄµ÷ÊÔapi¹¤×÷ÔÚr3Éϵģ¬windowsϵͳֻÔÊÐíÒ»¸ö½ø³Ì±»Ò»¸öµ÷ÊÔÆ÷À´µ÷ÊÔ£¬¶øarmadillo×Ô¼ºÉú³É2¸ö½ø³Ì£¬¸¸½ø³Ì×öµ÷ÊÔÆ÷£¬×Ó½ø³Ì×ö±»µ÷ÊÔÕߣ¬¸¸½ø³Ì¸ºÔð¶Ô×Ó½ø³ÌµÄ´úÂë½øÐнâÂ룬¶ø¶ÔÍÑ¿ÇÀ´ËµºÜÖØÒªµÄIAT²¿·ÖÈ´ÊÇ×Ó½ø³Ì¸ºÔð½øÐнâÃܲ¢hook¡£OllydbgÏÖÔÚȴû°ì·¨attachÉÏ×Ó½ø³Ì¡£¼ÇµÃÓÐƪÎÄÕÂ˵ÓÃDebugActiveProcessStopÕâ¸öº¯Êý¿ÉÒÔʹµ÷ÊÔÆ÷ºÍ×Ó½ø³ÌÍÑÀ룬µ«Õâ¸öº¯ÊýÔÚxpºÍ.net serverµÄϵͳÉϲŵõ½Ö§³Ö£¬ÎÒÕą̂ÀϾɵÄk6/2 300µÄcpuÔËÐиöwin2000ÒѾÏÔµÃÓÐЩ³ÔÁ¦ÁË£¬¸ù±¾Ã»ÉÝÍûÓÃxpϵͳ¡£ÔÚ½ÓÏÂÀ´µÄʱ¼äÀïÎÒ²»¶ÏµÄ·ÔÄ×ÊÁϺ͵÷ÊÔarm¿Ç£¬ÖÕÓÚÕÒµ½Ò»¸öÓÃollydbgÐÞ¸´IATµÄ·½·¨£¬ËäÈ»Õâ¸ö·½·¨²¢²»ÍêÃÀ£¬µ«ÎÒÈ´ÓÃÕâ¸ö·½·¨ÇáËɵÄÍѵôÁ˺ü¸¸öarm¿Ç¡£ºÃÁË£¬ÂÞàÂÁËÕâô¶à£¬ÏÖÔÚÎÒÃÇ¿ªÊ¼ÊµÕ½°É¡£
Ä¿±ê³ÌÐò£º¾ÍÓÃarmadillo3.50a(public builder)×Ô¼º°É
¹¤¾ß£ºOLLYDBG 1.09d¡¢lordpe¡¢import REC v1.4.2+¡¢armadillo dumper 1.0£¨Ò»¸öС¹¤¾ß£©
ÒÔÉϹ¤¾ß¿ÉÒÔÔÚ2004ÐÂÄê´óÀñ°üºÍ¡¶¼ÓÃÜÓë½âÃÜ¡·µÄ¸½´ø¹âÅÌÀïÕÒµ½¡£
µÚÒ»²½£º²éÕÒOEP
²éÕÒOEP¿ÉÒÔ˵ºÍ±ðµÄ¼ÓÃܿDZÈÆðÀ´£¬armadilloµÄOEP²éÕÒ¿ÉÒÔ˵ÊÇ×î¼òµ¥µÄÁË¡£ÓÃlordpe²é¿´ÎÒÃǵÄÄ¿±ê³ÌÐò£¬¿ÉÒÔ¿´µ½ËûµÄ.text¡¢.rdata¡¢.data¶ÎµÄRoffsetºÍRsize¶¼ÎªÁ㣬ÕâЩ¶Î¶¼ÊÇδ¼Ó¿ÇʱԳÌÐòµÄÔËÐпռ䣬ÏÖÔÚÕâÀïµÄ´úÂë±»Íâ¿Ç¼ÓÃÜÆðÀ´·Å±ðµÄµØ·½²¢°ÑÕâÀïÇåÁãÁË¡£Íâ¿ÇÖ´ÐÐÍê×Ô¼ºµÄÈÎÎñÌøµ½OEPÖ´ÐÐÇ°£¬°ÑÕâЩÐèҪдÈë½âÃÜ´úÂëµØÖ·¿Õ¼äÉèÖÃÁËPAGE_GUARD(ÔÚwin2000Àï)ÊôÐÔ¡£¿ÉÒÔÏëÏóÌøתµ½OEPÖ´ÐÐʱ¿Ï¶¨ÏÈÒý·¢Ò»¸öÒì³££¬Íâ¿Ç£¨¸¸½ø³Ì£©²¶»ñÕâ¸öÒì³££¬È»ºóµ÷ÓÃVirtualProtectEx ÐÞ¸Ä0x1000ÄÚ´æ¶ÎÊôÐÔ£¬²¢ÓÃWriteProcessMemory дÈëÕâ¸öµØÖ·¿Õ¼ä0x1000´óСÒѽâÃܵÄÊý¾Ý¡£È»ºóµ÷ÓÃContinueDebugEvent£¬Ê¹ÓòÎÊýDBG_CONTINUEÈÃ×Ó³ÌÐòÔÚ³ö´íµÄµØ·½ÖØÐÂÔËÐС£µ±×Ó³ÌÐòÔËÐе½GUARDÊôÐԵĵØַʱ¾Í°´ÉÏÃæµÄ·½·¨½øÐнâÃÜ¡£½âÃÜÒ»¶¨µÄ¿éºó£¬¸¸½ø³Ì»á¸ù¾ÝһЩË㷨ÿ½âÃÜÒ»¸ö¿éºóÔÙÆÆ»µÁíÍâÒ»¸ö¿éµÄÊý¾Ý£¬²¢°ÑËüÖØÐÂÉèÖÃΪGUARDÊôÐÔ£¬Ò²¾ÍÊÇ˵ÈκÎʱºòÄÚ´æÀïҲûÓÐÍêÕûµÄÔ³ÌÐòÓ°Ïñ£¬Õâ¿É·ÀÖ¹lordpeÖ®ÀàµÄ¹¤¾ß°ÑËûdump³öÀ´¡£ÏÂÃæÊǾßÌåµÄ²éÕÒOEPµÄ²½Öè¡£
ÓÃOLLYDBGÔØÈëarmadillo.exe£¬»áÍ£ÔÚÈë¿Ú49A000´¦£¬¼ÇÏÂÈë¿Ú¿ªÊ¼¶þ×Ö½ÚµÄÄÚÈÝ£¨60,E8£©£¬»áÔÚºóÃæµÄdump²½ÖèÀïÃæÓõ½¡£ÔÚÃüÁî´°¿ÚÀï϶ϵ㣺bp WaitForDebugEvent¡£Armadillo»á¼ì²éÊÇ·ñ´æÔÚµ÷ÊÔÆ÷£¬ËùÒÔÎÒÃDZØÐëÒþ²ØÎÒÃǵÄollydbg£¨Óòå¼þ»òÏÂbp IsDebuggerPresentÃüÁ¡£ÔÚµ÷ÊÔÉèÖÃÀïºöÂÔµôµ¥²½Öжϣ¬È»ºóF9ÔËÐУ¬ÓÃSHIFT+F9Ìø¹ý2´ÎÒì³££¬»á¶ÏÔÚWaitForDebugEvent´¦£¬Õâʱ²é¿´¶ÑÕ»´°¿ÚµÄ²ÎÊý˵Ã÷£º
0012DAAC 004777F0 /CALL µ½ WaitForDebugEvent À´×Ô Armadill.004777EA
