大家看下这个lpk.dll的汇编源码,编译正常,但编译后的dll程序怎么都加载不了,这是什么原因?
我想了很久,对代码改了很多次都不行,实在想不出原因,请求高手指点下。。。多谢!!!
(不是我机器环境的问题,用KanXue老大提供的VC的那个就很好用)
以下是源码,麻烦高手瞧瞧。。。
.586
.model flat,stdcall
option casemap :none
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
checkAddr equ 000486880h
checkValue equ 000DD840Fh
pitchAddr0 equ 0004864F4h
pitchSize0 equ 2
.data
pitchNew0 db 090h,090h
strLpkInitialize db "LpkInitialize",0
strLpkTabbedTextOut db "LpkTabbedTextOut",0
strLpkDllInitialize db "LpkDllInitialize",0
strLpkDrawTextEx db "LpkDrawTextEx",0
strLpkEditControl db "LpkEditControl",0
strLpkExtTextOut db "LpkExtTextOut",0
strLpkGetCharacterPlacement db "LpkGetCharacterPlacement",0
strLpkGetTextExtentExPoint db "LpkGetTextExtentExPoint",0
strLpkPSMTextOut db "LpkPSMTextOut",0
strLpkUseGDIWidthCache db "LpkUseGDIWidthCache",0
strftsWordBreak db "ftsWordBreak",0
addrLpkInitialize dd 0
addrLpkTabbedTextOut dd 0
addrLpkDllInitialize dd 0
addrLpkDrawTextEx dd 0
addrLpkEditControl dd 0
addrLpkExtTextOut dd 0
addrLpkGetCharacterPlacement dd 0
addrLpkGetTextExtentExPoint dd 0
addrLpkPSMTextOut dd 0
addrLpkUseGDIWidthCache dd 0
addrftsWordBreak dd 0
.data?
hLib dd ?
hInstance dd ?
hProcess dd ?
.code
DllEntry proc hinstdll:DWORD,reason:DWORD,reserved1:DWORD
pushad
.if reason == DLL_PROCESS_ATTACH
push hinstdll
pop hInstance
call LoadDebug
call hijack
.elseif reason == DLL_PROCESS_DETACH
.elseif reason == DLL_THREAD_ATTACH
.endif
popad
mov eax,1
ret
DllEntry endp
isTarget proc
LOCAL Targetcode:DWORD
invoke ReadProcessMemory,hProcess,checkAddr,addr Targetcode,4,NULL
.if eax!=0
.if Targetcode==checkValue
mov eax,TRUE
ret
.else
mov eax,FALSE
ret
.endif
.endif
mov eax,FALSE
ret
isTarget endp
PatchProcess proc
LOCAL Oldpp:DWORD
invoke VirtualProtectEx,hProcess,pitchAddr0,pitchSize0,PAGE_EXECUTE_READWRITE,addr Oldpp
invoke WriteProcessMemory,hProcess,pitchAddr0,offset pitchNew0,pitchSize0,NULL
mov eax,1
ret
PatchProcess endp
hijack proc
LOCAL mbi:MEMORY_BASIC_INFORMATION
LOCAL msize:DWORD
invoke GetCurrentProcess
mov hProcess,eax
invoke isTarget
.if eax==TRUE
invoke PatchProcess
.endif
mov eax,1
ret
hijack endp
LoadDebug PROC
LOCAL LibPath[200h]:BYTE
pushad
invoke GetSystemDirectory,addr LibPath,100h
lea ebx,LibPath
add eax,ebx
mov dword ptr [eax],'KPL\'
mov dword ptr [eax+4],'LLD.'
mov dword ptr [eax+8],0
invoke LoadLibrary,addr LibPath
.if eax != 0
mov hLib,EAX
invoke GetProcAddress,hLib,addr strLpkInitialize
mov addrLpkInitialize,EAX
invoke GetProcAddress,hLib,addr strLpkTabbedTextOut
mov addrLpkTabbedTextOut,EAX
invoke GetProcAddress,hLib,addr strLpkDllInitialize
mov addrLpkDllInitialize,EAX
invoke GetProcAddress,hLib,addr strLpkDrawTextEx
mov addrLpkDrawTextEx,EAX
invoke GetProcAddress,hLib,addr strLpkExtTextOut
mov addrLpkExtTextOut,EAX
invoke GetProcAddress,hLib,addr strLpkGetCharacterPlacement
mov addrLpkGetCharacterPlacement,EAX
invoke GetProcAddress,hLib,addr strLpkGetTextExtentExPoint
mov addrLpkGetTextExtentExPoint,EAX
invoke GetProcAddress,hLib,addr strLpkPSMTextOut
mov addrLpkPSMTextOut,EAX
invoke GetProcAddress,hLib,addr strLpkUseGDIWidthCache
mov addrLpkUseGDIWidthCache,EAX
invoke GetProcAddress,hLib,addr strftsWordBreak
mov addrftsWordBreak,EAX
invoke GetProcAddress,hLib,addr strLpkEditControl
mov addrLpkEditControl,EAX
mov esi,eax
mov edi,offset addrLpkEditControl2
mov ecx,40h
rep movsb
.endif
popad
RET
LoadDebug Endp
;--------------------------------------------;
LpkInitialize Proc ;函数1
jmp addrLpkInitialize
LpkInitialize Endp
LpkTabbedTextOut Proc ;函数2
jmp addrLpkTabbedTextOut
LpkTabbedTextOut Endp
LpkDllInitialize Proc ;函数3
jmp addrLpkDllInitialize
LpkDllInitialize Endp
LpkDrawTextEx Proc ;函数4
jmp addrLpkDrawTextEx
LpkDrawTextEx Endp
LpkEditControl Proc ;函数5
addrLpkEditControl2 db 40h dup (0)
LpkEditControl Endp
LpkExtTextOut Proc ;函数6
jmp addrLpkExtTextOut
LpkExtTextOut Endp
LpkGetCharacterPlacement Proc ;函数7
jmp addrLpkGetCharacterPlacement
LpkGetCharacterPlacement Endp
LpkGetTextExtentExPoint Proc ;函数8
jmp addrLpkGetTextExtentExPoint
LpkGetTextExtentExPoint Endp
LpkPSMTextOut Proc ;函数9
jmp addrLpkPSMTextOut
LpkPSMTextOut Endp
LpkUseGDIWidthCache Proc ;函数10
jmp addrLpkUseGDIWidthCache
LpkUseGDIWidthCache Endp
ftsWordBreak Proc ;函数11
jmp addrftsWordBreak
ftsWordBreak Endp
;--------------------------------------------;
END DllEntry
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)