本文介绍了一种使用WIN32汇编语言实现非导入表调用API的方法，通过直接查找PE文件的导出表来获取API地址，并展示了具体的汇编代码示例。
;WIN32汇编无输入表调用API .386
.model flat,stdcall
option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include windows.inc
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 数据段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.const
szCaption db '恭喜',0
szText db '非导入表调用成功!',0
szLoadLibrary db 'LoadLibraryA',0
szGetProcAddress db 'GetProcAddress',0
szUser32 db 'user32',0
szMessageBox db 'MessageBoxA',0
.data?
ALoadLibrary dd ?
AGetProcAddress dd ?
AMessageBox dd ?
dwKernel32Base dd ?
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
_Handler proc _lpExceptionRecord,_lpSEH,_lpContext,_lpDispatchertext
pushad
mov esi,_lpExceptionRecord
assume esi:ptr EXCEPTIONRECORD
mov edi,_lpContext
assume edi:ptr CONTEXT
mov eax,_lpSEH
push [eax+0ch]
pop [edi].regEbp
push [eax+08]
pop [edi].regEip
push eax
pop [edi].regEsp
assume edi:nothing,esi:nothing
popad
mov eax,ExceptionContinueExecution
ret
_Handler endp
_GetKernel32Base proc uses edi esi ebx dwEsp
call @F
@@:
pop ebx
sub ebx,offset @B
;安装SEH
assume fs:nothing
push ebp
lea eax, [ebx+offset _safeplace]
push eax
lea eax,[ebx + offset _Handler]
push eax
push fs:[0]
mov fs:[0],esp
mov eax,dwEsp
and eax,0ffff0000h
.while eax>=70000000h
.if word ptr [eax] == IMAGE_DOS_SIGNATURE
mov edi,eax
add edi,[eax+03ch]
.if word ptr [edi] == IMAGE_NT_SIGNATURE
jmp find
.endif
.endif
_safeplace:
sub eax,10000h
.endw
mov eax,0
find:
pop fs:[0]
add esp,0ch
ret
_GetKernel32Base endp
_GetApi proc _hModule,_lpszApi
local @dwReturn,@dwSize
pushad
call @F
@@:
pop ebx
sub ebx,@B
assume fs:nothing
push ebp
push [ebx+offset error]
push [ebx+offset _Handler]
push fs:[0]
mov fs:[0],esp
mov edi,_lpszApi
mov ecx,-1
xor eax,eax
cld
repnz scasb
sub edi,_lpszApi
mov @dwSize,edi
mov esi,_hModule
add esi,[esi+3ch]
assume esi:ptr IMAGE_NT_HEADERS
mov esi,[esi].OptionalHeader.DataDirectory.VirtualAddress
add esi,_hModule
assume esi:ptr IMAGE_EXPORT_DIRECTORY
mov ebx,[esi].AddressOfNames
add ebx,_hModule
xor edx,edx
.while edx < [esi].NumberOfNames
push esi
mov edi,[ebx]
add edi,_hModule
mov esi,_lpszApi
mov ecx,@dwSize
cld
repz cmpsb
.if !ecx
pop esi
jmp @F
.endif
next:
pop esi
inc edx
add ebx,4
.endw
jmp error
@@:
sub ebx,[esi].AddressOfNames
sub ebx,_hModule
shr ebx,1
add ebx,[esi].AddressOfNameOrdinals
add ebx,_hModule
movzx eax,word ptr [ebx]
shl eax,2
add eax,[esi].AddressOfFunctions
add eax,_hModule
mov eax,[eax]
add eax,_hModule
mov @dwReturn,eax
error:
pop fs:[0]
add esp,0ch
assume esi:nothing
popad
mov eax,@dwReturn
ret
_GetApi endp
start:
mov eax,[esp]
invoke _GetKernel32Base,eax
.if eax
mov dwKernel32Base,eax
invoke _GetApi,eax, offset szGetProcAddress
mov AGetProcAddress,eax
.endif
.if AGetProcAddress
push offset szLoadLibrary
push dwKernel32Base
call AGetProcAddress
.if eax
mov ALoadLibrary,eax
push offset szUser32
call eax
.if eax
push offset szMessageBox
push eax
call AGetProcAddress
.if eax
mov AMessageBox,eax
.endif
.endif
.endif
.endif
.if AMessageBox
push MB_YESNO
push offset szCaption
push offset szText
push NULL
call AMessageBox
.endif
ret;invoke ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
