DelphiXE2测试：从内存加载64位Dll

最新推荐文章于 2024-05-28 10:57:11 发布

weixin_30530339

最新推荐文章于 2024-05-28 10:57:11 发布

阅读量519

点赞数

原文链接：http://www.cnblogs.com/wuan/archive/2011/09/27/2193574.html

版权

unit NtResDll;

interface

uses

{$IFDEF DELPHI16}Winapi.Windows{$ELSE}Windows{$ENDIF}, {$IFDEF DELPHI16}System.SysUtils{$ELSE}SysUtils{$ENDIF}, {$IFDEF DELPHI16}System.Classes{$ELSE}Classes{$ENDIF};

function IsWinNT: boolean;
function LoadMyResDll(FileBuffer: Pointer; var EntryPoint: Pointer): Pointer;
function FindMyResFunc(pBaseAddress: Pointer; FuncName: PAnsiChar): Pointer;
function FreeMyResDll(BaseAddress: Pointer; EntryPoint: Pointer): Boolean;

implementation

{$WARNINGS OFF}

{$WARNINGS OFF}

type
PShort = ^Short;
TShortArr = array of Short;
PShortArr = ^TShortArr;
TDWORDArr = array of DWORD;
PDWORDArr = ^TDWORDArr;

// PE file header structures used to parse the dll for correct dll loading.
// For detailed infromation about this sructures refer to MSDN library

TIIDUnion = record
    case Integer of
      0: (Characteristics: DWORD);
      1: (OriginalFirstThunk: DWORD);
end;

TImgSecHdrMisc = record
    case Integer of
      0: (PhysicalAddress: DWORD);
      1: (VirtualSize: DWORD);
end;

_IMAGE_SECTION_HEADER = record
    Name: array[0..IMAGE_SIZEOF_SHORT_NAME - 1] of Byte;
    Misc: TImgSecHdrMisc;
    VirtualAddress: DWORD;
    SizeOfRawData: DWORD;
    PointerToRawData: DWORD;
    PointerToRelocations: DWORD;
    PointerToLinenumbers: DWORD;
    NumberOfRelocations: WORD;
    NumberOfLinenumbers: WORD;
    Characteristics: DWORD;
end;

IMAGE_SECTION_HEADER = _IMAGE_SECTION_HEADER;
PIMAGE_SECTION_HEADER = ^IMAGE_SECTION_HEADER;

PIMAGE_IMPORT_DESCRIPTOR = ^IMAGE_IMPORT_DESCRIPTOR;
_IMAGE_IMPORT_DESCRIPTOR = record
    Union: TIIDUnion;
    TimeDateStamp: DWORD;
    ForwarderChain: DWORD;
    Name: DWORD;
    FirstThunk: DWORD;
end;
IMAGE_IMPORT_DESCRIPTOR = _IMAGE_IMPORT_DESCRIPTOR;

PIMAGE_THUNK_DATA32 = ^IMAGE_THUNK_DATA32;
_IMAGE_THUNK_DATA32 = record
    case Integer of
      0: (ForwarderString: DWORD);
      1: (Function_: DWORD);
      2: (Ordinal: DWORD);
      3: (AddressOfData: DWORD);
end;
IMAGE_THUNK_DATA32 = _IMAGE_THUNK_DATA32;

{$IFDEF WIN64}
PIMAGE_THUNK_DATA64 = ^IMAGE_THUNK_DATA64;
_IMAGE_THUNK_DATA64 = record
    case Integer of
      0: (ForwarderString: DWORD64);
      1: (Function_: DWORD64);
      2: (Ordinal: DWORD64);
      3: (AddressOfData: DWORD64);
end;
IMAGE_THUNK_DATA64 = _IMAGE_THUNK_DATA64;
{$ENDIF}

PIMAGE_IMPORT_BY_NAME = ^IMAGE_IMPORT_BY_NAME;
_IMAGE_IMPORT_BY_NAME = record
Hint: WORD;
Name: array[0..0] of Byte;
end;
IMAGE_IMPORT_BY_NAME = _IMAGE_IMPORT_BY_NAME;

