SHARE
TWEET

Untitled

a guest May 2nd, 2017 179 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. {$apptype console}
  2. program DrvConv; uses windows, imagehlp;//, sysutils;
  3. var
  4.    base:integer;
  5.  
  6. type
  7. PImageImportDescriptor = ^TImageImportDescriptor;
  8. TImageImportDescriptor = packed record
  9.   OriginalFirstThunk: dword;
  10.   TimeDateStamp: dword;
  11.   ForwarderChain: dword;
  12.   Name: dword;
  13.   FirstThunk: dword;
  14. end;
  15.  
  16. var
  17.     img: PLoadedImage;
  18.     Section: PImageSectionHeader;
  19.     str: string; i: integer;
  20.  
  21.     ImpTable: PImageImportDescriptor;
  22.     ImpName: pinteger;
  23.  
  24. begin
  25.     str:= ParamStr(1); if str = '' then exit;
  26.     img:= ImageLoad(pchar(str), nil);
  27.     if img = nil then exit;
  28.  
  29.     MapAndLoad(pchar(str), nil, img, true, false);
  30.  
  31. //перебор секций
  32. for i := 0 to img.NumberOfSections-1 do
  33. begin
  34.     Section:= pointer(integer(img.Sections)+SizeOf(TImageSectionHeader)*i);
  35.     str:= pchar(@Section.Name);
  36.     if str = '.idata' then break;
  37. end;
  38. //скорректировать смещение базы
  39.     base :=integer(img.MappedAddress)-  
  40.                     (Section.VirtualAddress - Section.PointerToRawData);
  41. //установить указатель на таблицу
  42.     ImpTable := pointer(integer(img.MappedAddress)+Section.PointerToRawData);
  43.  
  44. //перебор таблицы
  45.     while ImpTable.Name <> 0 do
  46.     begin
  47.       str := pchar(ImpTable.Name+ Base);
  48.  
  49.        ImpName:= pointer(ImpTable.FirstThunk+base);
  50.    //перебор имен
  51.         while ImpName^ <> 0 do
  52.          begin
  53.           if str = 'kernel32.dll' then
  54.               writeln (str,' ', pchar(ImpName^+2+base));
  55.  
  56.          Inc(ImpName);
  57.         end;
  58.  
  59.       Inc(ImpTable);
  60.     end;
  61.  
  62.     writeln ('done');
  63. end.
  64.  
  65.  
  66.  
  67.  
  68. {$apptype console}
  69. program xtest;uses  sysutils;
  70.  
  71. const cr = #$d#$a; ap = #39;
  72. var
  73.     i, ii : integer;
  74.  
  75.     f:text;
  76.     wordlist : array [0..100000] of string;
  77.      
  78.  
  79. function load_str (str:string):integer;
  80. var i:integer;
  81. begin
  82.    Assign (f, str); Reset (f);
  83.    for i:= 0 to 100000 do if EOF(f) then break else readln(f,wordlist[i]);
  84.    Close(f);
  85. //   rndmax := i;
  86.  result := i;
  87. end;
  88.  
  89.  
  90. begin
  91.  
  92.  ii:= load_str('func.txt');
  93.  
  94.  
  95. writeln (
  96. '{$warnings off}{$hints off}'+cr+
  97. 'library fakedll;'+cr+
  98. 'const LibName = '+ap+ 'kernel32.dll'+ap+ ';' +cr+
  99. cr+
  100. cr+
  101. 'type TCallFunc = record'+cr+
  102. '    i: integer;'+cr+
  103. '    n: pchar;'+cr+
  104. 'end; '+cr+
  105. 'PCallFunc = ^TCallFunc;'+cr+
  106. 'cf = TCallFunc;'+cr+
  107. cr+
  108. 'procedure logcf (f:PCallFunc);'+cr+
  109. 'begin'+cr+
  110. 'if f.i = 0 then writeln (f.n);'+cr+
  111. '  inc(  f.i); '+cr+
  112. 'end;'+cr+cr
  113. );
  114.  
  115.  
  116.  for i := 0 to ii-1 do  begin
  117.  
  118.             writeln ('procedure '+ 'proc',i, ';external LibName name '+ap+wordlist[i] +ap,';');
  119.  
  120.  end;
  121.  
  122.  
  123. writeln;
  124. writeln;
  125. writeln;
  126.  
  127.  for i := 0 to ii-1 do  begin writeln (
  128. 'procedure _proc',i,'; const f:cf=(i:0;n:' +cr +
  129. '          '+ap+wordlist[i] +ap + '); asm lea eax,f call logcf'+cr+
  130. '      jmp  proc',i,cr+  
  131. 'end;'
  132.  
  133. );
  134. end;
  135.  
  136.  
  137. writeln;
  138. writeln;
  139. writeln (
  140. 'exports');
  141.  
  142.  for i := 0 to ii-1 do writeln (
  143. '_proc',i,' name '+ap+wordlist[i]+ap+','
  144.  
  145.  
  146. );
  147.  
  148. writeln ('end.');
  149.  
  150. end.
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top