1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30: 31: 32: 33: 34: 35: 36: 37: 38: 39: 40: 41: 42: 43: 44: 45: 46: 47: 48: 49: 50: 51: 52: 53: 54: 55: 56: 57: 58: 59: 60: 61: 62: 63: 64: 65: 66: 67: 68: 69: 70: 71: 72: 73: 74: 75: 76: 77: 78: 79: 80: 81: 82: 83: 84: 85: 86: 87: 88: 89: 90: 91: 92: 93: 94: 95: 96: 97: 98: 99: 100: 101: 102: 103: 104: 105: 106: 107: 108: 109: 110: 111: 112: 113: 114: 115: 116: 117: 118: 119: 120: 121: 122: 123: 124: 125: 126: 127: 128: 129: 130: 131: 132: 133: 134: 135: 136: 137: 138: 139: 140: 141: 142: 143: 144: 145: 146: 147: 148: 149: 150: 151: 152: 153: 154: 155: 156: 157: 158: 159: 160: 161: 162: 163: 164: 165: 166: 167: 168: 169: 170: 171: 172: 173: 174: 175: 176: 177: 178: 179: 180: 181: 182: 183: 184: 185: 186: 187: 188: 189: 190: 191: 192: 193: 194: 195: 196: 197: 198: 199: 200: 201: 202: 203: 204: 205: 206: 207: 208: 209: 210: 211: 212: 213: 214: 215: 216: 217: 218: 219: 220: 221: 222: 223: 224: 225: 226: 227: 228: 229: 230: 231: 232: 233: 234: 235: 236: 237: 238: 239: 240: 241: 242: 243: 244: 245: 246: 247: 248: 249: 250: 251: 252: 253: 254: 255: 256: 257: 258:
| program modulehandle;
uses windows, uallUtil;
procedure CheckSum; asm PUSH EBP MOV EBP, ESP PUSH ECX PUSH EBX PUSH EDX
XOR EDX, EDX MOV EBX, [EBP+8] @@next: MOV AL, [EBX] TEST AL, AL JZ @@Exit CMP AL, $61 JS @@ok CMP AL, $7B JNS @@ok SUB Al, $20 @@ok: AND EAX, $FF ADD EDX, EAX SHL EDX, 1 INC EBX JMP @@next
@@Exit: XOR EAX, EAX CMP EDX, [EBP+12] SETE AL
POP EDX POP EBX POP ECX POP EBP RET $8 end;
procedure GetProcAddressXSub; asm PUSH EBP MOV EBP, ESP
PUSH ECX PUSH EDX PUSH EBX PUSH ESI PUSH EDI
XOR EBX, EBX MOV ECX, [EBP+8] MOV EAX, [ECX] AND EAX, $0000FFFF CMP EAX, $00005A4D JNE @@Exit MOV EDX, ECX ADD EDX, $3C MOV EDX, [EDX] ADD EDX, ECX MOV EAX, [EDX] AND EAX, $0000FFFF CMP EAX, $00004550 JNE @@Exit
ADD EDX, $78 MOV EAX, ECX ADD EAX, [EDX] ADD EAX, 24 MOV EDX, [EAX]
ADD EAX, 4 MOV ESI, [EAX] ADD ESI, ECX
ADD EAX, 4 MOV EBX, [EAX] ADD EBX, ECX MOV EDI, EBX
@@Next: TEST EDX, EDX JZ @@Exit XOR EDX, EDX PUSH ECX ADD ECX, [EBX]
PUSH [EBP+12] PUSH ECX CALL checksum POP ECX TEST AX, AX JNZ @@IsAddr
ADD EBX, 4 DEC EDX JMP @@Next
@@IsAddr: SUB EBX, EDI ADD ESI, EBX MOV EBX, [ESI] ADD EBX, ECX
@@Exit: MOV EAX, EBX
POP EDI POP ESI POP EBX POP EDX POP ECX POP EBP RET $8 end;
procedure GetProcAddressX; asm PUSH EBP MOV EBP, ESP XOR EDX, EDX PUSH OFFSET @@MyHandler PUSH DWORD PTR FS:[EDX] MOV FS:[EDX], ESP PUSH [EBP+$C] PUSH [EBP+$8] CALL GetProcAddressXSub JMP @@BehindMyHandler @@MyHandler: MOV ESP, [EBP-$4] XOR EAX, EAX @@BehindMyHandler: XOR EDX, EDX POP DWORD PTR FS:[EDX] POP EDX POP EBP RET $8 end;
procedure GetModuleHandleXSub; asm PUSH EBP MOV EBP, ESP
MOV ECX, [EBP+8] MOV EAX, [ECX] AND EAX, $0000FFFF CMP EAX, $00005A4D JNE @@Exit MOV EDX, ECX ADD EDX, $3C MOV EDX, [EDX] ADD EDX, ECX MOV EAX, [EDX] AND EAX, $0000FFFF CMP EAX, $00004550 JNE @@Exit ADD EDX, $78 MOV EAX, ECX ADD EAX, [EDX] ADD EAX, $C MOV EAX, [EAX] ADD EAX, ECX XOR EDX, EDX MOV EBX, EAX PUSH [EBP+12] PUSH EBX CALL checksum XOR EBX, EBX TEST EAX, EAX JZ @@Exit MOV EBX, ECX @@Exit: MOV EAX, EBX POP EBP RET $8 end;
procedure GetModuleHandleX; asm PUSH EBP MOV EBP, ESP MOV ECX, $FFFF0000 MOV EBX, EAX @@goon: PUSH EBX PUSH ECX PUSH EBP XOR EDX, EDX PUSH OFFSET @@MyHandler PUSH DWORD PTR FS:[EDX] MOV FS:[EDX], ESP PUSH [EBP+8] PUSH ECX CALL GetModuleHandleXSub JMP @@BehindMyHandler @@MyHandler: MOV ESP, [EBP-$4] XOR EAX, EAX @@BehindMyHandler: XOR EDX, EDX POP DWORD PTR FS:[EDX] POP EDX POP EBP POP ECX POP EBX TEST EAX, EAX JNZ @@Exit SUB ECX, $10000 TEST ECX, ECX JNZ @@goon @@Exit: POP EBP RET $4 end;
var kernelhandle, procaddress, moduleh, loadlib: integer; begin asm PUSH $000940C8 CALL GetModuleHandleX MOV kernelhandle, EAX
PUSH EAX PUSH $00248C3A PUSH EAX CALL GetProcAddressX MOV procaddress, EAX POP EAX
PUSH EAX PUSH $0091A736 PUSH EAX CALL GetProcAddressX MOV moduleh, EAX POP EAX
PUSH EAX PUSH $000957C6 PUSH EAX CALL GetProcAddressX MOV loadlib, EAX POP EAX end;
MessageBoxA(0,PChar('Kernel32.dll Handle: '+IntToHex(kernelhandle,8)),nil,0); MessageBoxA(0,PChar('GetProcAddress Address: '+IntToHex(procaddress,8)),nil,0); MessageBoxA(0,PChar('GetModuleHandleA Address: '+IntToHex(moduleh,8)),nil,0); MessageBoxA(0,PChar('LoadLibraryA Address: '+IntToHex(loadlib,8)),nil,0); end. |