技术宅的结界

 找回密码
 立即注册→加入我们

QQ登录

只需一步,快速开始

搜索
热搜: 下载 VB C 实现 编写
查看: 1958|回复: 8
收起左侧

【安利】纯VB自己实现GetProcAddress

[复制链接]

30

主题

88

帖子

3075

积分

用户组: 管理员

UID
1043
精华
13
威望
98 点
宅币
2485 个
贡献
241 次
宅之契约
0 份
在线时间
488 小时
注册时间
2015-8-15
发表于 2016-1-22 17:36:46 | 显示全部楼层 |阅读模式

欢迎访问技术宅的结界,请注册或者登录吧。

您需要 登录 才可以下载或查看,没有帐号?立即注册→加入我们

x
发此贴主要是因为MP那个逗比杀软在Ring3下Hook了GetProcAddress
[Visual Basic] 纯文本查看 复制代码
Option Explicit
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByVal dest As Long, ByVal src As Long, ByVal cch As Long)
Public Declare Function lstrlen Lib "kernel32" Alias "lstrlenA" (ByVal lpString As Long) As Long
Public Type IMAGE_DOS_HEADER
    e_magic As Integer
    e_cblp As Integer
    e_cp As Integer
    e_crlc As Integer
    e_cparhdr As Integer
    e_minalloc As Integer
    e_maxalloc As Integer
    e_ss As Integer
    e_sp As Integer
    e_csum As Integer
    e_ip As Integer
    e_cs As Integer
    e_lfarlc As Integer
    e_ovno As Integer
    e_res(0 To 3) As Integer
    e_oemid As Integer
    e_oeminfo As Integer
    e_res2(0 To 9)  As Integer
    e_lfanew As Long
End Type
Public Type IMAGE_FILE_HEADER
        Machine As Integer
        NumberOfSections As Integer
        TimeDateStamp As Long
        PointerToSymbolTable As Long
        NumberOfSymbols As Long
        SizeOfOptionalHeader As Integer
        Characteristics As Integer
End Type
Public Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16
Public Const IMAGE_DIRECTORY_ENTRY_EXPORT = &H1
Public Type IMAGE_DATA_DIRECTORY
        VirtualAddress As Long
        Size As Long
End Type
Public Type IMAGE_OPTIONAL_HEADER
        Magic As Integer
        MajorLinkerVersion As Byte
        MinorLinkerVersion As Byte
        SizeOfCode As Long
        SizeOfInitializedData As Long
        SizeOfUninitializedData As Long
        AddressOfEntryPoint As Long
        BaseOfCode As Long
        BaseOfData As Long
        ' NT additional fields.24
        ImageBase As Long '28
        SectionAlignment As Long '32
        FileAlignment As Long '36
        MajorOperatingSystemVersion As Integer
        MinorOperatingSystemVersion As Integer '40
        MajorImageVersion As Integer
        MinorImageVersion As Integer '44
        MajorSubsystemVersion As Integer
        MinorSubsystemVersion As Integer '48
        Reserved1 As Long '56
        SizeOfImage As Long '60
        SizeOfHeaders As Long '64
        Checksum As Long '68
        Subsystem As Integer '70
        DllCharacteristics As Integer '72
        SizeOfStackReserve As Long '76
        SizeOfStackCommit As Long '80
        SizeOfHeapReserve As Long '84
        SizeOfHeapCommit As Long '88
        LoaderFlags As Long '92
        NumberOfRvaAndSizes As Long '96
        DataDirectory(1 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES) As IMAGE_DATA_DIRECTORY
End Type
Public Type IMAGE_NT_HEADER
        Signature As Long
        FileHeader As IMAGE_FILE_HEADER
        OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type
Public Type IMAGE_EXPORT_DIRECTORY
    Characteristics As Long
    TimeDateStamp As Long
    MajorVersion As Integer
    MinorVersion As Integer
    name As Long
    Base As Long
    NumberOfNames As Long
    NumberOfFunctions As Long
    AddressOfFunctions As Long
    AddressOfNames As Long
    AddressOfNameOridinals As Long
End Type
Public Function AnsiStringFromPtr(ByVal pString As Long, Optional ByVal Length As Long = 0) As String
Dim pLen As Long
Dim Buff() As Byte
Dim i As Long
If Length = 0 Then
    pLen = lstrlen(pString)
Else
    pLen = Length
End If
ReDim Buff(1 To pLen)
CopyMemory VarPtr(Buff(1)), pString, pLen
For i = 1 To pLen Step 1
    AnsiStringFromPtr = AnsiStringFromPtr & Chr(Buff(i))
Next i
End Function
Public Function MyGetProcAddress(ByVal lpBase As Long, ByVal lpProcName As String) As Long
Dim DosHead As IMAGE_DOS_HEADER
Dim NtHead As IMAGE_NT_HEADER
Dim ExpDir As IMAGE_EXPORT_DIRECTORY
Dim NameRva() As Long
Dim FuncRva() As Long
Dim OridRva() As Integer
Dim fApi As Long
Dim szProc As String
Dim i As Integer
CopyMemory VarPtr(DosHead), lpBase, Len(DosHead)
CopyMemory VarPtr(NtHead), lpBase + DosHead.e_lfanew, Len(NtHead)
CopyMemory VarPtr(ExpDir), lpBase + NtHead.OptionalHeader.DataDirectory(IMAGE_DIRECTORY_ENTRY_EXPORT).VirtualAddress, Len(ExpDir)
ReDim NameRva(1 To ExpDir.NumberOfNames)
ReDim OridRva(1 To ExpDir.NumberOfNames)
ReDim FuncRva(1 To ExpDir.NumberOfFunctions)
CopyMemory VarPtr(NameRva(1)), ExpDir.AddressOfNames + lpBase, 4 * ExpDir.NumberOfNames
CopyMemory VarPtr(OridRva(1)), ExpDir.AddressOfNameOridinals + lpBase, 2 * ExpDir.NumberOfNames
CopyMemory VarPtr(FuncRva(1)), ExpDir.AddressOfFunctions + lpBase, 4 * ExpDir.NumberOfFunctions
For i = 1 To ExpDir.NumberOfNames
    szProc = AnsiStringFromPtr(NameRva(i) + lpBase)
    If szProc = lpProcName Then
        fApi = lpBase + FuncRva(OridRva(i) + 1)
        MyGetProcAddress = fApi
    End If
Next i
End Function