end start
可以嵌入PE文件执行的WIN32汇编代码
.386
.model flat,stdcall
option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include windows.inc
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
jmp _NewEntry
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;重要的函数名，为兼容WIN7 kernelbase.dll，增加LoadLibraryA函数
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
szLoadLibraryA db 'LoadLibraryA',0
;szLoadLibraryA db 'LoadLibraryA',0
szGetProcAddress db 'GetProcAddress',0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;补丁功能代码需要的DLL，函数名，字符串等全局变量定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
szUser32 db 'user32',0
szMessageBoxA db 'MessageBoxA',0
szCaption db '恭喜',0
szText db '非导入表调用成功!',0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;SEH错误Handler
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_SEHHandler proc _lpExceptionRecord,_lpSEH,_lpContext,_lpDispatchertext
pushad
mov esi,_lpExceptionRecord
assume esi:ptr EXCEPTIONRECORD
mov edi,_lpContext
assume edi:ptr CONTEXT
mov eax,_lpSEH
push [eax+0ch]
pop [edi].regEbp
push [eax+08]
pop [edi].regEip
push eax
pop [edi].regEsp
assume edi:nothing,esi:nothing
popad
mov eax,ExceptionContinueExecution
ret
_SEHHandler endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;获取kernel32.dll基地址,2种获取方法自行选择
;PS:用PEB获取最好使用LoadLibraryExA函数以兼容WIN7
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetKernel32Base proc uses edi esi ebx _dwEsp
call @F
@@:
pop ebx
sub ebx,offset @B
;安装SEH
assume fs:nothing
push ebp
lea eax, [ebx+offset _safeplace]
push eax
lea eax,[ebx + offset _SEHHandler]
push eax
push fs:[0]
mov fs:[0],esp
mov eax,_dwEsp
and eax,0ffff0000h
.while eax>=70000000h
.if word ptr [eax] == IMAGE_DOS_SIGNATURE
mov edi,eax
add edi,[eax+03ch]
.if word ptr [edi] == IMAGE_NT_SIGNATURE
jmp find
.endif
.endif
_safeplace:
sub eax,10000h
.endw
mov eax,0
find:
pop fs:[0]
add esp,0ch
ret
_GetKernel32Base endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;用PEB获取基址的方法
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;_GetKernel32Base proc
; local @dwRet
; pushad
;
; assume fs:nothing
; mov eax,fs:[30h] ;获取PEB所在地址
; mov eax,[eax+0ch] ;获取PEB_LDR_DATA 结构指针
; mov esi,[eax+1ch] ;获取InInitializationOrderModuleList 链表头
; ;第一个LDR_MODULE节点InInitializationOrderModuleList成员的指针
; lodsd ;获取双向链表当前节点后继的指针
; mov eax,[eax+8] ;获取kernel32.dll的基地址
; mov @dwRet,eax
; popad
;
; mov eax,@dwRet
; ret
;_GetKernel32Base endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;查找导出表获取制定API地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetApi proc _hModule,_lpszApi
local @dwReturn,@dwSize
pushad
call @F
@@:
pop ebx
sub ebx,@B
assume fs:nothing
push ebp
push [ebx+offset error]
push [ebx+offset _SEHHandler]
push fs:[0]
mov fs:[0],esp
mov edi,_lpszApi
mov ecx,-1
xor eax,eax
cld
repnz scasb
sub edi,_lpszApi
mov @dwSize,edi
mov esi,_hModule
add esi,[esi+3ch]
assume esi:ptr IMAGE_NT_HEADERS
mov esi,[esi].OptionalHeader.DataDirectory.VirtualAddress
add esi,_hModule
assume esi:ptr IMAGE_EXPORT_DIRECTORY
mov ebx,[esi].AddressOfNames
add ebx,_hModule
xor edx,edx
.while edx < [esi].NumberOfNames
push esi
mov edi,[ebx]
add edi,_hModule
mov esi,_lpszApi
mov ecx,@dwSize
