获取hProcess,运行VB中Command1后可以成功实现远程调用callType的运行。
如何通过Command1来传递参数(x y m d)给callType(使用技能)运行?
===========================================
PowerBASIC的代码:
#DIM ALL '申明所有
#REGISTER ALL '注册所有
#COMPILE DLL "ProjectOK.DLL" '生成文件类型及名字
#INCLUDE "WIN32API.INC" '引用API
''''''''''''''''''''''''''' 注入程序 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION FuncIn ALIAS "FuncIn" (BYVAL Func AS DWORD POINTER) EXPORT AS LONG
WriteProcessMemory(hProcess, BYVAL ThreadAdd, @Func, 4096, 0&)
hThread = CreateRemoteThread(hProcess, BYVAL 0&, 0, ThreadAdd, BYVAL 0&, 0, 0&)
WaitForSingleObject(hThread, %INFINITE)
CloseHandle(hThread)
FUNCTION = -1&
END FUNCTION
FUNCTION UseSkills ALIAS "UseSkills" () EXPORT AS LONG
FuncIn(CODEPTR(UseSkillsCall))
FUNCTION = -1&
END FUNCTION
'''''''''''''''''''' CallType使用技能 ''''''''''''''''''''''''''''''''''''
FUNCTION UseSkillsCall ALIAS "UseSkillsCall" () EXPORT AS LONG
DIM Address AS LONG
DIM x AS LONG
DIM y AS LONG
DIM m AS LONG
DIM d AS LONG
Address = &H00531010
x = &H12C
y = &H1C2
m = 0
d = &H15
!pushad
!PUSH x
!PUSH y
!PUSH m
!PUSH d
!mov EDX, dword ptr [&H9A0FC4]
!mov ecx, dword ptr [EDX-&H8]
!call Address
!popad
END FUNCTION
===========================================
VB的代码:
Public Declare Function UseSkills Lib "ProjectOK.Dll" () As Long
Private Sub Command1_Click()
Call UseSkills
End Sub
===========================================
参考资料:
http://blog.csdn.net/hack_wg/archive/2009/09/12/4546836.aspx
[课程]FART 脱壳王!加量不加价!FART作者讲授!