从内存中加载DLL DELPHI版

雨点打透心脏的1/2处 2021-11-23 18:24 565阅读 0赞 
  1. //从内存中加载DLL DELPHI版  
  2. unit MemLibrary;
  3. interface
  4. uses
  5. Windows;
  7. function memLoadLibrary(pLib: Pointer): DWord;
  8. function memGetProcAddress(dwLibHandle: DWord; pFunctionName: PChar): Pointer; stdcall;
  9. function memFreeLibrary(dwHandle: DWord): Boolean;
  11. implementation
  12. procedure ChangeReloc(baseorgp, basedllp, relocp: pointer; size: cardinal);
  13. type
  14.     TRelocblock = record
  15.         vaddress: integer;
  16.         size: integer;
  17.     end;
  18.     PRelocblock = ^TRelocblock;
  19. var
  20.     myreloc: PRelocblock;
  21.     reloccount: integer;
  22.     startp: ^word;
  23.     i: cardinal;
  24.     p: ^cardinal;
  25.     dif: cardinal;
  26. begin
  27.     myreloc := relocp;
  28.     dif := cardinal(basedllp)-cardinal(baseorgp);
  29.     startp := pointer(cardinal(relocp)+8);
  30.     while myreloc^.vaddress <> 0 do
  31.     begin
  32.       reloccount := (myreloc^.size-8) div sizeof(word);
  33.       for i := 0 to reloccount-1 do
  34.       begin
  35.         if (startp^ xor $3000 < $1000) then
  36.         begin
  37.           p := pointer(myreloc^.vaddress+startp^ mod $3000+integer(basedllp));
  38.           p^ := p^+dif;
  39.         end;
  40.         startp := pointer(cardinal(startp)+sizeof(word));
  41.       end;
  42.       myreloc := pointer(startp);
  43.       startp := pointer(cardinal(startp)+8);
  44.     end;
  45. end;
  46. procedure CreateImportTable(dllbasep, importp: pointer); stdcall;
  47. type
  48.     timportblock = record
  49.           Characteristics: cardinal;
  50.           TimeDateStamp: cardinal;
  51.           ForwarderChain: cardinal;
  52.           Name: pchar;
  53.           FirstThunk: pointer;
  54.     end;
  55.     pimportblock = ^timportblock;
  56. var
  57.     myimport: pimportblock;
  58.     thunksread, thunkswrite: ^pointer;
  59.     dllname: pchar;
  60.     dllh: thandle;
  61.     old: cardinal;
  62. begin
  63.     myimport := importp;
  64.     while (myimport^.FirstThunk <> nil) and (myimport^.Name <> nil) do
  65.     begin
  66.       dllname := pointer(integer(dllbasep)+integer(myimport^.name));
  67.       dllh := LoadLibrary(dllname);
  68.       thunksread := pointer(integer(myimport^.FirstThunk)+integer(dllbasep));
  69.       thunkswrite := thunksread;
  70.       if integer(myimport^.TimeDateStamp) = -1 then
  71.         thunksread := pointer(integer(myimport^.Characteristics)+integer(dllbasep));
  72.       while (thunksread^ <> nil) do
  73.       begin
  74.         if VirtualProtect(thunkswrite,4,PAGE_EXECUTE_READWRITE,old) then
  75.         begin
  76.           if (cardinal(thunksread^) and $80000000 <> 0) then
  77.           thunkswrite^ := GetProcAddress(dllh,pchar(cardinal(thunksread^) and $FFFF)) else
  78.           thunkswrite^ := GetProcAddress(dllh,pchar(integer(dllbasep)+integer(thunksread^)+2));
  79.           VirtualProtect(thunkswrite,4,old,old);
  80.         end;
  81.         inc(thunksread,1);
  82.         inc(thunkswrite,1);
  83.       end;
  84.       myimport := pointer(integer(myimport)+sizeof(timportblock));
  85.     end;
  86. end;
  88. function memLoadLibrary(pLib: Pointer): DWord;
  89. var
  90. DllMain    : function (dwHandle, dwReason, dwReserved: DWord): DWord; stdcall;
  91. IDH        : PImageDosHeader;
  92. INH        : PImageNtHeaders;
  93. SEC        : PImageSectionHeader;
  94. dwSecCount : DWord;
  95. dwLen      : DWord;
  96. dwmemsize : DWord;
  97. i          : Integer;
  98. pAll       : Pointer;
  99. begin
  100. Result := 0;
  101. IDH := pLib;
