VB.NET 动态 API 调用 x64

Posted 2023-02-16

【中文标题】VB.NET 动态 API 调用 x64

【英文标题】：VB.NET Dynamic API calls x64

【发布时间】：2013-04-30 12:01:19

【问题描述】：

首先，我是新来的，所以如果我错过了什么，请不要吃亏。 这是我在这个论坛上的第一个问题，希望能得到正确的答案。

问题描述：

我正在尝试使用 CallWindowProc 来动态调用 API，但是大家都知道这很复杂，因为 CallWindowProc 的参数数量有限。所以需要使用 asm 代码。借助互联网上的各种资源我能够获得有效的代码，但仅适用于 x86 架构（在 x64 机器上为 x86 编译）。问题是 x64 架构严格使用 __fastcall 调用约定，而 x86 没有。

问题：

我需要一些建议，为什么下面的代码不起作用。我还尝试了一些使用 Asm 示例中的操作码的组合，但没有成功。

汇编代码 MASM 64

; Sample x64 Assembly Program
; Chris Lomont 2009 www.lomont.org
extrn ExitProcess: PROC   ; external functions in system libraries
extrn MessageBoxA: PROC
.data
caption db 'Test', 0
message db 'Test msg!', 0
.code
Start PROC
  sub    rsp,28h      ; shadow space, aligns stack
  mov    rcx, 0       ; hWnd = HWND_DESKTOP
  lea    rdx, message ; LPCSTR lpText
  lea    r8,  caption ; LPCSTR lpCaption
  mov    r9d, 0       ; uType = MB_OK
  call   MessageBoxA  ; call MessageBox API function
  mov    ecx, eax     ; uExitCode = MessageBox(...)
  call ExitProcess
Start ENDP
End

反汇编窗口中的代码。

  sub    rsp,28h      ; shadow space, aligns stack
000000013F4C1010 48 83 EC 28          sub         rsp,28h  
  mov    rcx, 0       ; hWnd = HWND_DESKTOP
000000013F4C1014 48 C7 C1 00 00 00 00 mov         rcx,0  
  lea    rdx, message ; LPCSTR lpText
000000013F4C101B 48 8D 15 E3 2F 00 00 lea         rdx,[message (13F4C4005h)]  
  lea    r8,  caption ; LPCSTR lpCaption
000000013F4C1022 4C 8D 05 D7 2F 00 00 lea         r8,[caption (13F4C4000h)]  
  mov    r9d, 0       ; uType = MB_OK
000000013F4C1029 41 B9 00 00 00 00    mov         r9d,0  
  call   MessageBoxA  ; call MessageBox API function
000000013F4C102F E8 18 00 00 00       call        MessageBoxA (13F4C104Ch)  
  mov    ecx, eax     ; uExitCode = MessageBox(...)
000000013F4C1034 8B C8                mov         ecx,eax  
  call ExitProcess
000000013F4C1036 E8 0B 00 00 00       call        ExitProcess (13F4C1046h)  

Vb.net 代码

    Imports System.Runtime.InteropServices
Module CallApiByName64

#Region "Declaration"

#Region "Functions"

    Private Declare Unicode Function CallWindowProc Lib "user32.dll" Alias "CallWindowProcW" (ByVal lpPrevWndFunc As IntPtr, ByVal hWnd As IntPtr, ByVal Msg As UInteger, ByVal wParam As IntPtr, ByVal lParam As IntPtr) As IntPtr

    Private Declare Unicode Function GetModuleHandle Lib "kernel32.dll" Alias "GetModuleHandleW" (ByVal moduleName As String) As IntPtr

    Private Declare Unicode Function LoadLibraryEx Lib "kernel32.dll" Alias "LoadLibraryExW" (ByVal lpFileName As String, ByVal hFile As IntPtr, ByVal dwFlags As Integer) As IntPtr

    Private Declare Function FreeLibrary Lib "kernel32.dll" Alias "FreeLibrary" (ByVal hModule As IntPtr) As Integer

