Пример #1
0
        /// <summary>
        /// 枚举模块导出函数
        /// </summary>
        /// <param name="processHandle">进程句柄</param>
        /// <param name="moduleHandle">模块句柄</param>
        /// <param name="callback">回调函数</param>
        /// <returns></returns>
        internal static bool EnumFunctionsInternal(IntPtr processHandle, IntPtr moduleHandle, EnumFunctionsCallback callback)
        {
            int  ntHeaderOffset;
            bool is64;
            int  iedRVA;
            IMAGE_EXPORT_DIRECTORY ied;

            int[]  nameOffsets;
            string functionName;
            short  ordinal;
            int    addressOffset;

            if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + 0x3C, out ntHeaderOffset))
            {
                return(false);
            }
            if (!Process32.Is64BitProcessInternal(processHandle, out is64))
            {
                return(false);
            }
            if (is64)
            {
                if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + ntHeaderOffset + 0x88, out iedRVA))
                {
                    return(false);
                }
            }
            else
            {
                if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + ntHeaderOffset + 0x78, out iedRVA))
                {
                    return(false);
                }
            }
            if (!ReadProcessMemory(processHandle, moduleHandle + iedRVA, &ied, (size_t)40, null))
            {
                return(false);
            }
            if (ied.NumberOfNames == 0)
            {
                //无按名称导出函数
                return(true);
            }
            nameOffsets = new int[ied.NumberOfNames];
            fixed(void *p = &nameOffsets[0])
            if (!ReadProcessMemory(processHandle, moduleHandle + (int)ied.AddressOfNames, p, (size_t)(ied.NumberOfNames * 4), null))
                return(false);

            for (int i = 0; i < ied.NumberOfNames; i++)
            {
                if (!MemoryIO.ReadStringInternal(processHandle, moduleHandle + nameOffsets[i], out functionName, 40, false, Encoding.ASCII))
                {
                    return(false);
                }
                if (!MemoryIO.ReadInt16Internal(processHandle, moduleHandle + ((int)ied.AddressOfNameOrdinals + i * 2), out ordinal))
                {
                    return(false);
                }
                if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + ((int)ied.AddressOfFunctions + ordinal * 4), out addressOffset))
                {
                    return(false);
                }
                if (!callback(moduleHandle + addressOffset, functionName, ordinal))
                {
                    return(true);
                }
            }

            return(true);
        }
Пример #2
0
        /// <summary>
        /// 获取远程进程函数地址
        /// </summary>
        /// <param name="processHandle">进程句柄</param>
        /// <param name="moduleName">模块名</param>
        /// <param name="functionName">函数名</param>
        /// <returns></returns>
        internal static IntPtr GetProcAddressInternal(IntPtr processHandle, string moduleName, string functionName)
        {
            IntPtr moduleHandle;
            int    ntHeaderOffset;
            bool   is64;
            int    iedRVA;
            IMAGE_EXPORT_DIRECTORY ied;

            int[]  nameOffsets;
            string name;
            short  ordinal;
            int    addressOffset;

            moduleHandle = GetHandleInternal(processHandle, false, moduleName);
            if (moduleHandle == IntPtr.Zero)
            {
                return(IntPtr.Zero);
            }
            if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + 0x3C, out ntHeaderOffset))
            {
                return(IntPtr.Zero);
            }
            if (!Process32.Is64BitProcessInternal(processHandle, out is64))
            {
                return(IntPtr.Zero);
            }
            if (is64)
            {
                if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + ntHeaderOffset + 0x88, out iedRVA))
                {
                    return(IntPtr.Zero);
                }
            }
            else
            {
                if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + ntHeaderOffset + 0x78, out iedRVA))
                {
                    return(IntPtr.Zero);
                }
            }
            if (!ReadProcessMemory(processHandle, moduleHandle + iedRVA, &ied, (size_t)40, null))
            {
                return(IntPtr.Zero);
            }
            nameOffsets = new int[ied.NumberOfNames];
            fixed(void *p = &nameOffsets[0])
            if (!ReadProcessMemory(processHandle, moduleHandle + (int)ied.AddressOfNames, p, (size_t)(ied.NumberOfNames * 4), null))
                return(IntPtr.Zero);

            for (int i = 0; i < ied.NumberOfNames; i++)
            {
                if (!MemoryIO.ReadStringInternal(processHandle, moduleHandle + nameOffsets[i], out name, 40, false, Encoding.ASCII))
                {
                    return(IntPtr.Zero);
                }
                if (name == functionName)
                {
                    if (!MemoryIO.ReadInt16Internal(processHandle, moduleHandle + (int)ied.AddressOfNameOrdinals + i * 2, out ordinal))
                    {
                        return(IntPtr.Zero);
                    }
                    if (!MemoryIO.ReadInt32Internal(processHandle, moduleHandle + (int)ied.AddressOfFunctions + ordinal * 4, out addressOffset))
                    {
                        return(IntPtr.Zero);
                    }
                    return(moduleHandle + addressOffset);
                }
            }

            return(IntPtr.Zero);
        }