mov eax,[esp] ;//取Kernel32返回地址
and ax,0f000h
mov esi,eax ;//得到Kernel.PELoader代码位置(不精确)
LoopFindKernel32:
sub esi,1000h
cmp word ptr[esi],'ZM' ;//搜索EXE文件头
jnz short LoopFindKernel32
GetPeHeader:
movzx edi,word ptr[esi+3ch]
add edi,esi
cmp word ptr[edi],'EP' ;//确认是否PE文件头
jnz short LoopFindKernel32 ;esi->kernel32,edi->kernel32 PE HEADER
;//////////////////////////////////////////////////任务：查找GetProcAddress函数地址
mov Kernel32Addr,esi
GetPeExportTable:
mov ebp,[edi+78h];4+14h+60h
add ebp,Kernel32Addr ;//得到输出函数表
mov ExportKernel,ebp
push GetProcAddLen
push offset aGetProcAddr
call GetApiAddress
mov GetProcAddr,eax
push GetModuleHandleLen
push offset aGetModuleHandle
call GetApiAddress
mov GetModuleHandleAddr,eax
push LoadLibraryLen
push offset aLoadLibrary
call GetApiAddress
mov LoadLibraryAddr,eax
push ExitProcessLen
push offset aExitProcess
call GetApiAddress
mov ExitProcessAddr,eax
invoke wsprintf,addr temp2,addr temp1,Kernel32Addr,GetProcAddr,GetModuleHandleAddr,LoadLibraryAddr,ExitProcessAddr
invoke MessageBoxA,0,addr temp2,addr szTitle,0
push 0
call dword ptr[ExitProcessAddr]
GetApiAddress proc AddressOfName:dword,ApiLength:byte
push ebx
push esi
push edi
mov edi,ExportKernel
assume edi:ptr IMAGE_EXPORT_DIRECTORY
GetExportNameList:
mov ebx,[edi].AddressOfNames ;//得到输出函数名表
add ebx,Kernel32Addr ;ebx->AddressOfNames(函数名字的指针地址).
xor eax,eax ;//函数序号计数
mov edx,Kernel32Addr ;//暂存Kernel32模块句柄;edx->kernel32
push edi ;保存EDI
LoopFindApiStr:
add ebx,04
inc eax ;//增加函数计数
mov edi,[ebx]
add edi,edx ;//得到一个Api函数名字符串.edi->函数名
StrGetProcAddress:
mov esi,AddressOfName ;//得到Api名字字符串
cmpsd ;比较前4个字符是否相等
jnz short LoopFindApiStr ;eax=函数名的INDEX
xor ecx,ecx
mov cl, ApiLength
sub cl,4 ;//比较剩余的GetProcAddress串
cld
Goon:
cmpsb
jnz short LoopFindApiStr ;eax=函数名的INDEX
loop Goon
pop edi ;恢复EDI
mov esi,edx
movebx,[edi].AddressOfNameOrdinals
addebx,esi ;//取函数序号地址列表,ebx->AddresssOfNameOrdinals
movzx ecx,word ptr [ebx+eax*2]
mov ebx,[edi].AddressOfFunctions
add ebx,esi ;//得到Kernel32函数地址列表
mov ebx,[ebx+ecx*4]
add ebx,esi ;//计算GetProcAddress函数地址
mov eax,ebx ;eax=API函数地址,esi=Kernel32.dll hModule
pop edi
pop esi
pop ebx
ret
GetApiAddress endp
end Start