The AEP that writes the program to its own process

Test program features

Print out the program entry point address of your process.

Combined with the OD loader, the entry point you see is really 0x004014f0, and the program entry point finds

Test program

[CPP]View PlainCopy

2. @file exam_1_1.c
6. #include <stdlib.h>
8. #include <stdio.h>
12. void Fngetprogentry ();
16. int main (int agrc, char** argv)
18. {
20. Fngetprogentry ();
24. printf ("END, press any key to quit\n");
26. GetChar ();
28. return 0;
30. }
34. void Fngetprogentry ()
36. {
38. #define Pe_signture 0x4550///< "PE"
42. int* pfileaddressofnewheader = NULL;
44. int* pcofffileheader = NULL;
46. int* PAEP = NULL;
48. const int iaddrpeimgbase = 0x400000;
52. /// Ioffsetx for offset
54. /// Icontent for the contents of the address
56. const INT ioffsetfileaddressofnewheader = (16 * 4-4); ///< The offset of the File address of the new header with respect to the Dosheader
58. const int ioffsetaeptofileaddressofnewheader = 0x28;
62. int icontentfileaddressofnewheader = 0;
64. int ipesignature = 0;
66. int ioffsetaddressofentrypoint = 0; ///< Program Entry point offset address
70. Do
72. {
74. Pfileaddressofnewheader = (int*) (iaddrpeimgbase + ioffsetfileaddressofnewheader);
76. Icontentfileaddressofnewheader = *pfileaddressofnewheader; ///< icontentfileaddressofnewheader = 0xd0
80. Pcofffileheader = (int*) (iaddrpeimgbase + icontentfileaddressofnewheader);
82. Ipesignature = *pcofffileheader;
84. if (pe_signture! = ipesignature)
86. {
88. printf ("error PE file\n");
90. }
94. PAEP = (int*) ((int) Pcofffileheader + ioffsetaeptofileaddressofnewheader);
96. Ioffsetaddressofentrypoint = Iaddrpeimgbase + *PAEP;
98. printf ("My address entry point is 0x%x\n", ioffsetaddressofentrypoint);
100. } while (0);
104. printf ("END, press any key to quit\n");
106. }

Run results

http://blog.csdn.net/lostspeed/article/details/49506193

The AEP that writes the program to its own process