حقن ملف تنفيذى و جعله يحمل مكتبة من صنعنا

PHP كود :

yMSGByte: array[1..27] of Byte =
                       (
                        $6A, $00,           {PUSH 0}
                        $68, 0, 0, 0, 0,    {PUSH XXXX}  // title
                        $68, 0, 0, 0, 0,    {PUSH XXXX}  // text
                        $6A, $00,           {PUSH 0}     // owner
                        $B8, 0, 0, 0, 0,    {MOV EAX MessageBoxA}
                        $FF, $D0,           {CALL EAX}
                        $68, 0, 0, 0, 0,    {PUSH XXXX} // JMP TO real Starting point
                        $C3                 {RETN}
                       );

كود :

يجب أن تقوم بتحميل المكتبة التي أنشأتها

PHP كود :

MyMSGByte: array[1..27] of Byte =
                       (
                        $6A, $00,           {PUSH 0}
                        $68, 0, 0, 0, 0,    {PUSH XXXX}  // title
                        $68, 0, 0, 0, 0,    {PUSH XXXX}  // text
                        $6A, $00,           {PUSH 0}     // owner
                        $B8, 0, 0, 0, 0,    {MOV EAX MessageBoxA}
                        $FF, $D0,           {CALL EAX}
                        $68, 0, 0, 0, 0,    {PUSH XXXX} // JMP TO real Starting point
                        $C3                 {RETN}
                       );

PHP كود :

CopyMemory(@MyMSGByte[16], @pMsgBoxA, 4);

كود :

B8 [COLOR=Red]EA 07 3D 7E [COLOR=Black]//[/COLOR] [/COLOR]MOV EAX,user32.MessageBoxA

PHP كود :

function GetImportFunAddr(lpImportAddr: Pointer): Pointer;
begin
  Result := PPointer(PPointer(Cardinal(lpImportAddr) + 2)^)^;
end;

كود :

const
  MyMSGByte: array[1..27] of Byte =
                       (
                        $6A, $00,           {PUSH 0}
                        $68, 0, 0, 0, 0,    {PUSH XXXX}  // title
                        $68, 0, 0, 0, 0,    {PUSH XXXX}  // text
                        $6A, $00,           {PUSH 0}     // owner
                        $[COLOR=Blue]B8[/COLOR], [COLOR=Red]0[/COLOR], [COLOR=Red]0[/COLOR], [COLOR=Red]0[/COLOR],[COLOR=Red] 0[/COLOR],    {MOV EAX MessageBoxA}
                        $FF, $D0,           {CALL EAX}
                        $68, 0, 0, 0, 0,    {PUSH XXXX} // JMP TO real Starting point
                        $C3                 {RETN}
                       );

كود :

CopyMemory(@MyMSGByte[16], @pMsgBoxA, 4);

كود :

B8 [COLOR=Red]EA 07 3D 7E [COLOR=Black]//[/COLOR] [/COLOR]MOV EAX,user32.[COLOR=Red]MessageBoxA[/COLOR]

كود :

function GetImportFunAddr(lpImportAddr: Pointer): Pointer;
begin
  Result := PPointer(PPointer(Cardinal(lpImportAddr) + 2)^)^;
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
 ShowMessageFmt('%p',[GetImportFunAddr(@MessageBoxA)]);
 {GetProcAddress(LoadLibrary('user32.dll'), 'MessageBoxA')}
end;

PHP كود :

//----------- Load the library and get the Handle -----------------//

                        $68, 0, 0, 0, 0,    {PUSH XXXX}      // Password.dll
                        $B8, 0, 0, 0, 0,    {MOV EAX XXXX}   // @LoadLibrary
                        $FF, $D0,           {CALL EAX}       // Call LoadLibrary

                           {
                              Result of this function (LoadLibrary) is placed in the EAX
                                        EAX = Handle of loaded library
                                                                                         }

                       //---------------- Get Address of Function From DLL ----------------//

                        $68, 0, 0, 0, 0,    {PUSH XXXX}      // Name of Function to call
                        $50,                {PUSH EAX}       // Handle Of loaded library
                        $B8, 0, 0, 0, 0,    {MOV EAX XXXX}   // @GetProcAddress
                        $FF, $D0,           {CALL EAX}       // Call GetProcAddress


                           {
                              Result of this function (GetProcAddress) is placed in the EAX
                                     EAX = Address Of Function to call
                                                                                          }

                       //---------------------  Exeute  Function  -------------------------//

                        $68, 0, 0, 0, 0,    {PUSH XXXX}      // First Parametre =  Pchar
                        $50,                {PUSH EAX}       // Address Of Function to call
                        $FF, $D0,           {CALL EAX}       // Call This Function


                        $68, 0, 0, 0, 0,    {PUSH XXXX}      // JMP TO real Starting point
                        $C3                 {RETN}
                        //------------------------------------------------------------------//