PE学习3-动态获取Kernel32的基址，动态搜索API地址

;------------------------;AUTHOR:leeleehomDATE:09/04/2010 20:12;SearchKernel32Base.asm;功能描述:动态搜索KERNEL32.DLL的基址，动态搜索API地址;------------------------.386.model flat, stdcalloption casemap:none;------------------------include windows.inc;------------------------GetKernel32Base proto stdcall @lpAddr:dword_Seh_Handle proto C lpExceptionRecord:dword, lpSeh:dword, lpContext:dword, lpDispatcherCotext:dwordGetKernel32ExportTableAddr proto stdcall @lpKernelBase:dwordSearchGetProcAddrAPI proto stdcall lpExportTableAddr:dword, lpKernel32Base:dword, lpszFuncName:dword_asm_StrLen proto stdcall lpszStr:dword_asm_StrCmp proto lpszStrA:dword, lpszStrB:dword_GetProcAddressAPItypedef proto stdcall hModule:dword, lpszFuncName:dword__GetProcAddresstypedef ptr _GetProcAddressAPI_LoadLibraryAAPItypedef proto stdcall lpszDllName:dword__LoadLibraryAtypedef ptr _LoadLibraryAAPI_MessageBoxAAPItypedef proto stdcall hWnd:dword, lpszText:dword, lpszCaption:dword, dwStyle:dword__MessageBoxAtypedef ptr _MessageBoxAAPI;------------------------.const_szGetProcAddressNamebyte'GetProcAddress', 0_szLoadLibarayNamebyte'LoadLibraryA', 0_szUser32Dllbyte'User32.dll', 0_szMessageBoxAbyte'MessageBoxA', 0_szTextbyte'动态搜索API', 0;------------------------.data?_lpKernel32Basedword?;KERNEL32.DLL基址指针_GetProcAddress__GetProcAddress?_LoadLibraryA__LoadLibraryA?_MessageBoxA__MessageBoxA?;------------------------.codemain procinvoke GetKernel32Base, [esp];在WIN32系统中，当WINDOWS装载器装入PE文件时，程序的返回地址;被自动压入堆栈，根据这个原理可以找到KERNEL32.DLL的映象基址mov _lpKernel32Base, eaxinvoke GetKernel32ExportTableAddr, eaxinvoke SearchGetProcAddrAPI, eax, _lpKernel32Base, offset _szGetProcAddressName.if eaxmov _GetProcAddress, eax.endifinvoke _GetProcAddress, _lpKernel32Base, offset _szLoadLibarayNamemov _LoadLibraryA, eaxinvoke _LoadLibraryA, offset _szUser32Dllinvoke _GetProcAddress, eax, offset _szMessageBoxAmov _MessageBoxA, eaxinvoke _MessageBoxA, 0, offset _szText, offset _szText, MB_OKretmain endp;------------------------GetKernel32Base proc @lpAddr:dwordLOCAL lpBaseAddr:dwordpushadassume fs:nothing;构建SEH结构化异常处理push ebp;保存EBP基址，异常跳转时恢复函数基地push offset _Safe_Code;发生异常时，EIP跳转到该偏移地址push offset _Seh_Handle;入栈SEH异常回调函数push fs:[0];入栈SEH链表的第一个异常处理结构地址mov fs:[0], esp;在堆栈中构建一个SEH结构，并加入到SEH链表头mov edi, @lpAddrmov lpBaseAddr, 0.if edi;指针是否为空and edi, 0ffff0000h;PE装载器装载EXE.DLL是以64K对齐assume edi:ptr IMAGE_DOS_HEADER.while edi > 70000000h;KERNEL32.DLL NTDLL.DLL基址都大于70000000h.if [edi].e_magic == 'ZM';找到KERNEL32.DLL DOS头push edi;保存KERNEL32.DLL基址add edi, [edi].e_lfanew.if dword ptr[edi] == 'EP';找到KERNEL32.DLL PE头pop edi;恢复KERNEL32.DLL基址mov lpBaseAddr, edi;xor eax, eax;测试SEH异常处理是正常工作;mov dword ptr[eax], 0.break.endif.endifsub edi, 10000h.endwassume edi:nothing.endif_Safe_Code:;函数调用成功或出现异常时EIP跳转到这里执行pop fs:[0];恢复SEH链表add esp, 0ch;恢复堆栈平衡popadmov eax, lpBaseAddr;返回KERNEL32.DLL基址，如果没有找到返回0retGetKernel32Base endp;------------------------_Seh_Handle proc C lpExceptionRecord:dword, lpSeh:dword, lpContext:dword, lpDispatcherCotext:dwordpushadmov esi, lpContext;ESI保存EXCEPTION_RECORD结构体指针assume esi:ptr CONTEXTmov edi, lpSeh;edi等于堆栈中构建的SEH结构体的地址mov eax, [edi + 08h];改变EIP指令指针，mov [esi].regEip, eaxmov eax, [edi + 0ch]mov [esi].regEbp, eax;恢复基址指针mov [esi].regEsp, edi;恢复堆栈指针assume esi:nothingpopadmov eax, ExceptionContinueExecutionret_Seh_Handle