0012DAB0 0012EB60 |pDebugEvent = 0012EB60
0012DAB4 000003E8 \Timeout = 1000. ms
0012EB60´¦¾ÍÊÇ·¢Éúµ÷ÊÔʼþʱ¾ßÌåµÄÄÚÈÝ´æ·ÅµØÖ·£¬Ã¿´Îµ÷ÓÃWaitForDebugEventʱ¶¼»áʹÓÃÕâ¸öµØÖ·¡£ÎÒÃÇÔÚÊý¾Ý´°¿Ú´ò¿ªÕâ¸öµØÖ·£¬È¡ÏûWaitForDebugEvent¶Ïµã£¬ÔÙÏÂÒ»¸öеĶϵã bp WriteProcessMemory,°´F9¼ÌÐø¡£µÈ³ÌÐò¶ÏÔÚ¸ÕϵĶϵãʱ£¬ÏóÎÒÇ°Ãæ½âÊ͹ýµÄÄÇÑù£¬ÊÇÒòΪ×Ó³ÌÐòÖ´Ðе½ÁËOEP´¦·¢ÉúÒì³££¬¸¸½ø³Ìµ÷ÓÃWriteProcessMemoryÔÚÏò×Ó³ÌÐòOEPËùÔڵĿéд½âÃܹýµÄÊý¾Ý¡£²é¿´¶ÑÕ»´°¿Ú£º
0012D94C 0047B509 /CALL µ½ WriteProcessMemory À´×Ô Armadill.0047B503
0012D950 00000050 |hProcess = 00000050 (window)
0012D954 0043B000 |Address = 43B000 OEP¿Ï¶¨ÔÚ43B000¡ª43C000ÄÚ
0012D958 00B83250 |Buffer = 00B83250
0012D95C 00001000 |BytesToWrite = 1000 (4096.)
0012D960 0012DA68 \pBytesWritten = 0012DA68
ÎÒÃDz鿴Êý¾Ý´°¿Ú£¬Ò²¾ÍÊÇ´æ·Å¾ßÌåµ÷ÊÔÐÅÏ¢µÄ12EB60´¦£º
0012EB60 01 00 00 00 DebugEventCode 01±íʾEXCEPTION_DEBUG_EVENT
0012EB64 D8 05 00 00 ProcessId ·¢Éúµ÷ÊÔʼþµÄ½ø³Ìid
0012EB68 DC 05 00 00 ThreadId ·¢Éúµ÷ÊÔʱ¼äµÄÏß³Ìid
0012EB6C 01 00 00 80 ÒòΪ12eb60´¦Îª1£¬ËùÒÔÕâÀï´ú±íµÄÒâ˼ÊÇExceptionCode
0012EB70 00 00 00 00
0012EB74 00 00 00 00
0012EB78 B2 BE 43 00 ÕâÀï¾ÍÊÇÎÒÃÇÒªÕÒµÄOEP£¡£¡£¡£¡
¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£
ÏÖÔÚÎÒ½âÊÍÒ»ÏÂ12eb60´¦Êý¾ÝµÄÒâ˼£¬Õû¸öÊý¾Ý¿éÒÔÆ«ÒÆ0´¦µÄÊý¾Ý¾ö¶¨Õû¿éËù´ú±íµÄʼþ¡£Îª1ʱÊÇ·¢ÉúÁËÒì³££¬Î»2´ú±í´´½¨ÐÂÏß³Ìʼþ£¬Îª3´ú±í´´½¨Ð½ø³Ìʼþ¡£¡£¡£¡£¡£¡£µ±Îª1ʱ£¬ËµÃ÷·¢ÉúÁËÒì³££¬ÄÇôƫÒÆ0x0c´¦£¨12eb6c£©´ú±íµÄ¾ÍÊǾßÌåµÄÒì³£´úÂ룬ÔÚwinnt.hÀïÎÒ¿´µ½ÁËËûµÄ¶¨Ò壺
#define STATUS_GUARD_PAGE_VIOLATION ((DWORD )0x80000001L)
¿ÉÒÔ¿´µ½·¢ÉúÒì³£ÊÇÒòΪ´æÈ¡GUARDÊôÐÔµÄÄÚ´æÒ³£¬Æ«ÒÆ0x18(12eb78)ÊÇ·¢ÉúÒ쳣ʱµÄÖ¸ÁîµØÖ·£¬Ëû¾ÍÊÇÎÒÃÇÒªÕÒµÄOEPÀ²£¬ÏÖÔÚÖªµÀÎÒΪʲôarmadilloµÄOEP×îºÃ²éÕÒµÄÔÒòÁË°É£¡Èç¹ûÄãÏëÉîÈëµÄÁ˽âµ÷ÊÔapiºÍÓõ½µÄÊý¾Ý½á¹¹µÄ»°£¬½¨ÒéÄã¿´Ò»ÏÂPlatform SDK Documentation£¬ËûÀïÃæ½éÉܵıȽÏÏêϸ¡£
µÚ¶þ²½£º×¥È¡ÄÚ´æÓ³ÏñÎļþ
×îºÃÔÚOEP´¦×¥È¡ÄÚ´æÓ³ÏñÎļþ£¬Èç¹ûÈóÌÐòÔËÐÐÆðÀ´ÔÙץȡµÄ»°£¬³ÌÐòµÄÈ«¾Ö±äÁ¿ºÃ¶àÒѾ±»³ÌÐò×Ô¼ºÐÞ¸ÄÁË£¬ÕâÑùµÄ»°¼´Ê¹Íѿdzɹ¦£¬³ÌÐòÒ²²»¼ûµÃÄÜÁ¼ºÃµÄÔËÐС£ÄÇÎÒÃǾÍÔÚ×Ó³ÌÐòµÄOEP´¦Ð´¸öJMP EIPÖ¸ÁǰÃæÕÒOEPʱÎÒÃÇÖªµÀ×Ó³ÌÐòÒѾ±»¹ÒÆðÀ´ÁË£¬ÏÖÔÚ¸¸³ÌÐòÕý×¼±¸µ÷ÓÃдWriteProcessMemoryÏò×Ó³ÌÐòOEPËùÔڵĿéдÊý¾Ý£¬»º³åÇøµØÖ·ÊÇ00B83250£¬¼ÆËãOEPËùÔÚ×ֵĵØÖ·£º00B83250+(0043BEB2-0043B000)=00B84102¡£À´µ½00B84102´¦¿´µ½ÈëÏÂÊý¾Ý
