-
Notifications
You must be signed in to change notification settings - Fork 17
/
Copy pathmessagebox32.asm
159 lines (116 loc) · 3 KB
/
messagebox32.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
;;
;; Copyright 2015 Gu Zhengxiong <[email protected]>
;;
;; For those curious heads
;; striving to figure out what's under the hood.
;;
;; GPL
;;
.model flat, stdcall
option casemap:none
assume fs:nothing
.code
start:
;; ecx = NtCurrentTeb()->ProcessEnvironmentBlock;
xor ecx, ecx
mov ecx, dword ptr fs:[ecx + 30h]
;; ecx = ecx->Ldr;
mov ecx, dword ptr [ecx + 0ch]
;; ecx = ecx->InInitializationOrderModuleList;
mov ecx, dword ptr [ecx + 1ch]
find_kernel32_dll_base:
;; ebx = ecx->DllBase;
mov ebx, dword ptr [ecx + 8h]
;; eax = ecx->BaseDllName.Buffer;
mov eax, dword ptr [ecx + 20h]
;; ecx = ecx->InInitializationOrderLinks;
mov ecx, dword ptr [ecx]
;; if (eax[6] == '3')
cmp byte ptr [eax + 0ch], 33h
jne find_kernel32_dll_base
;; nonvolatile ebx = LoadLibrary("kernel32.dll");
mov ebp, ebx
;; ebp = ebx->e_lfanew;
add ebp, dword ptr [ebp + 3ch]
;; ebp = ebp->OptionalHeader.DataDirectory[0].VirtualAddress;
mov ebp, dword ptr [ebp + 78h]
add ebp, ebx
;; nonvolatile ebp = IMAGE_EXPORT_DIRECTORY;
;; eax = ebp->AddressOfNames;
mov eax, dword ptr [ebp + 20h]
add eax, ebx
xor edx, edx
find_get_proc_address:
;; esi = eax[edx]; // eax is ExportNamePointerTable, a dword array
mov esi, dword ptr [eax + edx * 4]
add esi, ebx
inc edx
;; if (memcmp(esi, 'PteG', 4))
cmp dword ptr [esi], 'PteG'
jne find_get_proc_address
;; if (memcmp(esi + 4, 'Acor', 4))
cmp dword ptr [esi + 4], 'Acor'
jne find_get_proc_address
;; esi = ebp->AddressOfNameOrdinals;
mov esi, dword ptr [ebp + 24h]
add esi, ebx
;; dx = esi[edx]; // esi is ExportOrdinalTable, a _word_ array
mov dx, word ptr [esi + edx * 2]
;; esi = ebp->AddressOfFunctions;
mov esi, dword ptr [ebp + 1ch]
add esi, ebx
;; esi = esi[edx]; // esi is is ExportAddressTable, a dword array
mov esi, dword ptr [esi + edx * 4 - 4]
add esi, ebx
;; nonvolatile esi = GetProcAddress;
xor edi, edi
;; nonvolatile edi = NULL;
;; eax = GetProcAddress(ebx, "LoadLibraryA");
push edi
push 'Ayra'
push 'rbiL'
push 'daoL'
push esp
push ebx
call esi
;; eax = LoadLibrary("user32");
xor ecx, ecx
push edi
mov cx, '23'
push ecx
push 'resu'
push esp
call eax
;; eax = GetProcAddress(eax, "MessageBoxA")
push edi
push 0141786fh
dec byte ptr [esp + 3h]
push 'Bega'
push 'sseM'
push esp
push eax
call esi
;; eax = MessageBoxA(NULL, "Hello World!", NULL, MB_OK);
push edi
push '!dlr'
push 'oW o'
push 'lleH'
mov ecx, esp
push edi
push edi
push ecx
push edi
call eax
;; eax = GetProcAddress(ebx, "ExitProcess")
push edi
push 01737365h
dec byte ptr [esp + 3h]
push 'corP'
push 'tixE'
push esp
push ebx
call esi
;; ExitProcess(NULL);
push edi
call eax
end start