能力值：
( LV2，RANK：10 )
|
-
-
2 楼
GetProcAddress动态获取一下Sleep的地址？
|
能力值：
( LV5，RANK：70 )
|
-
-
3 楼
[font=Fixedsys][color=#0000FF]void * [/color][color=#000080]__cdecl GetKernel32[/color][color=#0000FF]()
{
[/color][color=#000080]__asm
[/color][color=#0000FF]{
xor [/color][color=#000080]eax[/color][color=#0000FF], [/color][color=#000080]eax[/color][color=#0000FF];
[/color][color=#000080]mov eax[/color][color=#0000FF], [/color][color=#000080]dword ptr fs[/color][color=#0000FF]:[[/color][color=#000080]eax [/color][color=#0000FF]+ [/color][color=#FF00FF]0x30[/color][color=#0000FF]];
[/color][color=#000080]mov eax[/color][color=#0000FF], [[/color][color=#000080]eax [/color][color=#0000FF]+ [/color][color=#FF00FF]0x0C[/color][color=#0000FF]];
[/color][color=#000080]mov eax[/color][color=#0000FF], [[/color][color=#000080]eax [/color][color=#0000FF]+ [/color][color=#FF00FF]0x1C[/color][color=#0000FF]];
[/color][color=#000080]mov eax[/color][color=#0000FF], [[/color][color=#000080]eax [/color][color=#0000FF]+ [/color][color=#FF00FF]0x08[/color][color=#0000FF]];
[/color][color=#000080]pop ebp[/color][color=#0000FF];
[/color][color=#000080]ret
[/color][color=#0000FF]}
}
[/color][color=#000080]GetProcAddress[/color][color=#0000FF]([/color][color=#000080]GetKernel32[/color][color=#0000FF](), [/color][color=#A31515]"Sleep"[/color][color=#0000FF]);[/color][/font]
不好意思，之前的写错了啦
|
能力值：
( LV2，RANK：10 )
|
-
-
4 楼
谢谢分享，受教了！
想问个题外话，我的代码显示框怎么与楼上的不一样？
void * __cdecl GetKernel32()
{
__asm
{
xor eax, eax;
mov eax, dword ptr fs:[eax + 0x30];
mov eax, [eax + 0x0C];
mov eax, [eax + 0x1C];
mov eax, [eax + 0x08];
pop ebp;
ret
}
}
GetProcAddress(GetKernel32(), "Sleep");
|
能力值：
( LV9，RANK：610 )
|
-
-
5 楼
严重怀疑楼上几位做过测试没有啊
#include "stdafx.h"
#include "windows.h"
_declspec (naked) HMODULE GetKernel32()
{
__asm
{
mov eax, dword ptr fs:[0x30];
mov eax, [eax + 0x0C];
mov eax, [eax + 0x1C];
mov eax, [eax]
mov eax, [eax + 0x08];
retn
}
}
int main(int argc, char* argv[])
{
printf("Sleep api 的地址是：0x%.8X\r\n", (DWORD)GetProcAddress(GetKernel32(), "Sleep"));
return 0;
}
|
能力值：
( LV9，RANK：140 )
|
-
-
6 楼
GetProcAddress
|
|
|
|