00B84102 55 8B EC 6A FF 68 C8 55 44 00 68 14 BC 43 00 64 U‹ìjÿhÈUD.h ¼C.d
jmp eip¶ÔÓ¦µÄ¶þ½øÖÆΪ EB FE,ÄñʼÇÏ 55 8B£¨Õâ¸öÊý¾ÝÔÚÎÒÃÇDUMP³öÓ³Ïñʱ»¹Òª°ÑËûдÈëOEP´¦£©¡£°ÑËûÐÞ¸ÄΪEB FE¡£
00B84102 EB FE EC 6A FF 68 C8 55 44 00 68 14 BC 43 00 64 ëþìjÿhÈUD.h ¼C.d
ÏÖÔÚ°´F9ÔËÐУ¬ÕâʱCPUÕ¼ÓÃÂÊÂíÉϵ½ÁË100%£¬ÒòΪÎÒÃǵÄ×Ó³ÌÐò·´¸´µÄÔÚOEP´¦ÔËÐÐJMP EIPÕâÌõÖ¸ÁîÒýÆðµÄ¡£Èç¹ûÄã¸Ð¾õ»úÆ÷±»ÍϵÄÌ«ÂýµÄ»°¿ÉÒÔ½µµÍËûµÄÓÅÏȼ¶¡£×Ó³ÌÐòÊDZ»¹ÒÆðÀ´ÁË£¬µ«ÊÇÎÒÃÇÈ´²»ÄÜץȡÄÚ´æÓ³Ïñ¡£Ö»ÓÐOEPËùÔڵĿéÒѾ½âÃÜ¡£ÏÖÔÚÒª×öµÄ¾ÍÊÇÔËÐÐÒ»¶Î´úÂëɨÃèÒ»ÏÂ×Ó½ø³ÌGUARDÊôÐԵĵØÖ·¿Õ¼ä£¬ÒÔ´¥·¢µ÷ÊÔÆ÷¶ÔÆä½âÂë¡£ÎÒÓõÄÊÇÒ»¸öС¹¤¾ß£¬ÊÇÔÚ2004´º½Ú´óÀñ°üÀïÕÒµ½µÄ¡£Ãû×Ö½Ðarmadillo dumper 1.0¡£Èç¹ûÄã»á±à³Ì²¢ÇÒ·ÖÎöÉõÖÁÓÚ±àд¹ýÍâ¹Ò³ÌÐòµÄ»°£¬ÕâÑùµÄС¶«¶«¿ÉÒÔ×Ô¼ººÜÈÝÒ׵ıàдһ¸öŶ J¡£
ÏÖÔÚ´ò¿ªlordpe£¬ÔÚÎÒÃǵÄ×Ó½ø³ÌÉϵãÓÒ¼ü£¬Ñ¡ÔñDump Region £¬¿ÉÒÔ¿´µ½ÔÚµØÖ·00401000´¦ÓÐÒ»¿é´óСΪ3A000µÄ¿é±ê¼ÇΪGUARDÊôÐÔ¡£ÏÖÔÚÔËÐÐDUMPERС³ÌÐò£¬PIDÀïÃæÊäÈë×Ó½ø³ÌµÄPROCESSID¡£µãdump»áµ¯³öÁíÍâÒ»¸ö¶Ô»°¿ò£¬ÔÚdump startÀïÊäÈëµØÖ·ÀïÊäÈë0x401000,pags countÀïÊäÈëÒ³ÊýÄ¿0x3a000/1000=0x3a,µãdump°´Å¥£¬ollydbgÂíÉÏÖжÏÔÚWriteProcessMemory´¦£¬ÎÒÃÇÒ»±ß°´F9Ò»±ß¿´¶ÑÕ»´°¿Úµ÷ÓÃWriteProcessMemoryµÄ²ÎÊý£¬»á·¢ÏÖAddress²ÎÊýÒÔ0x1000µÄÔöÁ¿²»¶ÏÔö¼Ó¡£
0012D94C 0047B509 /CALL µ½ WriteProcessMemory À´×Ô Armadill.0047B503
0012D950 00000050 |hProcess = 00000050 (window)
0012D954 00401000 |Address = 401000 Õâ¸ö²ÎÊý²»¶Ï±ä»¯
0012D958 00B83250 |Buffer = 00B83250
0012D95C 00001000 |BytesToWrite = 1000 (4096.)
0012D960 0012DA68 \pBytesWritten = 0012DA68
°´nÏÂF9ºó£¬ÎÒÃÇ·¢ÏÖAddress ͻȻÌø»ØÁË401000´¦£¬ÒÔºóËæ×Å°´F9 Address²ÎÊý²»¶ÏµÄÔڸߵØÖ·ºÍµÍµØÖ·¿Õ¼äÀ´»ØÌø¡£Õâ¾ÍÊÇArmadilloÔڰѽâÃܹýµÄÊý¾ÝÖØмÓÃÜÆðÀ´£¬²¢ÇÒÔÚÕâ¸öµØÖ·¿Õ¼äÖØи³ÓèGUARDÊôÐÔ¡£¿´À´Ö»ÓаÑÕâ¸ö¼ÓÃܺ¯ÊýÕÒ³öÀ´£¬½ûÖ¹Armadillo¼ÓÃÜÒѾ½âÃܵÄÊý¾Ý¡£
ÎÒÃÇÔÙÏÂÒ»¸öеĶϵã: bp VirtualProtectEx£¬¼ÌÐø°´F9£¬µ±·¢ÏÖ²ÎÊýΪÏÂÃæʱֹͣ
0012D94C 0047B5C4 /CALL µ½ VirtualProtectEx À´×Ô Armadill.0047B5BE
0012D950 00000050 |hProcess = 00000050 (window)
0012D954 00406000 |Address = Armadill.00406000
0012D958 00001000 |Size = 1000 (4096.)
