pe.asm

获取pe文件的函数. 我的QQ：2891

.386 
.model flat,stdcall 
option casemap:none 
include \masm32\include\windows.inc 
include \masm32\include\kernel32.inc 
include \masm32\include\comdlg32.inc 
include \masm32\include\user32.inc 
includelib \masm32\lib\user32.lib 
includelib \masm32\lib\kernel32.lib 
includelib \masm32\lib\comdlg32.lib 

SADD MACRO quoted_text:VARARG
    EXITM <ADDR literal(quoted_text)>
ENDM
literal MACRO quoted_text:VARARG
        LOCAL local_text
        .data
        local_text db quoted_text,0
        .code
        EXITM <local_text>
ENDM

IDD_MAINDLG equ 101 
IDC_EDIT equ 1000 
IDM_OPEN equ 40001 
IDM_EXIT equ 40003 

WinMain proto :DWORD,:DWORD,:DWORD,:DWORD 
DlgProc proto :DWORD,:DWORD,:DWORD,:DWORD 
ShowImportFunctions proto :DWORD 
ShowTheFunctions proto :DWORD,:DWORD 
AppendText proto :DWORD,:DWORD 

SEH struct 
PrevLink dd ? ; the address of the previous seh structure 
CurrentHandler dd ? ; the address of the new exception handler 
SafeOffset dd ? ; The offset where it's safe to continue execution 
PrevEsp dd ? ; the old value in esp 
PrevEbp dd ? ; The old value in ebp 
SEH ends 

.data 
ClassName   db  "SimpleWinClass",0
AppName db "PE tutorial no.6",0 
ofn OPENFILENAME <> 
FilterString db "Executable Files (*.exe, *.dll)",0,"*.exe;*.dll",0 
             db "All Files",0,"*.*",0,0 
FileOpenError db "Cannot open the file for reading",0 
FileOpenMappingError db "Cannot open the file for memory mapping",0 
FileMappingError db "Cannot map the file into memory",0 
NotValidPE db "This file is not a valid PE",0 
CRLF db 0Dh,0Ah,0 
ImportDescriptor db 0Dh,0Ah,"================[ IMAGE_IMPORT_DESCRIPTOR ]=============",0 
IDTemplate db "OriginalFirstThunk = %lX",0Dh,0Ah 
           db "TimeDateStamp = %lX",0Dh,0Ah 
           db "ForwarderChain = %lX",0Dh,0Ah 
           db "Name = %s",0Dh,0Ah 
           db "FirstThunk = %lX",0 
NameHeader db 0Dh,0Ah,"Hint Function",0Dh,0Ah 
           db "-----------------------------------------",0 
NameTemplate db "%u %s",0 
OrdinalTemplate db "%u (ord.)",0 

.data? 
hInstance   DWORD   ?
CommandLine DWORD   ?
buffer db 512 dup(?) 
hFile dd ? 
hMapping dd ? 
pMapping dd ? 
ValidPE dd ? 

.code
start:
	invoke GetModuleHandle, NULL
	mov    hInstance,eax
	invoke GetCommandLine
	mov    CommandLine,eax
	invoke WinMain, hInstance,NULL,CommandLine, SW_SHOWDEFAULT
	invoke ExitProcess,eax

WinMain proc hInst:HINSTANCE,hPrevInst:HINSTANCE,CmdLine:LPSTR,CmdShow:DWORD
	LOCAL wc:WNDCLASSEX
	LOCAL msg:MSG
	LOCAL hwnd:HWND
	mov   wc.cbSize,SIZEOF WNDCLASSEX
	mov   wc.style, CS_HREDRAW or CS_VREDRAW
	mov   wc.lpfnWndProc, OFFSET WndProc
	mov   wc.cbClsExtra,NULL
	mov   wc.cbWndExtra,NULL
	push  hInstance
	pop   wc.hInstance
	mov   wc.hbrBackground,2
	mov   wc.lpszMenuName,NULL
	mov   wc.lpszClassName,OFFSET ClassName
	invoke LoadIcon,NULL,IDI_APPLICATION
	mov   wc.hIcon,eax
	mov   wc.hIconSm,eax
	invoke LoadCursor,NULL,IDC_ARROW
	mov   wc.hCursor,eax
	invoke RegisterClassEx, addr wc
	INVOKE CreateWindowEx,NULL,ADDR ClassName,ADDR AppName,\
           WS_OVERLAPPEDWINDOW,50,\
           50,500,400,NULL,NULL,\
           hInst,NULL
	mov   hwnd,eax
	invoke ShowWindow, hwnd,SW_SHOWNORMAL
	invoke UpdateWindow, hwnd
	.WHILE TRUE
		invoke GetMessage, ADDR msg,NULL,0,0
		.BREAK .IF (!eax)
		invoke TranslateMessage, ADDR msg
		invoke DispatchMessage, ADDR msg
	.ENDW
	mov     eax,msg.wParam
	ret
WinMain endp
EditSl proc szMsg:DWORD,a:DWORD,b:DWORD,wd:DWORD,ht:DWORD,hParent:DWORD,ID:DWORD

