- UID
- 1
- 精华
- 积分
- 76361
- 威望
- 点
- 宅币
- 个
- 贡献
- 次
- 宅之契约
- 份
- 最后登录
- 1970-1-1
- 在线时间
- 小时
|
发表于 2018-11-19 08:29:16
|
显示全部楼层
为了练手,我也用汇编写了一个自己的版本,用NASM写的。编译的时候需要nasm编译器,以及,随便找一个链接器就好。
不依赖任何lib(自己找出kernel32.dll的地址,然后从kernel32.dll里面找到LoadLibrary等各种函数,再加载需要的DLL使用)
整个程序只有2KB。
getguid.zip
(589.62 KB, 下载次数: 3)
- global _start
- segment .text
- _start:
- ;找到kernel32.dll的地址
- mov eax, [fs:0x30] ; EAX = &PEB
- mov eax, [eax + 0xc] ; EAX = &(PEB->Ldr)
- mov eax, [eax + 0x14] ; EAX = PEB->Ldr.InMemOrder.Flink (当前exe)
- mov ebx, [eax + 0x10] ; EBX = 当前EXE的基址
- mov [_WCEx.hInstance], ebx
- mov eax, [eax] ; EAX = Flink(ntdll.dll)
- mov eax, [eax] ; EAX = Flink(kernel32.dll)
- mov ebx, [eax + 0x10] ; EBX = kernel32.dll的基址
- mov [_addr_of_Kernel32], ebx
- ;找到导出表
- mov edx, [ebx + 0x3c] ; EDX = DOS->e_lfanew
- add edx, ebx ; EDX = PE头
- mov edx, [edx + 0x78] ; EDX = 导出表偏移
- add edx, ebx ; EDX = 导出表
- mov esi, [edx + 0x20] ; ESI = 名字表偏移
- add esi, ebx ; ESI = 名字表
- ;找到GetProcAddress的序号
- xor ecx,ecx
- .LoopGetFunc:
- inc ecx
- lodsd
- add eax, ebx ; EAX = 函数名
- cmp dword [eax], 'GetP'
- jnz .LoopGetFunc
- cmp dword [eax+4], 'rocA'
- jnz .LoopGetFunc
- cmp dword [eax+8], 'ddre'
- jnz .LoopGetFunc
- cmp word [eax+12], 'ss'
- jnz .LoopGetFunc
- ;按着序号取得GetProcAddress的地址
- mov esi, [edx + 0x24] ; ESI = 序号表偏移
- add esi, ebx ; ESI = 序号表
- mov cx, [esi + ecx * 2] ; CX = 函数序号
- dec ecx
- mov esi, [edx + 0x1c] ; ESI = 地址表偏移
- add esi, ebx ; ESI = 地址表
- mov edx, [esi + ecx * 4] ; EDX = 指针(偏移)
- add edx, ebx ; EDX = GetProcAddress
- mov [_addr_of_GetProcAddress],edx
- ;调用GetProcAddress取得LoadLibrary的地址
- push _name_of_LoadLibraryA
- push ebx ; Kernel32基址
- call edx ; GetProcAddress
- mov [_addr_of_LoadLibraryA], eax
- ;取得ExitProcess的地址
- push _name_of_ExitProcess
- push dword[_addr_of_Kernel32]
- call [_addr_of_GetProcAddress]
- mov [_addr_of_ExitProcess], eax
- ;使用LoadLibrary加载user32.dll
- push _name_of_user32
- call [_addr_of_LoadLibraryA]
- mov [_addr_of_User32], eax
- ;使用LoadLibrary加载ole32.dll
- push _name_of_ole32
- call [_addr_of_LoadLibraryA]
- mov [_addr_of_Ole32], eax
- ;使用LoadLibrary加载gdi32.dll
- push _name_of_gdi32
- call [_addr_of_LoadLibraryA]
- mov [_addr_of_Gdi32], eax
- ;从User32导入需要的符号
- mov esi, _NameList_User32
- mov edi, _imp_from_user32
- mov ecx, _num_imp_user32
- mov ebp, [_addr_of_User32]
- .ImpFromUser32:
- push ecx
- lodsd
- push eax
- push ebp
- call [_addr_of_GetProcAddress]
- or eax,eax
- jnz .store_user32
- int3
- .store_user32:
- stosd
- pop ecx
