📄 lion-petut-c07.htm
字号:
assume edi:ptr IMAGE_NT_HEADERS <br>
.if
[edi].Signature==IMAGE_NT_SIGNATURE <br>
mov ValidPE, TRUE <br>
.else <br>
mov ValidPE, FALSE <br>
.endif <br>
.else <br>
mov
ValidPE,FALSE <br>
.endif <br>
FinalExit: <br>
push
seh.PrevLink <br>
pop fs:[0] <br>
.if
ValidPE==TRUE <br>
invoke ShowTheFunctions, hDlg, edi <br>
.else <br>
invoke MessageBox,0, addr NotValidPE, addr AppName,
MB_OK+MB_ICONERROR<br>
.endif <br>
invoke
UnmapViewOfFile, pMapping <br>
.else <br>
invoke
MessageBox, 0, addr FileMappingError, addr AppName,
MB_OK+MB_ICONERROR <br>
.endif <br>
invoke CloseHandle,hMapping <br>
.else <br>
invoke MessageBox, 0, addr
FileOpenMappingError, addr AppName, MB_OK+MB_ICONERROR <br>
.endif <br>
invoke CloseHandle, hFile <br>
.else <br>
invoke MessageBox, 0, addr
FileOpenError, addr AppName, MB_OK+MB_ICONERROR <br>
.endif <br>
.endif <br>
ret <br>
ShowExportFunctions endp <br>
<br>
AppendText proc hDlg:DWORD,pText:DWORD <br>
invoke SendDlgItemMessage,hDlg,IDC_EDIT,EM_REPLACESEL,0,pText <br>
invoke SendDlgItemMessage,hDlg,IDC_EDIT,EM_REPLACESEL,0,addr CRLF
<br>
invoke SendDlgItemMessage,hDlg,IDC_EDIT,EM_SETSEL,-1,0 <br>
ret <br>
AppendText endp <br>
<br>
RVAToFileMap PROC uses edi esi edx ecx pFileMap:DWORD,RVA:DWORD <br>
mov esi,pFileMap <br>
assume esi:ptr IMAGE_DOS_HEADER <br>
add esi,[esi].e_lfanew <br>
assume esi:ptr IMAGE_NT_HEADERS <br>
mov edi,RVA ; edi == RVA <br>
mov edx,esi <br>
add edx,sizeof IMAGE_NT_HEADERS <br>
mov cx,[esi].FileHeader.NumberOfSections <br>
movzx ecx,cx <br>
assume edx:ptr IMAGE_SECTION_HEADER <br>
.while ecx>0<br>
.if edi>=[edx].VirtualAddress <br>
mov eax,[edx].VirtualAddress <br>
add eax,[edx].SizeOfRawData <br>
.if edi<eax ; The address is in this section mov eax,[edx].VirtualAddress sub edi,eax edi="=" difference between specified RVA and's eax,[edx].PointerToRawData add eax,edi eax="=" file offset eax,pFileMap ret .endif edx,sizeof IMAGE_SECTION_HEADER dec ecx .endw assume edx:nothing esi:nothing RVAToFileMap endp ShowTheFunctions proc uses esi ebx hDlg:DWORD, pNTHdr:DWORD LOCAL temp[512]:BYTE NumberOfNames:DWORD Base:DWORD AddressOfFunctions:DWORD AddressOfNameOrdinals:DWORD edi,pNTHdr edi:ptr IMAGE_NT_HEADERS edi, [edi].OptionalHeader.DataDirectory.VirtualAddress .if invoke MessageBox,0, addr NoExportTable,addr AppName,MB_OK+MB_ICONERROR SetDlgItemText,hDlg,IDC_EDIT,0 AppendText,hDlg,addr buffer RVAToFileMap,pMapping,edi IMAGE_EXPORT_DIRECTORY eax,[edi].NumberOfFunctions RVAToFileMap, pMapping,[edi].nName wsprintf, temp,addr ExportTable,eax,[edi].nBase,[edi].NumberOfFunctions,[edi].NumberOfNames,[edi].AddressOfFunctions,[edi].AddressOfNames,[edi].AddressOfNameOrdinals temp push [edi].NumberOfNames pop NumberOfNames [edi].nBase Base [edi].AddressOfFunctions AddressOfFunctions RVAToFileMap,pMapping,AddressOfFunctions AddressOfFunctions,eax esi,[edi].AddressOfNames RVAToFileMap,pMapping,esi esi,eax ebx,[edi].AddressOfNameOrdinals RVAToFileMap,pMapping,ebx ebx,eax AddressOfNameOrdinals,ebx Header edi,AddressOfFunctions .while><eax<br>
