[] 纯文本查看 复制代码
#include <ntdef.h>;
#include <iostream>;
#include <string>;
void GetAllFuncs(unsigned int* intEntry);
int main() {
_UNICODE_STRING* lpBaseDllName = {};
unsigned int* intBaseAddr = {};
__asm {
mov eax, fs: [030h] //TEB -> PEB
add eax, 0ch
mov eax, [eax] //PEB -> LDR
add eax, 01ch
mov eax, [eax] // LDR -> InInitializationOrderModuleList
mov edx, eax //Save the first entry
LIST_ENTRY_RET:
mov ecx, [eax + 08h] //DllBase(DOS HEADER)
mov intBaseAddr, ecx
lea ecx, [eax + 01ch]
mov lpBaseDllName, ecx //*BaseDllName *Note, normally kernel32.dll is at the second turn.
mov eax, [eax]
cmp eax, edx
je RETNOW
pushad
}
std::wcout << "DllName: " << lpBaseDllName->Buffer << std::hex << ", Entry: " << intBaseAddr << std::endl;
GetAllFuncs(intBaseAddr);
_asm {
popad
jmp LIST_ENTRY_RET
RETNOW:
}
}
void GetAllFuncs(unsigned int *intEntry) {
char* lpNameOfFunction = {};
unsigned int* intAddrOfFunction = {};
__asm {
mov eax, intEntry
mov ebx, [eax + 03ch] //DOS_HEADER.e_lfanew
add eax, ebx
//now eax points to PE
mov edx, 078h // PE + 078h = DataDirectory in x86(See IMAGE_NT_HEADERS32 struct)
mov bx, [eax + 018h] //Magic, 010Bh for x86, 020Bh for x64 (x86/64 for the HEADER only)
cmp bx, 020Bh
jnz x86_next
add edx, 010h //IMAGE_NT_HEADERS64 has more 10bytes than HEADERS32
x86_next :
mov eax, [eax + edx] //Export Table DATA_DIRECTORY
//mov eax,[ebx] //RVA of Export Table
mov ebx, intEntry
add ebx, eax //ebx points to IMAGE_EXPORT_DIRECTORY
//mov ecx,[ebx + 018h] //NumberOfNames
//mov eax,[ebx + 01ch] //AddressOfFunctions
//mov edx,[ebx + 024h] //AddressOfNameOrdinals
//[ebx + 020h] //AddressOfName
xor edi, edi
GO_ON_EXPORT :
imul eax, edi, 4
mov edx, [ebx + 020h] //RVA Address
add edx, intEntry
mov esi, [edx + eax] //AddressOfName
add esi, intEntry
mov lpNameOfFunction, esi
imul eax, edi, 2
mov edx, [ebx + 024h]
add edx, intEntry
movzx esi, word ptr[edx + eax] //AddressOfNameOrdinals[i]
imul esi, esi, 4
mov edx, [ebx + 01ch]
add edx, intEntry
mov ecx, [edx + esi]
add ecx, intEntry
mov intAddrOfFunction, ecx
pushad
}
std::cout << "Name: " << lpNameOfFunction << ", Address: " << std::hex << intAddrOfFunction << std::endl;
__asm{
popad
inc edi
cmp edi, [ebx + 018h]
jnz GO_ON_EXPORT
}
}
[复制链接]
发表于 2020-6-30 02:40
|
发表于 2020-6-30 12:09