- loop .ImpFromUser32
- ;从Ole32导入需要的符号
- mov esi, _NameList_Ole32
- mov edi, _imp_from_ole32
- mov ecx, _num_imp_ole32
- mov ebp, [_addr_of_Ole32]
- .ImpFromOle32:
- push ecx
- lodsd
- push eax
- push ebp
- call [_addr_of_GetProcAddress]
- or eax,eax
- jnz .store_ole32
- int3
- .store_ole32:
- stosd
- pop ecx
- loop .ImpFromOle32
- ;从Gdi32导入需要的符号
- mov esi, _NameList_Gdi32
- mov edi, _imp_from_gdi32
- mov ecx, _num_imp_gdi32
- mov ebp, [_addr_of_Gdi32]
- .ImpFromGdi32:
- push ecx
- lodsd
- push eax
- push ebp
- call [_addr_of_GetProcAddress]
- or eax,eax
- jnz .store_gdi32
- int3
- .store_gdi32:
- stosd
- pop ecx
- loop .ImpFromGdi32
- ;====创建窗口====
- mov dword [_WCEx.cbSize], 48
- mov dword [_WCEx.lpfnWndProc], _wnd_proc
- mov dword [_WCEx.hbrBackground], 16
- mov dword [_WCEx.lpszClassName], _ClassName
- push 32512 ; IDC_ARROW
- push 0
- call [_addr_of_LoadCursor]
- mov [_WCEx.hCursor], eax
- ;用新的GUID当作窗口类名
- call _update_guid
- mov esi, _StringGUID
- mov edi, _ClassName
- mov ecx, 20
- rep movsd
- ;把开头的{替换为c,把中间的横杠替换为下划线,把最后的}替换为'\0'
- mov word [_ClassName], 'c'
- mov ax,'_'
- mov [_ClassName+18], ax
- mov [_ClassName+28], ax
- mov [_ClassName+38], ax
- mov [_ClassName+48], ax
- mov word [_ClassName+74], 0
- push _WCEx
- call [_addr_of_RegisterClassEx]
- ;创建窗口
- push 0 ;lpParam
- push dword[_WCEx.hInstance] ;hInstance
- push 0 ;hMenu
- push 0 ;hWndParent
- push 200 ;Height
- push 320 ;Width
- push 0x80000000 ;Y
- push 0x80000000 ;X
- push 0x00CA0000 ;dwStyle
- push _WindowTitle ;lpWindowName
- push eax ;lpClassName
- push 0 ;dwExStyle
- call [_addr_of_CreateWindowExW]
- mov [_hWnd],eax
- push 1
- push dword [_hWnd]
- call [_addr_of_ShowWindow]
- push dword [_hWnd]
- call [_addr_of_UpdateWindow]
- ;====消息循环====
- .msgloop:
- push 0
- push 0
- push 0
- push _msg
- call [_addr_of_GetMessage]
- or eax, eax
- jz .loopout
- push _msg
- call [_addr_of_TranslateMessage]
- push _msg
- call [_addr_of_DispatchMessage]
- jmp .msgloop
- .loopout:
- push dword[_msg.wParam]
- call [_addr_of_ExitProcess]
- ret
- ;====函数:生成GUID====
- _update_guid:
- ;生成二进制的GUID
- push dword _BinGUID
- call [_addr_of_CoCreateGuid]
- ;生成GUID的字符串
- push dword 40
- push dword _StringGUID
- push dword _BinGUID
- call [_addr_of_StringFromGUID2]
- ret
- ;====消息处理函数====
- _wnd_proc:
- mov eax,[esp+8] ;读取消息
- ;然后判断是啥
- cmp eax, 1
- je .wm_create
- cmp eax, 2
- je .wm_destroy
- cmp eax, 0x111
- je .wm_command
- .default_msg:
- jmp [_addr_of_DefWindowProc]
- .wm_create:
- ;取得系统默认字体
