//可执行文件就不发了。。。免得不懂的乱传 学过win32汇编的人都知道知道怎么整的。支持通配符搜索,但本程序的通配符本人设为“++” 若有个别不明白的请加本人QQ 50325232 只限交流本程序技术方面的 本人鸟级。错误地方欢迎拍砖 转载请注明原著,这完全是本人原著
#define MANIFEST 24
#define ICO_MAIN 2
#define IDD_DLG1 1000
#define IDC_CBO1 1091
#define IDC_BTN1 1021
#define IDC_RBN1 1081
#define IDC_RBN2 1082
#define IDC_RBN3 1083
#define IDC_RBN4 1084
#define IDC_RBN5 1085
#define IDC_EDT1 1061
#define IDC_EDT2 1062
#define IDC_EDT3 1063
#define IDC_EDT4 1064
#define IDC_EDT5 1065
#define IDC_EDT6 1066
#define IDC_BTN2 1022
#define IDC_BTN3 1023
#define IDC_EDT7 1067
#define IDC_BTN4 1024
#define IDC_BTN5 1025
#define IDC_BTN6 1026
#define IDC_BTN7 1027
#define IDC_BTN8 1028
#define IDC_CBO2 1092
#define IDC_BTN9 1029
#define IDC_LSV1 1011
#define IDC_LSV2 1012
#define IDC_CHK1 1031
#define IDC_BTN10 1030
#define IDR_XPMANIFEST1 1
#define IDD_SUB1 2000
#define IDC_EDT201 2001
#define IDC_EDT202 2002
#define IDC_EDT203 2003
#define IDC_BTN201 2004
#define IDC_BTN205 2005
#include <resource.h>
ICO_MAIN ICON DISCARDABLE "DpCQ.ico"
IDD_DLG1 DIALOGEX 50,10,579,411
CAPTION "基址搜索器 作者:【残々剑】---->QQ:50325232"
FONT 8,"MS Sans Serif",0,0,0
STYLE WS_VISIBLE|WS_CAPTION|WS_SYSMENU|WS_MINIMIZEBOX
BEGIN
CONTROL "选择进程",-1,"Button",WS_CHILDWINDOW|WS_VISIBLE|BS_GROUPBOX,6,3,222,27
CONTROL "范围",-1,"Button",WS_CHILDWINDOW|WS_VISIBLE|BS_GROUPBOX,231,3,159,27
CONTROL "进程例表:",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,9,15,42,12
CONTROL "",IDC_CBO1,"ComboBox",WS_CHILDWINDOW|WS_VISIBLE|WS_VSCROLL|WS_TABSTOP|CBS_HASSTRINGS|CBS_SORT|CBS_DROPDOWNLIST,51,12,123,312,WS_EX_NOPARENTNOTIFY
CONTROL "刷新进程",IDC_BTN1,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,180,12,42,15
CONTROL "添加特征码",-1,"Button",WS_CHILDWINDOW|WS_VISIBLE|BS_GROUPBOX,6,33,384,78
CONTROL "基址",IDC_RBN1,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|BS_AUTORADIOBUTTON,12,45,33,12
CONTROL "Call地址",IDC_RBN2,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|BS_AUTORADIOBUTTON,93,45,42,12
CONTROL "OFFSET+1",IDC_RBN3,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|BS_AUTORADIOBUTTON,174,45,51,12
CONTROL "OFFSET+2",IDC_RBN4,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|BS_AUTORADIOBUTTON,255,45,51,12
CONTROL "OFFSET+4",IDC_RBN5,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|BS_AUTORADIOBUTTON,327,45,54,12
CONTROL "搜索范围",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,237,15,36,12
CONTROL "0400000",IDC_EDT1,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|ES_CENTER,276,15,45,12,WS_EX_CLIENTEDGE
CONTROL "到",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE|SS_CENTER,324,15,12,12
CONTROL "07FFFFF",IDC_EDT2,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|ES_CENTER,339,15,45,12,WS_EX_CLIENTEDGE
CONTROL "名称:",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,12,60,24,12
CONTROL "",IDC_EDT3,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,39,60,150,12,WS_EX_CLIENTEDGE
CONTROL "备注:",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,198,60,24,12
CONTROL "",IDC_EDT4,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,228,60,156,12,WS_EX_CLIENTEDGE
CONTROL "特征码",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,9,78,27,12
CONTROL "",IDC_EDT5,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_BORDER|WS_TABSTOP|ES_AUTOHSCROLL,39,78,345,12,WS_EX_CLIENTEDGE|WS_EX_NOPARENTNOTIFY
CONTROL "偏移值",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,9,96,27,12
CONTROL "0",IDC_EDT6,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|ES_UPPERCASE|ES_CENTER,39,96,18,12,WS_EX_CLIENTEDGE
CONTROL "计算偏移",IDC_BTN2,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,60,96,42,12
CONTROL "测试",IDC_BTN3,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,105,96,33,12
CONTROL "测试值",IDC_EDT7,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|ES_READONLY,144,96,51,12,WS_EX_CLIENTEDGE
CONTROL "插入行",IDC_BTN4,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,243,96,36,12
CONTROL "删除行",IDC_BTN5,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,282,96,36,12
CONTROL "特征码列表",-1,"Button",WS_CHILDWINDOW|WS_VISIBLE|BS_GROUPBOX,6,117,384,288
CONTROL "",-1,"Button",WS_CHILDWINDOW|WS_VISIBLE|BS_GROUPBOX,396,3,180,48
CONTROL "开始搜索",IDC_BTN6,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,399,12,42,33
CONTROL "导入特征码",IDC_BTN7,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,444,12,51,15
