Guest User

Untitled

a guest
Jun 21st, 2017
93
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ;---------------------------------------------
  2. ; Get DLL List without API
  3. ; Copyright (C) by ManHunter / PCL
  4. ; http://www.manhunter.ru
  5. ;---------------------------------------------
  6.  
  7. format PE console 4.0
  8. entry start
  9.  
  10. include 'win32wx.inc'
  11.  
  12. ;---------------------------------------------
  13.  
  14. struct UNICODE_STRING
  15.   Length        dw ?
  16.   MaximumLength dw ?
  17.   Buffer        dd ?
  18. ends
  19.  
  20. struct LIST_ENTRY
  21.   Flink         dd ?
  22.   Blink         dd ?
  23. ends
  24.  
  25. struct LDR_DATA_ENTRY
  26.   InMemoryOrderModuleList LIST_ENTRY
  27.   BaseAddress   dd ?
  28.   EntryPoint    dd ?
  29.   SizeOfImage   dd ?
  30.   FullDllName   UNICODE_STRING
  31.   BaseDllName   UNICODE_STRING
  32.   Flags         dd ?
  33.   LoadCount     dw ?
  34.   TlsIndex      dw ?
  35.   HashTableEntry LIST_ENTRY
  36.   TimeDateStamp dd ?
  37. ends
  38.  
  39. ;---------------------------------------------
  40.  
  41. section '.data' data readable writeable
  42.  
  43. mask    du 'Module: "%s" BaseAddress: %08Xh EntryPoint: %08Xh',13,10,0
  44. buff    du 1024 dup 0
  45. dummy   dd 0
  46.  
  47. ;---------------------------------------------
  48.  
  49. section '.code' code readable executable
  50.  
  51.   start:
  52.         ; EAX -> PEB
  53.         mov     eax,[fs:0x30]
  54.         ; EAX -> PEB_LDR_DATA
  55.         mov     eax,[eax+0x0C]
  56.         ; EBX -> InInitializationOrderModuleList
  57.         mov     ebx,[eax+0x1C]
  58.         invoke  GetStdHandle,STD_OUTPUT_HANDLE
  59.         mov     esi,eax
  60. @@:
  61.         ; Последняя запись?
  62.         cmp     [ebx+LDR_DATA_ENTRY.BaseAddress],0
  63.         je      @f
  64.  
  65.         cinvoke wsprintf,buff,mask,[ebx+LDR_DATA_ENTRY.FullDllName.Buffer],\
  66.                 [ebx+LDR_DATA_ENTRY.BaseAddress],\
  67.                 [ebx+LDR_DATA_ENTRY.EntryPoint]
  68.         invoke  WriteConsole,esi,buff,eax,dummy,0
  69.  
  70.         ; Указатель на следующую запись
  71.         mov     ebx,[ebx+LDR_DATA_ENTRY.InMemoryOrderModuleList.Flink]
  72.         jmp     @b
  73. @@:
  74.         invoke  ExitProcess,0
  75.  
  76. ;---------------------------------------------
  77.  
  78. section '.idata' import data readable writeable
  79.  
  80.   library kernel32,'kernel32.dll',\
  81.           user32,'user32.dll'
  82.  
  83.   include 'api\kernel32.inc'
  84.   include 'api\user32.inc'
RAW Paste Data