  102. if isBadReadPtr(IDH, SizeOf(TImageDosHeader)) or (IDH^.e_magic <> IMAGE_DOS_SIGNATURE) then
  103.     Exit;
  104. INH := pointer(cardinal(pLib)+cardinal(IDH^._lfanew));
  105. if isBadReadPtr(INH, SizeOf(TImageNtHeaders)) or (INH^.Signature <> IMAGE_NT_SIGNATURE) then
  106.     Exit;
  107. // if (pReserved <> nil) then
  108. //    dwLen := Length(pReserved)+1
  109. // else
  110.     dwLen := 0;
  111. SEC := Pointer(Integer(INH)+SizeOf(TImageNtHeaders));
  112. dwMemSize := INH^.OptionalHeader.SizeOfImage;
  113. if (dwMemSize = 0) then Exit;
  114. pAll := VirtualAlloc(nil,dwMemSize+dwLen,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
  115. if (pAll = nil) then Exit;
  116. dwSecCount := INH^.FileHeader.NumberOfSections;
  117. CopyMemory(pAll,IDH,DWord(SEC)-DWord(IDH)+dwSecCount*SizeOf(TImageSectionHeader));
  118. // CopyMemory(Pointer(DWord(pAll) + dwMemSize),pReserved,dwLen-1);
  119. CopyMemory(Pointer(DWord(pAll) + dwMemSize),nil,dwLen-1);
  120. for i := 0 to dwSecCount-1 do
  121. begin
  122.     CopyMemory(Pointer(DWord(pAll)+SEC^.VirtualAddress),
  123.           Pointer(DWord(pLib)+DWord(SEC^.PointerToRawData)),
  124.           SEC^.SizeOfRawData);
  125.     SEC := Pointer(Integer(SEC)+SizeOf(TImageSectionHeader));
  126. end;
  127. if (INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress <> 0) then
  128.     ChangeReloc(Pointer(INH^.OptionalHeader.ImageBase),
  129.           pAll,
  130.           Pointer(DWord(pAll)+INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress),
  131.           INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size);
  132. CreateImportTable(pAll, Pointer(DWord(pAll)+INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress));
  133. @DllMain := Pointer(INH^.OptionalHeader.AddressOfEntryPoint+DWord(pAll));
  134. // if (INH^.OptionalHeader.AddressOfEntryPoint <> 0) and (bDllMain) then
  135. if INH^.OptionalHeader.AddressOfEntryPoint <> 0 then
  136. begin
  137.     try
  138. //      if (pReserved <> nil) then
  139. //        DllMain(DWord(pAll),DLL_PROCESS_ATTACH,DWord(pAll)+dwMemSize)
  140. //      else
  141.         DllMain(DWord(pAll),DLL_PROCESS_ATTACH,0);
  142.     except
  143.     end;
  144. end;
  145. Result := DWord(pAll);
  146. end;
  148. function memFreeLibrary(dwHandle: DWord): Boolean;
  149. var
  150. IDH: PImageDosHeader;
  151. INH: PImageNTHeaders;
  152. begin
  153. Result := false;
  154. if (dwHandle = 0) then
  155.     Exit;
  156. IDH := Pointer(dwHandle);
  157. if (IDH^.e_magic <> IMAGE_DOS_SIGNATURE) then
  158.     Exit;
  159. INH := Pointer(DWord(IDH^._lfanew)+DWord(IDH));
  160. if (INH^.Signature <> IMAGE_NT_SIGNATURE) then
  161.     Exit;
  162. if VirtualFree(Pointer(dwHandle),INH^.OptionalHeader.SizeOfImage,MEM_DECOMMIT) then
  163.     Result := True;
  164. end;
  166. function memGetProcAddress(dwLibHandle: DWord; pFunctionName: PChar): Pointer; stdcall;
  167. var
  168. NtHeader          : PImageNtHeaders;
  169. DosHeader          : PImageDosHeader;
  170. DataDirectory      : PImageDataDirectory;
  171. ExportDirectory    : PImageExportDirectory;
  172. i          : Integer;
  173. iExportOrdinal     : Integer;
  174. ExportName         : String;
  175. dwPosDot          : DWord;
  176. dwNewmodule        : DWord;
  177. pFirstExportName   : Pointer;
  178. pFirstExportAddress: Pointer;
  179. pFirstExportOrdinal: Pointer;
  180. pExportAddr        : PDWord;
  181. pExportNameNow     : PDWord;
  182. pExportOrdinalNow : PWord;
  183. begin
  184. Result := nil;
  185. if pFunctionName = nil then Exit;
  186. DosHeader := Pointer(dwLibHandle);
  187. if isBadReadPtr(DosHeader,sizeof(TImageDosHeader)) or (DosHeader^.e_magic <> IMAGE_DOS_SIGNATURE) then
