Einsprungadresse einer Procedur ermitteln?

[brechi]

So könnte es aussehen:

Delphi-Quellcode:

program codeex;

uses windows;

procedure MBox;
begin
  MessageBoxA(0,'test','test',0);
end;
procedure MBoxE; asm end;


procedure DoCode(pMem: Pointer; dwSize: DWord);
var
  i: DWord;
begin
  for i := 0 to dwSize-1 do
    PByte(DWord(pMem)+i)^ := PByte(DWord(pMem)+i)^ xor $23;
end;

procedure Trash;
asm
  DB $0
end;

procedure CallMBA;
var
  dwOldProtect: DWord;
  dwProcSize: DWord;
begin
  dwProcSize := DWord(@MBoxE)-DWord(@MBox);
  if VirtualProtect(@Mbox, dwProcSize, PAGE_EXECUTE_READWRITE, dwOldProtect) then
  begin
    DoCode(@MBox,dwProcSize);  // entschlüsseln
    MBox;
    DoCode(@MBox,dwProcSize);  // verschlüsseln
    VirtualProtect(@MBox, dwProcSize, dwOldProtect, dwOldProtect);
  end;
end;

procedure CreateExe;
var
  f: File of Byte;
  FileMem: array of Byte;
begin
  // jetzt ohne viele checks, ohne CreateFileA usw bla bla
  // SizeOf Headers = $400
  // Codestart @ Section1 @ Virutal $1000

  CopyFile(PChar(Paramstr(0)), PChar(Paramstr(0)+'_rdy.exe'), False);

  AssignFile(f,Paramstr(0)+'_rdy.exe');
  Reset(f);
  SetLength(FileMem, FileSize(f));
  BlockRead(f, FileMem[0], Length(FileMem));
  CloseFile(f);

  DoCode( @FileMem[DWord(@MBox) - GetModuleHandle(nil) + $400 - $1000 ], DWord(@MboxE) - DWord(@MBox));

  FileMem[DWord(@Trash) - GetModuleHandle(nil) + $400 - $1000 ] := 1;

  AssignFile(f,Paramstr(0)+'_rdy.exe');
  ReWrite(f);
  BlockWrite(f, FileMem[0], Length(FileMem));
  CloseFile(f);
end;

begin
  if (PByte(@Trash)^ = 0) then
    CreateExe else
    CallMBA;
end.