mov eax,[edx].VirtualAddress
<br>
sub edi,eax<br>
mov
eax,[edx].PointerToRawData <br>
add eax,edi<br>
add eax,pFileMap <br>
ret <br>
.endif <br>
.endif <br>
add edx,sizeof IMAGE_SECTION_HEADER <br>
dec ecx <br>
.endw <br>
assume edx:nothing <br>
assume esi:nothing <br>
mov eax,edi <br>
ret <br>
RVAToFileMap endp <br>
<br>
ShowTheFunctions proc uses esi ecx ebx hDlg:DWORD, pNTHdr:DWORD <br>
LOCAL temp[512]:BYTE <br>
LOCAL NumberOfNames:DWORD <br>
LOCAL Base:DWORD <br>
<br>
mov edi,pNTHdr <br>
assume edi:ptr IMAGE_NT_HEADERS <br>
mov edi, [edi].OptionalHeader.DataDirectory.VirtualAddress <br>
.if edi==0 <br>
invoke MessageBox,0, addr NoExportTable,addr
AppName,MB_OK+MB_ICONERROR <br>
ret <br>
.endif <br>
invoke SetDlgItemText,hDlg,IDC_EDIT,0 <br>
invoke AppendText,hDlg,addr buffer <br>
invoke RVAToFileMap,pMapping,edi <br>
mov edi,eax <br>
assume edi:ptr IMAGE_EXPORT_DIRECTORY <br>
mov eax,[edi].NumberOfFunctions <br>
invoke RVAToFileMap, pMapping,[edi].nName <br>
invoke wsprintf, addr temp,addr ExportTable, eax, [edi].nBase,
[edi].NumberOfFunctions, [edi].NumberOfNames,
[edi].AddressOfFunctions, [edi].AddressOfNames,
[edi].AddressOfNameOrdinals <br>
invoke AppendText,hDlg,addr temp<br>
invoke AppendText,hDlg,addr Header <br>
push [edi].NumberOfNames<br>
pop NumberOfNames<br>
push [edi].nBase <br>
pop Base <br>
invoke RVAToFileMap,pMapping,[edi].AddressOfNames <br>
mov esi,eax <br>
invoke RVAToFileMap,pMapping,[edi].AddressOfNameOrdinals <br>
mov ebx,eax <br>
invoke RVAToFileMap,pMapping,[edi].AddressOfFunctions <br>
mov edi,eax<br>
.while NumberOfNames>0 <br>
invoke RVAToFileMap,pMapping,dword ptr [esi] <br>
mov dx,[ebx] <br>
movzx edx,dx <br>
mov ecx,edx <br>
shl edx,2 <br>
add edx,edi <br>
add ecx,Base <br>
invoke wsprintf, addr temp,addr template,dword ptr
[edx],ecx,eax <br>
invoke AppendText,hDlg,addr temp <br>
dec NumberOfNames <br>
add esi,4 <br>
add ebx,2 <br>
.endw <br>
ret <br>
ShowTheFunctions endp <br>
end start </font></p>
<h3>分析<font face="Arial, Helvetica, sans-serif">:</font></h3>
<p><font face="Fixedsys">mov edi,pNTHdr <br>
assume edi:ptr IMAGE_NT_HEADERS <br>
mov edi, [edi].OptionalHeader.DataDirectory.VirtualAddress <br>
.if edi==0 <br>
invoke MessageBox,0, addr NoExportTable,addr
AppName,MB_OK+MB_ICONERROR <br>
ret <br>
.endif </font></p>
<p><font size="2" face="MS Sans Serif">程序检验PE有效性后，定位到数据目录获取引出表的虚拟地址。若该虚拟地址为0，则文件不含引出符号。</font></p>
<p><font face="Fixedsys">mov eax,[edi].NumberOfFunctions <br>
invoke RVAToFileMap, pMapping,[edi].nName <br>
invoke wsprintf, addr temp,addr ExportTable, eax, [edi].nBase,
[edi].NumberOfFunctions, [edi].NumberOfNames,
[edi].AddressOfFunctions, [edi].AddressOfNames,
[edi].AddressOfNameOrdinals <br>
invoke AppendText,hDlg,addr temp </font></p>
<p><font size="2" face="MS Sans Serif">在编辑控件中显示</font><font color="#CCFFCC" size="2"
face="MS Sans Serif"><b>IMAGE_EXPORT_DIRECTORY</b></font><font
size="2" face="MS Sans Serif"> 结构的一些重要信息。</font></p>
<p><font face="Fixedsys">push [edi].NumberOfNames <br>
pop NumberOfNames <br>
