|
Pa onda ste lejm =) Ja sam pisao bez import table =)
Kaca : Ehhh vreme je potrebno, ali i zivci i dobro poznavanje debuggera jer tu jedna instrukcija moze mnogo da znaci =)
Dopuna: 06 Feb 2005 17:15
Evo i source ->>>
486
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
.code
start:
ASSUME FS:NOTHING
jmp __print
mTitle db "Small",0
mText db "Hello world",0
api db "MessageBoxA",0
dll db "user32",0
exit db "ExitProcess",0
load db "LoadLibraryA",0
kernel dd ?
__print:
call KernelBase
mov kernel, eax
push offset load
push eax
call GetProc
push offset dll
call eax
push offset api
push eax
call GetProc
push MB_OK
push offset mTitle
push offset mText
push NULL
call eax
push offset exit
push kernel
call GetProc
push NULL
call eax
KernelBase PROC stack:DWORD
mov eax, dword ptr FS:[30h]
mov eax, dword ptr[eax+0ch]
mov esi, dword ptr[eax+14h]
;1. is our progy
lodsd
mov esi, eax
lodsd
mov eax,dword ptr [eax+10h]
ret
KernelBase endp
GetProc PROC handle:DWORD, pApi:DWORD
mov edi, pApi
mov ecx, 100 ;<----max str len
mov eax, 0
repnz scasb
mov ecx, edi
sub ecx, pApi ;<----str len!!!! of API
;Lets find our API
;First locate IMAGE_EXPORT_DIRECTORY
mov esi, handle
add esi, [esi + 03ch] ;<---------- PE header
mov ebx, [esi + 078h] ;<---------- Export Table offset
add ebx, handle ;<---------- go to Export Table
ASSUME ebx : ptr IMAGE_EXPORT_DIRECTORY
mov edx, [ebx].AddressOfNames ;<--- this is RVA
add edx, handle ;<--- Real address
xor eax,eax ;<--- eax is counter
lopni_ga:
mov esi, pApi ;<--- Api that we search
mov edi, [edx] ;<--- Api from AddressOfNames
add edi, handle ;<--- RVA+handle real address
push ecx ;<--- save strlen
repe cmpsb ;<--- compare stringz
pop ecx ;<--- restore strlen
jz imamo ;<--- we found it
add edx,4 ;<--- go to next address
inc eax ;<--- increment counter
jmp lopni_ga
imamo:
mov esi,[ebx].AddressOfNameOrdinals ;<--- Now find ordinal
add esi,handle ;<--- rva_ordinal_table + image_base
xor edx, edx
mov dx, word ptr[esi+eax*2]
mov esi, [ebx].AddressOfFunctions ;<--- RVA of ADDRESS TABLE
add esi, handle ;<--- RVA + base_image
mov eax, dword ptr[esi+edx*4]
add eax, handle
ret 8
GetProc ENDP
end start
|
