首页
社区
课程
招聘
[讨论]Win32ASM写的lpk.dll
发表于: 2009-10-18 01:59 6065

[讨论]Win32ASM写的lpk.dll

2009-10-18 01:59
6065
大家看下这个lpk.dll的汇编源码,编译正常,但编译后的dll程序怎么都加载不了,这是什么原因?
我想了很久,对代码改了很多次都不行,实在想不出原因,请求高手指点下。。。多谢!!!
(不是我机器环境的问题,用KanXue老大提供的VC的那个就很好用)

以下是源码,麻烦高手瞧瞧。。。
.586
.model flat,stdcall
option casemap :none

include		windows.inc
include		kernel32.inc
include		user32.inc
includelib	kernel32.lib
includelib	user32.lib

checkAddr	equ 000486880h
checkValue	equ 000DD840Fh
pitchAddr0	equ 0004864F4h
pitchSize0	equ 2

.data
pitchNew0	db 090h,090h

strLpkInitialize		db "LpkInitialize",0
strLpkTabbedTextOut		db "LpkTabbedTextOut",0
strLpkDllInitialize		db "LpkDllInitialize",0
strLpkDrawTextEx		db "LpkDrawTextEx",0
strLpkEditControl		db "LpkEditControl",0
strLpkExtTextOut		db "LpkExtTextOut",0
strLpkGetCharacterPlacement	db "LpkGetCharacterPlacement",0
strLpkGetTextExtentExPoint	db "LpkGetTextExtentExPoint",0
strLpkPSMTextOut		db "LpkPSMTextOut",0
strLpkUseGDIWidthCache		db "LpkUseGDIWidthCache",0
strftsWordBreak			db "ftsWordBreak",0

addrLpkInitialize		dd 0
addrLpkTabbedTextOut		dd 0
addrLpkDllInitialize		dd 0
addrLpkDrawTextEx		dd 0
addrLpkEditControl		dd 0
addrLpkExtTextOut		dd 0
addrLpkGetCharacterPlacement	dd 0
addrLpkGetTextExtentExPoint	dd 0
addrLpkPSMTextOut		dd 0
addrLpkUseGDIWidthCache		dd 0
addrftsWordBreak		dd 0

.data?
hLib		dd ?
hInstance	dd ?
hProcess	dd ?

.code
DllEntry proc hinstdll:DWORD,reason:DWORD,reserved1:DWORD
	pushad
	.if reason == DLL_PROCESS_ATTACH
		push	hinstdll
		pop	hInstance
		call	LoadDebug
		call 	hijack
	.elseif reason == DLL_PROCESS_DETACH
	.elseif reason == DLL_THREAD_ATTACH
	.endif
	popad
	mov	eax,1
	ret
DllEntry endp

isTarget proc
	LOCAL 	Targetcode:DWORD
	invoke 	ReadProcessMemory,hProcess,checkAddr,addr Targetcode,4,NULL
	.if	eax!=0
		.if	Targetcode==checkValue
			mov	eax,TRUE
			ret
		.else
			mov	eax,FALSE
			ret
		.endif
	.endif
	mov	eax,FALSE
	ret
isTarget endp

PatchProcess proc
	LOCAL 	Oldpp:DWORD
	invoke	VirtualProtectEx,hProcess,pitchAddr0,pitchSize0,PAGE_EXECUTE_READWRITE,addr Oldpp
	invoke	WriteProcessMemory,hProcess,pitchAddr0,offset pitchNew0,pitchSize0,NULL	
	mov	eax,1
	ret
PatchProcess endp

hijack proc
	LOCAL 	mbi:MEMORY_BASIC_INFORMATION
	LOCAL 	msize:DWORD	
	invoke 	GetCurrentProcess
	mov 	hProcess,eax
	invoke	isTarget
	.if	eax==TRUE
		invoke	PatchProcess
	.endif
	mov	eax,1
	ret
hijack endp