push [edi].nBase <br>
pop Base </font></p>
<p><font size="2" face="MS Sans Serif">由于我们要枚举所有函数名，就要知道引出表里的名字数目。</font><font color="#FFFFCC" size="2"
face="MS Sans Serif"><b>nBase</b></font><font size="2"
face="MS Sans Serif"> 在将</font><font color="#FFFFCC" size="2"
face="MS Sans Serif"><b>AddressOfFunctions</b></font><font
size="2" face="MS Sans Serif"> 数组索引转换成序数时派到用场。</font></p>
<p><font face="Fixedsys">invoke
RVAToFileMap,pMapping,[edi].AddressOfNames <br>
mov esi,eax <br>
invoke RVAToFileMap,pMapping,[edi].AddressOfNameOrdinals <br>
mov ebx,eax <br>
invoke RVAToFileMap,pMapping,[edi].AddressOfFunctions <br>
mov edi,eax</font></p>
<p><font size="2" face="MS Sans Serif">将三个数组的地址相应存放到esi,，ebx，edi中。准备开始访问。</font></p>
<p><font face="Fixedsys">.while NumberOfNames>0 </font></p>
<p><font size="2" face="MS Sans Serif">直到所有名字都被处理完毕。</font></p>
<p><font face="Fixedsys"> invoke
RVAToFileMap,pMapping,dword ptr [esi] </font></p>
<p><font size="2" face="MS Sans Serif">由于esi指向包含名字字符串RVAs的数组，所以[esi]含有当前名字的RVA，需要将它转换成虚拟地址，后面wsprintf要用的。</font></p>
<p><font face="Fixedsys"> mov dx,[ebx] <br>
movzx edx,dx <br>
mov ecx,edx<br>
add ecx,Base <br>
</font></p>
<p><font size="2" face="MS Sans Serif">ebx指向序数数组，值是字类型的。因此我们先要将其转换成双字，此时edx和ecx含有指向</font><font color="#FFFFCC" size="2"
face="MS Sans Serif"><b>AddressOfFunctions</b></font><font
size="2" face="MS Sans Serif"> 数组的索引。我们用edx作为索引值，而将ecx加上nBase得到函数的序数值。=</font><font
size="2" face="MS Sans Serif"></font></p>
<p><font face="Fixedsys"> shl edx,2 <br>
add edx,edi </font></p>
<p><font size="2" face="MS Sans Serif">索引乘以4 (</font><font color="#FFFFCC" size="2"
face="MS Sans Serif"><b>AddressOfFunctions</b></font><font
size="2" face="MS Sans Serif"> 数组中每个元素都是4字节大小) 然后加上数组首地址，这样</font><font
size="2" face="MS Sans Serif">edx指向的就是所要函数的RVA了。</font></p>
<p><font face="Fixedsys"> invoke wsprintf, addr
temp,addr template,dword ptr [edx],ecx,eax <br>
invoke AppendText,hDlg,addr temp </font></p>
<p><font size="2" face="MS Sans Serif">在编辑控件中显示函数的RVA, 序数, 和名字。</font></p>
<p><font face="Fixedsys"> dec NumberOfNames <br>
add esi,4 <br>
add ebx,2 <br>
.endw </font></p>
<p><font size="2" face="MS Sans Serif">修正计数器，</font><font color="#FFFFCC"
size="2" face="MS Sans Serif"><b>AddressOfNames</b></font><font
size="2" face="MS Sans Serif"> 和 </font><font color="#FFFFCC"
size="2" face="MS Sans Serif"><b>AddressOfNameOrdinals</b></font><font
size="2" face="MS Sans Serif"> 两数组的当前指针，继续遍历直到所有名字全都处理完毕。</font></p>
<hr>
<p align="center"><font size="2"><b>翻译：</b></font><font
size="2" face="MS Sans Serif"><b>iamgufeng [</b></font><a
href="http://win32asm.cjb.net/"><font size="2"
face="MS Sans Serif"><b>Iczelion's Win32 Assembly Homepage</b></font></a><font
size="2" face="MS Sans Serif"><b>]</b><strong>[</strong></font><a
href="http://asm.yeah.net"><font size="2" face="MS Sans Serif"><strong>LuoYunBin's
Win32 ASM Page</strong></font></a><font size="2"
face="MS Sans Serif"><strong>]</strong></font></p>
<p> </p>
</body>
</html>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -