[转载]CCLdll.Asm(页 1) - 各类程序语言{ Program Development } - 机器细语[ ASM ] - 邪恶八进制信息安全团队技术讨论组努力为祖国的信息安全撑起一片蓝天

金州 2005-11-22 00:39

[转载]CCLdll.Asm

文章作者：ccl原作者

.386
.model flat,stdcall
option casemap:none

include windows.inc
include kernel32.inc
includelib kernel32.lib

;所有的入口参数中
;lpSecStart 为内存中节表开始的地址
;lpFileHead 为内存中文件开始的地址（由MapViewOfFile返回）

.code

cGetSecRawSize proc lpSecStart             ;取得某节的RawSize
LOCAL _dReturn
pushad
mov esi,lpSecStart
assume esi:ptr IMAGE_SECTION_HEADER
mov eax,[esi].SizeOfRawData
mov _dReturn,eax
popad
mov eax,_dReturn
assume esi:nothing
ret

cGetSecRawSize endp

cGetSecRawOff proc lpSecStart             ;取得某节的RawOffset
LOCAL _dReturn
pushad
mov esi,lpSecStart
assume esi:ptr IMAGE_SECTION_HEADER
mov eax,[esi].PointerToRawData
mov _dReturn,eax
popad
mov eax,_dReturn
assume esi:nothing
ret
cGetSecRawOff endp

cGetSecNum proc lpFileHead:DWORD ;获取节的个数
LOCAL _dReturn
pushad
mov esi,lpFileHead
assume esi:ptr IMAGE_DOS_HEADER
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
mov edx,esi
add edx,sizeof IMAGE_NT_HEADERS
assume edx:ptr IMAGE_SECTION_HEADER
movzx eax,[esi].FileHeader.NumberOfSections
assume esi:nothing
assume edx:nothing
mov       _dReturn,eax
popad
mov       eax,_dReturn
ret

cGetSecNum endp

cGetSecTableStart proc lpFileHead:DWORD ;获取节表头
LOCAL _dReturn
      pushad
      mov esi,lpFileHead
      assume esi:ptr IMAGE_DOS_HEADER
      add esi,[esi].e_lfanew
      add esi,IMAGE_NT_HEADERS
      mov _dReturn,esi
      popad
      mov eax,_dReturn
      assume esi:nothing
ret
cGetSecTableStart endp

cGetRvaSection proc lpFileHead,dRVA;获得RVA所在节号,thanks罗云彬
LOCAL _dReturn
      pushad
      mov esi,lpFileHead
      assume esi:ptr IMAGE_DOS_HEADER
      add esi,[esi].e_lfanew
      assume esi:ptr IMAGE_NT_HEADERS
      mov edi,dRVA
      mov edx,esi
      add edx,sizeof IMAGE_NT_HEADERS
      assume edx:ptr IMAGE_SECTION_HEADER
      movzx ecx,[esi].FileHeader.NumberOfSections
      .repeat
         mov eax,[edx].VirtualAddress
         add eax,[edx].SizeOfRawData       ;eax = Section End
         .if (edi >= [edx].VirtualAddress) && (edi < eax)
            movzx eax,word ptr[esi].FileHeader.NumberOfSections ;eax= Section Name
            sub eax,ecx
            inc eax
            jmp @F
         .endif
         add edx,sizeof IMAGE_SECTION_HEADER
      .untilcxz
      assume edx:nothing
      assume esi:nothing
      xor       eax,eax
      dec       eax
@@:       mov _dReturn,eax
      popad
      mov eax,_dReturn
      ret
cGetRvaSection endp

cRvaToOffset proc lpFileHead,dRVA;将RVA转换成文件中的偏移,thanks罗云彬
LOCAL _dReturn
      pushad
      mov esi,lpFileHead
      assume esi:ptr IMAGE_DOS_HEADER
      mov eax,[esi].e_lfanew
      add esi,eax
      assume esi:ptr IMAGE_NT_HEADERS
      mov edi,dRVA
      mov edx,esi
      add edx,sizeof IMAGE_NT_HEADERS
      assume edx:ptr IMAGE_SECTION_HEADER
      movzx ecx,[esi].FileHeader.NumberOfSections
      .repeat
         mov eax,[edx].VirtualAddress
         add eax,[edx].SizeOfRawData       ;eax = Section End
         .if (edi >= [edx].VirtualAddress) && (edi < eax)
            mov eax,[edx].VirtualAddress ;eax= Section start
            sub edi,eax          ;edi = offset in section
            mov eax,[edx].PointerToRawData
            add eax,edi          ;eax = file offset
            jmp @F
         .endif
         add edx,sizeof IMAGE_SECTION_HEADER
      .untilcxz
      assume edx:nothing
      assume esi:nothing
      xor       eax,eax
@@:
      mov _dReturn,eax
      popad
      mov eax,_dReturn
      ret
cRvaToOffset endp

cCheckPE proc lpFileHead          ;检查是否是有效的PE文件
LOCAL _dReturn
pushad
push  FALSE
pop _dReturn
mov esi,lpFileHead
assume esi:ptr IMAGE_DOS_HEADER
.if [esi].e_magic=="ZM"
      add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
      .if [esi].Signature=="EP"
         push TRUE
         pop       _dReturn
      .endif
.endif
assume esi:NOTHING
popad
mov eax,_dReturn
ret

