首页
社区
课程
招聘
请教,如何给dll做函数跳转的壳?
发表于: 2006-6-15 23:10 4123

请教,如何给dll做函数跳转的壳?

2006-6-15 23:10
4123
本人在做csp,想那dll去微软签名,故想做一个壳,里面的函数不真正实现,而是调用另外一个dll里面的同名函数。请问如何做壳?

哪位看雪网友帮忙回答一下,很着急啊。

先谢谢啦。
(等级不够,无法给kanxue发信啊。。。。。。。。。。。。)

[课程]Android-CTF解题方法汇总!

收藏
免费 0
支持
分享
最新回复 (4)
雪    币: 44229
活跃值: (19960)
能力值: (RANK:350 )
在线值:
发帖
回帖
粉丝
2
没太明白你意思。
调用另一个DLL函数可以用哪下2个函数实现:
LoadLibrary  
GetProcAddress
2006-6-16 09:55
0
雪    币: 6075
活跃值: (2236)
能力值: (RANK:1060 )
在线值:
发帖
回帖
粉丝
3
是不想用ForwardChain?
2006-6-16 10:21
0
雪    币: 2319
活跃值: (565)
能力值: (RANK:300 )
在线值:
发帖
回帖
粉丝
4
从 msdn magazine 抄的

Export Forwarding
A particularly slick feature of exports is the ability to "forward" an export to
another DLL. For example, in Windows NT®, Windows® 2000, and Windows
XP, the KERNEL32 HeapAlloc function is forwarded to the RtlAllocHeap function
exported by NTDLL. Forwarding is performed at link time by a special
syntax in the EXPORTS section of the .DEF file. Using HeapAlloc as an example,
KERNEL32's DEF file would contain:

   EXPORTS
   •••
   HeapAlloc = NTDLL.RtlAllocHeap

How can you tell if a function is forwarded rather than exported normally?
It's somewhat tricky. Normally, the EAT contains the RVA of the exported symbol.
However, if the function's RVA is inside the exports section (as given by the
VirtualAddress and Size fields in the DataDirectory), the symbol is forwarded.

When a symbol is forwarded, its RVA obviously can't be a code or data address
in the current module. Instead, the RVA points to an ASCII string of the DLL and
symbol name to which it is forwarded. In the prior example, it would be
NTDLL.RtlAllocHeap.
2006-6-16 11:17
0
雪    币: 44229
活跃值: (19960)
能力值: (RANK:350 )
在线值:
发帖
回帖
粉丝
5
以前 dREAMtHEATER翻译的:

   Export Forwarding是对一个函数的调用转至另一个DLL中的函数。例如,在Windows NT/2000/ XP中,KERNEL32的HeapAlloc函数被转向到由NTDLL输出的RtlAllocHeap。转向是在链接时实现的,通过在.DEF文件的EXPORTS区块内一个特殊的句法。用HeapAlloc作为一个范例,KERNEL32的DEF文件将包括:
   EXPORTS
   …
   HeapAlloc = NTDLL.RtlAllocHeap
   如何确定一个函数是被转向还是被正常输出的?正常地,EAT包含输出符号的RVA,但是,如果函数的RVA在输出区块内(由DataDirectory结构中的VirtualAddress和Size域给出),那么这个符号是转向的。
    当一个符号被转向,它的RVA明显地不能是当前模块中的一个代码或数据的地址,取代的是,RVA指向被转向到的DLL和符号名称的ASCII字符串。在前面的例子中,它将是NTDLL.RtlAllocHeap。
2006-6-16 20:57
0
游客
登录 | 注册 方可回帖
返回
//