| 网站首页 | 业界新闻 | 小组 | 威客 | 人才 | 下载频道 | 博客 | 代码贴 | 在线编程 | 编程论坛
欢迎加入我们,一同切磋技术
用户名:   
 
密 码:  
共有 684 人关注过本帖
标题:放一下
只看楼主 加入收藏
zhu224039
Rank: 8Rank: 8
等 级:贵宾
威 望:17
帖 子:862
专家分:792
注 册:2012-7-29
结帖率:59.52%
收藏
 问题点数:0 回复次数:0 
放一下
#include "stdafx.h"
#include "windows.h"
#define var_MessageBox    4
#define var_ExitProcess   8
#define var_LoadLibrary   12
#define var_DllBase          16
#define var_Export          20
#define var_Libname       28

int _tmain(int argc, _TCHAR* argv[])
{
    _asm{
        push ebp
        mov  ebp,esp
        sub  esp,0D4h
        mov  dword ptr [ebp-var_MessageBox],0x1e380a6a
        mov  dword ptr [ebp-var_ExitProcess],0x4fd18963
        mov  dword ptr [ebp-var_LoadLibrary],0xc0d83287
        mov  dword ptr [ebp-var_Libname],0x72657375
        mov  dword ptr [ebp-24],0x3233

        mov eax,fs:[0x30]
        mov eax,[eax+0x0c]
        mov eax,[eax+0x1c]
        mov eax,[eax]
        mov eax,[eax+08h]
        mov [ebp-var_DllBase],eax

        mov esi,ebp
        sub esi,12
Find_Next:
        lodsd
        cmp eax,0x1e380a6a
        jne Find_lib_Function
        push LOAD_LIBRARY_AS_DATAFILE
        push 0
        mov eax,ebp
        sub eax,28
        push eax
        call [ebp-var_LoadLibrary]
        mov [ebp-var_DllBase],eax


Find_lib_Function:
        mov eax,[ebp-var_DllBase]
        add eax,[eax+03ch]
        mov eax,[eax+078h]
        add eax,[ebp-var_DllBase]

        mov [ebp-var_Export],eax
        
        mov ecx,[eax+018h]
        mov eax,[eax+020h]
        add eax,[ebp-var_DllBase]

        xor edx,edx
Next_Loop:
        cmp edx,ecx
        jge nofind
        mov edi,[eax]
        add edi,[ebp-var_DllBase]
        xor ebx,ebx
Get_Hash:
        cmp byte ptr [edi],0
        je  xxx
        ror ebx,7
        push eax
        movzx eax,byte ptr [edi]
        add ebx,eax
        pop eax
        inc edi
        jmp Get_Hash
xxx:
        cmp ebx,dword ptr [esi-4]
        jz  find
        add eax,4
        inc edx
        jmp Next_Loop


find:
        mov eax,[ebp-var_Export]
        mov ecx,[eax+024h]
        add ecx,[ebp-var_DllBase]
        shl edx,1
        add ecx,edx
        movzx ecx,word ptr [ecx]
        shl ecx,2

        mov eax,[eax+01ch]
        add eax,[ebp-var_DllBase]
        add eax,ecx
        mov eax,[eax]
        add eax,[ebp-var_DllBase]
        mov [esi-4],eax

        cmp ebx,0x1e380a6a
        jz  call_function
        jmp Find_Next
call_function:
        push 0
        push 0
        mov eax,ebp
        sub eax,28
        push eax
        push 0
        call [ebp-var_MessageBox]
        push 0
        call [ebp-var_ExitProcess]

nofind:

    }
    printf("hello,word");
    getchar();
    return 0;
}

[ 本帖最后由 zhu224039 于 2014-6-7 03:57 编辑 ]
搜索更多相关主题的帖子: include 
2014-06-05 20:33
快速回复:放一下
数据加载中...
 
   



关于我们 | 广告合作 | 编程中国 | 清除Cookies | TOP | 手机版

编程中国 版权所有,并保留所有权利。
Powered by Discuz, Processed in 0.016672 second(s), 8 queries.
Copyright©2004-2024, BCCN.NET, All Rights Reserved