Hier poste ich ASM und Reversing Zeugs welches ich nicht in einem Thread packen kann, da es sich nicht lohnen würde.

GetAddress & GetName ( Alternative zu GetProcAddress )

Posted 05/02/2014 at 20:31 by Tension

Yoho,

Bei einem Projekt passierte mir was ganz witziges, GetProcAddress hat mir Gülle ausgegeben, damit sowas nicht passiert hab ich mir selber eine Funktion geschrieben und dachte mir dazu warum auch nicht gleich das Gegenteil davon? Eine Adresse zur API zurückwandeln!

Beweis.

Hier die beiden Funktionen:

Code:

;$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
;GetAddress
;Parameter:
; - Lib => Module where the function is inside
; - FuncName => Name of the function to search
;$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
GetAddress					proc		Lib:DWORD, FuncName:DWORD
	LOCAL i:DWORD, RetAddr:DWORD, FuncArray:DWORD, NameArray:DWORD, OrdinalArray:DWORD
	pushad
	mov i, 0
	mov RetAddr, 0
	mov esi, Lib
	assume esi:ptr IMAGE_DOS_HEADER
	add esi, [esi].e_lfanew
	assume esi:ptr IMAGE_NT_HEADERS
	mov edi, Lib
	add edi, [esi].OptionalHeader.DataDirectory.VirtualAddress
	assume edi:ptr IMAGE_EXPORT_DIRECTORY
	mov eax, Lib
	add eax, [edi].AddressOfFunctions
	mov FuncArray, eax
	mov eax, Lib
	add eax, [edi].AddressOfNames
	mov NameArray, eax
	mov eax, Lib
	add eax, [edi].AddressOfNameOrdinals
	mov OrdinalArray, eax
	mov ecx, [edi].NumberOfNames
	assume esi:ptr NOTHING
	assume edi:ptr NOTHING
	.while i < ecx
		pushad
		mov edx, NameArray
		mov edx, dword ptr ds:[edx]
		add edx, Lib
		pinvoke lstrcmp, edx, FuncName
		.if eax == 0
			mov esi, OrdinalArray
			mov ecx, i
			imul ecx, sizeof(WORD)
			add esi, ecx
			movzx edx, word ptr ds:[esi]
			imul edx, sizeof(DWORD)
			mov esi, FuncArray
			add esi, edx
			mov esi, dword ptr ds:[esi]
			add esi, Lib
			mov RetAddr, esi
			popad
			.break
		.endif
		popad
		inc i
		add NameArray, sizeof(DWORD)
	.endw
	popad
	mov eax, RetAddr
	ret

GetAddress endp

;$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
;GetName
;Parameter:
; - Lib => Module where the function is inside
; - FuncAddress => Address of the Function
;$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
GetName						proc		Lib:DWORD, FuncAddr:DWORD
	LOCAL i:DWORD, RetName:DWORD, FuncArray:DWORD, NameArray:DWORD, OrdinalArray:DWORD
	pushad
	mov i, 0
	mov RetName, 0
	mov esi, Lib
	assume esi:ptr IMAGE_DOS_HEADER
	add esi, [esi].e_lfanew
	assume esi:ptr IMAGE_NT_HEADERS
	mov edi, Lib
	add edi, [esi].OptionalHeader.DataDirectory.VirtualAddress
	assume edi:ptr IMAGE_EXPORT_DIRECTORY
	mov eax, Lib
	add eax, [edi].AddressOfFunctions
	mov FuncArray, eax
	mov eax, Lib
	add eax, [edi].AddressOfNames
	mov NameArray, eax
	mov eax, Lib
	add eax, [edi].AddressOfNameOrdinals
	mov OrdinalArray, eax
	mov ecx, [edi].NumberOfNames
	assume esi:ptr NOTHING
	assume edi:ptr NOTHING
	.while i < ecx
		pushad
		mov esi, OrdinalArray
		mov ecx, i
		imul ecx, sizeof(WORD)
		add esi, ecx
		movzx edx, word ptr ds:[esi]
		imul edx, sizeof(DWORD)
		mov esi, FuncArray
		add esi, edx
		mov esi, dword ptr ds:[esi]
		add esi, Lib
		.if esi == FuncAddr
			mov edx, NameArray
			mov edx, dword ptr ds:[edx]
			add edx, Lib
			mov RetName, edx
			popad
			.break
		.endif
		popad
		inc i
		add NameArray, sizeof(DWORD)
	.endw
	popad
	mov eax, RetName
	ret

GetName endp

Sollten sich von selbst erklären.
GetAddress => EAX => APIAddresse
GetName => EAX => APIName.

MfG.

Posted in Uncategorized

Views 826 Comments 0

« Prev Main Next »

Total Comments 0