C语言内嵌汇编API内存搜索引擎实例
本文实例讲述了C语言内嵌汇编API内存搜索引擎的方法,分享给大家供大家参考。具体实现方法如下:
//apisearchEngine.cpp:Definestheentrypointfortheconsoleapplication. // #include"stdafx.h" #include<Windows.h> DWORD__stdcallGetStrLengthA(char*szName) { _asm { pushedi pushebx moveax, szName movedi,eax movebx,eax xoral,al lstrscan: scasbyteptr[edi] //字符扫描法检查字符串指针长度 jnzlstrscan decedi subedi,ebx moveax,edi popebx popedi } } DWORD__stdcallCalcBufferCRC(char*lpBuffer) { _asm { pushebx pushedi pushecx pushebp movebx,lpBuffer pushebx callGetStrLengthA movedi,eax shredi,2 xorecx,ecx loopBegin: decedi jlloopOver xorecx,dwordptr[ebx] addebx,4 jmploopBegin loopOver: moveax,ecx popebp popecx popedi popebx } } DWORD__stdcallGetProcAddressA(HANDLEhModule,DWORDdwExportCRC) { //DWORDlpProcNameCRC=; DWORDdwProcNumber; LPVOIDpProcAddress,pProcNameAddress,pProcIndexAddress; _asm { pushebx pushesi moveax,hModule movedx,dwExportCRC //edx=函数名CRC32 movebx,eax //ebx=基址 moveax,[ebx+0x3c] //eax=文件头偏移 movesi,[ebx+eax+0x78] //esi=输出表偏移,文件头+可选头的长度=$78 leaesi,[ebx+esi+0x18] //esi=函数名数量=函数数量[ebx+esi+$14] lodsdwordptrds:[esi] movdwProcNumber,eax //eax=函数名数量 lodsdwordptrds:[esi] movpProcAddress,eax //eax=函数偏移量 lodsdwordptrds:[esi] movpProcNameAddress,eax //eax=函数名偏移量 lodsdwordptrds:[esi] movpProcIndexAddress,eax //eax=序列号偏移量 movedx,dwProcNumber //edx=遍历次数 LoopBegin: xoreax,eax //Result=0 decedx jlLoopEnd moveax,pProcNameAddress addeax,ebx //eax=函数名基地址 moveax,dwordptrds:[eax+edx*4] addeax,ebx //eax=遍历函数名 pusheax callCalcBufferCRC cmpeax,dwExportCRC //对比CRC32 jnzLoopBegin shledx,1 addedx,pProcIndexAddress //函数基序列 movzxeax,wordptrss:[edx+ebx] shleax,2 addeax,pProcAddress //函数基地址 moveax,[eax+ebx] addeax,ebx //Result=函数地址 LoopEnd: popesi popebx } }
DWORD__stdcallGetKernel32Module() { _asm { PUSH EBP XOR ECX,ECX //MOV ESI,[FS:ECX+0x30] ;ESI=&(PEB)([FS:0x30]) MOV ESI,FS:[0X30] MOV ESI,[ESI+0x0C] ;ESI=PEB->Ldr MOV ESI,[ESI+0x1C] ;ESI=PEB->Ldr.InInitOrder next_module: MOV EBP,[ESI+0x08] ;EBP=InInitOrder[X].base_address MOV EDI,[ESI+0x20] ;EBP=InInitOrder[X].module_name(unicode) MOV ESI,[ESI] ;ESI=InInitOrder[X].flink(nextmodule) CMP [EDI+12*2],CL ;modulename[12]==0? JNE next_module ;No:trynextmodule. MOV EAX,EBP POP EBP } } intmain(intargc,char*argv[]) { printf("writebyxiaoju!\n"); printf("*****************\n"); DWORDdwBaseKernel32=GetKernel32Module(); printf("Kernel32的模块地址:%08x\n",dwBaseKernel32); DWORDLoadLibraryCRC32=CalcBufferCRC("LoadLibraryA"); printf("LoadLibraryA的CRC值(静态写到程序中):%08x\n\n",LoadLibraryCRC32); DWORDdwAddrLoadLibrary=GetProcAddressA((HANDLE)dwBaseKernel32,0x577a7461); printf("在程序中动态得到的LoadLibraryA的地址:%08x\n",dwAddrLoadLibrary); getchar(); return0; }