首页
社区
课程
招聘
在程序入口添加ShellExecuteA出错[已解决]
发表于: 2006-8-19 10:47 9590

在程序入口添加ShellExecuteA出错[已解决]

2006-8-19 10:47
9590
我先用PEditor在程序的Imports中加入了ShellExecuteA
新建了一个节,修改入口点,然后添加了调用ShellExecuteA函数的代码
在OllyDBG中显示如下


为什么运行程序出现发送错误报告那种错误呢?

添加ShellExecuteA后出错的程序传上来了(后缀名是改的,改为.exe就可)

[课程]Android-CTF解题方法汇总!

上传的附件:
收藏
免费 0
支持
分享
最新回复 (16)
雪    币: 325
活跃值: (97)
能力值: ( LV13,RANK:530 )
在线值:
发帖
回帖
粉丝
2
参数传递有问题最好看清楚哪些可以为NULL
HINSTANCE ShellExecute(          HWND hwnd,
    LPCTSTR lpOperation,
    LPCTSTR lpFile,
    LPCTSTR lpParameters,
    LPCTSTR lpDirectory,
    INT nShowCmd
);
Parameters

hwnd
[in] Handle to the owner window used for displaying a user interface (UI) or error messages. This value can be NULL if the operation is not associated with a window.
lpOperation
[in] Pointer to a null-terminated string, referred to in this case as a verb, that specifies the action to be performed. The set of available verbs depends on the particular file or folder. Generally, the actions available from an object's shortcut menu are available verbs. For more information about verbs and their availability, see Object Verbs. See Extending Shortcut Menus for further discussion of shortcut menus. The following verbs are commonly used.
edit
Launches an editor and opens the document for editing. If lpFile is not a document file, the function will fail.
explore
Explores the folder specified by lpFile.
find
Initiates a search starting from the specified directory.
open
Opens the file specified by the lpFile parameter. The file can be an executable file, a document file, or a folder.
print
Prints the document file specified by lpFile. If lpFile is not a document file, the function will fail.
NULL
For systems prior to Microsoft Windows 2000, the default verb is used if it is valid and available in the registry. If not, the "open" verb is used.

For Windows 2000 and later systems, the default verb is used if available. If not, the "open" verb is used. If neither verb is available, the system uses the first verb listed in the registry.

lpFile
[in] Pointer to a null-terminated string that specifies the file or object on which to execute the specified verb. To specify a Shell namespace object, pass the fully qualified parse name. Note that not all verbs are supported on all objects. For example, not all document types support the "print" verb.
lpParameters
[in] If the lpFile parameter specifies an executable file, lpParameters is a pointer to a null-terminated string that specifies the parameters to be passed to the application. The format of this string is determined by the verb that is to be invoked. If lpFile specifies a document file, lpParameters should be NULL.
lpDirectory
[in] Pointer to a null-terminated string that specifies the default directory.
nShowCmd
[in] Flags that specify how an application is to be displayed when it is opened. If lpFile specifies a document file, the flag is simply passed to the associated application. It is up to the application to decide how to handle it.
SW_HIDE
Hides the window and activates another window.
SW_MAXIMIZE
Maximizes the specified window.
SW_MINIMIZE
Minimizes the specified window and activates the next top-level window in the z-order.
SW_RESTORE
Activates and displays the window. If the window is minimized or maximized, Windows restores it to its original size and position. An application should specify this flag when restoring a minimized window.
SW_SHOW
Activates the window and displays it in its current size and position.
SW_SHOWDEFAULT
Sets the show state based on the SW_ flag specified in the STARTUPINFO structure passed to the CreateProcess function by the program that started the application. An application should call ShowWindow with this flag to set the initial show state of its main window.
SW_SHOWMAXIMIZED
Activates the window and displays it as a maximized window.
SW_SHOWMINIMIZED
Activates the window and displays it as a minimized window.
SW_SHOWMINNOACTIVE
Displays the window as a minimized window. The active window remains active.
SW_SHOWNA
Displays the window in its current state. The active window remains active.
SW_SHOWNOACTIVATE
Displays a window in its most recent size and position. The active window remains active.
SW_SHOWNORMAL
Activates and displays a window. If the window is minimized or maximized, Windows restores it to its original size and position. An application should specify this flag when displaying the window for the first time.
2006-8-19 10:52
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
这种程序的动机是不是想制造垃圾广告呢?
2006-8-19 11:01
0
雪    币: 221
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
4
参数没问题,PUSH 0的地方都可以为NULL
2006-8-19 11:26
0
雪    币: 221
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
5
用这种方法好像往程序中加入原来没有的API都不行
我在另外一个没有使用MessageBox的测试程序中,用同样的方法加入,出现了同样的问题~!
2006-8-19 12:11
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
最初由 vlit 发布
用这种方法好像往程序中加入原来没有的API都不行
我在另外一个没有使用MessageBox的测试程序中,用同样的方法加入,出现了同样的问题~!


