通过解析PE头。读取dll模块和 dll模块函数

短命女 2023-10-12 03:11 63阅读 0赞

win32

int main()  
\{  
//001e1000  
::MessageBox(NULL, TEXT("111"), TEXT("222"), 0);  
HMODULE vHmodule = GetModuleHandle(NULL);

printf("vHmodule = 0x%08X\\n", vHmodule);

IMAGE\_DOS\_HEADER \*vImageDosHeader = (IMAGE\_DOS\_HEADER \*)vHmodule;  
//printf("%08X\\n", vImageDosHeader);  
printf("vImageDosHeader->e\_lfanew = %08X\\n", vImageDosHeader->e\_lfanew);

//DWORD \*vTemp = (DWORD \*)((DWORD)vHmodule + vImageDosHeader->e\_lfanew);  
//printf("vTemp=%08X\\n", vTemp);  
IMAGE\_NT\_HEADERS \*vImageNtHeaders = (IMAGE\_NT\_HEADERS \*)((DWORD)vHmodule + vImageDosHeader->e\_lfanew);  
  
//printf("vImageNtHeaders\[0\]=%X\\n", vTemp\[0\]);  
//printf("vImageNtHeaders\[2\]=%X\\n", vTemp\[2\]);  
//printf("vImageNtHeaders\[3\]=%X\\n", vTemp\[3\]);  
//printf("\*vImageDosHeader->e\_lfanew=0x%08X\\n", vImageDosHeader->e\_lfanew);

//printf("%08X\\n", vImageNtHeaders);  
IMAGE\_OPTIONAL\_HEADER32 vImageOptionalHeader32 = vImageNtHeaders->OptionalHeader;  
IMAGE\_DATA\_DIRECTORY vImageDataDirectory = vImageOptionalHeader32.DataDirectory\[1\];  
printf("\*vImageDataDirectory.VirtualAddress=0x%08X\\n", vImageDataDirectory.VirtualAddress);

IMAGE\_IMPORT\_DESCRIPTOR \*vImageImportDescriptor = (IMAGE\_IMPORT\_DESCRIPTOR \*)((DWORD)vHmodule + vImageDataDirectory.VirtualAddress);  
IMAGE\_THUNK\_DATA \*vImageThunkData;  
IMAGE\_IMPORT\_BY\_NAME \*vImageImportByName;  
printf("\\n\\n\\n");  
while (true)  
\{  
if (vImageImportDescriptor->OriginalFirstThunk == NULL)  
break;  
printf("vImageImportDescriptor->Name=%s\\n", ((DWORD)vHmodule + vImageImportDescriptor->Name));  
vImageThunkData = (IMAGE\_THUNK\_DATA \*)((DWORD)vHmodule + vImageImportDescriptor->OriginalFirstThunk);  
while (true)  
\{  
if (vImageThunkData->u1.AddressOfData == NULL)  
break;  
vImageImportByName = (IMAGE\_IMPORT\_BY\_NAME \*)((DWORD)vHmodule + vImageThunkData->u1.AddressOfData);  
printf("vImageImportByName->Name=%s\\n", vImageImportByName->Name);  
vImageThunkData++;  
\}  
printf("\\n\\n\\n");  
vImageImportDescriptor++;  
\}  
system("pause");  
return EXIT\_SUCCESS;  
\}

MFC

\#include <atlconv.h>

VOID

WINAPI  
ReWriteSleep(\_In\_ DWORD p)  
\{  
::MessageBox(NULL, TEXT("改写Sleep"), TEXT("改写Sleep"), 0);  
return;  
\}

void function dd()

USES\_CONVERSION;

CString str;  
// TODO: 在此添加控件通知处理程序代码  
HMODULE vHmodule = GetModuleHandle(NULL);

str.Format(TEXT("vHmodule = 0x%08X\\n"), vHmodule);  
::OutputDebugString(str);

IMAGE\_DOS\_HEADER \*vImageDosHeader = (IMAGE\_DOS\_HEADER \*)vHmodule;  
//printf("%08X\\n", vImageDosHeader);  
str.Format(TEXT("vImageDosHeader->e\_lfanew = %08X\\n"), vImageDosHeader->e\_lfanew);  
::OutputDebugString(str);

//printf("vImageNtHeaders\[0\]=%X\\n", vTemp\[0\]);  
//printf("vImageNtHeaders\[2\]=%X\\n", vTemp\[2\]);  
//printf("vImageNtHeaders\[3\]=%X\\n", vTemp\[3\]);  
//printf("\*vImageDosHeader->e\_lfanew=0x%08X\\n", vImageDosHeader->e\_lfanew);

str.Format(TEXT("\*vImageDataDirectory.VirtualAddress=0x%08X\\n"), vImageDataDirectory.VirtualAddress);  
::OutputDebugString(str);