CONTROL "保存特征码",IDC_BTN8,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,444,30,51,15
CONTROL "",IDC_CBO2,"ComboBox",WS_CHILDWINDOW|WS_VISIBLE|WS_VSCROLL|WS_TABSTOP|CBS_DROPDOWNLIST,498,12,72,39
CONTROL "生成代码",IDC_BTN9,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,498,30,72,15
CONTROL "搜索结果",-1,"Button",WS_CHILDWINDOW|WS_VISIBLE|BS_GROUPBOX,396,57,180,348
CONTROL "",IDC_LSV1,"SysListView32",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|LVS_NOLABELWRAP|LVS_SHOWSELALWAYS|LVS_SINGLESEL|LVS_REPORT,9,126,378,273,WS_EX_CLIENTEDGE|WS_EX_NOPARENTNOTIFY
CONTROL "",IDC_LSV2,"SysListView32",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|LVS_NOLABELWRAP|LVS_SHOWSELALWAYS|LVS_SINGLESEL|LVS_REPORT,402,69,168,330,WS_EX_CLIENTEDGE|WS_EX_NOPARENTNOTIFY
CONTROL "启用选择范围",IDC_CHK1,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP|BS_AUTOCHECKBOX,321,96,60,12
CONTROL "编辑行",IDC_BTN10,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,201,96,39,12
END
IDR_XPMANIFEST1 MANIFEST "xpmanifest.xml"
IDD_SUB1 DIALOGEX 30,115,129,66
CAPTION "计算偏移"
FONT 8,"MS Sans Serif",0,0,0
STYLE WS_VISIBLE|WS_THICKFRAME
BEGIN
CONTROL "计算差值",-1,"Button",WS_VISIBLE|BS_GROUPBOX,3,3,123,63
CONTROL "低地址:",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,6,15,36,12
CONTROL "高地址:",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE,6,30,36,12
CONTROL "0",IDC_EDT201,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,45,12,45,12,WS_EX_CLIENTEDGE
CONTROL "0",IDC_EDT202,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,45,30,45,12,WS_EX_CLIENTEDGE
CONTROL "+",-1,"Static",WS_CHILDWINDOW|WS_VISIBLE|SS_CENTERIMAGE|SS_CENTER,93,30,9,12
CONTROL "0",IDC_EDT203,"Edit",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,105,30,18,12,WS_EX_CLIENTEDGE
CONTROL "确 定",IDC_BTN201,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,9,48,54,15
CONTROL "关 闭",IDC_BTN205,"Button",WS_CHILDWINDOW|WS_VISIBLE|WS_TABSTOP,66,48,54,15
END
;>>>>>>>>源文件
MANIFEST equ 24
IDD_DLG1 equ 1000
IDC_CBO1 equ 1091
IDC_BTN1 equ 1021
IDC_RBN1 equ 1081
IDC_RBN2 equ 1082
IDC_RBN3 equ 1083
IDC_RBN4 equ 1084
IDC_RBN5 equ 1085
IDC_EDT1 equ 1061
IDC_EDT2 equ 1062
IDC_EDT3 equ 1063
IDC_EDT4 equ 1064
IDC_EDT5 equ 1065
IDC_EDT6 equ 1066
IDC_BTN2 equ 1022
IDC_BTN3 equ 1023
IDC_EDT7 equ 1067
IDC_BTN4 equ 1024
IDC_BTN5 equ 1025
IDC_BTN6 equ 1026
IDC_BTN7 equ 1027
IDC_BTN8 equ 1028
IDC_CBO2 equ 1092
IDC_BTN9 equ 1029
IDC_LSV1 equ 1011
IDC_LSV2 equ 1012
IDC_CHK1 equ 1031
IDC_BTN10 equ 1030
IDD_SUB1 equ 2000
IDC_EDT201 equ 2001
IDC_EDT202 equ 2002
IDC_EDT203 equ 2003
IDC_BTN201 equ 2004
IDC_BTN205 equ 2005
ICO_MAIN equ 2
IDR_XPMANIFEST1 equ 1
L macro @var:VARARG
LOCAL @lbl
.const
@lbl db @var,0
.code
exitm <offset @lbl>
endm
;>>>>>>>>>>>>>>
;主调用程序
;作者残剑-<50325232> 转载请注明原著
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.386
.model flat, stdcall
option casemap :none
include windows.inc
include user32.inc
include gdi32.inc
include kernel32.inc
include comctl32.inc
includelib user32.lib
includelib gdi32.lib
includelib kernel32.lib
includelib comctl32.lib
include comdlg32.inc
includelib comdlg32.lib
include stream.inc
includelib stream.lib
include Shlwapi.inc
includelib Shlwapi.lib ;strstr
include BaseSearch.inc
ID_MENU_JG equ 301
ID_MENU_NAME equ 300
ID_MENU_NOTE equ 302
ID_Timer equ 80
.data?
hWnd0 dd ?
hRichEdit dd ?
hInstanc dd ?
NoMsgCountLvs1 dd ?
NoMsgCountLvs2 dd ?
FileBase dd ?
FileSize1 dd ?
ProhWnd dd ?
DataBuf db 300 dup (?)
szFileName db MAX_PATH dup (?)
hPopMenu dd ?
szIcce INITCOMMONCONTROLSEX <?>
dwNum dd ?
dwLen dd ?
.data
.const
FmtOffsetDis db '%04d',0
FmtSyS db '%X',0
FmtSyS01 db '%08X',0
szFmtHexToDec db '%u',0
FmtLsvSave db '%s|::|%s|::|%s|::|%s|::|%s|::|',0Dh,0Ah,0
FmtSaveCodeAsm db '%s equ %08sh ;%s',0dh,0ah,0
FmtSaveCodeC db '#define %s %08s //%s',0dh,0ah,0
FmtSaveDelphi db 's% = %08s //%s',0dh,0ah,0
szProt db '是否要改变第 %d 行的数据',0
szFilter db 'Text Files(*.ini)',0,'*.ini',0,'All Files(*.*)',0,'*.*',0,0
szDefExt db 'ini',0
szFilter1 db 'Text Files(*.txt)',0,'*.txt',0,'All Files(*.*)',0,'*.*',0,0
szDefExt1 db 'txt',0
szSaveCaption db '请输入文件名',0
szB db '基址搜索器 作者:【残々剑】---->QQ:50325232',0
szA db 0BBh,0F9h,0D6h,0B7h,0CBh,0D1h,0CBh,0F7h,0C6h,0F7h,0A1h,0A1h,0D7h,0F7h,0D5h,0DFh,0A3h,0BAh,0A1h,0BEh,0B2h,0D0h,0A1h,0A9h,0BDh,0A3h,0A1h,0BFh,2Dh,2Dh,2Dh,2Dh,3Eh,51h,51h,0A3h,0BAh,35h,30h,33h,32h,35h,32h,33h,32h,0,0
;>>>>>>右击
szCopyName db '复制名称...',0
szCopyJG db '复制结果...',0
