Twitter
RSS

GetAddressFunction

Función alternativa a GetProcAddress.

include
'win32ax.inc'
.code
start:
invoke LoadLibrary,"user32.dll"
stdcall GetAddressFunction,eax,"MessageBoxA"
stdcall eax,0,0,0,0
invoke ExitProcess,0
proc GetAddressFunction,LibHandle,Api
locals
AddressOfNames dd ?
AddressOfFunctions dd ?
endl
push ebx edx edi ecx esi
mov eax,[LibHandle]
cmp eax,NULL
je .Error
mov ebx, dword[eax + 03Ch]
add ebx,eax
cmp word[ebx],"PE"
jne .Error
mov esi,dword[ebx+078h]
mov ebx,esi
add ebx,eax
push dword[ebx+20h]
pop [AddressOfNames]
add [AddressOfNames] ,eax
mov ecx,dword[ebx+018h]
xor edi,edi
add eax ,esi
push dword[eax+1ch]
pop [AddressOfFunctions]
sub eax,esi
add [AddressOfFunctions] ,eax
.encontrar:
dec ecx
mov eax,edi
rol eax,2
add eax,[AddressOfNames]
mov eax, dword[eax]
add eax, [LibHandle]
inc edi
stdcall comparar, [Api], eax
cmp ecx,NULL
je .Error
cmp eax, 0
jne .encontrar
dec edi
rol edi,2
mov eax,edi
add eax, [AddressOfFunctions]
mov eax, dword[eax]
add eax,[LibHandle]
pop esi ecx edi edx ebx
ret
.Error:
xor eax,eax ; xor eax,eax = NULL
pop esi ecx edi edx ebx
ret
endp
proc comparar ,SRC,DST
push edi ecx esi
mov ecx,-1
mov edi,[SRC]
mov al,0
repnz scasb
mov eax,ecx
not eax
mov ecx,eax
mov esi,[SRC]
mov edi,[DST]
repz cmpsb
mov eax,1
jnz Next
dec eax
Next:
pop esi ecx edi
ret
endp
.end start

Comments (0)