- push 17 ;DEFAULT_GUI_FONT
- call [_addr_of_GetStockObject]
- mov [_DefFont], eax
- ;创建控件——文本标签
- push 0 ;lpParam
- push dword[_WCEx.hInstance] ;hInstance
- push 100 ;hMenu
- push dword[esp+16] ;hWndParent
- push 17 ;Height
- push 273 ;Width
- push 24 ;Y
- push 16 ;X
- push 0x50000000 ;dwStyle
- push _StaticTitle ;lpWindowName
- push _Ctrl_Static ;lpClassName
- push 0 ;dwExStyle
- call [_addr_of_CreateWindowExA]
- push 1
- push dword[_DefFont]
- push 0x0030 ; WM_SETFONT
- push eax
- call [_addr_of_PostMessage]
- ;创建控件——文本框
- push 0 ;lpParam
- push dword[_WCEx.hInstance] ;hInstance
- push 101 ;hMenu
- push dword[esp+16] ;hWndParent
- push 18 ;Height
- push 273 ;Width
- push 48 ;Y
- push 16 ;X
- push 0x50810800 ;dwStyle
- push _StringGUID ;lpWindowName
- push _Ctrl_Edit ;lpClassName
- push 0 ;dwExStyle
- call [_addr_of_CreateWindowExW]
- mov [_hWnd_TextBox], eax
- push 1
- push dword[_DefFont]
- push 0x0030 ; WM_SETFONT
- push eax
- call [_addr_of_PostMessage]
- ;创建控件——按钮
- push 0 ;lpParam
- push dword[_WCEx.hInstance] ;hInstance
- push 102 ;hMenu
- push dword[esp+16] ;hWndParent
- push 33 ;Height
- push 89 ;Width
- push 128 ;Y
- push 16 ;X
- push 0x50000001 ;dwStyle
- push _ButtonTitle ;lpWindowName
- push _Ctrl_Button ;lpClassName
- push 0 ;dwExStyle
- call [_addr_of_CreateWindowExA]
- mov [_hWnd_Button], eax
- push 1
- push dword[_DefFont]
- push 0x0030 ; WM_SETFONT
- push eax
- call [_addr_of_PostMessage]
- xor eax, eax
- ret 16
- .wm_command:
- mov eax,[esp+12]
- cmp ax,102 ;按钮的ID
- jnz .default_msg
- shr eax,16
- cmp ax,0 ;是否为按钮按下的消息
- jnz .default_msg
- ;按钮按下,更新GUID
- call _update_guid
- push _StringGUID
- push dword[_hWnd_TextBox]
- call [_addr_of_SetWindowText]
- xor eax,eax
- ret 16
- .wm_destroy:
- push 0
- call [_addr_of_PostQuitMessage]
- xor eax,eax
- ret 16
- ; segment .rdata
- _name_of_LoadLibraryA db "LoadLibraryA", 0
- _name_of_ExitProcess db "ExitProcess", 0
- _name_of_user32 db "user32.dll", 0
- _name_of_LoadCursor db "LoadCursorA", 0
- _name_of_RegisterClassEx db "RegisterClassExW", 0
- _name_of_CreateWindowExA db "CreateWindowExA", 0
- _name_of_CreateWindowExW db "CreateWindowExW", 0
- _name_of_SetWindowText db "SetWindowTextW", 0
- _name_of_PostQuitMessage db "PostQuitMessage", 0
- _name_of_ShowWindow db "ShowWindow", 0
- _name_of_UpdateWindow db "UpdateWindow", 0
- _name_of_GetMessage db "GetMessageA", 0
- _name_of_PostMessage db "PostMessageA", 0
- _name_of_TranslateMessage db "TranslateMessage", 0
- _name_of_DispatchMessage db "DispatchMessageA", 0
