.
386
.model flat, stdcall
option casemap:none
include windows.inc
include user32.inc
include kernel32.inc
include msvcrt.inc
includelib user32.lib
includelib kernel32.lib
includelib msvcrt.lib
.data
g_szExe db
"winmine.exe"
,
0
;被调试的进程
g_hExe dd
0
;进程句柄
g_szEXCEPTION_DEBUG_EVENT db
"EXCEPTION_DEBUG_EVENT"
,
0dh
,
0ah
,
0
g_szCREATE_THREAD_DEBUG_EVENT db
"CREATE_THREAD_DEBUG_EVENT"
,
0dh
,
0ah
,
0
g_szCREATE_PROCESS_DEBUG_EVENT db
"CREATE_PROCESS_DEBUG_EVENT"
,
0dh
,
0ah
,
0
g_szEXIT_THREAD_DEBUG_EVENT db
"EXIT_THREAD_DEBUG_EVENT"
,
0dh
,
0ah
,
0
g_szEXIT_PROCESS_DEBUG_EVENT db
"EXIT_PROCESS_DEBUG_EVENT"
,
0dh
,
0ah
,
0
g_szLOAD_DLL_DEBUG_EVENT db
"LOAD_DLL_DEBUG_EVENT"
,
0dh
,
0ah
,
0
g_szUNLOAD_DLL_DEBUG_EVENT db
"UNLOAD_DLL_DEBUG_EVENT"
,
0dh
,
0ah
,
0
g_szOUTPUT_DEBUG_STRING_EVENT db
"OUTPUT_DEBUG_STRING_EVENT"
,
0dh
,
0ah
,
0
g_szLoadDllFmt db
"%08X %s"
,
0dh
,
0ah
,
0
g_szwLoadDllFmt dw
'%'
,
'0'
,
'8'
,
'X'
,
' '
,
'%'
,
's'
,
0dh
,
0ah
,
0
.code
OnLoadDll proc uses esi pDE:ptr DEBUG_EVENT
LOCAL @dwAddr:DWORD
LOCAL @dwByteReaded:DWORD
LOCAL @szwPath[
512
]:WORD
invoke crt_printf, offset g_szLOAD_DLL_DEBUG_EVENT
invoke RtlZeroMemory,addr @szwPath, size @szwPath
mov esi,pDE
assume esi: ptr DEBUG_EVENT
invoke ReadProcessMemory,g_hExe,[esi].u.LoadDll.lpImageName,addr @dwAddr, size @dwAddr,addr @dwByteReaded
.
if
!eax
ret
.endif
invoke ReadProcessMemory,g_hExe, @dwAddr ,addr @szwPath, sizeof @szwPath,addr @dwByteReaded
.
if
!eax
ret
.endif
.
if
[esi].u.LoadDll.fUnicode ;如果是
unicode
invoke crt_wprintf, offset g_szwLoadDllFmt,[esi].u.LoadDll.lpBaseOfDll,addr @szwPath
.elseif
invoke crt_printf, offset g_szwLoadDllFmt,[esi].u.LoadDll.lpBaseOfDll,addr @szwPath
.endif
assume esi:nothing
ret
OnLoadDll endp
main proc
LOCAL @si:STARTUPINFO
LOCAL @pi:PROCESS_INFORMATION
LOCAL @de:DEBUG_EVENT ;这个结构体使用后需要清
0
;初始化变量
invoke RtlZeroMemory,addr @si, size @si
invoke RtlZeroMemory,addr @pi, size @pi
invoke RtlZeroMemory,addr @de, size @de
;建立调试会话
invoke CreateProcess,NULL,offset g_szExe,NULL,NULL,NULL,\
DEBUG_ONLY_THIS_PROCESS,NULL,NULL,addr @si,addr @pi
.
if
!eax
ret ;建立调试会话失败直接退出
.endif
mov eax,@pi.hProcess
mov g_hExe,eax
;循环接受调试事件
.
while
TRUE
invoke WaitForDebugEvent,addr @de,INFINITE
;处理调试事件
.
if
@de.dwDebugEventCode
=
=
EXCEPTION_DEBUG_EVENT ;异常
90
%
都是在处理这个
invoke crt_printf, offset g_szEXCEPTION_DEBUG_EVENT
.elseif @de.dwDebugEventCode
=
=
CREATE_THREAD_DEBUG_EVENT ;创建线程
invoke crt_printf, offset g_szCREATE_THREAD_DEBUG_EVENT
.elseif @de.dwDebugEventCode
=
=
CREATE_PROCESS_DEBUG_EVENT ;创建进程
invoke crt_printf, offset g_szCREATE_PROCESS_DEBUG_EVENT
.elseif @de.dwDebugEventCode
=
=
EXIT_THREAD_DEBUG_EVENT ;线程退出
invoke crt_printf, offset g_szEXIT_THREAD_DEBUG_EVENT
.elseif @de.dwDebugEventCode
=
=
EXIT_PROCESS_DEBUG_EVENT ;进程退出
invoke crt_printf, offset g_szEXIT_PROCESS_DEBUG_EVENT
.elseif @de.dwDebugEventCode
=
=
LOAD_DLL_DEBUG_EVENT ;dll被加载
;invoke crt_printf, offset g_szLOAD_DLL_DEBUG_EVENT
invoke OnLoadDll,addr @de
.elseif @de.dwDebugEventCode
=
=
UNLOAD_DLL_DEBUG_EVENT ;dll被卸载
invoke crt_printf, offset g_szUNLOAD_DLL_DEBUG_EVENT
.elseif @de.dwDebugEventCode
=
=
UNLOAD_DLL_DEBUG_EVENT ;输出信息
invoke crt_printf, offset g_szOUTPUT_DEBUG_STRING_EVENT
.endif
;提交事件处理结果
invoke ContinueDebugEvent,@de.dwProcessId,@de.dwThreadId,DBG_CONTINUE
;DEBUG_EVENT结构体使用后清
0
invoke RtlZeroMemory,addr @de, size @de
.endw
ret
main endp
start:
invoke main
end start