寫項目時自己實現(xiàn)了這兩個函數(shù)，記錄下來以后方便復(fù)習(xí)。

其實對于免殺來說，這樣做意義不大，因為最終還是要調(diào)用API，反匯編引擎能發(fā)現(xiàn)

E8 <API> FF 15 <API>

這種代碼，就知道你調(diào)用了敏感函數(shù)。所以這篇文章實戰(zhàn)價值不大。

// 從PEB的_PEB_LDR_DATA里獲取已加載模塊的句柄 HMODULE GetLoadedModuleW(LPCWSTR lpModuleName) {typedef struct _UNICODE_STRING {USHORT Length;USHORT MaximumLength;PWSTR Buffer;} UNICODE_STRING, *PUNICODE_STRING;typedef struct _PEB_LDR_DATA{DWORD Length;bool Initialized;PVOID SsHandle;LIST_ENTRY InLoadOrderModuleList;LIST_ENTRY InMemoryOrderModuleList;LIST_ENTRY InInitializationOrderModuleList;} PEB_LDR_DATA, *PPEB_LDR_DATA;typedef struct _LDR_DATA_TABLE_ENTRY{LIST_ENTRY InLoadOrderLinks;LIST_ENTRY InMemoryOrderLinks;LIST_ENTRY InInitializationOrderLinks;PVOID DllBase;PVOID EntryPoint;UINT32 SizeOfImage;UNICODE_STRING FullDllName;UNICODE_STRING BaseDllName;UINT32 Flags;USHORT LoadCount;USHORT TlsIndex;LIST_ENTRY HashLinks;PVOID SectionPointer;UINT32 CheckSum;UINT32 TimeDateStamp;PVOID LoadedImports;PVOID EntryPointActivationContext;PVOID PatchInformation;} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;PPEB_LDR_DATA pLDR = NULL;PLDR_DATA_TABLE_ENTRY pLdteHead;PLDR_DATA_TABLE_ENTRY pLdteCur;BOOL bEqual = FALSE;DWORD StringMinLen = 0;HMODULE hModule = NULL;//pLDR = (PPEB_LDR_DATA)(__readfsdword(0x30) + 0x0C);__asm{mov eax, fs: [0x30] ; // PEBmov eax, [eax + 0x0C]; // PEB->LDRmov pLDR, eax;}// 如果是NULL，直接返回主模塊句柄（第一個模塊）if (lpModuleName == NULL){__asm{mov eax, fs: [0x30] ;mov eax, [eax + 0x08];mov hModule, eax;}return hModule;}pLdteHead = (PLDR_DATA_TABLE_ENTRY)(&pLDR->InLoadOrderModuleList);pLdteCur = (PLDR_DATA_TABLE_ENTRY)(pLdteHead->InLoadOrderLinks.Flink);// 遍歷模塊do{PLDR_DATA_TABLE_ENTRY pLdte = CONTAINING_RECORD(pLdteCur, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);// 字符串對比bEqual = TRUE;StringMinLen = min(wcslen(lpModuleName), pLdteCur->BaseDllName.Length);for (size_t i = 0; i < StringMinLen; i++){if (towupper(lpModuleName[i]) != towupper(pLdteCur->BaseDllName.Buffer[i])){bEqual = FALSE;break;}} if (bEqual){hModule = (HMODULE)pLdteCur->DllBase; break;}pLdteCur = (PLDR_DATA_TABLE_ENTRY)pLdteCur->InLoadOrderLinks.Flink;} while (pLdteHead != pLdteCur);return hModule; }// 重寫的 GetProcAddress LPVOID GetFunctionByName(LPVOID pDllImageBuffer, LPCSTR lpszFunc) {PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pDllImageBuffer;PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)pDllImageBuffer +pNtHeader->OptionalHeader.DataDirectory[0].VirtualAddress);PDWORD AddressOfFunctions = (PDWORD)((PBYTE)pDllImageBuffer + pExport->AddressOfFunctions);PDWORD AddressOfNames = (PDWORD)((PBYTE)pDllImageBuffer + pExport->AddressOfNames);PUSHORT AddressOfNameOrdinals = (PUSHORT)((PBYTE)pDllImageBuffer + pExport->AddressOfNameOrdinals);for (size_t i = 0; i < pExport->NumberOfNames; i++){if (0 == strcmp(lpszFunc, (char *)pDllImageBuffer + AddressOfNames[i])){return AddressOfFunctions[AddressOfNameOrdinals[i]] + (PBYTE)pDllImageBuffer;}}return NULL; }

總結(jié)

以上是生活随笔為你收集整理的自用 x86 GetProcAddress + GetModuleHandle的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。