0012D95C 00000120 |NewProtect = PAGE_EXECUTE_READ|PAGE_GUARD
0012D960 0012DA58 \pOldProtect = 0012DA58
ÉÏÃæµÄ²ÎÊý˵Ã÷Íâ¿ÇÒѾÍê³ÉÁ˶ÔÊý¾ÝµÄ¼ÓÃÜ£¬²¢¶ÔµØÖ·406000£¬´óСΪ0x1000µÄ¿é²¢ÖØÐÂGUARDÆðÀ´¡£°´ALT+F9»Øµ½µ÷ÓÃVirtualProtectEx´¦£º
0047B5C4 85C0 TEST EAX,EAX
0047B5C6 75 0F JNZ SHORT Armadill.0047B5D7
0047B5C8 70 07 JO SHORT Armadill.0047B5D1
0047B5CA 7C 03 JL SHORT Armadill.0047B5CF
0047B5CC EB 05 JMP SHORT Armadill.0047B5D3
°´F8¸ú×Ù£¬ÏÂÃæÊÇÒ»¶Î»¨Ö¸Á¶à°´¼¸´ÎF8»áµ½ÏÂÃæµÄ´úÂ룺
0047B5FC 61 POPAD
0047B5FD B0 01 MOV AL,1
0047B5FF 5F POP EDI
0047B600 5E POP ESI
0047B601 5B POP EBX
0047B602 8BE5 MOV ESP,EBP
0047B604 5D POP EBP
0047B605 C3 RETN
Ö´ÐÐRETN¾Í»áµ½µ÷ÓÃÕâ¸öº¯ÊýµÄ´úÂë´¦£¬¶øÉÏÃæÕâ¸öCALLºÜ¿ÉÄÜÒ²¾ÍÊÇÎÒÃÇÒªÕҵļÓÃܺ¯Êý¡£
0047A42D 8B15 64044B00 MOV EDX,DWORD PTR DS:[4B0464]
0047A433 8D04B2 LEA EAX,DWORD PTR DS:[EDX+ESI*4]
0047A436 50 PUSH EAX
0047A437 8B0D 78044B00 MOV ECX,DWORD PTR DS:[4B0478]
0047A43D 8B15 7C044B00 MOV EDX,DWORD PTR DS:[4B047C]
0047A443 8B048A MOV EAX,DWORD PTR DS:[EDX+ECX*4]
0047A446 50 PUSH EAX
0047A447 E8 73000000 CALL Armadill.0047A4BF
0047A44C 83C4 0C ADD ESP,0C Ö´ÐÐRETNÎÒÃǵ½ÕâÀï
0047A44F 50 PUSH EAX
0047A450 F7D0 NOT EAX
0047A452 0FC8 BSWAP EAX
0047A454 58 POP EAX
0047A455 73 00 JNB SHORT Armadill.0047A457
0047A457 9C PUSHFD
0047A458 60 PUSHAD
0047A459 EB 2B JMP SHORT Armadill.0047A486
µØÖ·47a447´¦Ó¦¸Ã¾ÍÊÇÎÒÃÇÕҵĵ÷ÓüÓÃܺ¯ÊýµÄµØ·½¡£ÏÖÔÚÎÒÃÇÀ´ÐÞ¸ÄËûһϡ£Õâ¸öÊÇʹÓÃcµ÷Ó÷½Ê½£¬ËùÒÔÎÒÃDz»ÓùܶÑջƽºâ¡£¿ÉÄÜÒª¼ì²é·µ»ØÖµ£¬ËùÒÔÎÒÐ޸ijÉÏÂÃæµÄÑù×Ó£º
0047A43D 8B15 7C044B00 MOV EDX,DWORD PTR DS:[4B047C]
0047A443 8B048A MOV EAX,DWORD PTR DS:[EDX+ECX*4]
0047A446 50 PUSH EAX
0047A447 B8 01000000 MOV EAX,1 ʹ·µ»ØֵΪ1£¬ÆÛÆÏÂÃæµÄ´úÂë
0047A44C 83C4 0C ADD ESP,0C
0047A44F 50 PUSH EAX
0047A450 F7D0 NOT EAX
¹Ø±ÕOLLYDBG£¬ÖØÐÂÓÃÇ°ÃæµÄ·½·¨µ½OEP´¦£¬ÓÃDUMPERɨÃèGUARDµØÖ·¿Õ¼ä£¬µ±µÚÒ»´Î¶ÏÔÚWriteProcessMemoryʱÐ޸ĵØÖ·47A447µÄ´úÂëΪMOV EAX,1¡£È¡Ïû¶ÏµãÔËÐгÌÐò£¬ÓÃDUMPER°ÑËùÓеÄGUARD ¿Õ¼ä¶¼É¨Ãèһϣ¬ÕâʱÓÃlordpe¾Í¿ÉÒÔץȡӳÏñÎļþÁË¡£µ½ÕâÀïÎÒÃÇÒѾ´ò°ÜÁËcopymem-IIץȡÁËÓ³ÏñÎļþ¡£
×¢£º×îºÃÓÃlordpe£¬ÒòΪarmadilloÏóTELOCK98ÄÇÑùÐÞ¸ÄÁËÄÚ´æÖеÄÎļþÍ·£¬¶ølordpe¿ÉÒÔ¸ù¾Ý´ÅÅÌÉϵÄÎļþͷץȡӳÏñ¡£
µÚÈý²½£ºÖؽ¨ÊäÈë±í
ÓÃOLLYDBGÐÞIAT²¿·Öȷʵ°ÑÎÒ¸øÄÑסÁË£¬ÒòΪIATÊÇÔÚ×Ó³ÌÐòÖб»½âÃܵģ¬¶øÎÒÃǵÄOLLYDBGȴû°ì·¨µ÷ÊÔËû¡£Ã»°ì·¨£¬Ö»ºÃÂýÂý·ÖÎöÕâ¸ö¿Ç¹¤×÷¹ý³ÌÁË¡£ÎÒ·¢ÏÖ¸¸½ø³ÌÔÚ¿ªÊ¼µ÷ÊÔ×Ó½ø³Ìµ½×Ó½ø³ÌÔËÐе½OEP´¦£¬¸¸½ø³Ì¸ù±¾Ã»¸ÉÈŹý×Ó½ø³ÌµÄÔËÐС£ÏóWriteProcessMemory,SetThreadContext,SendMessage,µÈº¯Êý¸ù±¾Ã»µ÷Óùý¡£¶ÔÓÚµ÷ÊÔʼþͨ¹ýµ÷ÓÃContinueDebugEvent,²ÎÊýÓÃDBG_EXCEPTION_NOT_HANDLED»òDBG_CONTINUEÈÃ×Ó½ø³Ì×Ô¼º´¦ÀíÒì³£Çé¿ö¡£ÎҾͲúÉúÕâÑùµÄÏë·¨£º¿É²»¿ÉÒÔÈÃOLLYDBG¼ÓÔصĽø³ÌÈÏΪÒѾÓи¸½ø³Ì´æÔÚ£¬×Ô¼ºÓ¦¸Ã×ö×Ó½ø³Ì£¿ÎÒÃDz»ÐèÒªÕâ¸ö½ø³Ì¶