GetMd5Thread PROC PFile:DWORD

LOCAL @FileText[MAX_PATH]:BYTE
LOCAL @TEMP[MAX_PATH]:BYTE
LOCAL @hFileRead,@hMapFile,@pMemory,@FileSize

invoke CreateFile, PFile,\
GENERIC_READ ,\
0,\
NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,\
NULL
.if eax==0
jmp reterr
.endif


mov @hFileRead,eax
invoke ExtractFileName,PFile,addr @FileText ; 取短文件名

invoke CreateFileMapping,@hFileRead,NULL,PAGE_READONLY,0,0,NULL
.if eax==0
invoke CloseHandle,@hFileRead
jmp reterr
ret
.endif
mov @hMapFile,eax

invoke MapViewOfFile,@hMapFile,FILE_MAP_READ,0,0,0
.if eax==0
invoke CloseMapFile,@hMapFile,@hFileRead
jmp reterr
.endif
mov @pMemory,eax
invoke SendDlgItemMessage,hWinMain,IDC_PGB,PBM_SETPOS,1,0 ;进度开始（注意：这里并不是实时进度）
invoke GetFileSize,@hFileRead,0
mov @FileSize,eax
invoke _MD5,@pMemory,eax
invoke wsprintf ,addr @TEMP,addr szReceive, addr @FileText, @FileSize,eax
invoke SendDlgItemMessage,hWinMain,IDC_EDT_OUT,EM_REPLACESEL,0,addr @TEMP
invoke SendDlgItemMessage,hWinMain,IDC_PGB,PBM_SETPOS,100,0 ;进度结束
invoke RtlZeroMemory,addr FileName,MAX_PATH ; 清空数据
INVOKE SendDlgItemMessage,hWinMain,IDC_EDT_FILE,WM_SETTEXT,0, addr FileName
invoke UnmapViewOfFile,@pMemory
invoke CloseMapFile,@hMapFile,@hFileRead
ret

reterr:

invoke MessageBox,0,CTEXT("文件打开失败，请检查是否为有效文件！"),CTEXT("WinMd5 for ASM v1.1"),MB_ICONERROR OR MB_OK

ret

GetMd5Thread endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Programmed by nohacks, nohacks@163.com
; Website: http://hi.baidu.com/nohacks
; Win32 ASM is Masm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 版本信息
; WinMD5 for ASM V1.1 - 可以拖放取得文件的MD5值
;
; 2007年11月21日
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>


.386
.model flat, stdcall
option casemap :none

include windows.inc
include user32.inc
include shell32.inc
include kernel32.inc
includelib user32.lib
includelib kernel32.lib
include comdlg32.inc
includelib comdlg32.lib
includelib shell32.lib
include debug.inc
include Stdlib.Inc
includelib Stdlib.lib

m2m Macro M1,M2
push M2
pop M1
endm



SEH struct
PrevLink dd ? ; 用来保存SHE原地址
CurrentHandler dd ? ; SEH处理函数地址
SafeOffset dd ? ; 执行恢复地址
PrevEsp dd ? ; 用来保存 SEH前的esp
PrevEbp dd ? ; 用来保存 SEH前的ebp
SEH ends


.const
ICO_ICO EQU 1
DLG_MAIN EQU 1000
IDC_EDT_FILE EQU 1001
IDC_EDT_OUT EQU 1002
IDC_PGB EQU 1003
IDC_BTN_EXIT EQU 1004
.data?
hWinMain dd ?
hInstance dd ?
hMenu HANDLE dword ?
TheThread DWORD ?
ValidPE dd ?
.data
FileName db MAX_PATH dup(0)
temp db '%s',0DH,0AH,0
FilterString db "全部文件(*.*)",0,"*.*",0,0
szReceive db '文件名 ：%s',0dh,0ah
db '文件大小 ：%d','字节',0dh,0ah
db '文件MD5值：%s ',0dh,0ah,0
TEMP db '.',0

include md5.asm



_SetWindowCenter proc _hWnd:DWORD
LOCAL swidth,sheight,dwidth,dheight
LOCAL rect:RECT
invoke GetSystemMetrics,SM_CXSCREEN
mov swidth,eax
invoke GetSystemMetrics,SM_CYSCREEN
mov sheight,eax
invoke GetWindowRect,_hWnd,addr rect
mov eax,rect.right
sub eax,rect.left
mov dwidth,eax
sub swidth,eax
mov eax,rect.bottom
sub eax,rect.top
mov dheight,eax
sub sheight,eax
shr sheight,1
shr swidth,1
invoke SetWindowPos,_hWnd,HWND_NOTOPMOST,swidth,sheight,dwidth,dheight,SWP_SHOWWINDOW
ret
_SetWindowCenter endp

;********************************************************************
CloseMapFile PROC hMapFile:DWORD,hFileRead:DWORD
invoke CloseHandle,hMapFile
;mov hMapFile,0
invoke CloseHandle,hFileRead
ret
CloseMapFile endp