szCopyNote db '复制注释...',0
.code
.if eax
; add dwNum,2
; lea eax,szA
; add eax,dwNum
; invoke lstrcpy,offset szA,eax
; ;先将后面的复制过去
; invoke lstrlen,offset szA ;返回剩余长度
; ;shl eax,1h
; lea ecx,buf01
; add ecx,eax ;指向刚才复制的字符串的末尾
; sub eax,dwLen
; neg eax ;求出剩下的长度 eax==2
; invoke lstrcpyn,ecx,offset szA,eax ;实现开头接到未尾
; mov eax,dwNum
; .if eax >= dwLen ;若当前位置大于长度则重新开始
; xor eax,eax
; mov dwNum,eax
; .endif
; invoke SetWindowText,hWnd,addr buf01
.endif
ListViewAddColumn proc uses ebx esi edi hWin,_hDlgID,_dwColumn,_dwWidth,_lpszHead
local @stLVC:LV_COLUMN
pushad
invoke RtlZeroMemory,addr @stLVC,sizeof LV_COLUMN
mov @stLVC.imask,LVCF_TEXT or LVCF_WIDTH or LVCF_FMT
mov @stLVC.fmt,LVCFMT_LEFT
invoke lstrlen,_lpszHead
mov @stLVC.cchTextMax,20
push _lpszHead
pop @stLVC.pszText
push _dwWidth
pop @stLVC.lx
invoke SendDlgItemMessage,hWin,_hDlgID,LVM_INSERTCOLUMN,_dwColumn,addr @stLVC
popad
ret
ListViewAddColumn endp
ListViewSetItem proc uses ebx esi edi hWin,_hDlgID,_dwItem,_dwSubItem,_lpszText
local @stLVI:LV_ITEM
invoke RtlZeroMemory,addr @stLVI,sizeof LV_ITEM
invoke lstrlen,_lpszText
mov @stLVI.cchTextMax,eax
mov @stLVI.imask,LVIF_TEXT
push _lpszText
pop @stLVI.pszText
push _dwItem
pop @stLVI.iItem
push _dwSubItem
pop @stLVI.iSubItem
.if _dwSubItem == -1
mov @stLVI.iSubItem,0
invoke SendDlgItemMessage,hWin,_hDlgID,LVM_INSERTITEM,NULL,addr @stLVI
.else
invoke SendDlgItemMessage,hWin,_hDlgID,LVM_SETITEM,NULL,addr @stLVI
.endif
ret
ListViewSetItem endp
ListViewClear proc uses ebx esi edi hWin,hDlgID,Flags ;参数1:对话框句柄 参数2:控件ID 参数3:是否删除列 非零时为删除列
pushad
invoke SendDlgItemMessage,hWin,hDlgID,LVM_DELETEALLITEMS,0,0
.if Flags
.while TRUE
invoke SendDlgItemMessage,hWin,hDlgID,LVM_DELETECOLUMN,0,0
.break .if ! eax
.endw
.endif
popad
ret
ListViewClear endp
InitRButton proc uses ebx esi edi
invoke CreatePopupMenu
mov hPopMenu,eax
invoke AppendMenu,hPopMenu,MF_STRING,ID_MENU_JG,addr szCopyJG
invoke AppendMenu,hPopMenu,MF_STRING,ID_MENU_NAME,addr szCopyName
invoke AppendMenu,hPopMenu,MF_STRING,ID_MENU_NOTE,addr szCopyNote
ret
InitRButton endp
HexToDec proc uses ebx esi edi lpString:dword,IstrLen:dword
LOCAL intShu:dword
.if IstrLen <= 4
mov esi,lpString
push esi
cld
xor eax,eax
mov ebx,16
.while TRUE
movzx ecx,byte ptr [esi]
inc esi
.break .if ! ecx
.if ecx != '-'
.if cl > 60h
sub cl,57h
.elseif cl > '9'
sub cl,'A' - 0ah
.else
sub cl,'0'
.endif
mul ebx
add eax,ecx
.endif
mov intShu,eax
.endw
pop ecx
movzx eax,byte ptr [ecx]
.if eax == '-'
not intShu
add intShu,1
.endif
mov eax,intShu
.else
mov eax,-1
.endif
ret
HexToDec endp
StringToHex proc uses ebx esi edi EsiString:dword,StriLen:dword ;字符串到内存数据转换 ->返回字符串的长度
LOCAL @inc,@Cont
invoke RtlZeroMemory,addr DataBuf,sizeof DataBuf
mov @inc,0
xor edx,edx
mov esi,EsiString
lea edi,DataBuf
inc StriLen
mov ebx,StriLen
shr ebx,1
.while ebx
mov dl,byte ptr [esi]
.if dl != 20h
mov ecx,2
@@: mov dl,byte ptr [esi]
.if dl == 2Bh
.elseif dl > 40h
sub dl,37h
.else
sub dl,30h
.endif
.if dl != 2Bh
.if ecx == 2
shl dl,4
or byte ptr [edi],dl
.else
or byte ptr [edi],dl
.endif
.else
or byte ptr [edi],dl
.endif
inc esi
loop @B
inc edi
.else
.if @inc == 1
inc ebx
mov @inc,0
.else
inc @inc
.endif
inc esi
.endif
dec ebx
.endw
lea eax,DataBuf
sub edi,eax
mov eax,edi
ret
StringToHex endp
StringToHex04 proc uses ebx esi edi lpString:dword,Str0Len:dword
LOCAL buf[10]:byte
invoke RtlZeroMemory,addr buf,sizeof buf
xor edx,edx
mov esi,lpString
add esi,Str0Len
dec esi
lea edi,buf
shr Str0Len,1
mov ebx,Str0Len ;
.while ebx
mov dl,byte ptr [esi]
mov ecx,2
@@: mov dl,byte ptr [esi]
.if dl > 60h
sub dl,57h
.elseif dl > 40h
sub dl,37h
.elseif dl > 2Fh
sub dl,30h
.endif
.if ecx == 2
or byte ptr [edi],dl
.else
shl dl,4
or byte ptr [edi],dl
.endif
dec esi
loop @B
inc edi
dec ebx
.endw
.if Str0Len == 0
movzx eax,byte ptr [buf]
.elseif Str0Len == 1
movzx eax,word ptr [buf]
.elseif Str0Len == 2
mov eax,dword ptr [buf]
.endif
ret
StringToHex04 endp
SreachMem proc uses ebx esi edi ProcessID:dword,lpString:dword,SreachMod:dword,PianYi:dword
LOCAL @szbuf[1000H]:byte
mov esi,FileBase ;全局变量,用来定搜索主进程范围
mov edi,esi
add esi,FileSize1 ;全局变量,用来定搜索主进程范围
.if ProcessID != 0
.repeat
push edi ;返回值
invoke ReadProcessMemory,ProcessID,edi,addr @szbuf,1000H,0
;invoke GetDlgItemText,hWnd0,IDC_EDT5,addr buf,sizeof buf
invoke lstrlen,lpString
invoke StringToHex,lpString,eax
mov ebx,eax
xor eax,eax ;缓存区首地址
xor edx,edx ;特征码
dec ebx ;字符串是从零开始的 所以要减一