        invoke CreateWindowEx,WS_EX_CLIENTEDGE,SADD("Edit"),szMsg,
                WS_CHILD+WS_VISIBLE+WS_VSCROLL+ES_MULTILINE,
              a,b,wd,ht,hParent,ID,hInstance,NULL

        ret
EditSl endp
WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
	mov	eax,uMsg
	.IF eax==WM_LBUTTONDOWN
            invoke ShowImportFunctions,hWnd
      .elseif eax==WM_RBUTTONDOWN
            ;invoke SendMessage,hWnd,WM_CLOSE,0,0
	.elseif eax==WM_CREATE
            invoke EditSl,0,10,10,400,300,hWnd,1000
	.elseif eax==WM_DESTROY
		invoke PostQuitMessage,NULL
	.ELSE
		invoke DefWindowProc,hWnd,uMsg,wParam,lParam		
		ret
	.ENDIF
	xor eax,eax
	ret
WndProc endp
SEHHandler proc uses edx pExcept:DWORD, pFrame:DWORD, pContext:DWORD, pDispatch:DWORD 
  mov edx,pFrame 
  assume edx:ptr SEH 
  mov eax,pContext 
  assume eax:ptr CONTEXT 
  push [edx].SafeOffset 
  pop [eax].regEip 
  push [edx].PrevEsp 
  pop [eax].regEsp 
  push [edx].PrevEbp 
  pop [eax].regEbp 
  mov ValidPE, FALSE 
  mov eax,ExceptionContinueExecution 
  ret 
SEHHandler endp 

ShowImportFunctions proc uses edi hDlg:DWORD 
  LOCAL seh:SEH 
  mov ofn.lStructSize,SIZEOF ofn
  mov ofn.lpstrFilter, OFFSET FilterString 
  mov ofn.lpstrFile, OFFSET buffer 
  mov ofn.nMaxFile,512 
  mov ofn.Flags, OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST or OFN_LONGNAMES or OFN_EXPLORER or OFN_HIDEREADONLY 
  invoke GetOpenFileName, ADDR ofn 
  .if eax==TRUE 
    invoke CreateFile, addr buffer, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL 
    .if eax!=INVALID_HANDLE_VALUE 
      mov hFile, eax 
      invoke CreateFileMapping, hFile, NULL, PAGE_READONLY,0,0,0 
      .if eax!=NULL 
        mov hMapping, eax 
        invoke MapViewOfFile,hMapping,FILE_MAP_READ,0,0,0 
        .if eax!=NULL 
          mov pMapping,eax 
          assume fs:nothing 
          push fs:[0] 
          pop seh.PrevLink 
          mov seh.CurrentHandler,offset SEHHandler 
          mov seh.SafeOffset,offset FinalExit 
          lea eax,seh 
          mov fs:[0], eax 
          mov seh.PrevEsp,esp 
          mov seh.PrevEbp,ebp 
          mov edi, pMapping 
          assume edi:ptr IMAGE_DOS_HEADER 
          .if [edi].e_magic==IMAGE_DOS_SIGNATURE 
            add edi, [edi].e_lfanew 
            assume edi:ptr IMAGE_NT_HEADERS 
            .if [edi].Signature==IMAGE_NT_SIGNATURE 
              mov ValidPE, TRUE 
            .else 
              mov ValidPE, FALSE 
            .endif 
          .else 
            mov ValidPE,FALSE 
          .endif 
FinalExit: 
          push seh.PrevLink 
          pop fs:[0] 
          .if ValidPE==TRUE 
            invoke ShowTheFunctions, hDlg, edi 
          .else 
            invoke MessageBox,0, addr NotValidPE, addr AppName, MB_OK+MB_ICONERROR 
          .endif 
          invoke UnmapViewOfFile, pMapping 
      .else 
          invoke MessageBox, 0, addr FileMappingError, addr AppName, MB_OK+MB_ICONERROR 
      .endif 
      invoke CloseHandle,hMapping 
    .else 
      invoke MessageBox, 0, addr FileOpenMappingError, addr AppName, MB_OK+MB_ICONERROR 
    .endif 
    invoke CloseHandle, hFile 
   .else 
   invoke MessageBox, 0, addr FileOpenError, addr AppName, MB_OK+MB_ICONERROR 
   .endif 
 .endif 
 ret 
ShowImportFunctions endp 

