按序号调用DLL的函数

 

//示例：按序号调用DLL的函数
void CTestwDlg::OnButton1()
{
        //1.动态加载DLL
        HMODULE hlib = LoadLibrary("c:\\scan.dll");
        if (!hlib)
        {
                MessageBox("LoadLib fail");
                return;
        }

        //2.得到序号为1的函数地址
        DWORD fxAddr = (DWORD)GetProcAddress(hlib, (LPCTSTR)1);

        //3.分析函数原型 (通过OD/IDA分析压栈参数和调用约定)
        /*
.text:00AE63D7 8B 4D 1C     mov     ecx, [ebp+arg_14]
.text:00AE63DA 8B 55 18     mov     edx, [ebp+arg_10]
.text:00AE63DD 51           push    ecx
.text:00AE63DE 52           push    edx
.text:00AE63DF 8D 4D F8     lea     ecx, [ebp+var_8]
.text:00AE63E2 51           push    ecx
.text:00AE63E3 FF D0        call    eax
.text:00AE63E5 EB 12                short loc_AE63F9
        */

        //4.调用函数(三种方式)
        int v1,v2,v3,v4, r1, r2, r3;
        v1=v2=v3=v4=r1=r2=r3=0;
      
        //M1
        typedef int (__stdcall *PFX)(int *, int, unsigned int);
        PFX  pfx = (PFX)fxAddr;
      
        r1 =pfx(&v2, v3, v4);

        //M2
        r2 = ((int (__stdcall *)(int *, int, unsigned int))pfx)(&v2, v3, v4);

        DWORD r = 0;

        //M3
        __asm
        {
                PUSHAD
                        mov     edx, v4
                        mov     ecx, v3
                        push    edx
                        push    ecx
                        lea     edx, v2
                        push    edx
                        mov                EAX, pfx;
                        call    eax
                        MOV                r3, eax;

                POPAD
        }

        CString s;
        s.Format("r1=%d,r2=%d,r3=%d", r1,r2,r3);
        MessageBox(s, "Success");

        return;
}