查找kernel32.dll 基地址 stack
从[esp]获取kernel32中call 指令push的返回地址, 即应用程序返回后的地址rtlexituserthread , 有些是exitthread.拿到这个地址就拿到了kernel32空间的某个值, 模块地址64k对齐,去掉低2个字节来对齐.然后依次减64k寻找.386.model flat, stdcalloption casemap:noneinclude windows.incinclude user32.incincludelib user...