.while (eax < 1000h) && (edx<ebx) && (ebx!=-1)
push eax
push edx
mov al,byte ptr [@szbuf+eax]
lea ecx,dword ptr [DataBuf] ;取得搜索地址
mov dl,byte ptr [ecx+edx]
.if (al == dl) || (dl == 2bh)
pop edx
inc edx
pop eax
inc eax
.elseif ;下面4句使指针指向要找的字符串首
pop edx
pop eax
xor edx,edx
inc eax
.endif
.endw
pop edi
.if edx == ebx
sub eax,ebx
add edi,eax
mov eax,edi
jmp var ;找到了特征码
.endif
add edi,1000h
.until edi > esi
.if edx != ebx
mov eax,0FFFFFFFh
ret
.endif
.elseif
xor eax,eax
ret
.endif
var:
add eax,PianYi
.if SreachMod != 0Bh
mov ecx,eax
invoke ReadProcessMemory,ProcessID,ecx,addr @szbuf,4,0
xor eax,eax
.if SreachMod == 0Ah
mov eax,dword ptr [@szbuf]
.elseif SreachMod == 0Ch
mov al,byte ptr [@szbuf]
.elseif SreachMod == 0Dh
mov ax,word ptr [@szbuf]
.elseif SreachMod == 0Eh
mov eax,dword ptr [@szbuf]
.endif
.endif
ret
SreachMem endp
GetMoudelData proc uses ebx esi edi PeId:dword,szProName:dword
LOCAL @stModu:MODULEENTRY32
LOCAL @hSnapShot
invoke RtlZeroMemory,addr @stModu,Sizeof @stModu
mov @stModu.dwSize,Sizeof @stModu
invoke CreateToolhelp32Snapshot,TH32CS_SNAPMODULE,PeId
mov @hSnapShot,eax
invoke Module32First,@hSnapShot,addr @stModu
.while eax
invoke lstrcmp,szProName,addr @stModu.szModule
.if eax == 0
push @stModu.modBaseAddr
pop FileBase
push @stModu.modBaseSize
pop FileSize1
invoke CloseHandle,@hSnapShot
ret
.endif
invoke Module32Next,@hSnapShot,addr @stModu
.endw
invoke CloseHandle,@hSnapShot
ret
GetMoudelData endp
GetProcessID proc uses ebx esi edi szProName:dword,szThreadName:dword
LOCAL @stProcess:PROCESSENTRY32
LOCAL @hSnapShot
invoke RtlZeroMemory,addr @stProcess,Sizeof @stProcess
mov @stProcess.dwSize,Sizeof @stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,NULL
mov @hSnapShot,eax
invoke Process32First,@hSnapShot,addr @stProcess
.while eax
invoke lstrcmp,szProName,addr @stProcess.szExeFile
.if eax == 0
invoke GetMoudelData,@stProcess.th32ProcessID,szThreadName
invoke CloseHandle,@hSnapShot
mov eax,@stProcess.th32ProcessID ;成功:保存ID 到eax
ret
.endif
invoke Process32Next,@hSnapShot,addr @stProcess
.endw
invoke CloseHandle,@hSnapShot
mov eax,0 ;失败:返回0 到eax
ret
GetProcessID endp
GetProcessList proc uses ebx esi edi hWin:dword,DlgID:dword
local @stProcess:PROCESSENTRY32
local @hSnapShot,@Count
LOCAL @Count01[256]:byte
invoke RtlZeroMemory,addr @stProcess,sizeof @stProcess
invoke SendDlgItemMessage,hWin,DlgID,CB_RESETCONTENT,0,0
invoke SendDlgItemMessage,hWin,DlgID,CB_ADDSTRING,0,L(" 请选择正确的进程!")
mov @stProcess.dwSize,sizeof @stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0
mov @hSnapShot,eax
invoke Process32First,@hSnapShot,addr @stProcess
xor edx,edx
mov @Count,0
.while eax
mov ebx,@stProcess.th32ProcessID
mov edx,@Count
inc edx
mov @Count,edx
invoke SendDlgItemMessage,hWin,IDC_CBO1,CB_ADDSTRING,0,addr @stProcess.szExeFile
invoke Process32Next,@hSnapShot,addr @stProcess
.endw
invoke CloseHandle,@hSnapShot
invoke SendDlgItemMessage,hWin,DlgID,CB_SETCURSEL,0,0
ret
GetProcessList endp
ShengChenTextOrEdti proc uses ebx esi edi hWin:dword,aFlag:dword ;生成列表文件
LOCAL buf[256]:byte
mov edi,NoMsgCountLvs1
.if aFlag
invoke ListViewSetItem,hWin,IDC_LSV1,edi,-1,0
.endif
xor esi,esi
invoke RtlZeroMemory,addr buf,sizeof buf
invoke GetDlgItemText,hWin,IDC_EDT3,addr buf,sizeof buf
.if eax == NULL
invoke MessageBox,hWin,L("请写入名称!"),L("提示"),MB_ICONQUESTION
invoke GetDlgItem,hWin,IDC_EDT3
invoke SetFocus,eax
ret
.else
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,addr buf
.endif
inc esi
invoke RtlZeroMemory,addr buf,sizeof buf
invoke GetDlgItemText,hWin,IDC_EDT4,addr buf,sizeof buf
.if eax == NULL
invoke MessageBox,hWin,L("请写入备注!"),L("提示"),MB_ICONQUESTION
invoke GetDlgItem,hWin,IDC_EDT4
invoke SetFocus,eax
ret
.else
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,addr buf
.endif
inc esi
invoke RtlZeroMemory,addr buf,sizeof buf
invoke GetDlgItemText,hWin,IDC_EDT5,addr buf,sizeof buf
.if eax == NULL
invoke MessageBox,hWin,L("请写入特征码!"),L("提示"),MB_ICONQUESTION
invoke GetDlgItem,hWin,IDC_EDT5
invoke SetFocus,eax
ret
.else
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,addr buf
.endif
inc esi
mov ebx,IDC_RBN1
.while TRUE
invoke IsDlgButtonChecked,hWin,ebx
.break .if eax == BST_CHECKED
inc ebx
.endw
sub ebx,IDC_RBN1
.if ebx == 0
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,L("A")
.elseif ebx == 1
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,L("B")
.elseif ebx == 2
