delphi 给力版 GetProcAddress  
官方Delphi 学习QQ群: 682628230(三千人)
频道

delphi 给力版 GetProcAddress


 

上联合翻宝贝,一个不小心,翻到一个给力的函数 = =  

虽然不知道作者是谁,深深膜拜作者一下先


const
  MAX_API_STRING_LENGTH = 150;

type
  PSEHStruct = ^TSEHStruct;
  TSEHStruct = record
    saveEsp: Cardinal;
    saveEbp: Cardinal;
    gotoEip: Cardinal;
  end;

function MyGetProcAddress(DllBase: LongWord; ApiName: PChar): Pointer; pascal;
asm
        PUSH    ESI
        PUSH    EDI
        PUSH    ECX
        PUSH    EBX
        PUSH    EDX
        XOR     EDX, EDX
        PUSH    OFFSET SEHHandler
        PUSH    DWORD PTR FS:[EDX]
        MOV     SEH.saveEsp, ESP
        MOV     SEH.saveEbp, EBP
        MOV     SEH.gotoEip, OFFSET @@NotFound
        MOV     FS:[EDX], ESP
        MOV     EDI, ApiName
        MOV     ECX, MAX_API_STRING_LENGTH
        REPNZ   SCASB
        MOV     ECX, EDI
        SUB     ECX, ApiName
        MOV     EDX, DllBase
        CMP     [EDX].TImageDosHeader.e_magic, IMAGE_DOS_SIGNATURE
        JNZ     @@NotFound
        ADD     EDX, [EDX].TImageDosHeader._lfanew
        CMP     [EDX].TImageNtHeaders.Signature, IMAGE_NT_SIGNATURE
        JNZ     @@NotFound
        MOV     EDX, [EDX].TImageNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].TImageDataDirectory.VirtualAddress
        OR      EDX, EDX
        JZ      @@NotFound
        ADD     EDX, DllBase
        MOV     EBX, [EDX].TImageExportDirectory.AddressOfNames
        ADD     EBX, DllBase
        XOR     EAX, EAX
@@Loop:
        MOV     EDI, [EBX]
        ADD     EDI, DllBase
        MOV     ESI, ApiName
        PUSH    ECX
        REPZ    CMPSB
        POP     ECX
        JE      @@Found
        ADD     EBX, 4
        INC     EAX
        CMP     EAX, [EDX].TImageExportDirectory.NumberOfNames
        JB      @@Loop
        JMP     @@NotFound
@@Found:
        SHL     EAX, 1
        ADD     EAX, [EDX].TImageExportDirectory.AddressOfNameOrdinals
        ADD     EAX, DllBase
        MOV     AX, [EAX]
        AND     EAX, $0000FFFF
        { ordinal -> function }
        SHL     EAX, 2
        ADD     EAX, [EDX].TImageExportDirectory.AddressOfFunctions
        ADD     EAX, DllBase
        MOV     EAX, [EAX]
        ADD     EAX, DllBase
        JMP     @@Exit
@@NotFound:
        { return 0 on error }
        XOR     EAX, EAX
@@Exit:
        XOR     EDX, EDX
        POP     DWORD PTR FS:[EDX]
        ADD     ESP, 4
        POP     EDX
        POP     EBX
        POP     ECX
        POP     EDI
        POP     ESI
end;

 

使用的时候
  zhu:Pointer;
  zhu:=MyGetProcAddress(LoadLibrary('Kernel32.dll'),'OpenProcess');


推荐分享
图文皆来源于网络,内容仅做公益性分享,版权归原作者所有,如有侵权请告知删除!
 

Copyright © 2014 DelphiW.com 开发 源码 文档 技巧 All Rights Reserved
晋ICP备14006235号-8 晋公网安备 14108102000087号

执行时间: 0.046108961105347 seconds