/* * Test to make sure things are working alright. * * LoadLibraryA -> ec0e4e8e */ #include //#define USE_KERNEL32_METHOD_PEB //#define USE_KERNEL32_METHOD_SEH //#define USE_KERNEL32_METHOD_TOPSTACK #pragma warning(disable: 4068) int __declspec(naked) test_begin() { __asm { entry: jmp startup #include "generic.c" startup: // Resolve kernel32 call find_kernel32 mov edx, eax // Resolve LoadLibraryA push 0xec0e4e8e push edx call find_function add esp, 0x8 } } void __declspec(naked) test_end() { __asm ret } int main(int argc, char **argv) { unsigned char *start = (unsigned char *)((unsigned char *)test_begin); unsigned char *stop = (unsigned char *)((unsigned char *)test_end); unsigned long length; int found; // Calculate the actual address in memory of the begin/end function based off their relative jmp points. start += *(unsigned long *)((unsigned char *)test_begin + 1) + 5; stop += *(unsigned long *)((unsigned char *)test_end + 1) + 5; length = stop - start; __try { found = test_begin(); } __finally { } printf("LoadLibraryA VMA=%.8x length=%lu\n", found, length); return 1; }