ASM Community

.386

.model flat,stdcall

option casemap:none



include	\masm32\include\windows.inc

include	\masm32\include\kernel32.inc

includelib	\masm32\lib\kernel32.lib



.data

user32	db 'user32.dll',0

msgbox	db 'MessageBoxA',0

caption	db 'GetProcAddress example',0



.code

start:

	invoke	LoadLibrary,ADDR user32

	push	eax

	invoke	GetProcAddress,eax,ADDR msgbox

	push	MB_OK

	push	OFFSET msgbox

	push	OFFSET msgbox

	push	0

	call	eax

	pop	eax

	invoke	FreeLibrary,eax

	invoke	ExitProcess,0



END start

; ebp holds a delta offset

            szGetProcAddress  db "GetProcAddress",0 

            GPASIZE     = $ - szGetProcAddress 

            ApiCounter  dd  0 



    GetGetProcAddressAddress proc 

            and      dword ptr [ebp + ApiCounter],0 

            mov      edi,dword ptr [eax+3Ch]          ; kernel PE hdr 

            add      edi,eax                                      ; add image base 

            assume edi:ptr IMAGE_NT_HEADERS  

            mov     edi,[edi].OptionalHeader.DataDirectory.VirtualAddress 

            add     edi,eax 

            assume edi:ptr IMAGE_EXPORT_DIRECTORY 

            mov     ecx,[edi].NumberOfNames 

            mov     esi,[edi].AddressOfNames 

            

            

            add     esi,eax 

            xchg    eax,ebx 

           MatchLp: 



            lodsd 

            add     eax,ebx 



            push    ecx 

            push    edi 

            push    esi 



            push    GPASIZE 

            pop     ecx 

            lea     edi,[ebp+szGetProcAddress] 

            mov     esi,eax 

            repz    cmpsb 



            pop     esi 

            pop     edi 

            

            jecxz      GPA_found 

            

            inc     dword ptr [ebp + ApiCounter] 

            

            pop     ecx 

            dec     ecx 

            jnz     MatchLp 

            

            xor    eax, eax          ; error 

            ret 

            

           GPA_found: 

              

            mov     esi,[edi].AddressOfNameOrdinals          

            pop     ecx 

            

            

            mov     ecx,dword ptr [ebp + ApiCounter] 

            shl     ecx,1 

            add     esi,ecx 

            add     esi,ebx 

            xor     eax,eax 

            lodsw    

            shl     eax,2 



            add     eax,[edi].AddressOfFunctions 

            mov     esi,eax 

            add     esi,ebx 

            lodsd 

            add     eax,ebx 



            assume edi :nothing 

        

            ret 

    GetGetProcAddressAddress endp 

		.386

		.model flat,stdcall

		option casemap:none



include		windows.inc

include		kernel32.inc

includelib	kernel32.lib

include		user32.inc

includelib	user32.lib



		.data

lpMessageBox	dd	?

lpGetModuleHandle	dd	?

dwProcessId	dd	?

hProcess	dd	?

hKernel		dd	?

hUser		dd	?

hNotepad	dd	?

lpBeginAddress	dd	?



		.const

szClassName	db	'Notepad',0

szKernel	db	'kernel32.dll',0

szUser		db	'user32.dll',0

szMessageBoxA	db	'MessageBoxA',0

szGetModule	db	'GetModuleHandleA',0

		.code

		include injected.asm

Start:

		;Get handle of kernel32

		invoke	GetModuleHandle,offset szKernel

		mov	hKernel,eax

		;Get handle of user32

		invoke	GetModuleHandle,offset szUser

		mov	hUser,eax

		invoke	GetProcAddress,eax,offset szMessageBoxA

		mov	lpMessageBox,eax



		invoke	GetProcAddress,hKernel,offset szGetModule

		mov	lpGetModuleHandle,eax



		; Find window(Notepad)

		invoke	FindWindow,offset szClassName,NULL

		mov	hNotepad,eax

		invoke	GetWindowThreadProcessId,eax,offset dwProcessId



		; Open notepad process and get process handle

		invoke	OpenProcess,PROCESS_ALL_ACCESS,FALSE,dwProcessId

		mov	hProcess,eax

		invoke	VirtualAllocEx,eax,NULL,REMOTE_CODE_LEN,MEM_COMMIT,PAGE_EXECUTE_READWRITE

		mov	lpBeginAddress,eax

		invoke	WriteProcessMemory,hProcess,eax,offset REMOTE_CODE_START,REMOTE_CODE_LEN,NULL