PIMAGE_EXPORT_DIRECTORY = ^IMAGE_EXPORT_DIRECTORY;
_IMAGE_EXPORT_DIRECTORY = record
    Characteristics: DWORD;
    TimeDateStamp: DWORD;
    MajorVersion: WORD;
    MinorVersion: WORD;
    Name: DWORD;
    Base: DWORD;
    NumberOfFunctions: DWORD;
    NumberOfNames: DWORD;
    AddressOfFunctions: DWORD;
    AddressOfNames: DWORD;
    AddressOfNameOrdinals: DWORD;
end;

IMAGE_EXPORT_DIRECTORY = _IMAGE_EXPORT_DIRECTORY;
{$IFDEF WIN64}
PIMAGE_NT_HEADERS = ^_IMAGE_NT_HEADERS64;
IMAGE_THUNK_DATA = IMAGE_THUNK_DATA64;
PIMAGE_THUNK_DATA = ^IMAGE_THUNK_DATA64;
MY_POINTER        = DWORD64;
PMY_POINTER       = ^DWORD64;
{$ELSE}
PIMAGE_NT_HEADERS = ^_IMAGE_NT_HEADERS;
IMAGE_THUNK_DATA = IMAGE_THUNK_DATA32;
PIMAGE_THUNK_DATA = ^IMAGE_THUNK_DATA32;
MY_POINTER        = DWORD;
PMY_POINTER       = ^DWORD;
{$ENDIF}
TEntryPointProc = function(hinstDll: HINST; fdwReason: DWORD; lpvREserved: Pointer): Boolean; stdcall; // the dll entry point procedure type

function IsWinNT : Boolean;
var
   osv : TOSVERSIONINFO;
begin
   osv.dwOSVersionInfoSize := sizeOf(OSVERSIONINFO);
   GetVersionEx(osv);
   result := (osv.dwPlatformId = VER_PLATFORM_WIN32_NT);
end;

function FreeMyResDll(BaseAddress: Pointer; EntryPoint: Pointer): Boolean;
begin
Result := False;
if not IsWinNT then begin
if Assigned(BaseAddress) then FreeLibrary(THandle(BaseAddress));
exit;
end;
if Assigned(BaseAddress) and Assigned(EntryPoint) then
if TEntryPointProc(EntryPoint)(HINST(BaseAddress), DLL_PROCESS_DETACH, nil) then
Result := VirtualFree(BaseAddress, 0, MEM_RELEASE);
end;

function FindMyResFunc(pBaseAddress: Pointer; FuncName: PAnsiChar): Pointer;
var
pinth: PIMAGE_NT_HEADERS;
pied: PIMAGE_EXPORT_DIRECTORY;
k: Integer;
FuncAddr: Pointer;
dwBaseAddress: MY_POINTER;
begin
FuncAddr := nil;
Result := nil;
if not IsWinNT then begin
    Result := GetProcAddress(THandle(pBaseAddress), FuncName);
    exit;
end;
dwBaseAddress := MY_POINTER(pBaseAddress);
if (dwBaseAddress <> 0) then
    begin
      pinth := PIMAGE_NT_HEADERS(dwBaseAddress + PDWORD(dwBaseAddress + $3C)^);
      pied := PIMAGE_EXPORT_DIRECTORY(pinth.OptionalHeader.DataDirectory[0].VirtualAddress + dwBaseAddress);
      for k := 0 to Pred(pied.NumberOfNames) do
        begin
          if strcomp(PAnsiChar(TDWORDArr(pied.AddressOfNames + dwBaseAddress)[k] + dwBaseAddress), FuncName) = 0 then
            begin
              FuncAddr := Pointer(TDWORDArr(pied.AddressOfFunctions + dwBaseAddress)
                    [TShortArr(pied.AddressOfNameOrdinals + dwBaseAddress)[k]]);
              FuncAddr := Pointer(MY_POINTER(FuncAddr) + dwBaseAddress);
            end;
        end;
      Result := FuncAddr;
    end;
end;

end.

转载于:https://www.cnblogs.com/wuan/archive/2011/09/27/2193574.html

weixin_30530339

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
DelphiXE2测试：从内存加载64位Dll

unit NtResDll;interfaceuses {$IFDEF DELPHI16}Winapi.Windows{$ELSE}Windows{$ENDIF}, {$IFDEF DELPHI16}System.SysUtils{$ELSE}SysUtils{$ENDIF}, {$IFDEF DELPHI16}System.Classes{$ELSE}Classes{$ENDIF}...
复制链接

扫一扫