  188.     Exit; {
  189.      Wrong PE (DOS) Header}
  190. NtHeader := Pointer(DWord(DosHeader^._lfanew)+DWord(DosHeader));
  191. if isBadReadPtr(NtHeader, sizeof(TImageNTHeaders)) or (NtHeader^.Signature <> IMAGE_NT_SIGNATURE) then
  192.     Exit; {
  193.      Wrong PW (NT) Header}
  194. DataDirectory := @NtHeader^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
  195. if (DataDirectory = nil) or (DataDirectory^.VirtualAddress = 0) then
  196.     Exit; {
  197.      Library has no exporttable}
  198. ExportDirectory := Pointer(DWord(DosHeader) + DWord(DataDirectory^.VirtualAddress));
  199. if isBadReadPtr(ExportDirectory,SizeOf(TImageExportDirectory)) then
  200.     Exit;
  201. pFirstExportName := Pointer(DWord(ExportDirectory^.AddressOfNames)+DWord(DosHeader));
  202. pFirstExportOrdinal := Pointer(DWord(ExportDirectory^.AddressOfNameOrdinals)+DWord(DosHeader));
  203. pFirstExportAddress := Pointer(DWord(ExportDirectory^.AddressOfFunctions)+DWord(DosHeader));
  204. if (integer(pFunctionName) > $FFFF) then {
  205.      is FunctionName a PChar?}
  206. begin
  207.     iExportOrdinal := -1;          {
  208.      if we dont find the correct ExportOrdinal}
  209.     for i := 0 to ExportDirectory^.NumberOfNames-1 do {
  210.      for each export do}
  211.     begin
  212.       pExportNameNow := Pointer(Integer(pFirstExportName)+SizeOf(Pointer)*i);
  213.       if (not isBadReadPtr(pExportNameNow,SizeOf(DWord))) then
  214.       begin
  215.         ExportName := PChar(pExportNameNow^+ DWord(DosHeader));
  216.         if (ExportName = pFunctionName) then {
  217.      is it the export we search? Calculate the ordinal.}
  218.         begin
  219.           pExportOrdinalNow := Pointer(Integer(pFirstExportOrdinal)+SizeOf(Word)*i);
  220.           if (not isBadReadPtr(pExportOrdinalNow,SizeOf(Word))) then
  221.           iExportOrdinal := pExportOrdinalNow^;
  222.         end;
  223.       end;
  224.     end;
  225. end else{
  226.      no PChar, calculate the ordinal directly}
  227.     iExportOrdinal := DWord(pFunctionName)-DWord(ExportDirectory^.Base);
  228. if (iExportOrdinal < 0) or (iExportOrdinal > Integer(ExportDirectory^.NumberOfFunctions)) then
  229.     Exit; {
  230.      havent found the ordinal}
  231. pExportAddr := Pointer(iExportOrdinal*4+Integer(pFirstExportAddress));
  232. if (isBadReadPtr(pExportAddr,SizeOf(DWord))) then
  233.     Exit;
  234. {
  235.      Is the Export outside the ExportSection? If not its NT spezific forwared function}
  236. if (pExportAddr^ < DWord(DataDirectory^.VirtualAddress)) or
  237.      (pExportAddr^ > DWord(DataDirectory^.VirtualAddress+DataDirectory^.Size)) then
  238. begin
  239.     if (pExportAddr^ <> 0) then {
  240.      calculate export address}
  241.       Result := Pointer(pExportAddr^+DWord(DosHeader));
  242. end
  243. else
  244. begin {
  245.      forwarded function (like kernel32.EnterCriticalSection -> NTDLL.RtlEnterCriticalSection)}
  246.     ExportName := PChar(dwLibHandle+pExportAddr^);
  247.     dwPosDot := Pos('.',ExportName);
  248.     if (dwPosDot > 0) then
  249.     begin
  250.       dwNewModule := GetModuleHandle(PChar(Copy(ExportName,1,dwPosDot-1)));
  251.       if (dwNewModule = 0) then
  252.         dwNewModule := LoadLibrary(PChar(Copy(ExportName,1,dwPosDot-1)));
  253.       if (dwNewModule <> 0) then
  254.         result := GetProcAddressX(dwNewModule,PChar(Copy(ExportName,dwPosDot+1,Length(ExportName))));
  255.     end;
  256. end;
  257. end;
  258. end.

转载于:https://www.cnblogs.com/MaxWoods/p/3706194.html

发表评论

表情：
评论列表 （有 0 条评论，565人围观）

还没有评论，来说两句吧...

相关阅读