| 发表于：2007-09-21 09:24:245楼 得分:10 |
option explicit
public declare function loadlibrary lib "kernel32 " alias "loadlibrarya " （byval lplibfilename as string) as long
public declare function getprocaddress lib "kernel32 " （byval hmodule as long, byval lpprocname as string) as long
public declare function callwindowproc lib "user32 " alias "callwindowproca " （byval lpprevwndfunc as long, byval hwnd as long, byval msg as long, byval wparam as long, byval lparam as long) as long
public declare function freelibrary lib "kernel32 " （byval hlibmodule as long) as long
public declare sub copymemory lib "kernel32 " alias "rtlmovememory " （lpdest as any, lpsource as any, byval cbytes as long)
private m_opindex as long '写入位置
private m_opcode（) as byte 'assembly 的opcode
public function dynamicrundll32（byval isunload as boolean, byval strlibfilename as string, strprocname as string, paramarray params（)) as long
dim hproc as long
dim hmodule as long
redim m_opcode（400 + 6 * ubound（params)) '保留用来写m_opcode
'读取api库
hmodule = loadlibrary（byval strlibfilename)
if hmodule = 0 then
msgbox "library读取失败！ "
dynamicrundll32 = 0
exit function
end if
'取得函数地址
hproc = getprocaddress（hmodule, byval strprocname)
if hproc = 0 then
msgbox "函数读取失败！ ", vbcritical
freelibrary hmodule
dynamicrundll32 = 0
exit function
end if
'执行assembly code部分
dynamicrundll32 = callwindowproc（getcodestart（hproc, params), 0, 1, 2, 3)
'一些函数需要驻留这就先不释放
if isunload then freelibrary hmodule '释放空间
end function
'public function rundll32（libfilename as string, procname as string, paramarray params（)) as long
' dim hproc as long
' dim hmodule as long
'
' redim m_opcode（400 + 6 * ubound（params)) '保留用来写m_opcode
' '读取api库
' hmodule = loadlibrary（byval libfilename)
' if hmodule = 0 then
' msgbox "library读取失败！ "
' exit function
' end if
'
' '取得函数地址
' hproc = getprocaddress（hmodule, byval procname)
' if hproc = 0 then
' msgbox "函数读取失败！ ", vbcritical
' freelibrary hmodule
' exit function
' end if
'
'
' '执行assembly code部分
' rundll32 = callwindowproc（getcodestart（hproc, params), 0, 1, 2, 3)
'
' freelibrary hmodule '释放空间
'end function
private function getcodestart（byval lngproc as long, byval arrparams as variant) as long
'---以下为assembly部分--
'作用：将函数的参数压入堆栈
dim lngindex as long, lngcodestart as long
'程序起始位址必须是16的倍数
'varptr函数是用来取得变量的地址
lngcodestart = （varptr（m_opcode（0)) or &hf) + 1
m_opindex = lngcodestart - varptr（m_opcode（0)) '程序开始的元素的位置
'前面部分以中断点添满
for lngindex = 0 to m_opindex - 1
m_opcode（lngindex) = &hcc 'int 3
next lngindex
'--------以下开始放入所需的程序----------
'将参数push到堆栈
'由于是stdcall call 参数由最后一个开始放到堆栈
for lngindex = ubound（arrparams) to 0 step -1
addbytetocode &h68 'push的机器码为h68
addlongtocode clng（arrparams（lngindex)) '参数地址
next lngindex
'call hproc
addbytetocode &he8 'call的机器码为he8
addlongtocode lngproc - varptr（m_opcode（m_opindex)) - 4 '函数地址 用call的定址
'-----------结束所需的程序--------------
'返回呼叫函數
addbytetocode &hc2 'ret 10h
addbytetocode &h10
addbytetocode &h0
getcodestart = lngcodestart
end function
private sub addlongtocode（ldata as long)
'将long类型的参数写到m_opcode中
copymemory m_opcode（m_opindex), ldata, 4
m_opindex = m_opindex + 4
end sub
private sub addinttocode（idata as byte)
'将integer类型的参数写道m_opcode中
copymemory m_opcode（m_opindex), idata, 2
m_opindex = m_opindex + 2
end sub
private sub addbytetocode（bdata as byte)
'将byte类型的参数写道m_opcode中
m_opcode（m_opindex) = bdata
m_opindex = m_opindex + 1
end sub
窗体源码：
private sub cmdok_click（)
call dynamicrundll32（false, "test.dll ", "showmessage ")
end sub
private sub form_load（)
dim s1（) as byte, s2（) as byte
dim ret as long
s1 = strconv（ "123 ", vbfromunicode)
s2 = strconv（ "vbnote ", vbfromunicode)
ret = dynamicrundll32（true, "user32 ", "setwindowtexta ", hwnd, varptr（s1（0)))
ret = dynamicrundll32（true, "user32 ", "setwindowtexta ", hwnd, strptr（s2))
call dynamicrundll32（true, "kernel32 ", "deletefilea ", strptr（strconv（ "c:\111.txt ", vbfromunicode)))
end sub | | |
|
