[原创]VC2008内嵌ASM动态调用API

Tesla.Angela · 发表于 2010-7-23 20:54:54

本帖最后由 Tesla.Angela 于 2010-7-23 21:01 编辑

现在发现，VC真是太强大了。。。
VB用了近200代码才实现的功能，用VC仅仅18代码行就实现了。。。

#include "stdafx.h"

long invoke(char *LibName, char *ApiName, long ParamCount, long Params[])
{
long i,myrt,tmp;
HMODULE hLIB=LoadLibraryA(LibName);
PVOID pAPI=GetProcAddress(hLIB,ApiName);
for(i=ParamCount-1;i>=0;i--)
{
      tmp=Params;
      __asm push tmp
}
__asm
{
      call pAPI
      mov myrt,eax
}
FreeLibrary(hLIB);
return myrt;
}

void showmsgbox()
{
long msgbox[4];//参数数组
char ttt[]="title",ccc[]="caption";
RtlZeroMemory(msgbox,sizeof(msgbox));//实际上是把MessageBoxA的参数1和参数4设置为0
msgbox[1]=(long)ccc;
msgbox[2]=(long)ttt;
invoke("user32.dll","MessageBoxA",4,msgbox);
}

void killprocess()
{
long pid,hp;
long op[3],tp[2];
printf("input pid:");
scanf("%ld",&pid);
op[0]=1;
op[1]=0;
op[2]=pid;
hp=invoke("kernel32.dll","OpenProcess",3,op);
tp[0]=hp;
tp[1]=0;
invoke("kernel32.dll","TerminateProcess",2,tp);
}

void zwkillprocess()
{
long pid,hp;
long oa[6],cid[2];
long zwop[4],zwtp[2];
printf("input pid:");
scanf("%ld",&pid);
RtlZeroMemory(oa,sizeof(oa));
RtlZeroMemory(cid,sizeof(cid));
oa[0]=24;
cid[0]=pid;
zwop[0]=(long)(&hp);
zwop[1]=1;
zwop[2]=(long)oa;
zwop[3]=(long)cid;
invoke("ntdll.dll","ZwOpenProcess",4,zwop);
zwtp[0]=hp;
zwtp[1]=0;
invoke("ntdll.dll","ZwTerminateProcess",2,zwtp);
}

int main()
{
showmsgbox();
//killprocess();
zwkillprocess();
return 0;
}