1. 数据目录中添加导出表结构 20b0(6B0)
在148h至14fh添加字节：b0 20 00 00 45 00 00 00
2. 添加导出表
1）.nName 20e2(6E2)
2）.AddressOfFunctions 20d8(6D8)
3）.AddressOfNames 20dc(6DC) --- 函数名OpenUrlA 20ec(6EC)
4）.AddressOfNameOrdinals 20E0(6E0)
在6b0处添加如下字节:用作导出表
00 00 00 00 34 cf e5 48 00 00 00 00 e2 20 00 00
01 00 00 00 01 00 00 00 01 00 00 00 d8 20 00 00
dc 20 00 00 e0 20 00 00 20 11 00 00 ec 20 00 00
00 00 70 65 64 69 79 2e 64 6c 6c 00 4f 70 65 6e
55 72 6c 41 00
3. 添加导出函数
在520h处添加机器码：
53 57 56 E8 00 00 00 00 5B 81 EB 28 11 40 00
8D B3 00 11 40 00 56 BF 77 1D 80 7C FF D7 50
5F 8D B3 10 11 40 00 56 57 B8 28 AC 80 7C FF
D0 6A 01 6A 00 6A 00 8D B3 e0 10 40 00 56 8D
B3 d0 10 40 00 56 6A 00 FF D0 57 B8 66 AA 80
7C FF D0 5E 5F 5B C3
在.text中添加常量字符串。
1）在4e0h处添加： 68 74 74 70 3A 2F 2F 26 62 73 2E 70 65 64 69 79 2E 63 6F 6D 00 "http://bbs.pediy.com"
2）在4d0h处添加： 6F 70 65 6E 00 "open"
3) 在500h处添加： 73 68 65 6C 6C 33 32 2E 64 6C 6C 00 "shell32.dll"
4) 在510h处添加： 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 "ShellExecuteA"
导出函数代码：
#include "windows.h"
char File[] = "http://bbs.pediy.com";
char Operation[] = "open";
char ShellDll[] = "shell32.dll";
char ShellFun[] = "ShellExecuteA";
int main(int argc, char* argv[])
{
_asm
{
push ebx
push edi
push esi
call delta
delta:
pop ebx
sub ebx, offset delta
lea esi, [ebx +ShellDll]
push esi
mov edi, 0x7c801d77
call edi
push eax
pop edi
lea esi, [ebx +ShellFun]
push esi
push edi
mov eax, 0x7c80ac28
call eax
push 1
push 0
push 0
lea esi, [ebx +File]
push esi
lea esi, [ebx +Operation]
push esi
push 0
call eax
push edi
mov eax,0x7c80aa66
call eax
pop esi
pop edi
pop ebx
ret
}
return 0;
}
将delta,File，Operation，ShellDll，ShellFun的地址分别修改为我们添加到.text对应的虚拟地址。
得到如下的机器码：
53 57 56 E8 00 00 00 00 5B 81 EB 28 11 40 00
8D B3 00 11 40 00 56 BF 77 1D 80 7C FF D7 50
5F 8D B3 10 11 40 00 56 57 B8 28 AC 80 7C FF
D0 6A 01 6A 00 6A 00 8D B3 e0 00 40 00 56 8D
B3 d0 00 40 00 56 6A 00 FF D0 57 B8 66 AA 80
7C FF D0 5E 5F 5B C3
测试代码：
HMODULE hd = LoadLibrary("pediy.dll");
GetProcAddress(hd,"OpenUrlA");
_asm call eax
FreeLibrary(hd);
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
