调用自实现MyGetProcAddress获得CreateFileA函数并调用创建写入文件

最新推荐文章于 2024-04-20 15:39:01 发布

原创

最新推荐文章于 2024-04-20 15:39:01 发布 · 843 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#网络安全

写文件如下

#include <iostream>
#include <Windows.h>

typedef HANDLE(WINAPI* CreateFileAFunc)(LPCSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);

DWORD MyGetProcAddress(
	_In_ HMODULE hModule,
	_In_ LPCSTR lpProcName
)

{
   
   
	PIMAGE_DOS_HEADER pIMAGE_DOS_HEADER = (PIMAGE_DOS_HEADER)hModule;
	PIMAGE_NT_HEADERS pIMAGE_NT_HEADERS = (PIMAGE_NT_HEADERS)(pIMAGE_DOS_HEADER->e_lfanew + (DWORD)hModule);   //NT头
	PIMAGE_EXPORT_DIRECTORY pIMAGE_EXPORT_DIRECTORYRVA = (PIMAGE_EXPORT_DIRECTORY)(pIMAGE_NT_HEADERS->OptionalHeader.DataDirectory[0].VirtualAddress);  //导出表项，获得RVA  RVA并不是真正的导出表项需要转VA，转VA需要加上image_base(也就是加载地址）

	PIMAGE_EXPORT_DIRECTORY pIMAGE_EXPORT_DIRECTORY = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pIMAGE_EXPORT_DIRECTORYRVA + (DWORD)hModule);  //这个才是真正的VA，真正的导出表项，因为RVA在内存中是没有的

	DWORD ModuleName = pIMAGE_EXPORT_DIRECTORY->Name + (DWORD)hModule;
	//可以看到底下地址都需要写成指针形式
	DWORD* pAddressOfFunction = (DWORD*)(pIMAGE_EXPORT_DIRECTORY->AddressOfFunctions + (DWORD)hModule);
	//printf("%s", ModuleName);
	DWORD* NameAddress = (DWORD*)(pIMAGE_EXPORT_DIRECTORY->AddressOfNames + (DWORD)hModule);
	WORD* pAddressOfNameOrdinals = (WORD*)(pIMAGE_EXPORT_DIRECTORY->AddressOfNameOrdinals + (DWORD)hModule);



	for (size_t i = 0; i < pIMAGE_EXPORT_DIRECTORY->NumberOfNames; i++)
	{
   
   
		DWORD FunNameRVA = NameAddres