àÍêÃÀ£¬Ö»ÒªËûÄܸøÎÒÃǽâ³öû¼ÓÃܵÄIAT¾Í¿ÉÒÔÁË¡£ÏÖÔھͿªÊ¼·ÖÎöËûÃǸ¸×ÓÖ®¼äµÄ¹ØϵÁË¡£ÕâÒ»·ÖÎö²Å·¢ÏÖ×Ô¼ºµÄ֪ʶÕæµÄºÜØÑ·¦£¬ÕæÓ¦ÁËÄǾ䣬Êéµ½ÓÃʱ·½ºÞÉÙ¡£ÓÖ°áÆðÁË¡¶WINDOWSºËÐıà³Ì¡·ÕⲿÎäѧÃؼ®±ßѧϰ±ßÑо¿¡£°ÑÕⲿÊéÓÖ·ÁËÒ»±é²Å·¢ÏÖÒÔÇ°ËäÈ»¿´¹ýÕâ²»Ê飬¶øÀïÃæµÄºÃ¶à¾«ËèȴûÏû»¯µô¡£ÏÖÔÚ¶ÔÕÕÕâ¸öarm¿Ç£¬ÖÕÓÚ¶ÔÀïÃæËù½²µÄ¸¸×Ó½ø³ÌÖ®¼ä£¬Ïß³ÌÖ®¼äµÄ¹Øϵ¡¢Í¨ÐÅ£¬Äں˶ÔÏ󣬾ä±úµÄ¼Ì³ÐÐÔµÈÓÐÁËÉî¿ÌµÄÌå»á¡£ºÇºÇ£¬ÓÖ˵ÁËÕâô¶à·Ï»°¡£ÏÖÔÚÎÒÃǼÌÐø˵arm¿Ç¡£·ÖÎö·¢ÏÖ£¬ÅжÏÊÇ·ñÓи¸½ø³Ì´æÔÚÊǸù¾ÝÒ»¸ö»¥³â¶ÔÏó¡£Arm¿Ç»áÏȳ¢ÊÔ´ò¿ªÕâ¸ö¶ÔÏó£¬Èç¹û³É¹¦£¬ÄÇô¾Í×Ô¼º×÷Ϊ×Ó³ÌÐòÀ´ÔËÐС£¶øÇÒ»¹²»½öÈç´Ë£¬¸¸½ø³Ì»»´´½¨ÁËÒ»¸ö¿É¼Ì³ÐµÄ¹²ÏíÄÚ´æ¿é¾ä±ú£¬²¢ÒÔ´ËÀ´ºÍ×Ó³ÌÐòͨÐÅ¡£
ÎÒÃÇÓÃollydbgÔØÈëarmadillo.exe,϶ϵã: bp CreateFileMappingA,bp SetEnvironmentVariableA,bp CreateProcessW, bp WriteProcessMemory,bp ResumeThread, bp DebugActiveProcessÔËÐгÌÐò¶ÏÏÂʱÈçÏ£º
0012DA9C 00476803 /CALL µ½ CreateFileMappingA À´×Ô Armadill.004767FD
0012DAA0 FFFFFFFF |hFile = FFFFFFFF
0012DAA4 0012F270 |pSecurity = 0012F270
0012DAA8 00000004 |Protection = PAGE_READWRITE
0012DAAC 00000000 |MaximumSizeHigh = 0
0012DAB0 00001000 |MaximumSizeLow = 1000
0012DAB4 00000000 \MapName = NULL
ÔÙ¿´pSecurityµØÖ·£º
0012F270 0C 00 00 00 00 00 00 00 01 00 00 00 D8 36 13 00 ........ ...? .
µÚ3¸ö²ÎÊýΪTRUE£¬ËµÃ÷CreateFileMappingA·µ»ØµÄ¾ä±ú¾ßÓм̳ÐÐÔ¡£
¼ÌÐøÔËÐлá¶ÏÔÚCreateEnvironmentVariableA:
0012DAAC 00476C9E /CALL µ½ SetEnvironmentVariableA À´×Ô Armadill.00476C98
0012DAB0 004AAB8C |VarName = "_RS"
0012DAB4 0012F27C \Value = "72"
¸¸½ø³Ì´´½¨ÁËÒ»¸ö»·¾³±äÁ¿"_RS"£¬ËûµÄÖµ¾ÍÊǸղŷµ»ØµÄ¾ä±úµÄÊ®½øÖƵıíʾ¡±72¡±¡£
0012DA8C 0047757C /CALL µ½ CreateProcessW À´×Ô Armadill.00477576
0012DA90 0012EE10 |ModuleFileName = "C:\Program Files\Armadillo\Armadillo.exe"
0012DA94 00020998 |CommandLine = ""C:\Program Files\Armadillo\Armadillo.exe""
0012DA98 00000000 |pProcessSecurity = NULL
0012DA9C 00000000 |pThreadSecurity = NULL
0012DAA0 00000001 |InheritHandles = TRUE //×¢ÒâÕâÀï
0012DAA4 00000004 |CreationFlags = CREATE_SUSPENDED //ÕâÀïʹ×Ó½ø³Ì¹ÒÆð
0012DAA8 00000000 |pEnvironment = NULL
0012DAAC 00000000 |CurrentDir = NULL
0012DAB0 0012EDCC |pStartupInfo = 0012EDCC
0012DAB4 0012F48C \pProcessInfo = 0012F48C
µ±µ÷ÓÃCreateProcessʱ£¬InheritHandlesʹÓÃÁËTRUE£¬Õâ±íÃ÷¸¸½ø³ÌÀïµÄ¿É¼Ì³Ð¾ä±ú×Ó½ø³Ì¶¼»áÓµÓÐÒ»¸ö¡£
0012D7AC 0047BA37 /CALL µ½ WriteProcessMemory À´×Ô Armadill.0047BA31
0012D7B0 00000050 |hProcess = 00000050 (window)
0012D7B4 0049A000 |Address = 49A000 Õâ²»¾ÍÊdzÌÐòµÄÈë¿ÚµØÖ·Âð£¿
0012D7B8 0012DA9C |Buffer = 0012DA9C È¥¿´¿´ËûÔÚÈë¿ÚдÁËʲô¶«¶«
0012D7BC 00000002 |BytesToWrite = 2
0012D7C0 0012DAA0 \pBytesWritten = 0012DAA0
¿´ÏÂÃæµÄÊý¾Ý¿ÉÖªµÀÔÚ³ÌÐòµÄÈë¿ÚдÏÂÁËjmp eipÖ¸Áî
0012DA9C EB FE 00 00 ëþ..
