利用peb枚举当前进程加载模块

最新推荐文章于 2023-12-29 18:32:49 发布

可惜流年

最新推荐文章于 2023-12-29 18:32:49 发布

阅读量675

点赞数

文章标签： buffer include null output path c

本文链接：https://blog.csdn.net/FreezingPT/article/details/2087037

版权

其实就是根据http://blog.csdn.net/iiprogram/archive/2006/03/22/632573.aspx上的c代码写的

希望作者不会鄙视我

include /masm32/include/windows.inc

include /masm32/include/kernel32.inc
include /masm32/include/user32.inc
includelib /masm32/lib/kernel32.lib
includelib /masm32/lib/user32.lib

.data
stdOut dd ?
format db "%ls",0
rt dw 0d0ah
.data?
buffer db MAX_PATH dup(?)
.code
start:
invoke GetStdHandle,STD_OUTPUT_HANDLE
mov stdOut,eax
assume fs:nothing
mov   eax,fs:[18h]
mov   eax,dword ptr [eax+30h]
mov   eax,dword ptr [eax+0ch]
mov   eax,dword ptr [eax+0ch]
.repeat
mov ebx,eax
mov   eax,dword ptr [eax+28h]
invoke wsprintf,addr buffer,addr format,eax
invoke lstrlen,addr buffer
invoke WriteFile,stdOut,addr buffer,eax,0,NULL
invoke WriteFile,stdOut,addr rt,2,0,NULL
mov eax,dword ptr [ebx]
mov ecx,dword ptr [eax+18h]
.until (ecx==NULL)
invoke ExitProcess,NULL
end start