遍历模块基质的汇编代码

2019独角兽企业重金招聘Python工程师标准>>>

  我从 zeus 木马中扣出来的  自己做了改写 使得找不到 kernel.dll 的时候不会出错 。。。

#include 
#include 

WCHAR *str1 = L"%s ";
WCHAR *str2 = L"%X \n";
WCHAR *str3 = L"%c  ";

HMODULE __declspec(naked) GetKernel32Handle(void)
{
	__asm
	{
		push edi
		push esi
		push ebx

		cld                    //clear the direction flag for the loop
		mov edx, fs:[0x30]     //get a pointer to the PEB
		mov edx, [edx + 0x0C]  //get PEB->Ldr
		mov edx, [edx + 0x14]  //get the first module from the InMemoryOrder module list
			
next_mod:
		mov esi, [edx + 0x28]  //get pointer to modules name (unicode string)
		test esi,esi  // 如果是最后一个 模块了 那么 此时 esi 是 空
		jz _out

		xor edi, edi           //clear edi which will store the hash of the module name	
loop_modname:
		xor eax, eax           //clear eax
		lodsw                  //read in the next byte of the name
		cmp ax, 0x0061            //some versions of Windows use lower case module names
		jl not_lowercase
		sub ax, 0x20           //if so normalise to uppercase
not_lowercase:
		ror edi, 13            //rotate right our hash value
		add edi, eax           //add the next byte of the name to the hash
		test ax,ax
		jnz  loop_modname
/*
		pushad
		push edi
		mov eax,offset str2
		mov eax,[eax]
		push eax
		call wprintf
		add esp,8
		popad

  zzz.exe 8D93016D
  ntdll.dll DF956BA6
  kernel32.dll 50BB715E
  KERNELBASE.dll B0CE8C74

		*/
		cmp edi, 0x50BB715E    //compare the hash with that of KERNEL32.DLL
		mov eax, [edx + 0x10]  //get this modules base address
		mov edx, [edx]         //get the next module
	//	jne next_mod           //if it doesn't match, process the next module
		jmp next_mod	
_out:
		pop ebx
		pop esi
		pop edi
		retn
	};
}

int main(int argc, char* argv[])
{
	printf("%X",GetKernel32Handle());
	return 0;
}

转载于:https://my.oschina.net/sincoder/blog/117914