delphi 给力版 GetProcAddress

quasiceo 2013-11-30

展开全文

delphi 给力版 GetProcAddress

作者：admin 来源：日期：2011/8/16 9:37:53 人气：591 标签：

QQ空间新浪微博腾讯微博腾讯朋友 QQ收藏百度空间百度贴吧更多0

上联合翻宝贝，一个不小心，翻到一个给力的函数 = =

虽然不知道作者是谁，深深膜拜作者一下先

const
MAX_API_STRING_LENGTH = 150;

type
PSEHStruct = ^TSEHStruct;
TSEHStruct = record
    saveEsp: Cardinal;
    saveEbp: Cardinal;
    gotoEip: Cardinal;
end;

function MyGetProcAddress(DllBase: LongWord; ApiName: PChar): Pointer; pascal;
asm
        PUSH    ESI
        PUSH    EDI
        PUSH    ECX
        PUSH    EBX
        PUSH    EDX
        XOR     EDX, EDX
        PUSH    OFFSET SEHHandler
        PUSH    DWORD PTR FS:[EDX]
        MOV     SEH.saveEsp, ESP
        MOV     SEH.saveEbp, EBP
        MOV     SEH.gotoEip, OFFSET @@NotFound
        MOV     FS:[EDX], ESP
        MOV     EDI, ApiName
        MOV     ECX, MAX_API_STRING_LENGTH
        REPNZ   SCASB
        MOV     ECX, EDI
        SUB     ECX, ApiName
        MOV     EDX, DllBase
        CMP     [EDX].TImageDosHeader.e_magic, IMAGE_DOS_SIGNATURE
        JNZ     @@NotFound
        ADD     EDX, [EDX].TImageDosHeader._lfanew
        CMP     [EDX].TImageNtHeaders.Signature, IMAGE_NT_SIGNATURE
        JNZ     @@NotFound
        MOV     EDX, [EDX].TImageNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].TImageDataDirectory.VirtualAddress
        OR      EDX, EDX
        JZ      @@NotFound
        ADD     EDX, DllBase
        MOV     EBX, [EDX].TImageExportDirectory.AddressOfNames
        ADD     EBX, DllBase
        XOR     EAX, EAX
@@Loop:
        MOV     EDI, [EBX]
        ADD     EDI, DllBase
        MOV     ESI, ApiName
        PUSH    ECX
        REPZ    CMPSB
        POP     ECX
        JE      @@Found
        ADD     EBX, 4
        INC     EAX
        CMP     EAX, [EDX].TImageExportDirectory.NumberOfNames
        JB      @@Loop
        JMP     @@NotFound
@@Found:
        SHL     EAX, 1
        ADD     EAX, [EDX].TImageExportDirectory.AddressOfNameOrdinals
        ADD     EAX, DllBase
        MOV     AX, [EAX]
        AND     EAX, $0000FFFF
        { ordinal -> function }
        SHL     EAX, 2
        ADD     EAX, [EDX].TImageExportDirectory.AddressOfFunctions
        ADD     EAX, DllBase
        MOV     EAX, [EAX]
        ADD     EAX, DllBase
        JMP     @@Exit
@@NotFound:
        { return 0 on error }
        XOR     EAX, EAX
@@Exit:
        XOR     EDX, EDX
        POP     DWORD PTR FS:[EDX]
        ADD     ESP, 4
        POP     EDX
        POP     EBX
        POP     ECX
        POP     EDI
        POP     ESI
end;