- _name_of_DefWindowProc db "DefWindowProcA", 0
- _name_of_ole32 db "ole32.dll", 0
- _name_of_CoCreateGuid db "CoCreateGuid", 0
- _name_of_StringFromGUID2 db "StringFromGUID2", 0
- _name_of_gdi32 db "gdi32.dll", 0
- _name_of_GetStockObject db "GetStockObject", 0
- _NameList_User32:
- dd _name_of_LoadCursor
- dd _name_of_RegisterClassEx
- dd _name_of_CreateWindowExA
- dd _name_of_CreateWindowExW
- dd _name_of_SetWindowText
- dd _name_of_PostQuitMessage
- dd _name_of_ShowWindow
- dd _name_of_UpdateWindow
- dd _name_of_GetMessage
- dd _name_of_PostMessage
- dd _name_of_TranslateMessage
- dd _name_of_DispatchMessage
- dd _name_of_DefWindowProc
- _num_imp_user32 equ ($ - _NameList_User32) / 4
- _NameList_Ole32:
- dd _name_of_CoCreateGuid
- dd _name_of_StringFromGUID2
- _num_imp_ole32 equ ($ - _NameList_Ole32) / 4
- _NameList_Gdi32:
- dd _name_of_GetStockObject
- _num_imp_gdi32 equ ($ - _NameList_Gdi32) / 4
- _Ctrl_Static db "STATIC", 0
- _Ctrl_Edit dw "E", "D", "I", "T", 0 ;因为生成的GUID字符串是宽字符,所以用W方式的API来弄它相关的
- _Ctrl_Button db "BUTTON", 0
- _WindowTitle db "GUID Generator", 0
- _StaticTitle db "New GUID:", 0
- _ButtonTitle db "&Generate", 0
- segment .bss
- _addr_of_Kernel32 resd 1
- _addr_of_User32 resd 1
- _addr_of_Ole32 resd 1
- _addr_of_Gdi32 resd 1
- _addr_of_GetProcAddress resd 1
- _addr_of_LoadLibraryA resd 1
- _addr_of_ExitProcess resd 1
- _imp_from_user32:
- _addr_of_LoadCursor resd 1
- _addr_of_RegisterClassEx resd 1
- _addr_of_CreateWindowExA resd 1
- _addr_of_CreateWindowExW resd 1
- _addr_of_SetWindowText resd 1
- _addr_of_PostQuitMessage resd 1
- _addr_of_ShowWindow resd 1
- _addr_of_UpdateWindow resd 1
- _addr_of_GetMessage resd 1
- _addr_of_PostMessage resd 1
- _addr_of_TranslateMessage resd 1
- _addr_of_DispatchMessage resd 1
- _addr_of_DefWindowProc resd 1
- _imp_from_ole32:
- _addr_of_CoCreateGuid resd 1
- _addr_of_StringFromGUID2 resd 1
- _imp_from_gdi32:
- _addr_of_GetStockObject resd 1
- _BinGUID resd 4
- _StringGUID resw 40
- _ClassName resw 40 ;窗口类名(直接用GUID来取)
- _hWnd resd 1
- _hWnd_TextBox resd 1
- _hWnd_Button resd 1
- _DefFont resd 1 ;默认字体
- _WCEx: ;WNDCLASSEX结构
- .cbSize resd 1
- .style resd 1
- .lpfnWndProc resd 1
- .cbClsExtra resd 1
- .cbWndExtra resd 1
- .hInstance resd 1
- .hIcon resd 1
- .hCursor resd 1
- .hbrBackground resd 1
- .lpszMenuName resd 1
- .lpszClassName resd 1
- .hIconSm resd 1
- _msg:
- .hwnd resd 1
- .message resd 1
- .wParam resd 1
- .lParam resd 1
- .time resd 1
- .ptx resd 1
- .pty resd 1
复制代码 |
|