本帖被以下淘专辑推荐:

flowers for Broken spirits - a woman turned into stake will hold the world in the basin of fire.

1041

主题

2328

帖子

5万

积分

用户组: 管理员

一只技术宅

UID
1
精华
217
威望
288 点
宅币
18065 个
贡献
36610 次
宅之契约
0 份
在线时间
1732 小时
注册时间
2014-1-26
发表于 2016-1-22 18:25:40 | 显示全部楼层
噫!你难道不知道VB可以直接用StrConv将Byte数组直接转换为Unicode编码的字符串吗?
[Visual Basic] 纯文本查看 复制代码
Dim CStr() As Byte
Open "1.txt" For Binary Access Read As #1
ReDim CStr(LOF(1) - 1)
Get #1, , CStr
Close #1

Dim BStr As String
BStr = StrConv(CStr, vbUnicode)

Debug.Print BStr

30

主题

88

帖子

3075

积分

用户组: 管理员

UID
1043
精华
13
威望
98 点
宅币
2485 个
贡献
241 次
宅之契约
0 份
在线时间
488 小时
注册时间
2015-8-15
 楼主| 发表于 2016-1-23 23:48:28 | 显示全部楼层
噫!你难道不知道VB可以直接用StrConv将Byte数组直接转换为Unicode编码的字符串吗?

这个我知道,但我不知道为啥,StrConv用着感觉好奇怪(什么怪毛病23333333333),因此AnsiString就Chr顺着来,UnicodeString就ChrW顺着来
flowers for Broken spirits - a woman turned into stake will hold the world in the basin of fire.

1041

主题

2328

帖子

5万

积分

用户组: 管理员

一只技术宅

UID
1
精华
217
威望
288 点
宅币
18065 个
贡献
36610 次
宅之契约
0 份
在线时间
1732 小时
注册时间
2014-1-26
发表于 2016-1-31 20:50:48 | 显示全部楼层
tangptr@126.com 发表于 2016-1-23 23:48
这个我知道,但我不知道为啥,StrConv用着感觉好奇怪(什么怪毛病23333333333),因此AnsiString就Chr顺着 ...

而且Byte数组也可以拿来直接赋值给字符串,或者互相赋值的。

1041

主题

2328

帖子

5万

积分

用户组: 管理员

一只技术宅

UID
1
精华
217
威望
288 点
宅币
18065 个
贡献
36610 次
宅之契约
0 份
在线时间
1732 小时
注册时间
2014-1-26
发表于 2016-1-31 20:50:52 | 显示全部楼层
tangptr@126.com 发表于 2016-1-23 23:48
这个我知道,但我不知道为啥,StrConv用着感觉好奇怪(什么怪毛病23333333333),因此AnsiString就Chr顺着 ...

而且Byte数组也可以拿来直接赋值给字符串,或者互相赋值的。

30

主题

88

帖子

3075

积分

用户组: 管理员

UID
1043
精华
13
威望
98 点
宅币
2485 个
贡献
241 次
宅之契约
0 份
在线时间
488 小时
注册时间
2015-8-15
 楼主| 发表于 2016-1-31 23:49:17 | 显示全部楼层
Integer数组可以吗
flowers for Broken spirits - a woman turned into stake will hold the world in the basin of fire.

2

主题

61

帖子

458

积分

用户组: 中·技术宅

UID
2364
精华
0
威望
0 点
宅币
397 个
贡献
0 次
宅之契约
0 份
在线时间
53 小时
注册时间
2017-3-30
发表于 2017-9-28 19:07:10 | 显示全部楼层
好东西收着

1

主题

15

帖子

15

积分

用户组: 初·技术宅

UID
2735
精华
0
威望
0 点
宅币
0 个
贡献
0 次
宅之契约
0 份
在线时间
6 小时
注册时间
2017-7-28
发表于 2017-10-8 20:29:47 | 显示全部楼层
好东西收着

0

主题

18

帖子

51

积分

用户组: 小·技术宅

UID
2933
精华
0
威望
2 点
宅币
29 个
贡献
0 次
宅之契约
0 份
在线时间
2 小时
注册时间
2017-10-9
发表于 2017-10-9 13:57:26 | 显示全部楼层
有想法奥
回复

使用道具 举报

本版积分规则

QQ|申请友链||Archiver|手机版|小黑屋|技术宅的结界 ( 滇ICP备16008837号|网站地图

GMT+8, 2019-8-21 23:22 , Processed in 0.106209 second(s), 39 queries , Gzip On.

Powered by Discuz! X3.2

© 2001-2013 Comsenz Inc.

快速回复 返回顶部 返回列表