让侦测工具把壳识别为VC++

<BR>&nbsp;&nbsp;&nbsp;&nbsp;一时找不到好的例子程序,向朋友要了一个易语言编译的窗口空程序演示一下-_-! <BR>&nbsp;&nbsp;&nbsp;&nbsp;目标文件:Target.exe <BR>&nbsp;&nbsp;&nbsp;&nbsp;加个壳:SVKP&nbsp;1.3x&nbsp;-&gt;&nbsp;Pavol&nbsp;Cerven[注:Cracked],PEiD正确识别出来了.记下入口点:5000 <BR>&nbsp;&nbsp;&nbsp;&nbsp;用ToPo增加大约128字节的空间[注:个人爱好而定],进入LordPE的PE&nbsp;Editor,打开Target.exe, <BR>把.topo0段名改为.text,装的更像一点[注:也可以个性一点改成自己的大名,不影响结果] <BR>&nbsp;&nbsp;&nbsp;&nbsp;记下VOffset:13000,把入口点改为这个值.OllyDbg载入Target.exe,轰~我们来到了一个异常, <BR>向上拉动滚动条,来到413000处改写代码: <BR>;---------------------------------------------------------------- <BR>;伪造VC++入口代码特征 <BR>;assume&nbsp;&nbsp;fs:nothing <BR>push&nbsp;ebp <BR>mov&nbsp;ebp,esp <BR>push&nbsp;-1 <BR>push&nbsp;666666 <BR>push&nbsp;888888 <BR>mov&nbsp;eax,fs:[0] <BR>push&nbsp;eax <BR>mov&nbsp;fs:[0],esp <BR>;下边再恢复 <BR>pop&nbsp;eax <BR>mov&nbsp;fs:[0],eax <BR>pop&nbsp;eax <BR>pop&nbsp;eax <BR>pop&nbsp;eax <BR>pop&nbsp;eax <BR>mov&nbsp;ebp,eax <BR>;---------------------------------------------------------------- <BR>&nbsp;&nbsp;&nbsp;&nbsp;别忘了jmp&nbsp;405000,也就是壳的入口点.选中修改过的代码按右键,把它保存为newTarget.exe. <BR>PEiD侦测一下:Microsoft&nbsp;Visual&nbsp;C++,并且运行正常,任务完成. <BR>&nbsp;&nbsp;&nbsp;&nbsp;感谢您耐心阅读到这里.