cCheckPE endp

cGetEntryOff proc lpFileHead;取得原PE文件入口的文件偏移
LOCAL _dReturn
pushad
mov esi,lpFileHead
assume esi:ptr IMAGE_DOS_HEADER
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
mov eax,[esi].OptionalHeader.AddressOfEntryPoint
invoke cRvaToOffset,lpFileHead,eax
mov _dReturn,eax
popad
mov eax,_dReturn
ret

cGetEntryOff endp

cGetEntryRva proc lpFileHead;取得原PE文件入口的RVA地址
LOCAL _dReturn
pushad
mov esi,lpFileHead
assume esi:ptr IMAGE_DOS_HEADER
mov eax,[esi].e_lfanew
add esi,eax
assume esi:ptr IMAGE_NT_HEADERS
mov eax,[esi].OptionalHeader.AddressOfEntryPoint
mov _dReturn,eax
assume esi:nothing
popad
mov eax,_dReturn
ret

cGetEntryRva endp

cCanAddNewSec proc lpFileHead;判断是否能添加一个新节，返回值为TRUE和FALSE
LOCAL _dReturn
pushad
mov _dReturn,FALSE
mov esi,lpFileHead
assume esi:ptr IMAGE_DOS_HEADER
mov edi,[esi].e_lfanew
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
invoke cGetSecNum,lpFileHead
mov ecx,28h
inc eax
mul ecx
add eax,edi
add eax,24
add ax,[esi].FileHeader.SizeOfOptionalHeader
.if eax<[esi].OptionalHeader.SizeOfHeaders
      mov _dReturn,TRUE
.endif
popad
mov eax,_dReturn
ret

cCanAddNewSec endp

cOffsetToRva proc lpFileHead,dOffset          ;将文件Offset转换为内存RVA
LOCAL _dReturn
pushad
      mov esi,lpFileHead
      assume esi:ptr IMAGE_DOS_HEADER
      add esi,[esi].e_lfanew
      assume esi:ptr IMAGE_NT_HEADERS
      mov edi,dOffset
      mov edx,esi
      add edx,sizeof IMAGE_NT_HEADERS
      assume edx:ptr IMAGE_SECTION_HEADER
      movzx ecx,[esi].FileHeader.NumberOfSections
      .repeat
         mov eax,[edx].PointerToRawData
         add eax,[edx].SizeOfRawData       ;eax = Section End
         .if (edi >= [edx].PointerToRawData) && (edi < eax)
            mov eax,[edx].PointerToRawData ;eax= Section start
            sub edi,eax          ;edi = offset in section
            mov eax,[edx].VirtualAddress
            add eax,edi          ;eax = file offset
            jmp @F
         .endif
         add edx,sizeof IMAGE_SECTION_HEADER
      .untilcxz
      assume edx:nothing
      assume esi:nothing
      xor       eax,eax
@@:
      mov _dReturn,eax
      popad
      mov eax,_dReturn
ret

cOffsetToRva endp

cGetSecAttribute proc lpFileHead,dNum       ;取得第N个节的属性
LOCAL _dReturn
pushad
mov eax,dNum
dec eax
mov ecx,28h
mul ecx
mov ebx,eax
invoke cGetSecTableStart,lpFileHead
add eax,ebx
mov esi,eax
assume esi:ptr IMAGE_SECTION_HEADER
push [esi].Characteristics
pop _dReturn
assume esi:nothing
popad
mov eax,_dReturn
ret

cGetSecAttribute endp

cChangeSecAttribute proc lpFileHead,dNum,dAttribute ;改变第dNum个节的属性
pushad
mov eax,dNum
nop
dec eax
nop
mov ecx,28h
mul ecx
mov ebx,eax
invoke cGetSecTableStart,lpFileHead
add eax,ebx
mov esi,eax
assume esi:ptr IMAGE_SECTION_HEADER
push dAttribute
pop dword ptr [esi].Characteristics
assume esi:nothing
@@: popad
ret
cChangeSecAttribute endp

cCheckIsDll proc lpFileHead ;检测是否是DLL
LOCAL _dReturn
pushad
mov esi,lpFileHead
assume esi:ptr IMAGE_DOS_HEADER
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
xor eax,eax
mov ax,word ptr [esi].FileHeader.Characteristics
and ax,2000h
.if eax==0
      mov _dReturn,FALSE
.else
      mov _dReturn,TRUE
.endif
popad
mov eax,_dReturn
ret

cCheckIsDll endp

DllEntry proc hInstDLL:HINSTANCE, reason:DWORD, reserved1:DWORD

   mov  eax,TRUE
   ret
DllEntry Endp

db "CCLdll.dll Version 2.5"
db "tankaiha[NE365][FCG]"

End DllEntry

;-------------------------------------------------------------------------------------

天亮就去睡 2005-12-5 09:08

这个是做什么用的呀？ [s:34] 代码好多`@@

页: [1]

邪恶八进制信息安全团队技术讨论组's Archiver

[转载]CCLdll.Asm