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,L("C")
.elseif ebx == 3
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,L("D")
.elseif ebx == 4
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,L("E")
.endif
inc esi
invoke RtlZeroMemory,addr buf,sizeof buf
invoke GetDlgItemText,hWin,IDC_EDT6,addr buf,sizeof buf
.if eax
invoke ListViewSetItem,hWin,IDC_LSV1,edi,esi,addr buf
.else
invoke MessageBox,hWin,L("请写入偏移"),L("提示"),MB_ICONQUESTION
invoke GetDlgItem,hWin,IDC_EDT6
invoke SetFocus,eax
ret
.endif
.if aFlag
inc NoMsgCountLvs1
.endif
ret
ShengChenTextOrEdti endp
StartSreach proc uses ebx esi edi hWin:dword
LOCAL @stLvi:LV_ITEM
LOCAL buf[300]:byte
LOCAL buf1[10]:byte
LOCAL @Class:dword,@byteOffset:dword
invoke RtlZeroMemory,addr @stLvi,sizeof @stLvi
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEMCOUNT,0,0
xor edi,edi
dec eax
mov ebx,eax
.while ebx
invoke ListViewSetItem,hWin,IDC_LSV2,edi,-1,0
xor esi,esi
invoke RtlZeroMemory,addr buf,sizeof buf
mov @stLvi.imask,LVIF_TEXT
mov @stLvi.iItem,edi
mov @stLvi.iSubItem,0
lea eax,buf
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,addr @stLvi
.if eax
invoke ListViewSetItem,hWin,IDC_LSV2,edi,esi,addr buf
inc esi
.else
ret
.endif
invoke RtlZeroMemory,addr buf,sizeof buf
mov @stLvi.iSubItem,2
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,addr @stLvi
.if eax
;写入搜索代码
invoke RtlZeroMemory,addr buf1,sizeof buf1
mov @stLvi.iSubItem,3
lea eax,buf1
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf1
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,addr @stLvi
movzx eax,byte ptr [buf1]
sub eax,37h
mov @Class,eax
invoke RtlZeroMemory,addr buf1,sizeof buf1
mov @stLvi.iSubItem,4
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,addr @stLvi
invoke lstrlen,addr buf1
invoke HexToDec,addr buf1,eax
invoke SreachMem,ProhWnd,addr buf,@Class,eax ;搜索代码
.if eax != -1
invoke wsprintf,addr buf,offset FmtSyS01,eax
invoke ListViewSetItem,hWin,IDC_LSV2,edi,esi,addr buf
.else
invoke wsprintf,addr buf,offset FmtSyS01,eax
invoke ListViewSetItem,hWin,IDC_LSV2,edi,esi,addr buf
.endif
.endif
inc esi
invoke RtlZeroMemory,addr buf,sizeof buf
lea eax,buf
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf
mov @stLvi.iSubItem,1
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,addr @stLvi
.if eax
invoke ListViewSetItem,hWin,IDC_LSV2,edi,esi,addr buf
.endif
inc edi
dec ebx
.endw
ret
StartSreach endp
GetLsvDate proc uses ebx esi edi hWin:dword,CounItem:dword
LOCAL @stLvi:LV_ITEM
LOCAL buf[300]:byte
mov edi,CounItem
invoke RtlZeroMemory,addr @stLvi,sizeof @stLvi
mov @stLvi.imask,LVIF_TEXT
mov @stLvi.iItem,edi
mov @stLvi.iSubItem,0
lea eax,buf
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
.if eax
invoke SetDlgItemText,hWin,IDC_EDT3,addr buf
.endif
mov @stLvi.iSubItem,1
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
.if eax
invoke SetDlgItemText,hWin,IDC_EDT4,ADDR buf
.endif
mov @stLvi.iSubItem,2
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
.if eax
invoke SetDlgItemText,hWin,IDC_EDT5,ADDR buf
.endif
mov @stLvi.iSubItem,3
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
.if eax
movzx eax,byte ptr [buf]
.if eax
sub eax,41h
add eax,IDC_RBN1
invoke CheckRadioButton,hWin,IDC_RBN1,IDC_RBN5,eax
.endif
.endif
mov @stLvi.iSubItem,4
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
.if eax
invoke SetDlgItemText,hWin,IDC_EDT6,ADDR buf
.endif
ret
GetLsvDate endp
DaoRuFile proc uses ebx esi edi hWin:dword ;导入文件 注:不要读取大于3000H个字节文件合12000个字节
local @stOF:OPENFILENAME
LOCAL hWndFile:dword,nUmberOfbyte:dword,bufReadLong:dword
LOCAL buf[3000h]:byte
LOCAL buf01[300]:byte
LOCAL @Edi:dword,@Esi:dword
mov @Edi,0
mov @Esi,0
invoke RtlZeroMemory,addr @stOF,sizeof @stOF
mov @stOF.lStructSize,sizeof @stOF
push hWin
pop @stOF.hwndOwner
mov @stOF.lpstrFilter,offset szFilter
mov @stOF.lpstrFile,offset szFileName
mov @stOF.nMaxFile,MAX_PATH
mov @stOF.Flags,OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST
invoke GetOpenFileName,addr @stOF
.if eax
invoke CreateFile,addr szFileName,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_READONLY,NULL
mov hWndFile,eax
.while TRUE
invoke RtlZeroMemory,addr buf,sizeof buf
invoke ReadFile,hWndFile,addr buf,sizeof buf,addr nUmberOfbyte,NULL
.break .if ! nUmberOfbyte
.if eax
lea esi,dword ptr [buf]
mov ebx,esi
invoke lstrlen,addr buf
mov bufReadLong,eax
.while bufReadLong
.if dword ptr [esi] == '|::|'