LoadDebug PROC
	LOCAL 	LibPath[200h]:BYTE
	pushad
	invoke 	GetSystemDirectory,addr LibPath,100h
	lea 	ebx,LibPath
	add 	eax,ebx
	mov 	dword ptr [eax],'KPL\'
	mov 	dword ptr [eax+4],'LLD.'
	mov 	dword ptr [eax+8],0
	invoke 	LoadLibrary,addr LibPath
	.if 	eax != 0
		mov 	hLib,EAX
		invoke 	GetProcAddress,hLib,addr strLpkInitialize
		mov 	addrLpkInitialize,EAX
		invoke 	GetProcAddress,hLib,addr strLpkTabbedTextOut
		mov 	addrLpkTabbedTextOut,EAX
		invoke 	GetProcAddress,hLib,addr strLpkDllInitialize
		mov 	addrLpkDllInitialize,EAX
		invoke 	GetProcAddress,hLib,addr strLpkDrawTextEx
		mov 	addrLpkDrawTextEx,EAX
		invoke 	GetProcAddress,hLib,addr strLpkExtTextOut
		mov 	addrLpkExtTextOut,EAX
		invoke 	GetProcAddress,hLib,addr strLpkGetCharacterPlacement
		mov 	addrLpkGetCharacterPlacement,EAX
		invoke 	GetProcAddress,hLib,addr strLpkGetTextExtentExPoint
		mov 	addrLpkGetTextExtentExPoint,EAX
		invoke 	GetProcAddress,hLib,addr strLpkPSMTextOut
		mov 	addrLpkPSMTextOut,EAX
		invoke 	GetProcAddress,hLib,addr strLpkUseGDIWidthCache
		mov 	addrLpkUseGDIWidthCache,EAX
		invoke 	GetProcAddress,hLib,addr strftsWordBreak
		mov 	addrftsWordBreak,EAX
		invoke 	GetProcAddress,hLib,addr strLpkEditControl
		mov 	addrLpkEditControl,EAX
		mov 	esi,eax
		mov 	edi,offset addrLpkEditControl2
		mov 	ecx,40h
		rep 	movsb
	.endif
	popad
	RET
LoadDebug Endp
;--------------------------------------------;
LpkInitialize Proc			;函数1
	jmp 	addrLpkInitialize
LpkInitialize Endp
LpkTabbedTextOut Proc		;函数2
	jmp 	addrLpkTabbedTextOut
LpkTabbedTextOut Endp
LpkDllInitialize Proc			;函数3
	jmp 	addrLpkDllInitialize
LpkDllInitialize Endp
LpkDrawTextEx Proc			;函数4
	jmp 	addrLpkDrawTextEx
LpkDrawTextEx Endp
LpkEditControl Proc			;函数5
	addrLpkEditControl2 	db 40h dup (0)
LpkEditControl Endp
LpkExtTextOut Proc			;函数6
	jmp 	addrLpkExtTextOut
LpkExtTextOut Endp
LpkGetCharacterPlacement Proc	;函数7
	jmp 	addrLpkGetCharacterPlacement
LpkGetCharacterPlacement Endp
LpkGetTextExtentExPoint Proc	;函数8
	jmp 	addrLpkGetTextExtentExPoint
LpkGetTextExtentExPoint Endp
LpkPSMTextOut Proc			;函数9
	jmp 	addrLpkPSMTextOut
LpkPSMTextOut Endp
LpkUseGDIWidthCache Proc		;函数10
	jmp 	addrLpkUseGDIWidthCache
LpkUseGDIWidthCache Endp
ftsWordBreak Proc			;函数11
	jmp 	addrftsWordBreak
ftsWordBreak Endp
;--------------------------------------------;
END DllEntry

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 0
支持
分享
最新回复 (7)
雪    币: 138
活跃值: (11)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
2
DEF文件这样写,没错吧?

LIBRARY lpk.dll
EXPORTS
        LpkInitialize
        LpkTabbedTextOut
        LpkDllInitialize
        LpkDrawTextEx
        LpkEditControl
        LpkExtTextOut
        LpkGetCharacterPlacement
        LpkGetTextExtentExPoint
        LpkPSMTextOut
        LpkUseGDIWidthCache
        ftsWordBreak
2009-10-18 11:52
0
雪    币: 86
活跃值: (1183)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
看不懂ASM的
2009-10-18 13:41
0
雪    币: 419
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
http://blog.chinaunix.net/u1/35278/article_52405.html

自己去看看为什么
2009-10-18 13:50
0
雪    币: 138
活跃值: (11)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
5
网上相关资料我都搜了个遍。。。
你给的那个我当然看了啊,那个源码不完整,没看出什么不同来,我还留言了呢。。。

我现在的情况比较急,非常期待你的解答,多谢!
2009-10-18 14:12
0
雪    币: 419
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
http://unpack.cn/viewthread.php?tid=33319&extra=page%3D1

这里有完整的 你看看吧
2009-10-18 14:23
0
雪    币: 138
活跃值: (11)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
7
谢谢fixfix,问题已经解决。。。
2009-10-18 16:27
0
雪    币: 138
活跃值: (11)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
8
下面这个东西要放在数据区。。。

LpkEditControl Proc      ;函数5
  addrLpkEditControl2   db 40h dup (0)
LpkEditControl Endp

怪自己粗心了。。。
2009-10-18 16:30
0
游客
登录 | 注册 方可回帖
返回
//