获取hProcess，运行VB中Command1后可以成功实现远程调用callType的运行。

如何通过Command1来传递参数（x y m d）给callType（使用技能）运行？

===========================================

PowerBASIC的代码：

#DIM ALL '申明所有
#REGISTER ALL '注册所有
#COMPILE DLL "ProjectOK.DLL" '生成文件类型及名字
#INCLUDE "WIN32API.INC" '引用API

''''''''''''''''''''''''''' 注入程序 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION FuncIn ALIAS "FuncIn" (BYVAL Func AS DWORD POINTER) EXPORT AS LONG
    WriteProcessMemory(hProcess, BYVAL ThreadAdd, @Func, 4096, 0&)
    hThread = CreateRemoteThread(hProcess, BYVAL 0&, 0, ThreadAdd, BYVAL 0&, 0, 0&)
    WaitForSingleObject(hThread, %INFINITE)
    CloseHandle(hThread)
    FUNCTION = -1&
END FUNCTION

FUNCTION UseSkills ALIAS "UseSkills" () EXPORT AS LONG
    FuncIn(CODEPTR(UseSkillsCall))
    FUNCTION = -1&
END FUNCTION

'''''''''''''''''''' CallType使用技能 ''''''''''''''''''''''''''''''''''''
FUNCTION UseSkillsCall ALIAS "UseSkillsCall" () EXPORT AS LONG
    DIM Address AS LONG
    DIM x AS LONG
    DIM y AS LONG
    DIM m AS LONG
    DIM d AS LONG
    Address = &H00531010
    x = &H12C
    y = &H1C2
    m = 0
    d = &H15
    !pushad
    !PUSH x
    !PUSH y
    !PUSH m
    !PUSH d
    !mov EDX, dword ptr [&H9A0FC4]
    !mov ecx, dword ptr [EDX-&H8]
    !call Address
    !popad
END FUNCTION

===========================================

VB的代码：

Public Declare Function UseSkills Lib "ProjectOK.Dll"   () As Long

Private Sub Command1_Click()
    Call UseSkills
End Sub

===========================================

参考资料：
http://blog.csdn.net/hack_wg/archive/2009/09/12/4546836.aspx

[招生]系统0day安全班，企业级设备固件漏洞挖掘，Linux平台漏洞挖掘！