GEEKiDoS' Blog

简单通用 DllProxy

Reverse Engineering May 25, 2023

之前写脱壳器的时候写的, 贴一下

ifdef rax
	extern GetProcAddress:proc
	extern LoadLibraryA:proc
else
	.686
	.model flat, stdcall

	.code
	extern GetProcAddress@8:proc
	extern LoadLibraryA@4:proc
endif

do_proxy macro dll, func

.data
name_&func& db "&func&", 0
ifdef rax
	addr_&func& dq 0
else
	addr_&func& dd 0
endif

.code
exp_&func& proc
	ifdef rax
		cmp qword ptr [addr_&func&], 0
		jne jmp_target

		push rcx
		push rdx
		push r8
		push r9

		lea rcx, [dll]
		call LoadLibraryA

		mov rcx, rax
		lea rdx, [name_&func&]
		call GetProcAddress

		mov [addr_&func&], rax

		pop r9
		pop r8
		pop rdx
		pop rcx
	else
		cmp dword ptr [addr_&func&], 0
		jne jmp_target

		push offset [dll]
		call LoadLibraryA@4

		push offset [name_&func&]
		push eax
		call GetProcAddress@8
	
		mov [addr_&func&], eax
	endif

	jmp_target:
		ifdef rax
			jmp qword ptr [addr_&func&]
		else
			jmp dword ptr [addr_&func&]
		endif
exp_&func& endp

endm

用法

include proxy.asm

.data
d3d9 db "d3d9.dll", 0

do_proxy d3d9, Direct3DCreate9

end

标签

GEEKiDoS

向你推荐