ÕâʱÔÙÈÃ×Ó½ø³Ì¿ªÊ¼ÔËÐУ¬×Ó½ø³ÌÒ²Ö»ÄÜÔÚÈë¿Ú´¦´òת£¬È´Åܲ»µ½ÄÇÀïÈ¥ÁË¡£
0012D7D4 0047BAD9 /CALL µ½ ResumeThread À´×Ô Armadill.0047BAD3
0012D7D8 00000054 \hThread = 00000054 (window)
¿ªÊ¼´óÄ£´óÑùµÄµ÷ÊÔ×Ó½ø³ÌÁË¡£
0012DAB0 00477664 /CALL µ½ DebugActiveProcess À´×Ô Armadill.0047765E
0012DAB4 000007C4 \ProcessId = 7C4
ÐÞ¸´Èë¿Ú´¦×Ö
0012D7AC 0047BA5F /CALL µ½ WriteProcessMemory À´×Ô Armadill.0047BA59
0012D7B0 00000050 |hProcess = 00000050 (window)
0012D7B4 0049A000 |Address = 49A000
0012D7B8 004B0440 |Buffer = Armadill.004B0440
0012D7BC 00000002 |BytesToWrite = 2
0012D7C0 0012DAA0 \pBytesWritten = 0012DAA0
µ½ÕâÀïÄãÊÇ·ñÏëµ½ÁËʲô£¿ºÙºÙ£¬Èç¹ûÎÒÃÇÈø¸½ø³Ì¶ÏÔÚ12DAB0´¦£¬ÎÒÃÇÔÙ´ò¿ªÒ»¸öollydbg²»¾Í¿ÉÒÔ¸½¼Ó½ø×Ó½ø³ÌÁËÂ𣿶øÇÒ´ÓÕâÀïÇÐÈëµÄ»°¿ÉÒÔÈÃÎÒÃÇÊ¡Ï´´½¨¹²ÏíÄڴ棬³õʼ»¯Äڴ棬ÉèÖÃеĻ·¾³±äÁ¿µÈËöËéÊÂÇé¡£
OK£¬ÈÃÎÒÃÇÖØпªÊ¼£¬Õâ´ÎÖ»ÏÂÒ»¸ö¶Ïµã bp DebugActiveProcess£¬¶ÏÏÂʱ¶ÑÕ»´°¿ÚÊÇ£º
0012DAB0 00477664 /CALL µ½ DebugActiveProcess À´×Ô Armadill.0047765E
0012DAB4 000002B4 \ProcessId = 2B4
˵Ã÷×Ó½ø³ÌidΪ0x2b4,´ò¿ªÒ»¸öollydbg³ÌÐò£¬¸½¼Ó½øÕâ¸ö½ø³Ì£¬OK£¬³É¹¦ÁË¡£
°´ALT+F9»áÀ´µ½Èë¿Ú´¦£º
0049A000 >- EB FE JMP SHORT Armadill.
0049A002 0000 ADD BYTE PTR DS:[EAX],AL
0049A004 0000 ADD BYTE PTR DS:[EAX],AL
×Ó³ÌÐò»¹ÔÚÈë¿Ú´¦´òתÄØ¡£ÎÒÃÇÇ°Ãæ¼Ç¹ýÕâ¸öÖµ£¬ÏÖÔÚ°ÑËû¸Ä»ØÀ´¡£
0049A000 > 60 PUSHAD
0049A001 E8 00000000 CALL Armadill.0049A006
0049A006 5D POP EBP
0049A007 50 PUSH EAX
0049A008 51 PUSH ECX
0049A009 EB 0F JMP SHORT Armadill.0049A01A
´Ëʱ¸¸½ø³Ì»¹Ã»Éú³ÉÄĸöÒªÃüµÄ»¥³â¶ÔÏó£¬ËùÒÔÔÚÕâÀïÎÒÃÇÈÎÓÉËûÔËÐÐÏÂÈ¥µÄËû»¹»áÔÙ²úÉúÒ»¸ö×Ó½ø³Ì¡£ËùÒÔÎÒÃDZØÐëÏÂÒ»¸ö¶Ïµã: bp OpenMutexA¡£Õâʱºò²»ÐèÒªÒþ²ØÎÒÃǵĵ÷ÊÔÆ÷ÁË£¬×Ó³ÌÐò²»»á¼ì²âÓû§Ä£Ê½µ÷ÊÔÆ÷ÊÇ·ñ´æÔÚ£¬ÒòΪËû¾Í¹¤×÷ÔÚ±»µ÷ÊԵĻ·¾³Àï¡£
0012F574 0046F043 /CALL µ½ OpenMutexA À´×Ô Armadill.0046F03D
0012F578 001F0001 |Access = 1F0001
0012F57C 00000000 |Inheritable = FALSE
0012F580 0012FBB4 \MutexName = "2B4::DABB778916"
¿´µ½ÁËÂð£¿Ëû³¢ÊÔ´ò¿ªÒ»¸öÃûΪ2B4::DABB778916µÄ»¥³â¶ÔÏ󡣿´µ½Õâ¸ö¶ÔÏóÃûÓÐʲôÌرðµÄµØ·½ÁËÂð£¿2B4²»¾ÍÕýÊÇÕâ¸ö×Ó½ø³ÌµÄidÂð£¿ËûÕâÑù×ö¾Í¿ÉÒÔ±£Ö¤Ò»¸öÊÂÀýµÄ¶à¸öʵÏÖ¶ø²»»¥Ïà¸ÉÈÅ¡£ÏÖÔÚÎÒÃDZØÐ뽨Õâ¸ö¶ÔÏó£¬ÎÒÑ¡ÔñÁËÔÚ401000´¦ÊäÈëÈçÏ´úÂ룺
00401000 60 PUSHAD
00401001 9C PUSHFD
00401002 68 B4FB1200 PUSH 12FBB4 ASCII "2B4::DABB778916"
00401007 33C0 XOR EAX,EAX
