;---------------------------------------------
;构造无导入表的程序
;By lx 2023.2.3
;---------------------------------------------
.386
.model flat,stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
_PROCVAR0 typedef proto
_PROCVAR1 typedef proto :dword
_PROCVAR2 typedef proto :dword,:dword
_PROCVAR3 typedef proto :dword,:dword,:dword
_PROCVAR4 typedef proto :dword,:dword,:dword,:dword
PROCVAR0 typedef ptr _PROCVAR0
PROCVAR1 typedef ptr _PROCVAR1
PROCVAR2 typedef ptr _PROCVAR2
PROCVAR3 typedef ptr _PROCVAR3
PROCVAR4 typedef ptr _PROCVAR4
.data
;MessageBox
_MessageBox PROCVAR4 ?
;GetProcAddress
_GetProcAddress PROCVAR2 ?
;LoadLibrary
_LoadLibrary PROCVAR1 ?
;FreeLibrary
_FreeLibrary PROCVAR1 ?
szTestBuffer db 256 dup(0)
szFmt db '%08x',0
hKernel dd ?
hUser dd ?
.const
sz_GetProcAddress db 'GetProcAddress',0
sz_LoadLibrary db 'LoadLibraryA',0
sz_FreeLibrary db 'FreeLibraryA',0
sz_MessageBox db 'MessageBoxA',0
szUserDLL db 'user32.dll',0
szText db 'This easy',0
.code
;获取kernel32.dll基地址
_getKernelBase proc dwEsp
local @ret
mov @ret,0
pushad
mov edi,dwEsp
and edi,0ffff0000h
.repeat
mov esi,edi
.if word ptr [esi] == IMAGE_DOS_SIGNATURE
add esi,[esi+3ch]
.if word ptr [esi] == IMAGE_NT_SIGNATURE
mov @ret,edi
.break
.endif
.endif
sub edi,10000h
.until edi<=70000000h
popad
mov eax,@ret
ret
_getKernelBase endp
;获取导出函数地址
_getApi proc _hModule,_lpApi
local @dwLen
local @ret
mov @dwLen,0
mov @ret,0
pushad
mov edi,_lpApi
xor al,al
mov ecx,-1
cld
repnz scasb
mov ecx,edi
sub ecx,_lpApi
mov @dwLen,ecx
mov esi,_hModule
add esi,[esi+3ch]
assume esi:ptr IMAGE_NT_HEADERS
mov esi,[esi].OptionalHeader.DataDirectory.VirtualAddress
add esi,_hModule
assume esi:ptr IMAGE_EXPORT_DIRECTORY
xor edx,edx
mov ebx,[esi].AddressOfNames
add ebx,_hModule
.repeat
push esi
mov edi,[ebx]
add edi,_hModule
mov esi,_lpApi
mov ecx,@dwLen
repz cmpsb
.if ZERO?
pop esi
jmp @F
.endif
pop esi
add ebx,4
inc edx
.until edx>=[esi].NumberOfNames
jmp _ret
;ebx 为目的下标
@@:
sub ebx,_hModule
sub ebx,[esi].AddressOfNames
shr ebx,1
add ebx,[esi].AddressOfNameOrdinals
add ebx,_hModule
movzx eax,word ptr [ebx]
shl eax,2
add eax,[esi].AddressOfFunctions
add eax,_hModule
mov eax,[eax]
add eax,_hModule
mov @ret,eax
_ret:
assume esi:nothing
popad
mov eax,@ret
ret
_getApi endp
start:
push [esp]
call _getKernelBase
mov hKernel,eax
invoke _getApi,hKernel,addr sz_GetProcAddress
mov _GetProcAddress,eax
invoke _GetProcAddress,hKernel,offset sz_LoadLibrary
mov _LoadLibrary,eax
invoke _GetProcAddress,hKernel,offset sz_FreeLibrary
mov _FreeLibrary,eax
invoke _LoadLibrary,offset szUserDLL
mov hUser,eax
invoke _GetProcAddress,hUser,offset sz_MessageBox
mov _MessageBox,eax
invoke _MessageBox,NULL,offset szText,NULL,0
end start
构造无导入表的win32asm程序
最新推荐文章于 2024-08-18 23:52:40 发布
![](https://img-home.csdnimg.cn/images/20240711042549.png)