cld
repz cmpsb
.if !ecx
pop esi
jmp @F
.endif
next:
pop esi
inc edx
add ebx,4
.endw
jmp error
@@:
sub ebx,[esi].AddressOfNames
sub ebx,_hModule
shr ebx,1
add ebx,[esi].AddressOfNameOrdinals
add ebx,_hModule
movzx eax,word ptr [ebx]
shl eax,2
add eax,[esi].AddressOfFunctions
add eax,_hModule
mov eax,[eax]
add eax,_hModule
mov @dwReturn,eax
error:
pop fs:[0]
add esp,0ch
assume esi:nothing
popad
mov eax,@dwReturn
ret
_GetApi endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;补丁功能部分
;_dwKernelBase: kernel32.dll基址
;_lpGetProcAddress: GetProcAddress地址
;_lpLoadLibraryA LoadLibraryA或LoadLibraryA地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Patch proc _dwKernelBase,_lpGetProcAddress,_lpLoadLibraryA
local @hUser32,@lpMessageBoxA
pushad
lea edx,dword ptr [ebx+offset szUser32]
push 0
push 0
push edx
call _lpLoadLibraryA
.if eax
mov @hUser32,eax
lea edx,dword ptr [ebx+offset szMessageBoxA]
push edx
push eax
call _lpGetProcAddress
.if eax
mov @lpMessageBoxA,eax
.endif
.endif
.if @lpMessageBoxA
push MB_YESNO
lea edx,dword ptr [ebx+offset szCaption]
push edx
lea edx,dword ptr [ebx+offset szText]
push edx
push NULL
call @lpMessageBoxA
.endif
popad
ret
_Patch endp
_start proc
local @dwKernel32Base
local @lpGetProcAddress,@lpLoadLibraryA
pushad
push edx
call _GetKernel32Base
.if eax
mov @dwKernel32Base,eax
lea edx,dword ptr [ebx+offset szGetProcAddress]
push edx
push eax
call _GetApi
mov @lpGetProcAddress,eax
.endif
.if @lpGetProcAddress
lea edx,dword ptr [ebx+offset szLoadLibraryA]
push edx
push @dwKernel32Base
call @lpGetProcAddress
.if eax
mov @lpLoadLibraryA,eax
push eax
push @lpGetProcAddress
push @dwKernel32Base
call _Patch
.endif
.endif
popad
xor eax,eax
ret
_start endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;PE文件新入口
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_NewEntry:
mov edx,[esp]
call @F
@@:
pop ebx
sub ebx,@B
call _start
;ret
jmpToStart db 0E9h,0F0h,0FFh,0ffh,0ffh ;需要修正
ret
end _NewEntry
PE加载器(仅提供个思路..实际中无法使用)
#include <windows.h>
#include <commdlg.h>
#include "resource.h"
#pragma comment(linker,"/BASE:0x70000000")
void PopFileInitialize (HWND hwnd);
BOOL PopFileOpenDlg (HWND hwnd, PTSTR pstrFileName, PTSTR pstrTitleName);
BOOL FixReloc(BYTE *lpImage, DWORD OldImage, PIMAGE_BASE_RELOCATION pRelocData);
BOOL FixIAT(BYTE *lpImage, PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor);
BOOL LoadPE(TCHAR szFileName[]);
void SetProtect(BYTE *lpImage, PIMAGE_SECTION_HEADER pFirstSection,DWORD dwSectionNum);
//载入PE用到的参数
HINSTANCE arg1, arg2;
PSTR arg3;
int arg4;
int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,PSTR szCmdLine, int iCmdShow)
{
TCHAR szFileName[MAX_PATH] ={0};
arg1 = hInstance;
arg2 = hPrevInstance;
arg3 = szCmdLine;
arg4 = iCmdShow;
PopFileInitialize(NULL);
PopFileOpenDlg(NULL, szFileName, TEXT("选择要载入的PE文件") );
if (!LoadPE(szFileName) )
;//MessageBox(NULL, TEXT("载入PE文件失败"), NULL, NULL);
return 0;
}
BOOL LoadPE(TCHAR szFileName[])
{
//::PIMAGE_DATA_DIRECTORY pDataDirectory;
::PIMAGE_BASE_RELOCATION pRelocData;
::PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;
::PIMAGE_NT_HEADERS pNtHeaders;
HANDLE hFile;
HANDLE hMap;
BYTE *lpMemory;