		invoke	WriteProcessMemory,hProcess,lpBeginAddress,offset lpMessageBox,sizeof dword * 2,NULL



		mov	eax,lpBeginAddress

		add	eax,offset remote - offset REMOTE_CODE_START



		invoke	CreateRemoteThread,hProcess,NULL,0,eax,NULL,0,NULL



		; close thread handle

		invoke	CloseHandle,eax



		; close process handle

		invoke	CloseHandle,hProcess





		invoke	ExitProcess,NULL

end Start



REMOTE_CODE_START	equ		this byte

lpMessageBoxRemote	dd		?

lpGetModule		dd		?

hInstance		dd		?



szCaption		db		'Remote',0

szContent		db		'The code executed now is injected by another process!',0



remote			proc		uses esi ebx edi lParam

			local		@hModule



			call		@f

			@@:

			;ebx is the offset between original address and new address

			pop		ebx

			sub		ebx,offset @b



			push		NULL

			lea		esi,lpGetModule

			add		esi,ebx

			call		dword ptr [esi]

			lea		esi,hInstance

			add		esi,ebx

;			mov		[ebx + offset hInstance],eax

			mov		esi,eax



			push		MB_OK

			lea		esi,offset szCaption

			add		esi,ebx

			push		esi

			lea		esi,offset szContent

			add		esi,ebx

			push		esi

			lea		esi,offset hInstance

			add		esi,ebx

			push		[esi]

			lea		esi,lpMessageBoxRemote

			add		esi,ebx

			call		dword ptr [esi]

			ret

remote			endp



REMOTE_CODE_END		equ		this byte

REMOTE_CODE_LEN		equ		offset REMOTE_CODE_END - offset REMOTE_CODE_START

invoke GetProcAddress, handle, 238

GetProcAddr PROC USES esi edi ebx ecx edx  bHandle:DWORD, pApi:DWORD

;Install our Structured Exception Handler

    LOCAL handle:DWORD

        

    push bHandle

    pop  handle

    

   ;If handle == 0 we are looking for current module from PEB

   ;According to IDAs output of GetProcAddress ->>> BasepMapModuleHandle ->>>

   ; if handle is equal to 0, then get image-base from PEB 

    cmp handle, 0

    jnz @F

    mov eax, FS:[30h]

    mov eax, [eax+8]   ;<---- get Image Base

    mov handle, eax

    ;<---- Locate EXPORT_TABLE!!!!!!

    @@:    

    mov edi, handle

    add edi, dword ptr[edi+3ch]

    ASSUME EDI : ptr IMAGE_NT_HEADERS32

    mov ebx, [edi].OptionalHeader.DataDirectory[0].VirtualAddress

    add ebx, handle

    ASSUME EDI:NOTHING

    

    ASSUME EBX : ptr IMAGE_EXPORT_DIRECTORY

    

    ;Is it ordinal??

    mov ecx, 0FFFFh

    mov edx, pApi

    cmp edx, ecx

    jbe      @ordinal      

    

    ;<--- get api len!!!!!

    xor eax, eax

    mov edi, pApi

    mov ecx, 100h

    repnz scasb

    sub edi, pApi

    mov ecx, edi

    

    mov edx, [ebx].AddressOfNames

    add edx, handle

    

    xor eax, eax                            ;<----- eax is counter!!!

    @find_name:

     mov esi, [edx]

     add esi, handle

     mov edi, pApi

     push ecx                               ;<----- save API_len 

     cld

     repe cmpsb 

     jz @find_ordinal

     pop ecx

     add edx, 4

     inc eax

     cmp eax, [ebx].NumberOfNames

     jbe @find_name 

     mov eax, 0

     jmp @ExitProc

     

    ;<--------in eax is Ordinal index * 2 to find right address 

    @find_ordinal:

     mov esi, [ebx].AddressOfNameOrdinals

     add esi, handle

     xor edx, edx

     mov dx, word ptr[esi+eax*2]

    @ordinal:   

    ;<---- edx has ordinal number 

    ;<----- Now Find API address

    mov esi, [ebx].AddressOfFunctions

    add esi, handle

    xor eax, eax

    mov eax, dword ptr[esi+edx*4]

    add eax, handle            ;<---------API address  

   

    @ExitProc:

    add esp, 4

    ret 

GetProcAddr ENDP