[C++][ASM]免API撈模組基址(asm從PEB硬幹)

這是從對岸忘記從哪裡撈來的...
不過看了一下手法很漂亮就記錄下來惹XD
原理是用asm從PEB去指向模組的List去找這樣
底下稍微改過原本寫法然後補上註解
DWORD GetSelfModule()//等同GetModuleHanle(NULL)
{
DWORD dRetn = 0;
asm
{
   push eax //保護堆疊
   MOV eax,dword ptr fs:[0x30] // pointer to PEB
   MOV eax,dword ptr [eax+0x8] //eax = Current Module Base
   MOV [dRetn],eax
   pop eax //恢復堆疊
}
return dRetn;
}
另個是如果想搜索
DWORD GetKernelModule()//獲取Kernel32 DLL Base
{
DWORD dRetn = 0;
asm
{
   push eax
   mov eax,dword ptr fs:[0x30]   //pointer to PEB
   mov eax,dword ptr [eax+0x0c]   //pointer to loader data
   mov eax,dword ptr [eax+0x1c]   //first entry in initialization order list (ntdll.dll)
   mov eax,dword ptr [eax]    //second entry int initialization order list (kernel32.dll)
   mov eax,dword ptr [eax+0x08]   //base addr of kernel32.dll
   mov [dRetn],eax
   pop eax
}
return dRetn;
}
至於可以用在哪.....
比如說...要做黑黑的事情但是不想被防毒檢測到之類的XD(?)
或者遊戲保護不給搜索(?)不過一般遊戲不會防這個啦

忘了補一個
看雪的某個大大丟的寫法這個也不錯XD
//*參考 看雪 【原创】搜索输出表取得GetProcAddress地址C++版
PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNtHeader;
PIMAGE_EXPORT_DIRECTORY pExportDirectory;
HMODULE hModuleBase = hModule;
pDosHeader = (PIMAGE_DOS_HEADER)hModuleBase;
pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)hModuleBase + pDosHeader->e_lfanew);
pExportDirectory = PIMAGE_EXPORT_DIRECTORY(pNtHeader->OptionalHeader.DataDirectory[0].VirtualAddress + (PBYTE)hModuleBase);
PDWORD pAddressName = PDWORD((PBYTE)hModuleBase+pExportDirectory->AddressOfNames); //函数名称表指针
PWORD pAddressOfNameOrdinals = (PWORD)((PBYTE)hModuleBase+pExportDirectory->AddressOfNameOrdinals); //函数名称序号表指针
//PDWORD pAddresOfFunction = (PDWORD)((PBYTE)hModuleBase+pExportDirectory->AddressOfFunctions); //函数地址表指针
for (int index = 0; index < (pExportDirectory->NumberOfNames); index++)
{
PCHAR pFunc = (PCHAR)((long)hModuleBase + *pAddressName);
pAddressName ++ ;
if (!strcmp(pFunc, "GetProcAddress")) break;
pAddressOfNameOrdinals++;//ENT和函数名序号数组两个并行数组同时滑动指针(序号数组中的序号就对应函数名对应的函数地址的数组索引)
}

熱門文章