BYTE *lpImage;
DWORD dwImageBase; //文件头基地址
DWORD dwEntryAddress; //入口地址
DWORD dwImageSize;
if (INVALID_HANDLE_VALUE == ( hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_ARCHIVE, NULL) ) )
{
MessageBox(NULL, L"打开文件失败", NULL, NULL);
return FALSE;
}
hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
if (hMap)
{
lpMemory = (BYTE*)MapViewOfFile (hMap, FILE_MAP_READ, 0, 0, 0);
if (lpMemory)
{
if ( *((WORD*)lpMemory) == 0x5A4D)
{
pNtHeaders = (PIMAGE_NT_HEADERS)(lpMemory + ((PIMAGE_DOS_HEADER)lpMemory)->e_lfanew);
if (pNtHeaders->Signature == 0x4550)
{
dwImageSize = pNtHeaders->OptionalHeader.SizeOfImage;
dwImageBase = pNtHeaders->OptionalHeader.ImageBase;
dwEntryAddress = pNtHeaders->OptionalHeader.AddressOfEntryPoint;
lpImage = (PBYTE)VirtualAlloc((LPVOID)dwImageBase, dwImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (!lpImage)
{
lpImage = (PBYTE)VirtualAlloc(NULL, dwImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
}
//文件头读入
memset(lpImage, 0, dwImageSize);
memcpy(lpImage, lpMemory, pNtHeaders->OptionalHeader.SizeOfHeaders);
//区段读入
PIMAGE_SECTION_HEADER pSectionHeader, pFirstSection;
DWORD dwSectionSize;
DWORD dwSectionAddr,dwFileAddr;
DWORD dwSectionNum = pNtHeaders->FileHeader.NumberOfSections;
pSectionHeader = pFirstSection = (PIMAGE_SECTION_HEADER)(pNtHeaders+1);
for (DWORD i=0; i < dwSectionNum; i++, pSectionHeader++)
{
dwSectionAddr = pSectionHeader->VirtualAddress;
dwFileAddr = pSectionHeader->PointerToRawData;
dwSectionSize = pSectionHeader->Misc.VirtualSize;
memcpy(lpImage + dwSectionAddr, lpMemory + dwFileAddr, pSectionHeader->SizeOfRawData);
}
//修复IAT
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(lpImage + pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
FixIAT(lpImage, pImportDescriptor);
//重定位修复
if (pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)
{
pRelocData = (PIMAGE_BASE_RELOCATION)(lpImage + pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
FixReloc(lpImage, dwImageBase, pRelocData);
}
SetProtect(lpImage, pFirstSection, dwSectionNum);
//准备跳入PE
DWORD addr = dwEntryAddress + (DWORD)lpImage;
_asm
{
push arg4
push arg3
push arg2
push lpImage
call addr
}
}
else
MessageBox(NULL, L"不是PE文件", NULL, NULL);
}
else
MessageBox(NULL, L"不是PE文件", NULL, NULL);
}
}
if (lpMemory)
UnmapViewOfFile (lpMemory);
CloseHandle(hMap);
CloseHandle(hFile);
return FALSE;
}
BOOL FixReloc(BYTE *lpImage, DWORD OldImage, PIMAGE_BASE_RELOCATION pRelocData)
{
DWORD dwOffset; //修正用
DWORD dwBase; //修正基地址
DWORD *dwAddress; //需要修正的地址
DWORD dwNum; //修正项数
WORD *wValue;//修正偏移
PIMAGE_BASE_RELOCATION pReloc;
dwOffset = (DWORD)(lpImage - OldImage);
pReloc = pRelocData;
for (; pReloc->VirtualAddress; pReloc++)
{
dwBase = pReloc->VirtualAddress;
dwNum = (pReloc->SizeOfBlock - 8) / 2;
wValue = (WORD*)((DWORD)pReloc + 8);
while(dwNum--)
{
dwAddress = (DWORD*)(lpImage + dwBase + *wValue);
(*dwAddress)+= dwOffset;
wValue++;
}
}
return TRUE;
}
BOOL FixIAT(BYTE *lpImage, PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor)
{
PIMAGE_IMPORT_DESCRIPTOR pDllImport;
PIMAGE_THUNK_DATA pOrignalThunk, pFirstThunk;
PIMAGE_IMPORT_BY_NAME pImportByName;
HMODULE hModule;
DWORD dwAddress,dwFunc;
