易语言生成劫持代码源码

系统结构:函数参数数量,生成劫持代码,查询函数参数数量,计算偏差,查看函数,字节集到十六进制,反汇编_BeaEngine,截取文本,十六进制转换十进制,取文件名,格式化文本_,到指针,RtlMoveMemory_IMAGE_DOS_HEADER,RtlMoveMemory_IMAGE_NT_HEADERS32,RtlMoveMemory_IMAGE_IMPORT_DESCRIPTOR,RtlMoveMemory_IMAGE_EXPORT_DIRECTORY,RtlMoveMemory_IMAGE_TLS_DIRECTORY32,RtlMoveMemory_IMAGE_DEBUG_DIRECTORY,RtlMoveMemory_IMAGE_SECTION_HEADER,LoadLibrary,FreeLibrary,GetProcAddress,Disasm,lstrcpyn,

======程序集1
           |  |
           |  |------ _启动子程序
           |  |
           |  |------ 函数参数数量
           |  |
           |  |------ 生成劫持代码
           |  |
           |  |------ 查询函数参数数量
           |  |
           |  |------ 计算偏差
           |  |
           |  |------ 查看函数
           |  |
           |  |
======程序集2
           |  |
           |  |------ 字节集到十六进制
           |  |
           |  |------ 反汇编_BeaEngine
           |  |
           |  |------ 截取文本
           |  |
           |  |------ 十六进制转换十进制
           |  |
           |  |------ 取文件名
           |  |
           |  |------ 格式化文本_
           |  |
           |  |------ _取子程序真实地址
           |  |
           |  |------ 到指针
           |  |
           |  |
======调用的Dll
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_DOS_HEADER
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_NT_HEADERS32
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_IMPORT_DESCRIPTOR
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_EXPORT_DIRECTORY
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_TLS_DIRECTORY32
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_DEBUG_DIRECTORY
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_SECTION_HEADER
           |  |
           |  |---[dll]------   LoadLibrary
           |  |
           |  |---[dll]------   FreeLibrary
           |  |
           |  |---[dll]------   GetProcAddress
           |  |
           |  |---[dll]------   Disasm
           |  |
           |  |---[dll]------   lstrcpyn

调用的DLL命令:

.DLL命令 RtlMoveMemory_IMAGE_DOS_HEADER, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_DOS_HEADER
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_NT_HEADERS32, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_NT_HEADERS32
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_IMPORT_DESCRIPTOR, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_IMPORT_DESCRIPTOR
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_EXPORT_DIRECTORY, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_EXPORT_DIRECTORY
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_TLS_DIRECTORY32, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_TLS_DIRECTORY32
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_DEBUG_DIRECTORY, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_DEBUG_DIRECTORY
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_SECTION_HEADER, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_SECTION_HEADER, 数组
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 LoadLibrary, 整数型, "kernel32.dll", "LoadLibraryA"
    .参数 lpLibFileName, 文本型

.DLL命令 FreeLibrary, 整数型, "kernel32.dll", "FreeLibrary"
    .参数 hLibModule, 整数型

.DLL命令 GetProcAddress, 整数型, "kernel32.dll", "GetProcAddress"
    .参数 hModule, 整数型
    .参数 lpProcName, 文本型

.DLL命令 Disasm, 整数型, "BeaEngine.dll", "_Disasm@4"
    .参数 Disasm, Disasm

.DLL命令 lstrcpyn, 子程序指针, "kernel32", "lstrcpynA"
    .参数 lpLong1, 整数型
    .参数 lpLong2, 整数型
    .参数 iMaxLength, 整数型