- [Duke's Virus Labs #8] - [Page 38] -

祭 㯠  㭪 KERNEL32
(c) by Voodoo/SMF

 ணࠬ   ᮬ !     
 㭪 KERNEL32.dll .  ஢  Win95/Win98/Win NT .
 १ ஢  Win2000  ࠤ 㧭   ᥬ .
  㯨⥫ ᫮ ᪠ ⥯    ᫮  ᠬ ⬥ .
 ᠬ 砫  ।塞 ⠪ 뢠 Image Base .   ᠬ 砫
室 ᨣ DOS  ("MZ")   ᬥ饭 3Ch  Dword ⠥
 ᨣ PE#0#0 . ᫨  室   諨 Image Base.   
   Import Table (Import RVA offset 80h).   
⠡   ன 㤥 ᪠ KERNEL32.dll . ⥬  室 ⠡
ᮢ 㭪権 KERNEL32.dll  ६    砫  
᪠ Image Base KERNEL32.dll(*).  ᪠  ⫨砥  ᪠
"᢮" Image Base .   ६  Export DirectoryTable .  
 RVA :Name Pointers Table,Ordinal Table,Address Table (஡ .
 ਫ 1) .
  室 pointer  GetProcAdress  ᤥ 'ࠫ ७ '
室 Ordinal  ⮩  㭪樨 .     室  ⮩ 㭪樨 
⠡ ᮢ .
   .   ⥯    㪨 !
Handle ୥    , 㭪 GetProcAdress  ⮦ .
   拉 win32.hlp  ᥬ ⨬ ஬  짮.;-)
   ᫨ GlobalAlloc GlobalLock.

ਫ 1 ................ () Hard Wisdom  Pefmt129.htm

P.S.
ࠦ ୮ Hard Wisdom`   ⮫ "᭮" ᠭ PE ଠ .
  뫠  voodoo_imishli@mail.ru .
 㤠 !
           -------------------------------------
(*) ⠫   㪠뢠  KERNEL32.dll,  ᫥⥫쭮 ⮤
      ࠡ   .    Win9x 
    㪠뢠   த :
    push XXXXXX         68h xxh xxh xxh xxh
    jmp  KERNEL32Entry  e9h xxh xxh xxh xxh
    .. ᫨  ⠥  ᨣ MZ
     ᪮३ ᥣ ᪠ ᥯襭 ⨯ 訡 㯠.
    ᫨  ᬮ ᭨ ⠪ 맮   
    祭 ਧ⥫.

===== Cut here =====
.386p
.model flat
MemSize Equ 2000h
extrn   ExitProcess:PROC
.DATA
GlobalAllocCRC  EQU 0CEB0D8A8h ; CRC 㭪権 KERNEL32
GlobalLockCRC   EQU 0D1BBD8A8h ;
GlobalUnlockCRC EQU 0D0C4D8A8h ;
GlobalFreeCRC   EQU 0D4B5D8A8h ;
.CODE
CheckSum EQU 80859190h         ; CRC  KERNEL32
Voodoo_:
;  mov ebx,offset   n1  ⠪   CRC 㦭 㭪樨 (१  EAX).
;  call CRCSum
;    mov ebx,offset n2
;  call CRCSum
;    mov ebx,offset n3
;  call CRCSum
;    mov ebx,offset n4
;  call CRCSum
;find MZ in memory
 call _ESI
_ESI: pop esi
  call  ScanMZ
   ; in esi PE header
   add esi,80h
   add edi,dword ptr [esi]     ;Import RVA
   jmp @L1
NotKERNEL32:
    MOV EBX,EBP
    add edi,00014h
@L1:
   cmp dword ptr [edi+0ch],000000h
   je NOtFound
   add ebx,dword ptr [edi+0ch] ;RVA NAme  of dll
   call CRCSum
   cmp eax,CheckSum
   jne NotKERNEL32
   push ebp
   pop esi
   add ESI,DWORD ptr [edi+10h] ;KERNEL32 proc
   mov esi,dword ptr [esi]
   cmp byte ptr [esi+5],0e9h   ; win9 (*)
   jne Ok_
   add esi,dword ptr [esi+6]
Ok_:call ScanMZ
   add esi,78h
   add edi,dword ptr [esi]        ; edi=Export Directory Table RVA
   mov ecx,dword ptr [edi+18h]    ; Num of Name Pointers
   mov eax,ebp
   add eax,dword ptr [edi+1ch]    ; Address Table
   push eax
   mov eax,ebp
   add eax,dword ptr [edi+24h]    ; Ordinal Table
   push eax
   push ecx
   add ebx,dword ptr [edi+20h]    ;ebx=Name Pointers RVA
   mov Name_Pointers_RVA,ebx
   mov esi,ebx
@L2:call ScanNameTable
    CheckSum2 EQU 91D7D4B9h       ;CRC  GetProcAddress
    cmp eax,CheckSum2
    je FoundGetProcAdr
    inc esi
    inc esi
    inc esi
    inc esi
    loop @L2
FoundGetProcAdr:
    pop eax
    sub eax,ecx ; #function
    shl eax,1   ; x2
    pop ebx     ; Ordinal Table
    add ebx,eax ;
    xor eax,eax
    mov ax,word ptr [ebx] ;Ordinal of GetProcAddress
    shl eax,2   ;x4
    pop ebx
    add ebx,eax
    mov eax,dword ptr [ebx]
    add eax,ebp
    mov GetProcAddress,eax
    mov KernelHandle,ebp

    mov edx,GlobalAllocCRC       ;  塞 
    call  CalkProcAdress         ;GlobalAlloc  
    mov GlobalAlloc,eax          ;GlobalLock .
    mov edx,GlobalLockCRC        ;
    call  CalkProcAdress         ;
    mov GlobalLock,eax           ;
    push MemSize                 ;    win32API
    push 0                       ;
    call dword ptr [GlobalAlloc] ;
    push eax                     ;
    call dword ptr [GlobalLock]  ;
    mov ebp,eax

NOtFound:
          push 0
          call ExitProcess
CalkProcAdress:
    mov esi,Name_Pointers_RVA
fCRC: call ScanNameTable
    cmp  eax,edx
    je  foCRC
    inc esi
    inc esi
    inc esi
    inc esi
    jmp fCRC
foCRC:
  mov eax,dword ptr [esi]
  add eax,ebp
  push eax
  push dword ptr KernelHandle
  call dword ptr [GetProcAddress]
   ret
ScanNameTable:
    mov ebx,ebp
    add ebx,dword ptr [esi]
    call CRCSum
    ret
CRCSum: xor eax,eax
        add eax,dword ptr [ebx]
        add eax,dword ptr [ebx+4]
        ret
ScanMZ:
   dec esi
   cmp word ptr [esi],'ZM'
   jne ScanMZ
   mov edi,esi
   mov ebx,esi
   MOV EBP,ESI
   push esi
   cmp dword ptr [esi+3ch],00010000h
   jg  NextMZ
   add esi,dword ptr [esi+3ch]
   cmp dword ptr [esi],004550h
NextMZ:pop esi
   jne ScanMZ
   add esi,dword ptr [esi+3ch]
   ret
GetProcAddress    dd 0
KernelHandle      dd 0
Name_Pointers_RVA dd 0
GlobalAlloc       dd 0
GlobalLock        dd 0
Voodoo_E:
Ends
End Voodoo_
===== Cut here =====
