FilesExpand file tree

 master

/

PebApi.asm

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

140 lines (122 loc) · 3.1 KB

 master

/

PebApi.asm

Copy path

Top

File metadata and controls

• Code
• Blame

140 lines (122 loc) · 3.1 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

proc PebGetModuleHandle ModuleHash:DWORD

local FirstEntry:DWORD

local CurrentEntry:DWORD

; Get InMemoryOrderModuleList from PEB

mov eax, 3

shl eax, 4

mov eax, [fs:eax] ; obfuscated fs:0x30

mov eax, [eax + PEB.Ldr]

mov eax, [eax + PEB_LDR_DATA.InMemoryOrderModuleList.Flink]

mov [FirstEntry], eax

mov [CurrentEntry], eax

; Find module by hash

.L_module:

; Compute hash of case insensitive module name

xor edx, edx

mov eax, [CurrentEntry]

movzx ecx, word[eax + LDR_DATA_TABLE_ENTRY.BaseDllName.Length]

test ecx, ecx

jz .C_module

mov esi, [eax + LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer]

xor eax, eax

cld

.L_module_hash:

lodsb

cmp al, 'a'

jl @f

and eax, 0xdf ; Convert lower case letters to upper case

@@: ror edx, 13

add edx, eax

dec ecx

test ecx, ecx

jnz .L_module_hash

; Check, if module is found by hash

cmp edx, [ModuleHash]

jne .C_module

; Return module base

mov eax, [CurrentEntry]

mov eax, [eax + LDR_DATA_TABLE_ENTRY.DllBase]

ret

.C_module:

; Move to next module, exit loop if CurrentEntry == FirstEntry

mov eax, [CurrentEntry]

mov eax, [eax + LIST_ENTRY.Flink]

mov [CurrentEntry], eax

cmp eax, [FirstEntry]

jne .L_module

; Module not found

xor eax, eax

ret

endp

proc PebGetProcAddress ModuleHash:DWORD, FunctionHash:DWORD

local ModuleBase:DWORD

local ExportDirectory:DWORD

local NameDirectory:DWORD

local NameOrdinalDirectory:DWORD

local FunctionCounter:DWORD

; Get module

stdcall PebGetModuleHandle, [ModuleHash]

test eax, eax

jz .E_functions

mov [ModuleBase], eax

; Get export directory

mov eax, [ModuleBase]

add eax, [eax + IMAGE_DOS_HEADER.e_lfanew]

mov eax, [eax + IMAGE_NT_HEADERS32.OptionalHeader.DataDirectoryExport.VirtualAddress]

add eax, [ModuleBase]

mov [ExportDirectory], eax

; Get name table

mov eax, [ExportDirectory]

mov eax, [eax + IMAGE_EXPORT_DIRECTORY.AddressOfNames]

add eax, [ModuleBase]

mov [NameDirectory], eax

; Get name ordinal table

mov eax, [ExportDirectory]

mov eax, [eax + IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals]

add eax, [ModuleBase]

mov [NameOrdinalDirectory], eax

; Find function in export directory by hash

mov [FunctionCounter], 0

.L_functions:

mov eax, [ExportDirectory]

mov eax, [eax + IMAGE_EXPORT_DIRECTORY.NumberOfNames]

cmp eax, [FunctionCounter]

je .E_functions

; Compute hash of function name

xor edx, edx

mov esi, [NameDirectory]

mov esi, [esi]

add esi, [ModuleBase]

xor eax, eax

cld

.L_function_hash:

lodsb

test al, al

jz .E_function_hash

ror edx, 13

add edx, eax

jmp .L_function_hash

.E_function_hash:

; Check, if function is found by hash

cmp edx, [FunctionHash]

jne .C_functions

; Return function address

mov eax, [ExportDirectory]

mov eax, [eax + IMAGE_EXPORT_DIRECTORY.AddressOfFunctions]

add eax, [ModuleBase]

mov ebx, [NameOrdinalDirectory]

movzx ebx, word[ebx]

lea eax, [eax + ebx * 4]

mov eax, [eax]

add eax, [ModuleBase]

ret

.C_functions:

add [NameDirectory], 4

add [NameOrdinalDirectory], 2

inc [FunctionCounter]

jmp .L_functions

.E_functions:

; Function not found in module's export table

xor eax, eax

ret

endp