结合C汇编搜寻主存储器

结合C汇编搜寻主存储器
// apisearchEngine.cpp : Defines the entry point for the console application.
1.//
2.
3.#include "stdafx.h"
4.#include <Windows.h>
5.
6.DWORD __stdcall GetStrLengthA(char* szName)
7.{
8. _asm
9. {
10. push edi
11. push ebx
12. mov eax, szName
13. mov edi, eax
14. mov ebx, eax
15. xor al, al
16.
17.lstrscan:
18. scas byte ptr [edi] //字符扫描法检查字符串指针长度
19. jnz lstrscan
20. dec edi
21. sub edi, ebx
22. mov eax, edi
23. pop ebx
24. pop edi
25.
26. }
27.}
28.
29.
30.DWORD __stdcall CalcBufferCRC(char* lpBuffer)
31.{
32. _asm
33. {
34. push ebx
35. push edi
36. push ecx
37. push ebp
38.
39. mov ebx, lpBuffer
40. push ebx
41. call GetStrLengthA
42. mov edi, eax
43. shr edi, 2
44. xor ecx, ecx
45.loopBegin:
46. dec edi
47. jl loopOver
48. xor ecx, dword ptr [ebx]
49. add ebx, 4
50. jmp loopBegin
51.loopOver:
52. mov eax, ecx
53.
54. pop ebp
55. pop ecx
56. pop edi
57. pop ebx
58.
59. }
60.}
61.
62.DWORD __stdcall GetProcAddressA(HANDLE hModule, DWORD dwExportCRC)
63.{
64.//DWORD lpProcNameCRC = ;
65.DWORD dwProcNumber;
66.LPVOID pProcAddress, pProcNameAddress, pProcIndexAddress;
67. _asm
68. {
69. push ebx
70. push esi
71.
72. mov eax, hModule
73. mov edx,dwExportCRC // edx=函数名CRC32
74. mov ebx, eax // ebx=基址
75. mov eax, [ebx+0x3c] // eax=文件头偏移
76. mov esi, [ebx+eax+0x78] // esi=输出表偏移,文件头+可选头的长度
=$78
77. lea esi, [ebx+esi+0x18] // esi=函数名数量 = 函数数
量 [ebx+esi+$14]
78. lods dword ptr ds:[esi]
79. mov dwProcNumber, eax // eax=函数名数量
80. lods dword ptr ds:[esi]
81. mov pProcAddress, eax // eax=函数偏移量
82. lods dword ptr ds:[esi]
83. mov pProcNameAddress, eax // eax=函数名偏移量
84. lods dword ptr ds:[esi]
85. mov pProcIndexAddress, eax // eax=序列号偏移量
86. mov edx, dwProcNumber // edx=遍历次数
87.LoopBegin:
88. xor eax, eax // Result = 0
89. dec edx
90. jl LoopEnd
91. mov eax, pProcNameAddress
92. add eax, ebx // eax=函数名基地址
93. mov eax, dword ptr ds:[eax+edx*4]
94. add eax, ebx // eax=遍历函数名
95. push eax
96. call CalcBufferCRC
97. cmp eax, dwExportCRC // 对比CRC32
98. jnz LoopBegin
99. shl edx, 1
100. add edx, pProcIndexAddress // 函数基序列
101. movzx eax, word ptr ss:[edx+ebx]
102. shl eax, 2
103. add eax, pProcAddress // 函数基地址
104. mov eax, [eax+ebx]
105. add eax, ebx // Result = 函数地址
106.LoopEnd:
107. pop esi
108. pop ebx
109.
110. }
111.}
112.
113.
114.
115.DWORD __stdcall GetKernel32Module()
116.{
117. _asm
118. {
119. PUSH EBP
120. XOR ECX, ECX
121.//MOV ESI, [FS:ECX + 0x30] ; ESI = &(PEB) ([FS:0x30])
122. MOV ESI, FS:[0X30]
123. MOV ESI, [ESI + 0x0C] ; ESI = PEB->Ldr
124. MOV ESI, [ESI + 0x1C] ; ESI = PEB->Ldr.InInitOrder 125.next_module:
126. MOV EBP, [ESI + 0x08] ; EBP = InInitOrder[X].base_add ress
127. MOV EDI, [ESI + 0x20] ; EBP = InInitOrder[X].module_n ame (unicode)
128. MOV ESI, [ESI] ; ESI = InInitOrder[X].flink (n ext module)
129. CMP [EDI + 12*2], CL ; modulename[12] == 0 ? 130. JNE next_module ; No: try next module.
131.
132. MOV EAX, EBP
133. POP EBP
134.
135. }
136.}
137.int main(int argc, char* argv[])
138.{
139. printf("write by xiaoju !\n");
140. printf("*****************\n");
141.DWORD dwBaseKernel32 = GetKernel32Module();
142. printf("Kernel32的模块地址:%08x\n",dwBaseKernel32);
143.
144.
145.DWORD LoadLibraryCRC32= CalcBufferCRC("LoadLibraryA") ;
146. printf("LoadLibraryA的CRC值(静态写到程序
中):%08x\n\n", LoadLibraryCRC32);
147.
148.
149.
150.DWORD dwAddrLoadLibrary = GetProcAddressA((HANDLE)dwBaseKernel32, 0x577 a7461);
151. printf("在程序中动态得到的LoadLibraryA的地
址:%08x\n", dwAddrLoadLibrary);
152. getchar();
153.return 0;
154.}。