wargame.kr
[wargame.kr] DLL with nodepad
문제분석 & 풀이DLL 파일을 분석해보자. ○ start()int __cdecl start(LPVOID lpParameter){ wchar_t *v1; // eax WCHAR Filename[256]; // [esp+4h] [ebp-204h] BYREF if ( GetModuleFileNameW(0, Filename, 0x200u) ) { v1 = wcsrchr(Filename, 0x5Cu); if ( v1 ) { if ( !wcsicmp(v1 + 1, L"notepad.exe") ) { dword_70A833A8 = (int)CreateThread(0, 0, (LPTHREAD_START_ROUTINE)StartAddress, lpParameter, ..