endp;------------------------GetKernel32ExportTableAddr proc stdcall lpKernelBase:dwordLOCAL lpAddr:dwordpushadassume fs:nothing;SEH异常处理push ebppush offset _SafeCodepush offset _Seh_Handlepush fs:[0]mov fs:[0], espmov lpAddr, 0mov esi, lpKernelBase.if esi;指针是否为空assume esi:ptr IMAGE_DOS_HEADER.if [esi].e_magic != 'ZM';判断是不是有效的DOS头jmp _SafeCode;如果不是有效的DOS头，函数退出.endifadd esi, [esi].e_lfanew;转到PE头assume esi:nothingassume esi:ptr IMAGE_NT_HEADERS.if [esi].Signature == 'EP';判断是不是有效的PE头;xor eax, eax;测试SEH异常处理是正常工作;mov dword ptr[eax], 0lea eax, [esi].OptionalHeader.DataDirectory;导出表是数据目录结构数组的第一个结构mov lpAddr, eaxjmp _SafeCode.endifassume esi:nothing.endif_SafeCode:pop fs:[0];恢复add esp, 0chpopadmov eax, lpAddrretGetKernel32ExportTableAddr endp;------------------------SearchGetProcAddrAPI proc lpExportTableAddr:dword, lpKernel32Base:dword, lpszFuncName:dwordLOCAL lpApiAddr:dwordpushadassume fs:nothing;SEH异常处理push ebppush offset _SafeCodepush offset _Seh_Handlepush fs:[0]mov fs:[0], espmov esi, lpExportTableAddrmov lpApiAddr, 0.if esi;判断指针不为空assume esi:ptr IMAGE_DATA_DIRECTORYmov esi, [esi].VirtualAddressadd esi, lpKernel32Baseassume esi: ptr IMAGE_EXPORT_DIRECTORYmov eax, [esi].nName;得到指向DLL文件名字字符串的RVA地址add eax, lpKernel32Base;得到KERNEL32.DLL文件名字字符串在内存中的地址;PrintStringByAddr eax;eax = "KERNEL32.DLL";--------------------------------------------------------------------------------------mov ebx, [esi].AddressOfNames;得到KERNEL32.DLL导出函数名称数组的RVA地址add ebx, lpKernel32Base;得到KERNEL32.DLL导出函数名称数组在内存中的地址push ebx;保存一份ebxmov ecx, [esi].NumberOfNames;得到KERNEL32.DLL中以名称导出的函数个数;--------------------------------------------------------------------------------------@@:;枚举KERNEL32.DLL导出的所有函数名mov edi, [ebx];得到函数名的RVA地址add edi, lpKernel32Base;得到函数名在内存中的地址invoke _asm_StrCmp, edi, lpszFuncName;比较导出的函数与"GetProcAddress"是否相等.if !eaxjmp@f;如果找到该函数，进行第二阶段.endifadd ebx, 4;下一个函数名loop @b;循环jmp _SafeCode;如果找不到该函数，函数返回;--------------------------------------------------------------------------------------@@:pop eax;将前面备份的ebx值恢复eax中sub ebx, eax;得到函数名地址在地址数组中的偏移ror ebx, 1;得到序号名地址在序号数组中的偏移;因为序号名地址是一个WORD型，所以要除2mov edi, [esi].AddressOfNameOrdinals;得到KERNEL32.DLL导出函数序号名数组RVA地址add edi, lpKernel32Base;得到KERNEL32.DLL导出函数序号数组在内存中的地址add edi, ebx;加上序号名地址偏移movzx eax, word ptr[edi];得到函数索引mov edi, [esi].AddressOfFunctions;得到KERNEL32.DLL导出函数地址数组的RVA地址add edi, lpKernel32Base;得到KERNEL32.DLL导出函数地址数组在内存中的地址shl eax, 2;函数索引*4，得到函数导出地址在导出地址数组中的偏移add edi, eax;定位到函数地址mov eax, [edi];得到函数的RVA地址add eax, lpKernel32Base;得到函数在内存中的地址mov lpApiAddr, eaxassume esi:nothing.endifjmp _ret;返回_SafeCode:pop ebx;恢复前面保存的ebx，让堆栈平衡_ret:pop fs:[0];恢复SEHadd esp, 0chpopadmov eax, lpApiAddrretSearchGetProcAddrAPI endp;------------------------_asm_StrCmp proc lpszStrA:dword, lpszStrB:dwordLOCAL dwRet:dwordpushadmov dwRet, -1;不相等返回-1invoke _asm_StrLen, lpszStrA;取得字符串A的长度mov ecx, eaxinvoke _asm_StrLen, lpszStrB;取得字符串B的长度.if eax == ecx;如果字符串长度相等mov esi, lpszStrAmov edi, lpszStrBcldrepz cmpsb;比较字符串.if Zero?mov dwRet, 0;相等返回0.endif.endifpopadmov eax, dwRetret_asm_StrCmp endp;------------------------_asm_StrLen proc lpszStr:dwordLOCAL dwLen:dwordpushadmov dwLen, 0mov edi, lpszStr;取得字符串的地址xor ecx, ecxdec ecx;ecx = 0ffffffffhxor eax, eax;eax = 0cldrepnz scasb;在目标字符串中查找字节0.if Zero?;如果查找到sub edi, lpszStr;计算字符串的长度mov dwLen, edi.endifpopadmov eax, dwLen;返回字符串的长度ret_asm_StrLen endp;------------------------end main