00401009 50 PUSH EAX
0040100A 50 PUSH EAX
0040100B E8 E694A677 CALL KERNEL32.CreateMutexA
00401010 9D POPFD
00401011 61 POPAD
00401012 - E9 8F9FA777 JMP KERNEL32.OpenMutexA
ÔÚ401000´¦µãÓÒ¼üÑ¡Ôñн¨ÆðÔ´£¬È»ºóF9ÔËÐУ¬ÓÖ¶ÏÔÚOpenMutexA´¦¡£ALT+F9·µ»Øµ½µ÷Óô¦£¬Õâʱ²é¿´CPU´°¿Ú£º
ERROR_SUCCESS (00000000)
˵Ã÷ÎÒÃǸղŵĴúÂëÆðÁË×÷Óá£ÏÖÔÚ×îºÃ°Ñ¸Õ²ÅµÄ´úÂëÇåÁ㣬ÎÒÈÏΪÕâÊǸöºÃÏ°¹ß:)
ÏÖÔÚËûÒѾ¹Ô¹ÔµÄ°Ñ×Ô¼ºµ±³É×Ó³ÌÐòÀ´ÔËÐÐÁË¡£ÖÁÓÚËûÔõô½âÃÜIATµ±È»Ò²¾ÍÌÓ²»¹ýollydbgÑÛ¾¦ÁË¡£
ÔÚÊý¾Ý´°¿ÚÀï°´CTRL+G,ÊäÈëIATµÄµØÖ·444000,¼ÌÐøÔËÐгÌÐò£¬´óÔ¼ÔÚµÚ15´ÎÒì³£ºóÎÒÃÇ·¢ÏÖIAT±»Ð´ÈëÁËÊý¾Ý¡£
00444000 4A 78 04 00 5E 78 04 00 70 78 04 00 82 78 04 00 Jx .^x .px .‚x .
00444010 B6 78 04 00 A4 78 04 00 94 78 04 00 3C 78 04 00 ¶x .¤x .”x .br> 00444020 00 00 00 00 74 6E 04 00 5C 6E 04 00 8C 6E 04 00 ....tn .\n .Œn .
00444030 11 00 00 80 00 00 00 00 56 77 04 00 62 77 04 00 ..€....Vw .bw .
00444040 6E 77 04 00 42 77 04 00 8E 77 04 00 A0 77 04 00 nw .Bw .Žw ._w .
¡£¡£¡£¡£¡£¡£
ÊDz»ÊǺÜÑÛÊ죿armadilloËäÈ»»¹ÔÁËIAT±í£¬µ«ÊÇËûÃÇÖ¸ÏòµÄµØÖ·È´ÒѾ±»ÇåÁã¡£ËùÒÔÕâЩÊý¾ÝÒ²¶¼ÊÇÒ²À¬»ø~~~¡£ÕâЩÊý¾Ý¸øÎÒÃǵÄ×÷ÓÃÖ»ÊÇÄܾ«È·µÄ¶¨Î»IATµÄµØÖ·ºÍ´óС¶øÒÑ¡£
ÏÖÔÚÔÚ444000ÏÂÄÚ´æд¶Ïµã¡£ÒÔÕÒµ½ÐÞ¸ÄIAT±íµÄÖ¸ÁîµØÖ·£¬ÔÙ¾¹ý¼¸´ÎÒì³££¬ÖжÏÔÚÕâÀ
00EDFB31 8908 MOV DWORD PTR DS:[EAX],ECX
00EDFB33 8B85 24E9FFFF MOV EAX,DWORD PTR SS:[EBP-16DC] Armadill.00444000
00EDFB39 83C0 04 ADD EAX,4
°´¼¸´ÎF8£¬»áÀ´µ½ÕâÀ
00EDF7BF 6A 01 PUSH 1
00EDF7C1 58 POP EAX Armadill.00444004
00EDF7C2 85C0 TEST EAX,EAX
00EDF7C4 0F84 7D030000 JE 00EDFB47
00EDF7CA 66:83A5 08E7FFF>AND WORD PTR SS:[EBP-18F8],0
00EDF7D2 83A5 00E7FFFF 0>AND DWORD PTR SS:[EBP-1900],0
00EDF7D9 83A5 04E7FFFF 0>AND DWORD PTR SS:[EBP-18FC],0
00EDF7E0 8B85 88ECFFFF MOV EAX,DWORD PTR SS:[EBP-1378]
00EDF7E6 0FBE00 MOVSX EAX,BYTE PTR DS:[EAX]
00EDF7E9 85C0 TEST EAX,EAX
00EDF7EB 0F85 0C010000 JNZ 00EDF8FD
00EDF7F1 C785 B0E6FFFF D>MOV DWORD PTR SS:[EBP-1950],0EC78DF
00EDF7FB C785 B4E6FFFF 9>MOV DWORD PTR SS:[EBP-194C],0EC7994
00EDF805 C785 B8E6FFFF 0>MOV DWORD PTR SS:[EBP-1948],0EC7906
00EDF80F C785 BCE6FFFF 1>MOV DWORD PTR SS:[EBP-1944],0EC7919
00EDF819 C785 C0E6FFFF 5>MOV DWORD PTR SS:[EBP-1940],0EC7957
00EDF823 C785 C4E6FFFF 5>MOV DWORD PTR SS:[EBP-193C],0EC795C
