2019独角兽企业重金招聘Python工程师标准>>> 
我从 zeus 木马中扣出来的 自己做了改写 使得找不到 kernel.dll 的时候不会出错 。。。
#include
#include
WCHAR *str1 = L"%s ";
WCHAR *str2 = L"%X \n";
WCHAR *str3 = L"%c ";
HMODULE __declspec(naked) GetKernel32Handle(void)
{
__asm
{
push edi
push esi
push ebx
cld //clear the direction flag for the loop
mov edx, fs:[0x30] //get a pointer to the PEB
mov edx, [edx + 0x0C] //get PEB->Ldr
mov edx, [edx + 0x14] //get the first module from the InMemoryOrder module list
next_mod:
mov esi, [edx + 0x28] //get pointer to modules name (unicode string)
test esi,esi // 如果是最后一个 模块了 那么 此时 esi 是 空
jz _out
xor edi, edi //clear edi which will store the hash of the module name
loop_modname:
xor eax, eax //clear eax
lodsw //read in the next byte of the name
cmp ax, 0x0061 //some versions of Windows use lower case module names
jl not_lowercase
sub ax, 0x20 //if so normalise to uppercase
not_lowercase:
ror edi, 13 //rotate right our hash value
add edi, eax //add the next byte of the name to the hash
test ax,ax
jnz loop_modname
/*
pushad
push edi
mov eax,offset str2
mov eax,[eax]
push eax
call wprintf
add esp,8
popad
zzz.exe 8D93016D
ntdll.dll DF956BA6
kernel32.dll 50BB715E
KERNELBASE.dll B0CE8C74
*/
cmp edi, 0x50BB715E //compare the hash with that of KERNEL32.DLL
mov eax, [edx + 0x10] //get this modules base address
mov edx, [edx] //get the next module
// jne next_mod //if it doesn't match, process the next module
jmp next_mod
_out:
pop ebx
pop esi
pop edi
retn
};
}
int main(int argc, char* argv[])
{
printf("%X",GetKernel32Handle());
return 0;
}