[C++][ASM]免API撈模組基址(asm從PEB硬幹)

這是從對岸忘記從哪裡撈來的...
不過看了一下手法很漂亮就記錄下來惹XD
原理是用asm從PEB去指向模組的List去找這樣
底下稍微改過原本寫法然後補上註解

DWORD GetSelfModule()//等同GetModuleHanle(NULL)
{
DWORD dRetn = 0;
asm
{
   push eax //保護堆疊
   MOV eax,dword ptr fs:[0x30] // pointer to PEB
   MOV eax,dword ptr [eax+0x8] //eax = Current Module Base
   MOV [dRetn],eax
   pop eax //恢復堆疊
}
return dRetn;
}

另個是如果想搜索

DWORD GetKernelModule()//獲取Kernel32 DLL Base
{
DWORD dRetn = 0;
asm
{
   push eax
   mov eax,dword ptr fs:[0x30]   //pointer to PEB
   mov eax,dword ptr [eax+0x0c]   //pointer to loader data
   mov eax,dword ptr [eax+0x1c]   //first entry in initialization order list (ntdll.dll)
   mov eax,dword ptr [eax]    //second entry int initialization order list (kernel32.dll)
   mov eax,dword ptr [eax+0x08]   //base addr of kernel32.dll
   mov [dRetn],eax
   pop eax
}
return dRetn;
}

至於可以用在哪.....
比如說...要做黑黑的事情但是不想被防毒檢測到之類的XD(?)
或者遊戲保護不給搜索(?)不過一般遊戲不會防這個啦

忘了補一個
看雪的某個大大丟的寫法這個也不錯XD

//*參考 看雪 【原创】搜索输出表取得GetProcAddress地址C++版

PIMAGE_DOS_HEADER pDosHeader;

PIMAGE_NT_HEADERS pNtHeader;

PIMAGE_EXPORT_DIRECTORY pExportDirectory;

HMODULE hModuleBase = hModule;

pDosHeader = (PIMAGE_DOS_HEADER)hModuleBase;

pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)hModuleBase + pDosHeader->e_lfanew);

pExportDirectory = PIMAGE_EXPORT_DIRECTORY(pNtHeader->OptionalHeader.DataDirectory[0].VirtualAddress + (PBYTE)hModuleBase);

PDWORD pAddressName = PDWORD((PBYTE)hModuleBase+pExportDirectory->AddressOfNames); //函数名称表指针

PWORD pAddressOfNameOrdinals = (PWORD)((PBYTE)hModuleBase+pExportDirectory->AddressOfNameOrdinals); //函数名称序号表指针

//PDWORD pAddresOfFunction = (PDWORD)((PBYTE)hModuleBase+pExportDirectory->AddressOfFunctions); //函数地址表指针

for (int index = 0; index < (pExportDirectory->NumberOfNames); index++)

{

PCHAR pFunc = (PCHAR)((long)hModuleBase + *pAddressName);

pAddressName ++ ;

if (!strcmp(pFunc, "GetProcAddress")) break;

pAddressOfNameOrdinals++;//ENT和函数名序号数组两个并行数组同时滑动指针(序号数组中的序号就对应函数名对应的函数地址的数组索引)

}