Adresse von GetProcAddress OHNE GetProcAddress ermitteln ;)

[sirius]

Bzgl GetProcAddress hatte Hagen hier folgendes publiziert:

Delphi-Quellcode:

function GetProcAddr(Module: hModule; Name: PChar): Pointer; 
asm 
        XOR   ECX,ECX                 // except frame 
        PUSH  OFFSET @@6 
        PUSH  DWord Ptr FS:[ECX] 
        MOV   FS:[ECX],ESP 
        PUSH  EBP 
        PUSH  EBX 
        MOV   EBP,EDX 
        AND   EAX,not 3 
        PUSH  EDI 
        MOV   EDX,[EAX + 03Ch] 
        PUSH  ESI 
        TEST  EBP,EBP 
        JZ    @@5 
        CMP   Word Ptr [EAX + EDX],'EP' 
        MOV   EDX,[EAX + EDX + 078h] 
        JNZ   @@5 
        ADD   EDX,EAX 
        TEST  EBP,0FFFF0000h 
        MOV   EBX,EAX 
        JZ    @@3                         // import by ordinal ?? 
        MOV   EAX,[EDX + 018h] 
        MOV   ECX,[EDX + 020h] 
        NOT   EAX 
@@1:    INC   EAX 
        MOV   ESI,EBP 
        JZ    @@4 
        MOV   EDI,[EBX + ECX] 
        ADD   ECX,4 
        ADD   EDI,EBX 
@@2:    CMPSB 
        JNE   @@1 
        CMP   Byte Ptr [ESI - 1],0 
        JNE   @@2 
        ADD   EAX,[EDX + 018h] 
        MOV   ECX,[EDX + 024h] 
        ADD   ECX,EBX 
        MOVZX EBP,Word Ptr [ECX + EAX * 2] 
        INC   EBP 
@@3:    MOV   ECX,[EDX + 01Ch] 
        DEC   EBP 
        ADD   ECX,EBX 
        MOV   EAX,[ECX + EBP * 4] 
        ADD   EAX,EBX 
@@4:    POP   ESI 
        POP   EDI 
        POP   EBX 
        POP   EBP 
        POP   DWord Ptr FS:[0] 
        POP   ECX 
        RET 
@@5:    XOR   EAX,EAX 
        JMP   @@4 
@@6:    MOV   EAX,[ESP + 00Ch]                 // except handler 
        PUSH  OFFSET @@5 
        POP   DWord Ptr [EAX + 0B8h] 
        SUB   EAX,EAX 
end;