From 9d18d77bd52bccde85046b308000ff090842b0d8 Mon Sep 17 00:00:00 2001 From: b1tg Date: Fri, 5 Feb 2021 00:37:30 +0800 Subject: [PATCH] full dump text, jump to entry ok; no need inline string anymore --- Cargo.lock | 7 +++++++ Cargo.toml | 3 +++ src/main.rs | 35 +++++++++++++++++++++++++---------- 3 files changed, 35 insertions(+), 10 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7a0a4f0..7803c6b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1,5 +1,11 @@ # This file is automatically @generated by Cargo. # It is not intended for manual editing. +[[package]] +name = "arrayvec" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b" + [[package]] name = "autocfg" version = "1.0.1" @@ -95,6 +101,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" name = "wo" version = "0.1.0" dependencies = [ + "arrayvec", "num", "num-traits", "winapi", diff --git a/Cargo.toml b/Cargo.toml index d5bc5cb..0b49b78 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -54,3 +54,6 @@ default-features = false [dependencies.num-traits] version = "0.2" default-features = false +[dependencies.arrayvec] +version = "0.5.2" +default-features = false \ No newline at end of file diff --git a/src/main.rs b/src/main.rs index 821edb9..e68ccf1 100644 --- a/src/main.rs +++ b/src/main.rs @@ -6,8 +6,10 @@ #![feature(asm)] #![feature(link_args)] use core::{ptr::null_mut, slice, usize}; + mod binds; mod utils; +use arrayvec::ArrayString; use binds::*; use utils::*; #[panic_handler] @@ -15,13 +17,18 @@ fn panic(_: &core::panic::PanicInfo) -> ! { loop {} } // use winapi::um::libloaderapi::LoadLibraryA; - // pub type LLA = extern "stdcall" LoadLibraryA; #[no_mangle] // #[link_section = ".text.prologue"] pub extern "C" fn main() -> ! { // "KERNEL32.DLL" + unsafe { + asm!("mov rcx, 0", "mov rdx, 0",); + } let KERNEL32_STR: [u16; 13] = [75, 69, 82, 78, 69, 76, 51, 50, 46, 68, 76, 76, 0]; + // let KERNEL32_STR = "KERNEL32.DLL"; + // username: Username::try_from_str("user")?, + // let KERNEL32_STR = KK20::try_from_str("KERNEL32.DLL"); let kk = get_module_by_name(KERNEL32_STR.as_ptr()); // println!("kernel32: {:p}", kk); // let kk = get_module_by_name(12); @@ -47,10 +54,13 @@ pub extern "C" fn main() -> ! { // let a = "user32.dll"; // let c_str = CString::new("user32.dll").unwrap(); // let c_world: *const c_char = c_str.as_ptr() as *const c_char; - // let c_world = b"user32.dll\0".as_ptr() as *const i8; - let c_world: [i8; 11] = [117, 115, 101, 114, 51, 50, 46, 100, 108, 108, 0]; - // unsafe{asm!("push rax");} - let u32_dll = LoadLibraryA(c_world.as_ptr()); + let c_world = b"user32.dll\0".as_ptr() as *const i8; + // let c_world: [i8; 11] = [117, 115, 101, 114, 51, 50, 46, 100, 108, 108, 0]; + + unsafe { + asm!("push rax"); + } + let u32_dll = LoadLibraryA(c_world); // println!("u32_dll: {:p}", u32_dll); // pub unsafe extern "system" fn GetProcAddress( @@ -63,17 +73,22 @@ pub extern "C" fn main() -> ! { // let c_str = CString::new("MessageBoxA").unwrap(); // let c_world: *const c_char = c_str.as_ptr() as *const c_char; - // let c_world = b"MessageBoxA\0".as_ptr() as *const i8; - let c_world: [i8; 12] = [77, 101, 115, 115, 97, 103, 101, 66, 111, 120, 65, 0]; - let c_world1 = b"xxx"; - let message_box_ptr = GetProcAddress(u32_dll, c_world1.as_ptr() as _); + let c_world = b"MessageBoxA\0".as_ptr() as *const i8; + // let c_world: [i8; 12] = [77, 101, 115, 115, 97, 103, 101, 66, 111, 120, 65, 0]; + // let c_world1 = b"xxx"; + let c_world1 = "title\0"; + // let c_world1 = aa + "123"; + // c_world1.to_uppercase(); + // let mut u = ArrayString::from_byte_string(b"hello world").unwrap(); + // u.push_str("abc"); + let message_box_ptr = GetProcAddress(u32_dll, c_world); // println!("message_box_ptr: {:p}", message_box_ptr); let MessageBoxA: extern "system" fn(h: PVOID, text: LPCSTR, cation: LPCSTR, t: u32) -> u32 = unsafe { core::mem::transmute(message_box_ptr) }; - MessageBoxA(null_mut(), c_world.as_ptr(), c_world.as_ptr(), 0x30); + MessageBoxA(null_mut(), c_world, c_world1.as_ptr() as _, 0x30); // https://stackoverflow.com/questions/46134477/how-can-i-call-a-raw-address-from-rust let OutputDebugStringA: extern "C" fn(*const i8) = unsafe { core::mem::transmute(dbg_addr) }; // let c_str = CString::new("helloxx").unwrap();