mov eax,esi
sub eax,ebx ;字符串的长度
push eax
invoke RtlZeroMemory,addr buf01,sizeof buf01
pop eax
invoke RtlMoveMemory,addr buf01,ebx,eax
invoke ListViewSetItem,hWin,IDC_LSV1,@Edi,@Esi,addr buf01
mov ebx,esi ;更新ebx以便有计下一个字符串的长度
add ebx,4
inc @Esi
.if @Esi == 5
inc @Edi
mov @Esi,0
invoke ListViewSetItem,hWin,IDC_LSV1,@Edi,-1,0
add ebx,2
.endif
.endif
inc esi
dec bufReadLong
.endw
.endif
.endw
invoke CloseHandle,hWndFile
.endif
ret
DaoRuFile endp
SaveAsFile proc uses ebx esi edi hWin:dword ;保存的文件
LOCAL @stOF:OPENFILENAME
LOCAL @stLvi:LV_ITEM
LOCAL buf01[80]:byte
LOCAL buf02[80]:byte
LOCAL buf03[300]:byte
LOCAL buf04[10]:byte
LOCAL buf05[10]:byte
LOCAL buf[500]:byte
LOCAL nUmberOfbyte:dword,hFile:dword
invoke RtlZeroMemory,addr @stOF,sizeof @stOF
mov @stOF.lStructSize,sizeof @stOF
push hWin
pop @stOF.hwndOwner
mov @stOF.lpstrFilter,offset szFilter
mov @stOF.lpstrFile,offset szFileName
mov @stOF.nMaxFile,MAX_PATH
mov @stOF.Flags,OFN_PATHMUSTEXIST
mov @stOF.lpstrDefExt,offset szDefExt
mov @stOF.lpstrTitle,offset szSaveCaption
invoke GetSaveFileName,addr @stOF ;获取保存文件名+路径
xor esi,esi
xor edi,edi
.if eax
invoke CreateFile,addr szFileName,GENERIC_WRITE,FILE_SHARE_READ,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
mov hFile,eax
.if eax
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEMCOUNT,0,0
dec eax
mov ebx,eax
.while ebx
invoke RtlZeroMemory,addr buf01,sizeof buf01
mov @stLvi.imask,LVIF_TEXT
mov @stLvi.iItem,edi
mov @stLvi.iSubItem,esi
lea eax,buf01
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf01
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf02,sizeof buf02
inc esi
mov @stLvi.iSubItem,esi
lea eax,buf02
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf02
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf03,sizeof buf03
inc esi
mov @stLvi.iSubItem,esi
lea eax,buf03
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf03
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf04,sizeof buf04
inc esi
mov @stLvi.iSubItem,esi
lea eax,buf04
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf04
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf05,sizeof buf05
inc esi
mov @stLvi.iSubItem,esi
lea eax,buf05
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf05
invoke SendDlgItemMessage,hWin,IDC_LSV1,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf,sizeof buf
invoke wsprintf,addr buf,offset FmtLsvSave,addr buf01,addr buf02,addr buf03,addr buf04,addr buf05
invoke lstrlen,addr buf
mov ecx,eax
invoke WriteFile,hFile,addr buf,ecx,addr nUmberOfbyte,NULL
inc edi
xor esi,esi
dec ebx
.endw
.endif
invoke CloseHandle,hFile
.endif
ret
SaveAsFile endp
ShenChenCode proc uses ebx edi esi hWin:dword,CodeClass:dword
LOCAL @stOF:OPENFILENAME
LOCAL @stLvi:LV_ITEM
LOCAL hFile:dword,nUmberOfbyte:dword
LOCAL buf01[80]:byte
LOCAL buf02[10]:byte
LOCAL buf03[100]:byte
LOCAL buf[250]:byte
invoke RtlZeroMemory,addr @stOF,sizeof @stOF
mov @stOF.lStructSize,sizeof @stOF
push hWin
pop @stOF.hwndOwner
mov @stOF.lpstrFilter,offset szFilter1
mov @stOF.lpstrFile,offset szFileName
mov @stOF.nMaxFile,MAX_PATH
mov @stOF.Flags,OFN_PATHMUSTEXIST
mov @stOF.lpstrDefExt,offset szDefExt1
mov @stOF.lpstrTitle,offset szSaveCaption
invoke GetSaveFileName,addr @stOF ;获取保存文件名+路径
xor esi,esi
xor edi,edi
.if eax
invoke CreateFile,addr szFileName,GENERIC_WRITE,FILE_SHARE_READ,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
mov hFile,eax
.if eax
invoke SendDlgItemMessage,hWin,IDC_LSV2,LVM_GETITEMCOUNT,0,0
mov ebx,eax
.while ebx
invoke RtlZeroMemory,addr buf01,sizeof buf01
mov @stLvi.imask,LVIF_TEXT
mov @stLvi.iItem,edi
mov @stLvi.iSubItem,esi
lea eax,buf01
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf01
invoke SendDlgItemMessage,hWin,IDC_LSV2,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf02,sizeof buf02
inc esi
mov @stLvi.iSubItem,esi
lea eax,buf02
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf02
invoke SendDlgItemMessage,hWin,IDC_LSV2,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf03,sizeof buf03
inc esi
mov @stLvi.iSubItem,esi
lea eax,buf03
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf03
invoke SendDlgItemMessage,hWin,IDC_LSV2,LVM_GETITEM,0,ADDR @stLvi
invoke RtlZeroMemory,addr buf,sizeof buf
.if CodeClass == 0 ;输入语言类型格式
lea edx,FmtSaveCodeAsm
.elseif CodeClass == 1
lea edx,FmtSaveCodeC
.elseif CodeClass == 2
lea edx,FmtSaveDelphi
.endif
