{"id":1293,"date":"2018-12-11T16:37:45","date_gmt":"2018-12-11T08:37:45","guid":{"rendered":"http:\/\/www.th-sjy.com\/?p=1293"},"modified":"2018-12-11T16:37:38","modified_gmt":"2018-12-11T08:37:38","slug":"%e4%b8%93%e4%b8%9a-pe-%e8%b5%84%e6%ba%90%e7%ae%a1%e7%90%86%e5%99%a8ppee1-08%e6%b1%89%e5%8c%96%e5%8d%95%e6%96%87%e4%bb%b6%e7%bb%bf%e8%89%b2%e7%89%88","status":"publish","type":"post","link":"http:\/\/www.th-sjy.com\/?p=1293","title":{"rendered":"\u4e13\u4e1aPE\u8d44\u6e90\u7ba1\u7406\u5668(PPEE)1.12\u6c49\u5316\u5355\u6587\u4ef6\u7248"},"content":{"rendered":"

PPEE<\/strong>\uff08\u5c0f\u72d7\uff09\u662f\u4e00\u4e2a\u4e13\u4e1a\u7684 PE \u6587\u4ef6\u8d44\u6e90\u7ba1\u7406\u5668\uff0c\u53ef\u7528\u4e8e\u9006\u5411\u5de5\u7a0b\u3001\u6076\u610f\u8f6f\u4ef6\u7814\u7a76\u548c\u9759\u6001\u68c0\u67e5 PE \u6587\u4ef6\u8be6\u7ec6\u4fe1\u606f\u7684\u4eba\u5458\u3002<\/p>\n

PPEE \u662f\u4e00\u53ea\u514d\u8d39\u3001\u5c0f\u5de7\u3001\u5feb\u901f\u3001\u7075\u6d3b\u548c\u53cb\u597d\u7684\u5c0f\u72d7\uff01<\/p>\n

\u6709\u5f88\u591a\u5de5\u5177\u53ef\u7528\u4e8e\u9759\u6001\u5206\u6790\u6076\u610f\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u4f46\u5b83\u4eec\u53ea\u662f\u666e\u901a\u7684\u6587\u4ef6\u5de5\u5177\u3002\u5c0f\u72d7\u662f\u4e00\u6b3e\u8f7b\u91cf\u7ea7\u3001\u5f3a\u5927\u7684\u9759\u6001\u53ef\u7591\u6587\u4ef6\u68c0\u67e5\u5de5\u5177\uff0c\u5185\u90e8\u81ea\u5e26\u4e00\u4e2a\u6587\u4ef6\u4fe1\u606f\u63d2\u4ef6\uff0c\u53ef\u5728\u77e5\u540d\u7684\u6076\u610f\u8f6f\u4ef6\u5b58\u50a8\u5e93\u4e2d\u4e00\u952e\u67e5\u8be2\u5927\u5c0f\u3001\u71b5\u3001\u5c5e\u6027\u3001\u54c8\u5e0c\u503c\u3001\u7248\u672c\u4fe1\u606f\u7b49\u6280\u672f\u4fe1\u606f\u3002<\/p>\n

\u7279\u5f81\uff1a<\/strong>
\n\u5c0f\u72d7\u5bf9\u4e8e\u7578\u5f62\u548c\u7279\u522b\u5236\u4f5c\u7684 PE \u6587\u4ef6\u662f\u5f3a\u5927\u7684\uff0c\u8fd9\u5bf9\u4e8e\u9006\u5411\u5de5\u7a0b\u3001\u6076\u610f\u8f6f\u4ef6\u7814\u7a76\u548c\u9759\u6001\u68c0\u67e5 PE \u6587\u4ef6\u8be6\u7ec6\u4fe1\u606f\u7684\u4eba\u5458\u6765\u8bf4\u975e\u5e38\u65b9\u4fbf\u3002\u652f\u6301\u5305\u62ec\u5bfc\u5165\u3001\u8d44\u6e90\u3001\u5f02\u5e38\u3001\u8bc1\u4e66\uff08\u4f9d\u8d56\u4e8e Windows API\uff09\u3001\u57fa\u5740\u91cd\u5b9a\u4f4d\u3001\u8c03\u8bd5\u3001TLS\u3001\u52a0\u8f7d\u914d\u7f6e\u3001\u7ed1\u5b9a\u5bfc\u5165\u3001IAT\u3001\u5ef6\u8fdf\u5bfc\u5165\u548c\u6e05\u7406 PE \u6587\u4ef6\u4e2d\u7684\u6240\u6709\u76ee\u5f55\u3002<\/p>\n

