dedndave
|
the Relat routine fixes INVOKE CALLs to always be relative it has been adapted to work with the "Vortex" method, as well
INCLUDE \masm32\include\masm32rt.inc
EXTERNDEF _imp__GetCurrentProcess@0:PTR pr0
.CODE
;-----------------------------------------------------------------------------
_main PROC
;modify the addresses
mov esi,offset LabelA call Relat
mov esi,offset LabelB call Relat
;test the functions after modification
call Test1
exit
_main ENDP
;-----------------------------------------------------------------------------
Test1 PROC
INVOKE GetCurrentProcess LabelA label dword
print uhex$(eax),13,10
INVOKE _imp__GetCurrentProcess@0 LabelB label dword
print uhex$(eax),13,10 ret
Test1 ENDP
;-----------------------------------------------------------------------------
Relat PROC
;Adjust the CALL address of an INVOKE to eliminate the IAT JMP
;Call With: ESI = address of code just after the INVOKE
; Returns: modifies the address of the INVOKE
sub esi,6 push esi sub esp,4 INVOKE VirtualProtect, esi, 6, PAGE_EXECUTE_READWRITE, esp pop edx pop esi or eax,eax jz Relat3
cld lodsw cmp ah,0E8h jz Relat0
cmp ax,15FFh lodsd jnz Relat2
mov word ptr [esi-6],0E890h jmp short Relat1
Relat0: lodsd add eax,esi push esi xchg eax,esi lodsw cmp ax,25FFh lodsd pop esi jnz Relat2
Relat1: mov eax,[eax] sub eax,esi mov [esi-4],eax
Relat2: sub esi,6 sub esp,4 INVOKE VirtualProtect, esi, 6, edx, esp add esp,4
Relat3: ret
Relat ENDP
;-----------------------------------------------------------------------------
END _main
|