PureBasic Forums - English

Code: Select all

#include <iostream>
#include <Windows.h>

BOOL APIENTRY MyMain(LPVOID lpParameter) {
	DWORD dwImageBase = reinterpret_cast<DWORD>(lpParameter);

	WCHAR szOutput[MAX_PATH];
	wsprintf(szOutput, L"Module base: 0x%08x", dwImageBase);
	::MessageBox(NULL, szOutput, L"Test DLL", MB_OK);

	return TRUE;
}

Code: Select all

_DLLEntryPoint@12:
  MOV    [_PB_Instance],eax
  CALL   PB_DllInit
  
  PUSH   dword 0
  LEA    eax,[_S2]
  PUSH   eax
  LEA    eax,[_S1]
  PUSH   eax
  PUSH   dword 0
  CALL  _MessageBoxW@16
  
  XOR    eax,eax
  MOV    eax,1
  RET    12

Code: Select all

    
;By celtic88 2018

_DLLEntryPoint@12:
PUSH Ebp
  SUB Esp, 4*20
  MOV Ebp, Esp
  
  CALL .KErnEl32 ; get Kernel32 base address
  MOV [Ebp], Eax
  
  PUSH .FuncLoadLibraryA ; get LoadLibraryA Proc address
  PUSH dword [Ebp]
  CALL .GEtProcAddrEss
  MOV dword [Ebp + 4], Eax
  
  PUSH .FuncGEtProcAddrEss; get GEtProcAddrEss Proc address
  PUSH dword [Ebp]
  CALL .GEtProcAddrEss
  MOV [Ebp + 8], Eax
  
  PUSH .UsEr32         ; get user32 base address
  CALL dword [Ebp + 4]
  MOV dword [Ebp + 12], Eax
  
  PUSH .MEssagEBoxA   ; get MEssagEBoxA Proc address
  PUSH dword [Ebp + 12]
  CALL dword [Ebp + 8]
  MOV dword [Ebp + 16], Eax
  
  PUSH dword 0   ; call MEssagEBoxA
  PUSH dword .CEltic88
  PUSH dword .CEltic88
  PUSH dword 0
  CALL dword [Ebp + 16]
  
  ADD Esp ,4*20
  POP Ebp
  RET 12
  
  .KErnEl32:
  PUSH Edi Ebx
  XOR Eax, Eax
  MOV    Edi, DWord [fs:Eax + 48] ;GEt PEb
  MOV     Edi, DWord [Edi+12]
  MOV     Edi, DWord [Edi+28]
  .NExtModulE:
  MOV     Edi, DWord [Edi]
  MOV     Ebx,DWord [Edi+32] 
  CMP     BytE [Ebx+24],al
  JNE     .NExtModulE
  CMP     BytE [Ebx], 75
  JE	    .Found_K32
  CMP     BytE [Ebx], 107
  JNE     .NExtModulE
  .Found_K32:
  MOV Eax, DWord [Edi+8]
  POP Ebx Edi
  RET
  
  .GEtProcAddrEss:
  PUSH  ESI Edi Edx Ebx Ebp Ecx
  
  SUB  Esp, 8
  MOV Ebp, Esp
  
  MOV Ebx,DWord [Ebp + 4 + 8 + 6*4] ;KErnEl32 basE
  
  MOV Edx, Ebx
  ADD Edx , [Ebx + 60] ;IMAGE_DOS_HEADER\E_lfanEw
  
  MOV Edx, [Edx + 120] ;IMAGE_NT_HEADERS\IMAGE_OPTIONAL_HEADER\DataDirEctory\ExportVirtualAddrEss
  ADD Edx, Ebx         ;IMAGE_EXPORT_DIRECTORY
  
  MOV Esi,Ebx
  ADD Esi, [Edx + 32] ;IMAGE_EXPORT_DIRECTORY\AddrEssOfNamEs
  
  MOV Edi,Ebx
  ADD Edi, [Edx + 36] ;IMAGE_EXPORT_DIRECTORY\AddrEssOfNamEOrdinals
  
  MOV Ecx,[Edx + 20]  ;IMAGE_filE_HEADER\NumbErOfSEctions
  
  .__GEtFuncList:
  LODSD
  ADD Eax, Ebx        ;function namE
  MOV Dword [Ebp], Eax
  MOV Eax, Ebx
  ADD Eax, [Edx + 28] ;IMAGE_EXPORT_DIRECTORY\AddrEssOfFunctions
  PUSH Ecx
  MOVSX Ecx, word [Edi]
  MOV Eax, [Eax + 4 * Ecx]
  ADD Eax,Ebx
  MOV [Ebp + 4], Eax
  POP Ecx
  
  PUSH Dword [Ebp]
  PUSH Dword [Ebp + 4 + 4 + 8 + 6*4]
  CALL .String_ComparE
  TEST Eax, Eax
  JZ .__Skip
  MOV Eax, Dword [Ebp + 4]
  JMP .Found_Proc
  .__Skip:
  ADD Edi,2
  DEC Ecx
  JNZ .__GEtFuncList
  
  .Found_Proc:
  ADD Esp, 8
  POP  Ecx Ebp Ebx Edx Edi ESI
  RET 8
  
  .String_ComparE:
  PUSH  ESI Edi Ecx
  MOV   ESI, [Esp + 4  + 12]
  MOV   Edi, [Esp + 8  + 12]
  MOV   Ecx, 1
  .Looop:
  CMP BytE [ESI + Ecx],0
  JE ._BrEak
  INC Ecx
  JMP .Looop
  ._BrEak:
  MOV   Eax, 1
  CLD
  REP	CMPSB
  JE  ._IsEqual
  XOR   Eax,Eax
  ._IsEqual:
  POP   Ecx Edi ESI
  RET 8
  
  .FuncGEtProcAddrEss:
  DB "GetProcAddress",0
  .FuncLoadLibraryA:
  DB "LoadLibraryA",0
  .UsEr32:
  DB "User32.dll",0
  .MEssagEBoxA:
  DB "MessageBoxA",0
  .CEltic88:
  DB "ByCEtic ;p",0