由于易博龙接手Delphi后,对编译器做了些修改,导致Delphi7以后的版本跨单元变量引用发生了改变,现举例说明如下:
unit Unit1;
interface
uses
nt_status, ntoskrnl, unit2;
function _DriverEntry(pDriverObject: PDriverObject; RegistryPath: PUnicodeString) : NTSTATUS; stdcall;
implementation
procedure DriverUnload(pDriverObject: PDriverObject); stdcall;
begin
end;
function _DriverEntry(pDriverObject: PDriverObject; RegistryPath: PUnicodeString) : NTSTATUS; stdcall;
begin
asm
int 3;
end;
pDriverObject^.DriverUnload := @DriverUnload;
test1 := 100;
ChangeOffset;
test3 := $3A3A;
DbgPrint('offset %d, test1=%d, test2=%d, test3=%d'#13#10, ShareNameOffset, test1, test2, test3);
recTest.b := $7F7F;
DbgPrint('myRec.a = %d, myRec.b = %d'#13#10, recTest.a, recTest.b);
Result:= STATUS_SUCCESS;
end;
end.
unit Unit2;
interface
uses
nt_status, ntoskrnl;
type
myRec = packed record
a: integer;
b: integer;
end;
var
ShareNameOffset: ULONG = 0; //全局变量
test1: DWORD;
test2: DWORD = 1000;
test3: DWORD;
recTest: myRec = (a:10; b:100);
procedure ChangeOffset;
implementation
procedure ChangeOffset;
begin
ShareNameOffset:= $ABC; //修改
test2 := $2000;
recTest.a := $1A1A;
recTest.b := $2A2A;
end;
end.
public start
start proc near
arg_0 = dword ptr 8
push ebp
mov ebp, esp
int 3 ; Trap to Debugger
mov eax, [ebp+arg_0]
mov dword ptr [eax+34h], offset sub_10280
mov dword_103B4, 64h ; test1 := 100
call sub_10344
mov dword_103B8, 3A3Ah ; test3 := 3A3A
mov eax, dword_103B8
push eax
mov eax, dword_103A4
push eax
mov eax, dword_103B4
push eax
mov eax, dword_103A0
push eax
push offset Format ; "offset %d, test1=%d, test2=%d, test3=%d"...
call DbgPrint
add esp, 14h
mov eax, 7F7Fh
mov dword_103AC, eax ; recTest.b := $7F7F
push eax
mov eax, dword_103A8
push eax
push offset aMyrec_aDMyrec_ ; "myRec.a = %d, myRec.b = %d\r\n"
call DbgPrint
add esp, 0Ch
xor eax, eax
pop ebp
retn 8
start endp
dword_103A0 dd 0
dword_103A4 dd 3E8h
dword_103A8 dd 0Ah
dword_103AC dd 64h
db 0
db 0
db 0
db 0
dword_103B4 dd 0
dword_103B8 dd 0
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!