[求助]调用EXE中的函数......
这个原理还是很简单的,把目标exe可以随便加载,比如读文件,或者干脆LoadLibrary就可以了。然后搜索其导入表,都修改成正确的指针就行了。然后再修改exe内需要重定位的地址,这个也不麻烦的。
修正重定位表的代码大概如下:
hMod = LoadLibrary("aa.exe");
if (!hMod)
return false;
pDosHeader = (PIMAGE_DOS_HEADER)hMod;
pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hMod + pDosHeader->e_lfanew);
pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hMod + pOptHeader->DataDirectory[1].VirtualAddress);
bRet = TRUE;
while(pImportDescriptor->FirstThunk)
{
//获取dll名称
char * dllname = (char *)((BYTE *)hMod + pImportDescriptor->Name);
pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hMod + pImportDescriptor->OriginalFirstThunk);
int no = 1;
while(pThunkData->u1.Function)
{
if ((pThunkData->u1.Ordinal & IMAGE_ORDINAL_FLAG) != IMAGE_ORDINAL_FLAG)
{
//获取函数名称
funname = (char *)((BYTE *)hMod + (DWORD)pThunkData->u1.AddressOfData + 2);
if (!GetModuleHandle(dllname))
{
LoadLibrary(dllname);
}
myaddr = (int*)GetProcAddress(GetModuleHandle(dllname), funname);
}
PDWORD lpAddr = (DWORD *)((BYTE *)hMod + (DWORD)pImportDescriptor->FirstThunk) +(no-1);
MEMORY_BASIC_INFORMATION mbi;
VirtualQuery(lpAddr,&mbi,sizeof(mbi));
VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
if (WriteProcessMemory(GetCurrentProcess(), lpAddr, &myaddr, sizeof(DWORD), NULL) == FALSE)
{
bRet = FALSE;
break;
}
VirtualProtect(lpAddr,sizeof(DWORD),dwOLD,0);
no++;
pThunkData++;
}
pImportDescriptor++;
}
修正需要重定位的地址和数据:
for (int i = 0; i < xxx; i++)
{
lpAddr = (PDWORD)(RelocAll[i] + (DWORD)hMod);
VirtualQuery(lpAddr,&mbi,sizeof(mbi));
VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
ReadProcessMemory(hProcess, (LPCVOID)lpAddr, &dwOrg, sizeof(DWORD), &dwRetCount);
dwOrg = dwOrg - 0x400000;
dwOrg = dwOrg + (DWORD)hMod;
if (WriteProcessMemory(hProcess, (void*)lpAddr, &dwOrg, sizeof(DWORD), NULL) == 0)
bRet = false;
}