char szDllName[MAX_PATH];
for (pDllImport = pImportDescriptor; pDllImport->Name ; pDllImport++)
{
lstrcpyA(szDllName, (char*)(lpImage + pDllImport->Name));
if (!(hModule = GetModuleHandleA(szDllName)) )
hModule = LoadLibraryA (szDllName);
if (pDllImport->OriginalFirstThunk)
pOrignalThunk = (PIMAGE_THUNK_DATA)(lpImage + pDllImport->OriginalFirstThunk);
else
pOrignalThunk = (PIMAGE_THUNK_DATA)(lpImage + pDllImport->FirstThunk);
pFirstThunk = (PIMAGE_THUNK_DATA)(lpImage + pDllImport->FirstThunk);
for (; pOrignalThunk->u1.Function; pOrignalThunk++, pFirstThunk++)
{
if ( (pOrignalThunk->u1.Ordinal) & 0x80000000) //序号导入
{
dwFunc = pOrignalThunk->u1.Ordinal;
dwFunc &= 0x7fffffff;
}
else //名称导入
{
pImportByName = (PIMAGE_IMPORT_BY_NAME)(lpImage + pOrignalThunk->u1.Function);
dwFunc = (DWORD)pImportByName->Name;
}
dwAddress = (DWORD)GetProcAddress (hModule, (LPCSTR)dwFunc);
pFirstThunk->u1.Function = dwAddress;
}
}
return TRUE;
}
void SetProtect(BYTE *lpImage, PIMAGE_SECTION_HEADER pFirstSection,DWORD dwSectionNum)
{
PIMAGE_SECTION_HEADER pSectionHeader = pFirstSection;
DWORD dwProtect;
DWORD dwSectionSize, dwSectionAddr;
for (DWORD i=0; i < dwSectionNum; i++, pSectionHeader++)
{
dwSectionSize = pSectionHeader->Misc.VirtualSize;
dwSectionAddr = pSectionHeader->VirtualAddress;
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_READ)
dwProtect = PAGE_READONLY;
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_WRITE)
dwProtect = PAGE_READWRITE;
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_EXECUTE)
{
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_READ)
dwProtect = PAGE_EXECUTE_READ;
else if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_WRITE)
dwProtect = PAGE_EXECUTE_READWRITE;
else
dwProtect = PAGE_EXECUTE;
}
DWORD OldProtect;
if (!VirtualProtect(lpImage+dwSectionAddr, dwSectionSize, dwProtect, &OldProtect) )
MessageBox(NULL,L"页面属性设置失败", NULL, 0);
}
}
///////////////////////////////////打开文件对话框/////////////////////////////////////////////////////////
static OPENFILENAME ofn ;
void PopFileInitialize (HWND hwnd)
{
static TCHAR szFilter[] = TEXT ("PE Files \0*.exe;*.dll\0") \
TEXT ("All Files (*.*)\0*.*\0\0") ;
ofn.lStructSize = sizeof (OPENFILENAME) ;
ofn.hwndOwner = hwnd ;
ofn.hInstance = NULL ;
ofn.lpstrFilter = szFilter ;
ofn.lpstrCustomFilter = NULL ;
ofn.nMaxCustFilter = 0 ;
ofn.nFilterIndex = 0 ;
ofn.lpstrFile = NULL ; // Set in Open and Close functions
ofn.nMaxFile = MAX_PATH ;
ofn.lpstrFileTitle = NULL ; // Set in Open and Close functions
ofn.nMaxFileTitle = MAX_PATH ;
ofn.lpstrInitialDir = NULL ;
ofn.lpstrTitle = NULL ;
ofn.Flags = 0 ; // Set in Open and Close functions
ofn.nFileOffset = 0 ;
ofn.nFileExtension = 0 ;
ofn.lpstrDefExt = TEXT ("txt") ;
ofn.lCustData = 0L ;
ofn.lpfnHook = NULL ;
ofn.lpTemplateName = NULL ;
}
BOOL PopFileOpenDlg (HWND hwnd, PTSTR pstrFileName, PTSTR pstrTitleName)
{
ofn.hwndOwner = hwnd ;
ofn.lpstrFile = pstrFileName ;
ofn.lpstrTitle = pstrTitleName ;
ofn.Flags = OFN_HIDEREADONLY | OFN_CREATEPROMPT ;
return GetOpenFileName (&ofn) ;
}
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
扫一扫
1126
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