– \u652f\u6301 PE32 \u548c PE64
\n– Virustotal \u548c OPSWAT \u7684 Metadefender \u67e5\u8be2\u62a5\u544a
\n– \u9759\u6001\u5206\u6790 windows \u672c\u5730\u548c .Net \u53ef\u6267\u884c\u6587\u4ef6
\n– \u5f3a\u5927\u7684 exe\u3001dll\u3001sys\u3001scr\u3001drv\u3001cpl\u3001ocx \u7b49\u89e3\u6790
\n– \u7f16\u8f91\u51e0\u4e4e\u6bcf\u4e2a\u6570\u636e\u7ed3\u6784
\n– \u8f7b\u677e\u5730\u8f6c\u50a8\u533a\u6bb5\u3001\u8d44\u6e90\u548c .Net \u7a0b\u5e8f\u96c6\u76ee\u5f55
\n– \u533a\u6bb5\u71b5\u548c MD5 \u8ba1\u7b97\u4ee5\u53ca\u8d44\u6e90\u9879\u76ee
\n– \u67e5\u770b\u5d4c\u5165\u5230\u6587\u4ef6\u4e2d\u5b57\u7b26\u4e32\uff0c\u5305\u62ec\u7f51\u5740\u3001\u6ce8\u518c\u8868\u548c\u53ef\u7591\u4e4b\u5904\u7b49
\n– \u63d0\u53d6\u5185\u5bb9\u4fdd\u7559\u5728 PE \u6587\u4ef6\u4e2d
\n– \u5f02\u5e38\u68c0\u6d4b
\n– \u53f3\u952e\u70b9\u51fb\u590d\u5236\u3001\u5728\u7f51\u7edc\u4e2d\u641c\u7d22\u3001Whois \u548c\u8f6c\u50a8
\n– \u5185\u7f6e\u5341\u516d\u8fdb\u5236\u7f16\u8f91\u5668
\n– Windows \u8d44\u6e90\u7ba1\u7406\u5668\u4e0a\u4e0b\u6587\u83dc\u5355\u96c6\u6210
\n– \u6570\u636e\u6784\u4ef6\u7684\u63cf\u8ff0\u6027\u4fe1\u606f
\n– \u5237\u65b0\u3001\u4fdd\u5b58\u548c\u53e6\u5b58\u4e3a\u83dc\u5355\u547d\u4ee4
\n– \u62d6\u653e\u652f\u6301
\n– \u5217\u8868\u67e5\u770b\u5217\u53ef\u4ee5\u4ee5\u9002\u5f53\u7684\u65b9\u5f0f\u5bf9\u6570\u636e\u8fdb\u884c\u6392\u5e8f
\n– \u4ece\u547d\u4ee4\u884c\u6253\u5f00\u6587\u4ef6
\n– \u6821\u9a8c\u548c\u9a8c\u8bc1
\n– \u63d2\u4ef6\u542f\u7528<\/p>\n

v1.12 \u7248\u672c\u66f4\u65b0\uff1a<\/strong>2018\u5e748\u670817\u65e5
\n– \u652f\u6301 Rich \u5934\uff08\u5b9e\u9a8c\u6027\uff09
\n– \u5728\u5bfc\u5165\u7684 API \u4e2d\u6309\u987a\u5e8f\u89e3\u6790\u540d\u79f0
\n– \u663e\u793a\u5bfc\u5165\u6a21\u5757\u7684\u6587\u4ef6\u63cf\u8ff0
\n– \u4e3a\u5217\u8868\u67e5\u770b\u6dfb\u52a0\u4e86\u8fc7\u6ee4\/\u641c\u7d22\u6846
\n– \u5728\u72b6\u6001\u680f\u4e2d\u6dfb\u52a0\u4e86 PE \u7c7b\u578b\u56fe\u6807
\n– .ini \u6587\u4ef6\u8f6c\u6362\u4e3a UTF
\n– \u5728 FileInfo \u63d2\u4ef6\u4e2d\u6dfb\u52a0\u4e86 SHA256 \u548c ImpHash
\n– \u9519\u8bef\u4fee\u590d<\/p>\n

\u6b64\u6c49\u5316\u5355\u6587\u4ef6\u7248\u7531 th_sjy \u6c49\u5316\u5236\u4f5c\u5206\u4eab<\/strong><\/p>\n

v1.12 \u6c49\u5316\u5355\u6587\u4ef6\u7248\u4e0b\u8f7d\uff1a<\/strong><\/span>https:\/\/th_sjy.ctfile.com\/fs\/235978-324550344<\/a>
\nv1.09 \u6c49\u5316\u5355\u6587\u4ef6\u7248\u4e0b\u8f7d\uff1a<\/strong><\/span>https:\/\/th_sjy.ctfile.com\/fs\/235978-214520885<\/a>
\nv1.08 \u6c49\u5316\u5355\u6587\u4ef6\/\u7eff\u8272\u7248\u4e0b\u8f7d\uff1a<\/strong><\/span>http:\/\/pan.baidu.com\/s\/1kVid7QR<\/a> \u00a0\u00a0\u63d0\u53d6\u7801\uff1aan8p<\/strong><\/p>\n

\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1ath_sjy \u4e13\u6ce8\u8f6f\u4ef6\u6c49\u5316\u548c\u8d44\u6e90\u5206\u4eab\uff0c<\/a> » \u4e13\u4e1aPE\u8d44\u6e90\u7ba1\u7406\u5668(PPEE)1.12\u6c49\u5316\u5355\u6587\u4ef6\u7248<\/a><\/p>","protected":false},"excerpt":{"rendered":"