SHARE
TWEET

Untitled

a guest Jun 21st, 2017 84 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ;---------------------------------------------
  2. ; Get DLL List without API
  3. ; Copyright (C) by ManHunter / PCL
  4. ; http://www.manhunter.ru
  5. ;---------------------------------------------
  6.  
  7. format PE console 4.0
  8. entry start
  9.  
  10. include 'win32wx.inc'
  11.  
  12. ;---------------------------------------------
  13.  
  14. struct UNICODE_STRING
  15.   Length        dw ?
  16.   MaximumLength dw ?
  17.   Buffer        dd ?
  18. ends
  19.  
  20. struct LIST_ENTRY
  21.   Flink         dd ?
  22.   Blink         dd ?
  23. ends
  24.  
  25. struct LDR_DATA_ENTRY
  26.   InMemoryOrderModuleList LIST_ENTRY
  27.   BaseAddress   dd ?
  28.   EntryPoint    dd ?
  29.   SizeOfImage   dd ?
  30.   FullDllName   UNICODE_STRING
  31.   BaseDllName   UNICODE_STRING
  32.   Flags         dd ?
  33.   LoadCount     dw ?
  34.   TlsIndex      dw ?
  35.   HashTableEntry LIST_ENTRY
  36.   TimeDateStamp dd ?
  37. ends
  38.  
  39. ;---------------------------------------------
  40.  
  41. section '.data' data readable writeable
  42.  
  43. mask    du 'Module: "%s" BaseAddress: %08Xh EntryPoint: %08Xh',13,10,0
  44. buff    du 1024 dup 0
  45. dummy   dd 0
  46.  
  47. ;---------------------------------------------
  48.  
  49. section '.code' code readable executable
  50.  
  51.   start:
  52.         ; EAX -> PEB
  53.         mov     eax,[fs:0x30]
  54.         ; EAX -> PEB_LDR_DATA
  55.         mov     eax,[eax+0x0C]
  56.         ; EBX -> InInitializationOrderModuleList
  57.         mov     ebx,[eax+0x1C]
  58.         invoke  GetStdHandle,STD_OUTPUT_HANDLE
  59.         mov     esi,eax
  60. @@:
  61.         ; Последняя запись?
  62.         cmp     [ebx+LDR_DATA_ENTRY.BaseAddress],0
  63.         je      @f
  64.  
  65.         cinvoke wsprintf,buff,mask,[ebx+LDR_DATA_ENTRY.FullDllName.Buffer],\
  66.                 [ebx+LDR_DATA_ENTRY.BaseAddress],\
  67.                 [ebx+LDR_DATA_ENTRY.EntryPoint]
  68.         invoke  WriteConsole,esi,buff,eax,dummy,0
  69.  
  70.         ; Указатель на следующую запись
  71.         mov     ebx,[ebx+LDR_DATA_ENTRY.InMemoryOrderModuleList.Flink]
  72.         jmp     @b
  73. @@:
  74.         invoke  ExitProcess,0
  75.  
  76. ;---------------------------------------------
  77.  
  78. section '.idata' import data readable writeable
  79.  
  80.   library kernel32,'kernel32.dll',\
  81.           user32,'user32.dll'
  82.  
  83.   include 'api\kernel32.inc'
  84.   include 'api\user32.inc'
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top