get_apiz.asm

Win32病毒入门源码

format  PE GUI 4.0
entry   __start

;
; code section...
;

section '.text' code    readable writeable executable

    ;
    ; _get_krnl_base: get kernel32.dll's base address
    ;
    ; input:
    ;       nothing
    ;
    ; output:
    ;       edi:    base address of kernel32.dll, zero if not found
    ;
    
    _get_krnl_base:
            mov     esi,[fs:0]
        visit_seh:
            lodsd
            inc     eax
            jz      in_krnl
            dec     eax
            xchg    esi,eax
            jmp     visit_seh
            
        in_krnl:
            lodsd
            xchg    eax,edi
            and     edi,0ffff0000h          ; base address must be aligned by 1000h
            
        krnl_search:
            cmp     word [edi],'MZ'         ; 'MZ' signature?
            jnz     not_pe                  ; it's not a PE, continue searching
            lea     esi,[edi+3ch]           ; point to e_lfanew
            lodsd                           ; get e_lfanew
            test    eax,0fffff000h          ; DOS header+DOS stub mustn't > 4k
            jnz     not_pe                  ; it's not a PE, continue searching
            add     eax,edi                 ; point to IMAGE_NT_HEADER
            cmp     word [eax],'PE'         ; 'PE' signature?
            jnz     not_pe                  ; it's not a PE, continue searching
            jmp     krnl_found
            
        not_pe:
            dec     edi
            xor     di,di                   ; decrease 4k bytes
            cmp     edi,70000000h           ; the base cannot below 70000000h
            jnb     krnl_search    
            xor     edi,edi                 ; base not found
            
        krnl_found:
            ret
            
            
    ;
    ; _get_apiz: get apiz from a loaded module, something like GetProcAddress
    ;
    ; input:
    ;       edx:    module handle (module base address)
    ;       esi:    API name
    ;
    ; output:
    ;       eax:    API address, zero if fail
    ;
    
    _get_apiz:
            push    ebp
            mov     ebp,esp
            
            push    ebx
            push    ecx
            push    edx
            push    esi
            push    edi
            
            or      edx,edx                 ; module image base valid?
            jz      return
            mov     ebx,edx                 ; save module image base for
                                            ; later use
            push    esi                     ; save API name
            xchg    esi,edi
            xor     ecx,ecx
            xor     al,al
            dec     ecx
            repnz   scasb
            neg     ecx
            dec     ecx
            push    ecx                     ; save length of the API name
            
            lea     edi,[edx+3ch]
            add     edx,dword [edi]         ; edx points to IMAGE_NT_HEADER
            push    edx                     ; save IMAGE_NT_HEADER
            mov     edi,dword [edx+78h]     ; edi has the RVA of export table
            add     edi,ebx                 ; edi points to export table
            push    edi                     ; save address of export table
            lea     esi,[edi+18h]
            lodsd                           ; eax get NumberOfNames
            push    eax                     ; save NumberOfNames
            mov     esi,[edi+20h]
            add     esi,ebx                 ; now points to name RVA table
            
            xor     edx,edx
        match_api_name:
            lodsd
            add     eax,ebx
            xchg    eax,edi                 ; get a API name
            xchg    esi,eax
            mov     ecx,dword [esp+0ch]     ; length of API name
            mov     esi,dword [esp+10h]     ; API name buffer
            repz    cmpsb
            jz      api_name_found
            xchg    esi,eax
            inc     edx
            cmp     edx,dword [esp]
            jz      api_not_found
            jmp     match_api_name
            
        api_not_found:
            xor     eax,eax
            xor     edi,edi
            jmp     return
            
        api_name_found:
            shl     edx,1
            mov     esi,[esp+04h]           ; export table address
            mov     eax,[esi+24h]
            add     eax,ebx                 ; ordinal table
            movzx   edx,word [eax+edx]
            shl     edx,2
            mov     eax,[esi+1ch]
            add     eax,ebx                 ; function address table
            mov     eax,[eax+edx]
            add     eax,ebx                 ; found!!!

        return:
            add     esp,14h
            pop     edi
            pop     esi
            pop     edx
            pop     ecx
            pop     ebx
            
            mov     esp,ebp
            pop     ebp
            ret


    ;
    ; main entrance...
    ;

    __start:
            call    _get_krnl_base          ; get kernel32.dll base address
            or      edi,edi
            jz      exit
            
            xchg    edi,edx                 ; edx <-- kernel32.dll's image base
            call    @f
            db      'LoadLibraryA',0
        @@:
            pop     esi                     ; esi <-- api name
            call    _get_apiz
            or      eax,eax
            jz      exit
            mov     [__addr_LoadLibrary],eax
            call    @f
            db      'GetProcAddress',0
        @@:
            pop     esi
            call    _get_apiz
            or      eax,eax
            jz      exit
            mov     [__addr_GetProcAddress],eax
            
            call    @f
            db      'user32.dll',0
        @@:
            mov     eax,12345678h
        __addr_LoadLibrary  =   $-4
            call    eax
            call    @f
            db      'MessageBoxA',0
        @@:
            push    eax
            mov     eax,12345678h
        __addr_GetProcAddress   =   $-4
            call    eax
            
            xor     ecx,ecx
            push    ecx
            call    @f
            db      'get_apiz',0
        @@:
            call    @f
            db      'Can you find the import section from this app ^_^',0
        @@:
            push    ecx
            call    eax
            
        exit:
            ret