|

楼主 |
发表于 2007-9-22 20:07:41
|
显示全部楼层
, _
ByVal NumberOfBytesToWrite As Long, _
ByRef NumberOfBytesWritten As Long) As Long
Public Function LzEnumLibraryFunction(ByVal hProcess, ByVal hModule As Long) As ExportTableInformation()
On Error GoTo ErrHdl
If (hModule <= 0) Then GoTo ErrHdl
Const FUNCTION_NAME_MAX_SIZE = &HFF
Dim st As Long
Dim inhInfo As IMAGE_NT_HEADER
Dim dmhInfo As DOS_MZ_HEADER
Dim ret() As ExportTableInformation
Dim pExportDir As IMAGE_EXPORT_DIRECTORY
Dim lpNameOridinals() As Integer, lpName() As Long, lpFunctions() As Long 'poniters
ReDim ret(0)
st = ZwReadVirtualMemory(hProcess, hModule, VarPtr(dmhInfo), LenB(dmhInfo), 0)
If (NT_SUCCESS(st)) Then
st = ZwReadVirtualMemory(hProcess, hModule + dmhInfo.e_lfanew, VarPtr(inhInfo), LenB(inhInfo), 0)
If (NT_SUCCESS(st)) Then
st = ZwReadVirtualMemory(hProcess, inhInfo.OptionalHeader.DataDirectory(IMAGE_DIRECTORY_ENTRY_EXPORT).VirtualAddress + hModule, VarPtr(pExportDir), LenB(pExportDir), ByVal 0)
If (NT_SUCCESS(st)) Then
With pExportDir
ReDim lpNameOridinals(.NumberOfNames - 1)
ReDim lpName(.NumberOfNames - 1)
ReDim lpFunctions(.NumberOfFunctions - 1)
st = ZwReadVirtualMemory(hProcess, .AddressOfNameOridinals + hModule, VarPtr(lpNameOridinals(0)), Len(lpNameOridinals(0)) * (.NumberOfNames), ByVal 0)
st = ZwReadVirtualMemory(hProcess, .AddressOfNames + hModule, VarPtr(lpName(0)), Len(lpName(0)) * (.NumberOfNames), ByVal 0)
st = ZwReadVirtualMemory(hProcess, .AddressOfFunctions + hModule, VarPtr(lpFunctions(0)), Len(lpFunctions(0)) * (.NumberOfFunctions), ByVal 0)
ReDim ret(.NumberOfFunctions - 1)
Dim I As Long, J As Long: I = 0: J = 0
Dim szFuncName As String
Dim bytFuncName() As Byte
Dim curByte As Byte
Dim Base As Long: Base = .Base
Dim lRetLength As Long
Dim curIndex As Long
ReDim bytFuncName(0)
For I = 0 To (.NumberOfFunctions - 1)
For J = 0 To (.NumberOfNames - 1)
If (lpNameOridinals(J) = I) Then
Do
st = ZwReadVirtualMemory(hProcess, hModule + lpName(I) + curIndex, VarPtr(curByte), 1, ByVal 0)
bytFuncName(curIndex) = curByte
curIndex = curIndex + 1
ReDim Preserve bytFuncName(curIndex)
Loop Until ((Not NT_SUCCESS(st)) Or (curByte = 0) Or (curIndex > FUNCTION_NAME_MAX_SIZE))
ReDim Preserve bytFuncName(UBound(bytFuncName) - 2)
szFuncName = StrConv(bytFuncName, vbUnicode)
ret(I).szFunctionName = szFuncName
ret(I).dwOridinal = lpNameOridinals(I) + Base - 1
Exit For
End If
Next
curIndex = 0
ret(I).dwFunctionAddr = lpFunctions(ret(I).dwOridinal)
Next
End With
End If
End If
End If
ErrHdl:
LzEnumLibraryFunction = ret
On Error Resume Next
Erase ret
End Function
st里边的东西。 |
|