ShellExecuteA的地址有误.
2006-8-19 14:03
0
雪    币: 221
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
7
楼上的,Olly中都正确显示出来了,还会有误?
2006-8-19 14:09
0
雪    币: 291
活跃值: (213)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
8
不应该直接call 0040506C
应该是call dword ptr ds:[0040506C]
机器码FF 15 xxxxxxxx

或者在0040506c处补上0FF25(间接jmp的机器码)
变成
0040506c  jmp dword ptr ds:[xxxxxxxx]
(ShellExecuteA的地址,由Pe装载器填入)
2006-8-19 15:24
0
雪    币: 221
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
9
thebutterfly
像你说的这样在OllyDBG中根本改不了
info------------>未认可操作数
2006-8-19 15:35
0
雪    币: 291
活跃值: (213)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
10
Sorry,写错了,应该是
call dword ptr ds:[0040506C]

试验过,将call改了是行的

这是改好的,直接把rar扩展名改为exe即可
上传的附件:
2006-8-19 15:39
0
雪    币: 221
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
11
Thank you!thebutterfly
你是怎么知道要这样改的呢?麻烦告诉一下
不然以后修改还是不明白啊!!!!!!!!!
thx again!
2006-8-19 15:48
0
雪    币: 221
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
12
这样修改之后
在OllyDBG中就变成了call [xxxxxxxx]
我看了一下其他函数,在call的时候没有这个[]
但是在JMP的时候有这个[],是不是以后添加的时候只要加上[]就可以了???


用另外个程序测试了一下我的想法,初步表明是正确的

感谢所有热心的朋友!!!!!!!特别是thebutterfly!!!
2006-8-19 15:52
0
雪    币: 291
活跃值: (213)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
13
因为我调试的时候,call到40506C处的时候,发现40506C处存放的地址才是ShellExecuteA的入口地址,而并非40506C是ShellExecuteA的地址
0040506C >  44              inc esp
0040506D    FE              ???                                         ; 未知命令
0040506E    3E:77 00        ja short tested.00405071

因此不能直接call, 必须用带内存操作数的间接call
2006-8-19 15:56
0
雪    币: 291
活跃值: (213)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
14
两种调用导入函数的方式
A)
call dword ptr ds:[xxxxxxx]
其中xxxxxxx是导入表中函数实际地址
这是直接用间接call调用导入函数

B0
call yyyyyyyyy
...
...
yyyyyyyy  jmp dword ptr ds:[xxxxxxsxxx]

其中xxxxxx含义同上
2006-8-19 15:59
0
雪    币: 221
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
15
再次感谢thebutterfly!!!
2006-8-19 16:05
0
雪    币: 291
活跃值: (213)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
16
不用谢,祝贺楼主问题解决
2006-8-19 16:10
0
雪    币: 291
活跃值: (213)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
17
补充说明一点,在用MASM编程时,假设要调用MessageBoxA函数,如果不用
include user32.inc

call  MessageBoxA            (1)

这种形式,而用

externdef _imp__MessageBoxA@16:dword

call dword ptr ds:[_imp__MessageBoxA@16]      (2)

也是可行的

对于方法1,将生成

aaaa   call   yyyy
...
...
...
yyyy   jmp    dword ptr ds:[xxxx]

而对于方法(2)
将生成
call   dword ptr ds:[xxxx]

的形式
2006-8-19 16:20
0
游客
登录 | 注册 方可回帖
返回
//