    Private Declare Function VirtualAlloc Lib "kernel32.dll" Alias "VirtualAlloc" (ByVal lpAddress As IntPtr, ByVal dwSize As Integer, ByVal flAllocationType As Integer, ByVal flProtect As Integer) As IntPtr

    Private Declare Function VirtualFree Lib "kernel32.dll" Alias "VirtualFree" (ByVal lpAddress As IntPtr, ByVal dwSize As Integer, ByVal dwFreeType As Integer) As Integer

    Private Declare Function GetProcAddress Lib "kernel32.dll" Alias "GetProcAddress" (ByVal hModule As IntPtr, ByVal methodName As String) As IntPtr

    Private Declare Sub RtlMoveMemory Lib "kernel32.dll" Alias "RtlMoveMemory" (ByVal Destination As IntPtr, ByVal Source() As Byte, ByVal Length As Integer)

#End Region

#Region "Constants"

    Private Const MEM_COMMIT As Integer = &H1000
    Private Const MEM_RESERVE As Integer = &H2000
    Private Const MEM_EXECUTE_READWRITE As Integer = &H40

#End Region

#End Region

    Dim FunctionAdress As IntPtr
    Dim MemAdressOffset As IntPtr

    Function Call_64(ByVal sLib As String, ByVal sMod As String, ByVal ParamArray Params() As IntPtr) As IntPtr
        Dim MemAdress As IntPtr

        '## CODE
        FunctionAdress = GetProcAddress(LoadLibraryEx(sLib, IntPtr.Zero, 0), sMod)
        If FunctionAdress = 0 Then Exit Function

        MemAdress = VirtualAlloc(IntPtr.Zero, 256, MEM_COMMIT Or MEM_RESERVE, MEM_EXECUTE_READWRITE)
        MemAdressOffset = MemAdress

        '## PREPARE STACK

        AddBytes(&H48, &H83, &HEC, &H28)

        '## FUNCTION PARAMETERS

        AddBytes(&H48, &HC7) 'mov opcode
        AddBytes(BitConverter.GetBytes(CInt(Params(0)))) 'Parameter 1 (stored in 4 bytes)

        AddBytes(&H48, &H8D) 'lea opcode
        AddBytes(BitConverter.GetBytes(CInt(Params(1)))) 'Parameter 2 (stored in 4 bytes) (address of string)

        AddBytes(&H4C, &H8D) 'lea opcode
        AddBytes(BitConverter.GetBytes(CInt(Params(2)))) 'Parameter 3 (stored in 4 bytes) (address of string)

        AddBytes(&H41, &HB9) 'mov opcode B8+r
        AddBytes(BitConverter.GetBytes(CInt(Params(3)))) 'Parameter 4 (stored in 4 bytes)

        '## CALL FUNCTION

        AddBytes(&HE8) 'call opcode
        AddBytes(BitConverter.GetBytes(CInt(FunctionAdress) - CInt(MemAdressOffset) - 16))

        AddBytes(&H8B, &HC8) ' mov         ecx,eax  

        '% IGNORE %
        Dim DumpBytes(CInt(MemAdressOffset) - CInt(MemAdress)) As Byte
        Marshal.Copy(MemAdress, DumpBytes, 0, CInt(MemAdressOffset) - CInt(MemAdress))
        '% END %

        '## EXECUTE CODE
        Call_64 = CallWindowProc(MemAdressOffset, 0, 0, 0, 0)

    End Function

    Private Sub AddBytes(ByVal Data() As Byte)
        RtlMoveMemory(MemAdressOffset, Data, Data.Length)
        MemAdressOffset = CInt(MemAdressOffset) + Data.Length
    End Sub

End Module

调用函数

Call_64("user32", "MessageBoxW", 0, Marshal.StringToHGlobalUni("Test"), Marshal.StringToHGlobalUni("Test msg!"), 0)

【参考方案1】：

当您在 VB 函数中生成机器代码序列时，您似乎忘记了 REX prefix bytes。这些是0x4n-bytes，出现在您在问题中显示的反汇编中的一些说明的开头。

【讨论】：

感谢您的建议，但似乎不是这样。某些内容丢失或不在正确的位置。Vb 代码已更新。