The third picture data clearly do not conform to the output table
I find a lot of DLL tried, the most of this appears to be a, but the data is impossible

CodePudding user response:

That is not to find the right place, see above, the export rva is 000 0459 f0 a6fcc you see below is obviously not right, although there are all kinds of address differences, but should be the same, at the end of this thing, also can't take the hexadecimal simple software such as UEdit32, either directly through exescope. Exe or use hiew32, because it often is not in the first quarter, internodes often have address is empty, address calculation is very trouble, in addition, download the Windows programming mysteries which Taiwan Hou Jie, that there is a detailed description of above,

CodePudding user response:

Reid look at, whether have encrypted compressed