IMAGE\_IMPORT\_DESCRIPTOR \*vImageImportDescriptor = (IMAGE\_IMPORT\_DESCRIPTOR \*)((DWORD)vHmodule + vImageDataDirectory.VirtualAddress);  
IMAGE\_THUNK\_DATA \*vImageThunkData;  
IMAGE\_THUNK\_DATA \*vImageThunkData2;  
IMAGE\_IMPORT\_BY\_NAME \*vImageImportByName;  
DWORD vFunAddress;  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));  
CString str2;  
CString str3 = TEXT("Sleep");  
DWORD \*p;  
MEMORY\_BASIC\_INFORMATION pInfo;  
DWORD pInfoOldProtect;  
while (true)  
\{  
if (vImageImportDescriptor->OriginalFirstThunk == NULL)  
break;

vImageThunkData = (IMAGE\_THUNK\_DATA \*)((DWORD)vHmodule + vImageImportDescriptor->OriginalFirstThunk);  
vImageThunkData2 = (IMAGE\_THUNK\_DATA \*)((DWORD)vHmodule + vImageImportDescriptor->FirstThunk);

if ((DWORD)vImageThunkData->u1.AddressOfData < (DWORD)vHmodule)  
\{  
str.Format(TEXT("vImageImportDescriptor->Name=%S\\n"), ((DWORD)vHmodule + vImageImportDescriptor->Name));  
::OutputDebugString(str);

//vImageThunkData = (IMAGE\_THUNK\_DATA \*)((DWORD)vHmodule + vImageImportDescriptor->OriginalFirstThunk);  
//str.Format(TEXT("vImageThunkData=%08X\\n"), (vImageThunkData));  
//::OutputDebugString(str);

str.Format(TEXT("vImageThunkData->u1.AddressOfData=%08X\\n"), (vImageThunkData->u1.AddressOfData));  
::OutputDebugString(str);

while (true)  
\{  
vImageImportByName = (IMAGE\_IMPORT\_BY\_NAME \*)((DWORD)vHmodule + vImageThunkData->u1.AddressOfData);

if (vImageThunkData->u1.AddressOfData == NULL)  
break;

str2 = vImageImportByName->Name;  
if (str2 == str3)  
\{  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));

//vImageThunkData2->u1.Function = (DWORD)ReWriteSleep;  
str.Format(TEXT("重写Sleep函数地址是=%08X, DWORD ReWriteSleep=%08X\\n"), ReWriteSleep, (DWORD)ReWriteSleep);  
::OutputDebugString(str);

str.Format(TEXT("找到了Sleep函数地址是=%08X\\n"), vImageThunkData2->u1.Function);  
::OutputDebugString(str);

p = &vImageThunkData2->u1.Function;  
str.Format(TEXT("u1.Function地址=%08X\\n"), p);  
::OutputDebugString(str);

str.Format(TEXT("p地址=%08X\\n"), p);  
::OutputDebugString(str);

::MessageBox(NULL, TEXT("333333"), TEXT("55555"), 0);

::VirtualQuery(p, &pInfo, sizeof(pInfo));  
::VirtualProtect(p, sizeof(p), PAGE\_EXECUTE\_READWRITE, &pInfoOldProtect);  
\*p = (DWORD)ReWriteSleep;  
::VirtualProtect(p, sizeof(p), pInfoOldProtect, &pInfoOldProtect);  
//::VirtualQuery(p, &pInfo, sizeof(pInfo));  
/\*\_\_asm  
\{  
PUSH EBX  
PUSH ECX  
MOV EBX, DWORD PTR p  
MOV ECX, DWORD PTR ReWriteSleep  
MOV DWORD PTR\[EBX\], ECX  
POP ECX  
POP EBX  
\}\*/

//vImageThunkData2->u1.Function = (DWORD)ReWriteSleep;  
//WriteProcessMemory(GetCurrentProcess(), &vImageThunkData2->u1.Function, ReWriteSleep, 4, NULL);  
  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));  
\}

//sprintf\_s(str3, "vImageImportByName->Name=%s\\n", vImageImportByName->Name);  
str.Format(TEXT("vImageImportByName->Name=%ws\\n"), str2);  
::OutputDebugString(str);

str.Format(TEXT("vImageThunkData2->u1.Function=%08X\\n"), vImageThunkData2->u1.Function);  
::OutputDebugString(str);

vImageThunkData++;  
vImageThunkData2++;  
\}  
\}  
::OutputDebugString(TEXT("\\n"));  
::OutputDebugString(TEXT("\\n"));  
vImageImportDescriptor++;  
\}

转载于:https://www.cnblogs.com/kuangke/p/5419976.html