get_kernel_esp.asm

Win32病毒入门源码

format  PE GUI 4.0
entry   __start


;
; code section...
;

section '.text' code    readable writeable executable

    szText: times 20h   db  0

    __start:
            mov     edi,[esp]               ; get address of kernel32!ExitThread
            and     edi,0ffff0000h          ; base address must be aligned by 1000h
            
        krnl_search:
            cmp     word [edi],'MZ'         ; 'MZ' signature?
            jnz     not_pe                  ; it's not a PE, continue searching
            lea     esi,[edi+3ch]           ; point to e_lfanew
            lodsd                           ; get e_lfanew
            test    eax,0fffff000h          ; DOS header+DOS stub mustn't > 4k
            jnz     not_pe                  ; it's not a PE, continue searching
            add     eax,edi                 ; point to IMAGE_NT_HEADER
            cmp     word [eax],'PE'         ; 'PE' signature?
            jnz     not_pe                  ; it's not a PE, continue searching
            jmp     krnl_found
            
        not_pe:
            dec     edi
            xor     di,di                   ; decrease 4k bytes
            cmp     edi,70000000h           ; the base cannot below 70000000h
            jnb     krnl_search    
            xor     edi,edi                 ; base not found           
             
        krnl_found:
            push    edi                     ; now EDI contains the kernel base
            call    push_format             ; zero if not found
            db      'kernel32 base = 0x%X',0
        push_format:
            push    szText
            call    [wsprintf]
            add     esp,0ch
            xor     eax,eax
            push    eax
            call    push_caption
            db      'kernel',0
        push_caption:
            push    szText
            push    eax
            call    [MessageBox]
            
            ret
            
            
;
; import section...
;

section '.idata' import data    readable

    ; image import descriptor
    dd      0,0,0,RVA usr_dll,RVA usr_thunk
    dd      0,0,0,0,0

    ; dll name
    usr_dll     db      'user32.dll',0

    ; image thunk data
    usr_thunk:
        MessageBox      dd      RVA __imp_MessageBox
        wsprintf        dd      RVA __imp_wsprintf
                        dd      0

    ; image import by name
    __imp_MessageBox    dw      0
                        db      'MessageBoxA',0
    __imp_wsprintf      dw      0
                        db      'wsprintfA',0