GetMd5Thread PROC PFile:DWORD
LOCAL seh:SEH
LOCAL md5 ,ProcessId
LOCAL @FileText[MAX_PATH]:BYTE
LOCAL @TEMP[MAX_PATH]:BYTE
LOCAL @hFileRead,@hMapFile,@pMemory,@FileSize

;SEH异常处理

assume fs:nothing
push fs:[0]
pop seh.PrevLink
mov seh.CurrentHandler,offset SEHHandler
mov seh.SafeOffset,offset FinalExit
lea eax,seh
mov fs:[0], eax
mov seh.PrevEsp,esp
mov seh.PrevEbp,ebp

invoke CreateFile, PFile,\
GENERIC_READ ,\
0,\
NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,\
0

mov @hFileRead,eax

invoke ExtractFileName,PFile,addr @FileText ; 取短文件名

invoke GetFileSize,@hFileRead,0 ;取文件尺寸
mov @FileSize,eax

invoke CreateFileMapping,@hFileRead,NULL,PAGE_READONLY,0,0,NULL
mov @hMapFile,eax
invoke MapViewOfFileEx,@hMapFile,FILE_MAP_READ,0,0,0,0
mov @pMemory,eax
invoke SendDlgItemMessage,hWinMain,IDC_PGB,PBM_SETPOS,1,0 ;进度开始（注意：这里并不是实时进度）
invoke _MD5,@pMemory, @FileSize

;MD5转为大写
mov md5,eax
invoke lstrlen, md5
invoke CharUpperBuff,md5,eax

invoke wsprintf ,addr @TEMP,addr szReceive, addr @FileText, @FileSize,md5
invoke SendDlgItemMessage,hWinMain,IDC_EDT_OUT,EM_REPLACESEL,0,addr @TEMP
invoke SendDlgItemMessage,hWinMain,IDC_PGB,PBM_SETPOS,100,0 ;进度结束
invoke RtlZeroMemory,addr FileName,MAX_PATH ; 清空数据
INVOKE SendDlgItemMessage,hWinMain,IDC_EDT_FILE,WM_SETTEXT,0, addr FileName
invoke UnmapViewOfFile,@pMemory
invoke CloseMapFile,@hMapFile,@hFileRead

;断开SHE链

push seh.PrevLink
pop fs:[0]

ret


SEH执行恢复地址：

FinalExit:

invoke MessageBox,0,CTEXT("文件打开失败，请检查是否为有效文件！"),CTEXT("WinMd5 for ASM v1.1"),MB_ICONERROR OR MB_OK

ret
GetMd5Thread endp

_ProcDlgMain proc uses ebx edi esi, \
hWnd:DWORD,wMsg:DWORD,wParam:DWORD,lParam:DWORD

LOCAL @hMem,@hFile,@Size,@Read
mov eax,wMsg
cmp eax ,WM_DROPFILES
je GetFile
cmp eax,WM_COMMAND
je Exit
cmp eax,WM_INITDIALOG
je boxStart
cmp eax,WM_CLOSE
je boxClose

retFalse:
mov eax,FALSE
ret

boxClose:

invoke EndDialog,hWnd,NULL
jmp retTrue

boxStart:

push hWnd
pop hWinMain
invoke LoadIcon,hInstance,ICO_ICO
invoke SendMessage,hWnd,WM_SETICON,ICON_BIG,eax ;设置窗口图标
invoke SetWindowPos,hWnd,HWND_TOPMOST,0,0,0,0, SWP_NOMOVE or SWP_NOSIZE ;窗口置顶
INVOKE _SetWindowCenter,hWinMain ;使窗体出现在屏幕中心
invoke DragAcceptFiles,hWnd,TRUE ;允许拖放文件
jmp retTrue

GetFile:

invoke DragQueryFile,wParam,0,addr FileName,MAX_PATH ;取拖放文件名
invoke SendDlgItemMessage,hWnd,IDC_EDT_FILE,EM_REPLACESEL,0, addr FileName ;输出到编辑框
invoke DragFinish,wParam ;释放拖放资源
invoke CreateThread,NULL,0,addr GetMd5Thread,addr FileName,0,NULL ;创建线程


Exit:
mov eax,wParam
.if eax==IDC_BTN_EXIT
invoke ExitProcess,NULL
.endif


retTrue:
mov eax,TRUE
ret
_ProcDlgMain endp
;--------------------------------------------------------------------;
;函数功能：SEH回调函数
;-------------------------------------------------------------------;
SEHHandler proc uses edx pExcept:DWORD, pFrame:DWORD, pContext:DWORD, pDispatch:DWORD
mov edx,pFrame
assume edx:ptr SEH
mov eax,pContext
assume eax:ptr CONTEXT
push [edx].SafeOffset
pop [eax].regEip
push [edx].PrevEsp
pop [eax].regEsp
push [edx].PrevEbp
pop [eax].regEbp
mov eax,ExceptionContinueExecution
ret
SEHHandler endp



Start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke DialogBoxParam,hInstance,DLG_MAIN,NULL,_ProcDlgMain,0
invoke ExitProcess,NULL
End Start

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法