看dumpbin,并没有用到MSVCRT.dll里面的东西,所以几乎可以肯定不是用VC写的。另外,这个鬼东西占用资源那么多,也不像是VC写出来的。和icq占用的内存差不多,而功能比icq差太多,像VC写的吗!!!Microsoft (R) COFF Binary File Dumper Version 6.00.8447 Copyright (C) Microsoft Corp 1992-1998. All rights reserved. Dump of file oicq.exeFile Type: EXECUTABLE IMAGE Section contains the following imports: WINMM.dll 61F168 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 33 mciSendCommandA MSACM32.dll 61F170 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 9 acmDriverOpen KERNEL32.dll 61F178 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 1C2 LoadLibraryA 13E GetProcAddress USER32.dll 61F184 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 2AE wvsprintfA GDI32.dll 61F18C Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 1D7 SetDIBitsToDevice comdlg32.dll 61F194 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 0 ChooseColorA WINSPOOL.DRV 61F19C Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 1C ClosePrinter ADVAPI32.dll 61F1A4 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 186 RegSetValueExA SHELL32.dll 61F1AC Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 12 DragFinish COMCTL32.dll 61F1B4 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 2A ImageList_Duplicate oledlg.dll 61F1BC Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference Ordinal 8 ole32.dll 61F1C4 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 10A StgOpenStorageOnILockBytes OLEPRO32.DLL 61F1CC Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference Ordinal 253 OLEAUT32.dll 61F1D4 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference Ordinal 185 urlmon.dll 61F1DC Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 2E IsValidURL WSOCK32.dll 61F1E4 Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference Ordinal 8 WININET.dll 61F1EC Import Address Table 0 Import Name Table 0 time date stamp 0 Index of first forwarder reference 7E InternetSetFilePointer Summary 7000 .aspack 8C000 .data 38000 .rdata 58000 .rsrc 102000 .text里面的hook.dll是VC写的。 Dump of file hookdll.dllFile Type: DLL Section contains the following imports: MFC42.DLL 10002000 Import Address Table 10002118 Import Name Table 0 time date stamp 0 Index of first forwarder reference Ordinal 3663 Ordinal 1253 Ordinal 342 Ordinal 823 Ordinal 1182 Ordinal 1168 Ordinal 825 MSVCRT.dll 10002020 Import Address Table 10002138 Import Name Table 0 time date stamp 0 Index of first forwarder reference CA _except_handler3 2E ?terminate@@YAXXZ 49 __CxxFrameHandler 25E free 10F _initterm 291 malloc 9D _adjust_fdiv USER32.dll 10002040 Import Address Table 10002158 Import Name Table 0 time date stamp 0 Index of first forwarder reference 214 SendMessageA 262 SetWindowsHookExA 286 UnhookWindowsHookEx 15 CallNextHookEx Summary 1000 .data 1000 .rdata 1000 .reloc 1000 .rsrc 1000 .text 1000 sharedda
Borland公司的产品编译的EXE文件头里Stub是:This program must be run under Win32 而Microsoft的产品编译的EXE文件头里Stub是:This program cannot be run in DOS mode.这是我以前分析Dos与Windows平台下的EXE文件头格式发现的.
用spy++看一下就知道了
呵呵~~~,什么都能开到,菜单,对话框...
信不信有你:)
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
Dump of file oicq.exeFile Type: EXECUTABLE IMAGE Section contains the following imports: WINMM.dll
61F168 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 33 mciSendCommandA MSACM32.dll
61F170 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 9 acmDriverOpen KERNEL32.dll
61F178 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 1C2 LoadLibraryA
13E GetProcAddress USER32.dll
61F184 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 2AE wvsprintfA GDI32.dll
61F18C Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 1D7 SetDIBitsToDevice comdlg32.dll
61F194 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 0 ChooseColorA WINSPOOL.DRV
61F19C Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 1C ClosePrinter ADVAPI32.dll
61F1A4 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 186 RegSetValueExA SHELL32.dll
61F1AC Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 12 DragFinish COMCTL32.dll
61F1B4 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 2A ImageList_Duplicate oledlg.dll
61F1BC Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference Ordinal 8 ole32.dll
61F1C4 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 10A StgOpenStorageOnILockBytes OLEPRO32.DLL
61F1CC Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference Ordinal 253 OLEAUT32.dll
61F1D4 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference Ordinal 185 urlmon.dll
61F1DC Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 2E IsValidURL WSOCK32.dll
61F1E4 Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference Ordinal 8 WININET.dll
61F1EC Import Address Table
0 Import Name Table
0 time date stamp
0 Index of first forwarder reference 7E InternetSetFilePointer Summary 7000 .aspack
8C000 .data
38000 .rdata
58000 .rsrc
102000 .text里面的hook.dll是VC写的。
Dump of file hookdll.dllFile Type: DLL Section contains the following imports: MFC42.DLL
10002000 Import Address Table
10002118 Import Name Table
0 time date stamp
0 Index of first forwarder reference Ordinal 3663
Ordinal 1253
Ordinal 342
Ordinal 823
Ordinal 1182
Ordinal 1168
Ordinal 825 MSVCRT.dll
10002020 Import Address Table
10002138 Import Name Table
0 time date stamp
0 Index of first forwarder reference CA _except_handler3
2E ?terminate@@YAXXZ
49 __CxxFrameHandler
25E free
10F _initterm
291 malloc
9D _adjust_fdiv USER32.dll
10002040 Import Address Table
10002158 Import Name Table
0 time date stamp
0 Index of first forwarder reference 214 SendMessageA
262 SetWindowsHookExA
286 UnhookWindowsHookEx
15 CallNextHookEx Summary 1000 .data
1000 .rdata
1000 .reloc
1000 .rsrc
1000 .text
1000 sharedda
你不是说腾讯公司那几个人就在你们这写字楼里上班吗?找他们问问不就ok了,
何必要我们在这里浪费时间瞎讨论呢?
写。
而Microsoft的产品编译的EXE文件头里Stub是:This program cannot be run in DOS mode.这是我以前分析Dos与Windows平台下的EXE文件头格式发现的.
一篇腾讯负责人的访谈文章上的
其实不管是vc还是delphi,都只是个工具而已
>>和icq占用的内存差不多,而功能比icq差太多,像VC写的吗!!!这个观点很有意思啊,通过“太差”来证明不是VC写的
可是事实证明是VC写的了,因此“VC写的”与“太差”同时成立...
以后我们大概要反过来,通过“太差”证明是VC写的... ^_^