AppendText proc hDlg:DWORD,pText:DWORD 
   invoke SendDlgItemMessage,hDlg,IDC_EDIT,EM_REPLACESEL,0,pText 
   ;invoke SendDlgItemMessage,hDlg,IDC_EDIT,EM_REPLACESEL,0,SADD("*") 
   invoke SendDlgItemMessage,hDlg,IDC_EDIT,EM_REPLACESEL,0,addr CRLF 
   invoke SendDlgItemMessage,hDlg,IDC_EDIT,EM_SETSEL,-1,0 
   ret 
AppendText endp 

RVAToOffset PROC uses edi esi edx ecx pFileMap:DWORD,RVA:DWORD 
   mov esi,pFileMap 
   assume esi:ptr IMAGE_DOS_HEADER 
   add esi,[esi].e_lfanew 
   assume esi:ptr IMAGE_NT_HEADERS 
   mov edi,RVA ; edi == RVA 
   mov edx,esi 
   add edx,sizeof IMAGE_NT_HEADERS 
   mov cx,[esi].FileHeader.NumberOfSections 
   movzx ecx,cx 
   assume edx:ptr IMAGE_SECTION_HEADER 
   .while ecx>0 ; check all sections 
     .if edi>=[edx].VirtualAddress 
       mov eax,[edx].VirtualAddress 
       add eax,[edx].SizeOfRawData 
       .if edi<eax ; The address is in this section 
         mov eax,[edx].VirtualAddress 
         sub edi,eax
         mov eax,[edx].PointerToRawData 
         add eax,edi ; eax == file offset 
         ret 
       .endif 
     .endif 
     add edx,sizeof IMAGE_SECTION_HEADER 
     dec ecx 
   .endw 
   assume edx:nothing 
   assume esi:nothing 
   mov eax,edi 
   ret 
RVAToOffset endp 

ShowTheFunctions proc uses esi ecx ebx hDlg:DWORD, pNTHdr:DWORD 
   LOCAL temp[512]:BYTE 
   invoke SetDlgItemText,hDlg,IDC_EDIT,0 
   invoke AppendText,hDlg,addr buffer 
   mov edi,pNTHdr 
   assume edi:ptr IMAGE_NT_HEADERS 
   mov edi, [edi].OptionalHeader.DataDirectory[sizeof IMAGE_DATA_DIRECTORY].VirtualAddress 
   invoke RVAToOffset,pMapping,edi 
   mov edi,eax 
   add edi,pMapping 
   assume edi:ptr IMAGE_IMPORT_DESCRIPTOR 
   .while !([edi].OriginalFirstThunk==0 && [edi].TimeDateStamp==0 && [edi].ForwarderChain==0 && [edi].Name1==0 && [edi].FirstThunk==0) 
     invoke AppendText,hDlg,addr ImportDescriptor 
     invoke RVAToOffset,pMapping, [edi].Name1 
     mov edx,eax 
     add edx,pMapping 
     invoke wsprintf, addr temp, addr IDTemplate, [edi].OriginalFirstThunk,[edi].TimeDateStamp,[edi].ForwarderChain,edx,[edi].FirstThunk      
     invoke AppendText,hDlg,addr temp 
     .if [edi].OriginalFirstThunk==0 
        mov esi,[edi].FirstThunk 
     .else 
        mov esi,[edi].OriginalFirstThunk 
     .endif 
     invoke RVAToOffset,pMapping,esi 
     add eax,pMapping 
     mov esi,eax 
     invoke AppendText,hDlg,addr NameHeader 
     .while dword ptr [esi]!=0 
       test dword ptr [esi],IMAGE_ORDINAL_FLAG32 
       jnz ImportByOrdinal 
       invoke RVAToOffset,pMapping,dword ptr [esi] 
       mov edx,eax 
       add edx,pMapping 
       assume edx:ptr IMAGE_IMPORT_BY_NAME 
       mov cx, [edx].Hint 
       movzx ecx,cx 
       invoke wsprintf,addr temp,addr NameTemplate,ecx,addr [edx].Name1 
       jmp ShowTheText 
ImportByOrdinal: 
       mov edx,dword ptr [esi] 
       and edx,0FFFFh 
       invoke wsprintf,addr temp,addr OrdinalTemplate,edx 
ShowTheText: 
       invoke AppendText,hDlg,addr temp 
       add esi,4 
    .endw 
    add edi,sizeof IMAGE_IMPORT_DESCRIPTOR 
  .endw 
  ret 
ShowTheFunctions endp
end start