00EDF82D C785 C8E6FFFF 6>MOV DWORD PTR SS:[EBP-1938],0EC7961
00EDF837 C785 CCE6FFFF 6>MOV DWORD PTR SS:[EBP-1934],0EC7966
00EDF841 C785 D0E6FFFF C>MOV DWORD PTR SS:[EBP-1930],0EC79C6
00EDF84B C785 D4E6FFFF 8>MOV DWORD PTR SS:[EBP-192C],0EC798D
00EDF855 C785 D8E6FFFF D>MOV DWORD PTR SS:[EBP-1928],0EC78DF
00EDF85F C785 DCE6FFFF 9>MOV DWORD PTR SS:[EBP-1924],0EC7994
00EDF869 C785 E0E6FFFF 0>MOV DWORD PTR SS:[EBP-1920],0EC7906
00EDF873 C785 E4E6FFFF 1>MOV DWORD PTR SS:[EBP-191C],0EC7919
00EDF87D C785 E8E6FFFF B>MOV DWORD PTR SS:[EBP-1918],0EC79B7
00EDF887 C785 ECE6FFFF B>MOV DWORD PTR SS:[EBP-1914],0EC79BC
00EDF891 C785 F0E6FFFF C>MOV DWORD PTR SS:[EBP-1910],0EC79C1
00EDF89B C785 F4E6FFFF 6>MOV DWORD PTR SS:[EBP-190C],0EC7966
00EDF8A5 C785 F8E6FFFF C>MOV DWORD PTR SS:[EBP-1908],0EC79C6
¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£¡£
ÕâÒ»¶Î´úÂë¾ÍÊǽâÃÜIAT²¢HOOKµÄ³ÌÐò¶Î¡£
Òª·ÀÖ¹±»IAT±»ÆÆ»µºÍ¼ÓÃܵÄÖ¸ÁîµØÖ·ÊÇ£º
00EDF8DA 8908 MOV DWORD PTR DS:[EAX],ECX
Ìø¹ýÉÏÃæµÄµØÖ·¿ÉÒÔ·ÀÖ¹À¬»øÊý¾ÝдÈëIAT±í£¬
00EDFA23 /75 11 JNZ SHORT 00EDFA36
ÉÏÃæµÄµØÖ·¸ÄΪJMP¿ÉÒÔ·ÀÖ¹api±»hook¡£
¿´ËûÃǵĵØÖ·ÎÒÃǾͿÉÒÔÖªµÀÕâЩ´úÂëÊǶ¯Ì¬Éú³ÉµÄ£¬ÎªÁËÇÀÔÚÖ´ÐÐÕâЩ´úÂëÇ°¿ØÖÆËûÃÇ£¬ÎÒÃÇÖØÐÂÔËÐгÌÐò£¬ÔÚµÚ15´ÎÒì³£ºóÔÚ00EDFA23´¦ÏÂÄÚ´æд¶Ïµã¡£²¢ÐÞ¸ÄJNZΪJMP£¬NOPµô00EDF8DAµÄÖ¸ÁÕâÑùÎÒÃǾͿÉÒԵõ½Ò»¸öÍêÕûµÄ£¬Î´¼ÓÃܵÄIAT±íÁË¡£ÔËÐÐimportREC£¬Ö±½ÓÌíÈëIATµÄλÖúʹóС¾Í¿ÉÒÔÓÃËûÐÞ¸´ÎÒÃǵÄÇ°ÃæDUMP³öµÄÎļþÁË¡£ÓÃfi²éһϣ¬ÊÇÓÃvc±àдµÄ¡£
ÎÒÓÃÕâ¸ö·½·¨ÍÑÁ˼¸¸öarmadillo3.50a¿Çʱ£¬¶¼ºÜ³É¹¦¡£µ«ÊÇÔÚÍѼӿǵļÇʱ¾µÈwindowsϵͳËù´øÎļþʱ£¬È´µÃ²»µ½ÕýÈ·µÄIAT :)¡£Õâ˵Ã÷ÎÒÕâ¸ö·½·¨²»ÍêÃÀ£¬»òÐíÎÒºöÂÔÁËʲô¶«Î÷£¬ÉõÖÁÓÚÕâ¸ö·½·¨¸ù±¾¾ÍÊÇ´íÎóµÄ¡£Ö®ËùÒԳɹ¦Ö»²»¹ýÊÇÔËÆøºÃ£¬Ï¹Ã¨ÅöןöËÀºÄ×Ó¡£Èç¹ûÄÇλ¸ßÈËÖªµÀÎÒ´íÔÚʲôµØ·½£¬»¶ÓÀ´ÐŸæËßÎÒ°¡£¬ÎÒµÄÐÅÏäÊÇ£ºmysqladm@yahoo.com£¬±¾È˸м¤²»¾¡¡£½âIAT²¿·ÖÓÃÉÏÃæµÄ·½·¨²»ÐеĻ°¾ÍÖ»ºÃÓÃSOFTICE¡¢TRWµÈϵͳ¼¶µÄµ÷ÊÔ¹¤¾ßÁË¡£
×îºó˵Ã÷һϣ¬ÉÏÃæÍѳöµÄÎļþ»¹²»ÄÜÔËÐУ¬¸ú×ÙһϻᷢÏÖ£¬Ëû»¹µ÷ÓÃÁËÍâ¿ÇÌṩµÄ½Ó¿Ú¡£ÕâÖÖÇé¿ö¶ÔÎÒÕâ¸ö³õͨ´ÎµÀµÄ²ËÄñ¾Í²»ÖªµÀÔõô°ìÁË£¬Ï£Íûijλ´óÏÀ³öÃæд¸öÕâ·½ÃæµÄÎÄÕÂÈÃÎÒÃÇ¿ª¿ªÑ۽硣
ÎҺܾÃûд¹ý¶«Î÷ÁË£¬Õâ¸öÌû×Ó»¨ÁËÎҺó¤Ê±¼ä²ÅÍê³É£¬¶øÇҸоõ×Ô¼ººÜ¶àÏëҪ˵µÄ¶«Î÷¶¼Ã»±í´ï³öÀ´¡£ÍÑÕâ¸ö¿Ç¸øÎÒ×î´óµÄºÃ´¦¾ÍÊǸü¼ÓÁ˽âwindowsϵͳ£¬ÕâÒ²ÕýÊÇÎÒѧÍѿǵÄÔÒò ^_^¡£¹ØÓÚarmadillo¿ÇµÄÎÄÕºܶ࣬ÎÒÒ²¼Ç²»ÇåÕâЩ¸ßÈ˵ÄÃû×ÖÁË£¬ÔÚ´ËÖÔÐĸÐлËûÃǵÄÖ¸µã¡£
Mysqladm
2004.3.3