invoke wsprintf,addr buf,edx,addr buf01,addr buf02,addr buf03
invoke lstrlen,addr buf
mov ecx,eax
invoke WriteFile,hFile,addr buf,ecx,addr nUmberOfbyte,NULL
inc edi
xor esi,esi
dec ebx
.endw
.endif
invoke CloseHandle,hFile
.endif
ret
ShenChenCode endp
@Tab1Proc proc uses ebx esi edi hWnd,uMsg,wParam,lParam
LOCAL buf[30]
mov eax,uMsg
.if eax == WM_COMMAND
mov eax,wParam
.if ax == IDC_BTN205
invoke GetDlgItem,hWnd0,IDC_BTN2
invoke EnableWindow,eax,TRUE
invoke EndDialog,hWnd,0
.elseif ax == IDC_BTN201
invoke GetDlgItemText,hWnd,IDC_EDT201,addr buf,sizeof buf
invoke HexToDec,addr buf,eax
.if eax == -1
ret
.endif
mov esi,eax
invoke GetDlgItemText,hWnd,IDC_EDT202,addr buf,sizeof buf
invoke HexToDec,addr buf,eax
.if eax == -1
ret
.endif
mov edi,eax
invoke GetDlgItemText,hWnd,IDC_EDT203,addr buf,sizeof buf
invoke HexToDec,addr buf,eax
.if eax == -1
ret
.endif
sub edi,esi
add eax,edi
invoke wsprintf,addr buf,offset FmtSyS,eax
invoke SetDlgItemText,hWnd0,IDC_EDT6,ADDR buf
.endif
.elseif eax == WM_INITDIALOG
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
@Tab1Proc endp
ProDlgMain proc uses ebx esi edi hWnd,uMsg,wParam,lParam
LOCAL @stLvi:LV_ITEM
LOCAL buf[80]:byte
LOCAL buf01[400]:byte
LOCAL @stCursorPt:POINT
LOCAL @Ecx:dword,@Edx:dword
mov eax,uMsg
.if eax == WM_TIMER
.elseif eax == WM_COMMAND
mov eax,wParam
.if ax == IDC_BTN1 ;刷新按钮
invoke GetProcessList,hWnd,IDC_CBO1
.elseif ax == IDC_BTN2
push hWnd
pop hWnd0
invoke CreateDialogParam,hInstanc,IDD_SUB1,hWnd,addr @Tab1Proc,0
invoke GetDlgItem,hWnd,IDC_BTN2
invoke EnableWindow,eax,FALSE
.elseif ax == IDC_BTN3 ;测试按钮
invoke SendDlgItemMessage,hWnd,IDC_CBO1,CB_GETCURSEL,0,0
mov ecx,eax
invoke SendDlgItemMessage,hWnd,IDC_CBO1,CB_GETLBTEXT,ecx,addr buf
invoke GetProcessID,addr buf,addr buf
.if !eax
invoke MessageBox,hWnd,L("提示"),L("进程ID获取失败"),MB_ICONQUESTION
ret
.endif
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,eax
.if eax
mov ebx,eax
mov esi,IDC_RBN1
.while TRUE
invoke IsDlgButtonChecked,hWnd,esi
.break .if eax == BST_CHECKED
inc esi
.endw
sub esi,IDC_RBN1
.if esi == 0
mov eax,0ah
.elseif esi == 1
mov eax,0bh
.elseif esi == 2
mov eax,0ch
.elseif esi == 3
mov eax,0dh
.elseif esi == 4
mov eax,0eh
.endif
mov edi,eax
invoke RtlZeroMemory,addr buf,sizeof buf
invoke GetDlgItemText,hWnd,IDC_EDT6,addr buf,sizeof buf
.if !eax
ret
.endif
invoke HexToDec,addr buf,eax
mov esi,eax
invoke RtlZeroMemory,addr buf01,sizeof buf01
invoke GetDlgItemText,hWnd,IDC_EDT5,ADDR buf01,sizeof buf01
.if !eax
ret
.endif
invoke SreachMem,ebx,addr buf01,edi,esi
invoke wsprintf,addr buf,addr FmtSyS,eax
invoke SetDlgItemText,hWnd,IDC_EDT7,addr buf
.else
invoke MessageBox,hWnd,L("提示"),L("进程句柄获取失败"),MB_ICONQUESTION
.endif
invoke CloseHandle,ebx
.elseif ax == IDC_BTN4 ;生成按钮
invoke ShengChenTextOrEdti,hWnd,1
.elseif ax == IDC_BTN5 ;删除指定行
.if NoMsgCountLvs1 >= 0
invoke SendDlgItemMessage,hWnd,IDC_LSV1,LVM_GETITEMCOUNT,0,0
.if eax > 1
invoke SendDlgItemMessage,hWnd,IDC_LSV1,LVM_DELETEITEM,NoMsgCountLvs1,0
.endif
.endif
.elseif ax == IDC_BTN6 ;开始搜索
invoke SendDlgItemMessage,hWnd,IDC_LSV2,LVM_GETITEMCOUNT,0,0
.if eax
dec eax
mov ebx,eax
.while ebx != -1
invoke SendDlgItemMessage,hWnd,IDC_LSV2,LVM_DELETEITEM,ebx,0
dec ebx
.endw
.endif
invoke SendDlgItemMessage,hWnd,IDC_CBO1,CB_GETCURSEL,0,0
mov ecx,eax
invoke SendDlgItemMessage,hWnd,IDC_CBO1,CB_GETLBTEXT,ecx,addr buf
invoke GetProcessID,addr buf,addr buf
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,eax
mov ProhWnd,eax
.if eax
invoke StartSreach,hWnd
invoke CloseHandle,ProhWnd
mov ProhWnd,0
.else
invoke SetDlgItemText,hWnd,IDC_BTN6,L("进程为空")
.endif
.elseif ax == IDC_CBO1
invoke SendDlgItemMessage,hWnd,IDC_CBO1,CB_GETCURSEL,0,0
mov ecx,eax
invoke SendDlgItemMessage,hWnd,IDC_CBO1,CB_GETLBTEXT,ecx,addr buf
.if eax
invoke lstrcmp,addr buf,L(" 请选择正确的进程!")
.if eax == 0
invoke SetDlgItemText,hWnd,IDC_BTN6,L("开始搜索")
.endif
.endif
.elseif ax == IDC_CHK1
invoke GetDlgItemInt,hWnd,IDC_EDT1,0,FALSE
.if eax
mov FileBase,eax
.endif
invoke GetDlgItemInt,hWnd,IDC_EDT2,0,FALSE
.if eax
mov FileSize1,eax
.endif
.elseif ax == IDC_BTN7
invoke DaoRuFile,hWnd
.elseif ax == IDC_BTN8
invoke SaveAsFile,hWnd
.elseif ax == IDC_BTN9 ;生成代码
invoke SendDlgItemMessage,hWnd,IDC_CBO2,CB_GETCURSEL,0,0
invoke ShenChenCode,hWnd,eax
.elseif ax == IDC_BTN10
mov eax,NoMsgCountLvs1
inc eax
invoke wsprintf,addr buf01,offset szProt,eax
invoke MessageBox,hWnd,addr buf01,L("提示"),MB_OKCANCEL or MB_ICONQUESTION
.if eax == 1
invoke ShengChenTextOrEdti,hWnd,0
.endif
.elseif (ax >= ID_MENU_NAME) && (ax <= ID_MENU_NOTE)
movzx eax,ax
sub eax,300
mov esi,eax
mov edi,NoMsgCountLvs2
invoke RtlZeroMemory,addr @stLvi,sizeof @stLvi
invoke RtlZeroMemory,addr buf,sizeof buf
mov @stLvi.imask,LVIF_TEXT
mov @stLvi.iItem,edi
mov @stLvi.iSubItem,esi
lea eax,buf
mov @stLvi.pszText,eax
mov @stLvi.cchTextMax,sizeof buf
invoke SendDlgItemMessage,hWnd,IDC_LSV2,LVM_GETITEM,0,ADDR @stLvi
.if eax
invoke lstrlen,addr buf
inc eax
push eax
invoke GlobalAlloc,GHND,eax
mov esi,eax
invoke GlobalLock,eax
mov edi,eax
pop eax
invoke RtlMoveMemory,edi,addr buf,eax
invoke GlobalUnlock,edi
invoke OpenClipboard,hWnd
invoke EmptyClipboard
invoke SetClipboardData,CF_TEXT,esi ;为什么总是执行第二次这个函数才执行成功,以上函数都执行成功
invoke CloseClipboard
.endif
.elseif ax == IDC_EDT5
mov eax,wParam
shr eax,10h
.if ax == 100h
invoke OpenClipboard,NULL
invoke GetClipboardData,CF_TEXT
mov esi,eax
invoke lstrlen,eax
nop
nop
.if eax > 63h
mov @Ecx,eax
invoke RtlZeroMemory,addr buf01,sizeof buf01
lea edi,buf01
.if word ptr [esi+5Fh] == 0a0dh
mov eax,@Ecx ;长度
mov ecx,5Fh
div ecx
mov ebx,eax
inc ebx
mov ecx,esi
add ecx,@Ecx
mov @Edx,ecx
mov eax,60h
.repeat
.if eax < 5Fh
mov ecx,edx
.else
mov ecx,5Fh
.endif
rep movsb
add esi,2h
dec ebx
.break .if ebx == 0
mov byte ptr [edi],20h
inc edi
push @Edx
sub @Edx,esi
mov eax,@Edx
pop @Edx
.until FALSE
.endif
invoke CloseClipboard
invoke lstrlen,addr buf01
inc eax
push eax
invoke GlobalAlloc,GHND,eax
mov esi,eax
invoke GlobalLock,eax
mov edi,eax
pop eax
invoke RtlMoveMemory,edi,addr buf01,eax
invoke GlobalUnlock,edi
invoke OpenClipboard,hWnd
invoke EmptyClipboard
invoke SetClipboardData,CF_TEXT,esi ;为什么总是执行第二次这个函数才执行成功,以上函数都执行成功
.endif
invoke CloseClipboard
.endif
.endif
.elseif eax == WM_NOTIFY
mov eax,wParam
.if ax == IDC_LSV1
mov eax,lParam
.if [eax].NMHDR.code == NM_CLICK
mov ecx, (NM_LISTVIEW ptr [eax]).iItem
mov NoMsgCountLvs1,ecx
.elseif [eax].NMHDR.code == NM_RCLICK
mov ecx, (NM_LISTVIEW ptr [eax]).iItem
mov NoMsgCountLvs1,ecx
invoke GetLsvDate,hWnd,ecx
.endif
.elseif ax == IDC_LSV2
mov eax,lParam
.if [eax].NMHDR.code == NM_RCLICK
mov ecx,(NM_LISTVIEW ptr [eax]).iItem
mov NoMsgCountLvs2,ecx
invoke GetCursorPos,addr @stCursorPt
invoke TrackPopupMenu,hPopMenu,TPM_LEFTBUTTON,@stCursorPt.x,@stCursorPt.y,NULL,hWnd,NULL
.elseif [eax].NMHDR.code == NM_CLICK
mov ecx, (NM_LISTVIEW ptr [eax]).iItem
mov NoMsgCountLvs2,ecx
.endif
.endif
.elseif eax == WM_CLOSE
invoke KillTimer,hWnd,ID_Timer
invoke EndDialog,hWnd,0
invoke CloseHandle,hInstanc
.elseif eax == WM_INITDIALOG
invoke LoadIcon,hInstanc,ICO_MAIN ;加载图标
invoke SendMessage,hWnd,WM_SETICON,ICON_BIG,eax
;>>>>>特征码列表
invoke SendDlgItemMessage,hWnd,IDC_LSV1,LVM_SETEXTENDEDLISTVIEWSTYLE,0,LVS_EX_FULLROWSELECT or LVS_EX_GRIDLINES
invoke ListViewAddColumn,hWnd,IDC_LSV1,0,100,L("名称")
invoke ListViewAddColumn,hWnd,IDC_LSV1,1,150,L("备注")
invoke ListViewAddColumn,hWnd,IDC_LSV1,2,300,L("特征码")
invoke ListViewAddColumn,hWnd,IDC_LSV1,3,50,L("类型")
invoke ListViewAddColumn,hWnd,IDC_LSV1,4,70,L("偏移值")
;>>>>>>结果列表
invoke SendDlgItemMessage,hWnd,IDC_LSV2,LVM_SETEXTENDEDLISTVIEWSTYLE,0,LVS_EX_FULLROWSELECT or LVS_EX_GRIDLINES
invoke ListViewAddColumn,hWnd,IDC_LSV2,0,100,L("名称")
invoke ListViewAddColumn,hWnd,IDC_LSV2,1,70,L("结果")
invoke ListViewAddColumn,hWnd,IDC_LSV2,2,200,L("备注")
invoke GetProcessList,hWnd,IDC_CBO1
invoke CheckDlgButton,hWnd,IDC_RBN1,BST_CHECKED
invoke SendDlgItemMessage,hWnd,IDC_EDT5,EM_LIMITTEXT,400,0
invoke ListViewSetItem,hWnd,IDC_LSV1,0,-1,0 ;增加一行
;>>>>>>添加保存类型
invoke SendDlgItemMessage,hWnd,IDC_CBO2,CB_ADDSTRING,0,L("ASM")
invoke SendDlgItemMessage,hWnd,IDC_CBO2,CB_ADDSTRING,0,L("C++")
invoke SendDlgItemMessage,hWnd,IDC_CBO2,CB_ADDSTRING,0,L("Delphi")
invoke SendDlgItemMessage,hWnd,IDC_CBO2,CB_SETCURSEL,0,0
invoke InitRButton
; invoke SetTimer,hWnd,ID_Timer,300,0
; xor eax,eax
; mov dwNum,eax
; invoke lstrlenW,offset szA ;得到的长度是字数 字节数应乘2
; ;shl eax,1h
; mov dwLen,eax
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
ProDlgMain endp
start:
mov szIcce.dwSize ,sizeof INITCOMMONCONTROLSEX
mov szIcce.dwICC, ICC_WIN95_CLASSES or ICC_LISTVIEW_CLASSES or ICC_BAR_CLASSES
invoke InitCommonControlsEx,offset szIcce
invoke GetModuleHandle,NULL
mov hInstanc,eax
invoke DialogBoxParam,hInstanc,IDD_DLG1,NULL,offset ProDlgMain,NULL
invoke ExitProcess,NULL
end start
[课程]Linux pwn 探索篇!