无LoadLibrary获取指定模块基址

实际上，这块可以写成汇编，然后做远程注入用

方法

1、通过fs:[30h]获取当前进程的_PEB结构

2、通过_PEB的Ldr成员获取_PEB_LDR_DATA结构

3、通过_PEB_LDR_DATA的InMemoryOrderModuleList成员获取_LIST_ENTRY结构

4、通过_LIST_ENTRY的Flink成员获取_LDR_DATA_TABLE_ENTRY结构，注意：这里的Flink指向的是_LDR_DATA_TABLE_ENTRY结构中的InMemoryOrderLinks成员，因此需要计算真正的_LDR_DATA_TABLE_ENTRY起始地址，我们可以用CONTAINING_RECORD来计算。

5、输出_LDR_DATA_TABLE_ENTRY的BaseDllName或FullDllName成员信息。

 #include <windows.h>  

 #define CONTAINING_RECORD(address, type, field) ((type *)( (PCHAR)(address) - (ULONG_PTR)(&((type *)0)->field)))  

 typedef struct _UNICODE_STRING {
     USHORT  Length;
     USHORT  MaximumLength;
     PWSTR  Buffer;
 } UNICODE_STRING, *PUNICODE_STRING;  

 typedef struct _PEB_LDR_DATA
 {
     DWORD Length;
     UCHAR Initialized;
     PVOID SsHandle;
     LIST_ENTRY InLoadOrderModuleList;
     LIST_ENTRY InMemoryOrderModuleList;
     LIST_ENTRY InInitializationOrderModuleList;
     PVOID EntryInProgress;
 }PEB_LDR_DATA,*PPEB_LDR_DATA;  

 typedef struct _LDR_DATA_TABLE_ENTRY
 {
     LIST_ENTRY InLoadOrderLinks;
     LIST_ENTRY InMemoryOrderLinks;
     LIST_ENTRY InInitializationOrderLinks;
     PVOID DllBase;
     PVOID EntryPoint;
     DWORD SizeOfImage;
     UNICODE_STRING FullDllName;
     UNICODE_STRING BaseDllName;
     DWORD Flags;
     WORD LoadCount;
     WORD TlsIndex;
     LIST_ENTRY HashLinks;
     PVOID SectionPointer;
     DWORD CheckSum;
     DWORD TimeDateStamp;
     PVOID LoadedImports;
     PVOID EntryPointActivationContext;
     PVOID PatchInformation;
 }LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENTRY;  

 typedef struct _PEB
 {
     UCHAR InheritedAddressSpace;
     UCHAR ReadImageFileExecOptions;
     UCHAR BeingDebugged;
     UCHAR SpareBool;
     PVOID Mutant;
     PVOID ImageBaseAddress;
     PPEB_LDR_DATA Ldr;
 }PEB,*PPEB;  

 int main(void)
 {
     PLDR_DATA_TABLE_ENTRY pLdrDataEntry = NULL;
     PLIST_ENTRY pListEntryStart = NULL,pListEntryEnd = NULL;
     PPEB_LDR_DATA pPebLdrData = NULL;
     PPEB pPeb = NULL;  

     __asm
     {
         //1、通过fs:[30h]获取当前进程的_PEB结构
         mov eax,dword ptr fs:[30h];
         mov pPeb,eax
     }  

     //2、通过_PEB的Ldr成员获取_PEB_LDR_DATA结构
     pPebLdrData = pPeb->Ldr;  

     //3、通过_PEB_LDR_DATA的InMemoryOrderModuleList成员获取_LIST_ENTRY结构
     pListEntryStart = pListEntryEnd = pPebLdrData->InMemoryOrderModuleList.Flink;  

     //查找所有已载入到内存中的模块
     do
     {
         //4、通过_LIST_ENTRY的Flink成员获取_LDR_DATA_TABLE_ENTRY结构
         pLdrDataEntry = (PLDR_DATA_TABLE_ENTRY)CONTAINING_RECORD(pListEntryStart,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks);  

         //5、输出_LDR_DATA_TABLE_ENTRY的BaseDllName或FullDllName成员信息
         printf("%S\n",pLdrDataEntry->BaseDllName.Buffer);  

         pListEntryStart = pListEntryStart->Flink;  

     }while(pListEntryStart != pListEntryEnd);  

     return ;
 }  

注入相关的代码在这里

 #include <Windows.h>

 #include <stdio.h>

 typedef struct _UNICODE_STRING {
     USHORT Length;
     USHORT MaximumLength;
     PWCH   Buffer;
 } UNICODE_STRING;

 typedef struct _LDR_DATA_TABLE_ENTRY
 {
     LIST_ENTRY InLoadOrderLinks;
     LIST_ENTRY InMemoryOrderLinks;
     LIST_ENTRY InInitializationOrderLinks;
     PVOID DllBase;
     PVOID EntryPoint;
     ULONG SizeOfImage;
     UNICODE_STRING FullDllName;
     UNICODE_STRING BaseDllName;
     ULONG Flags;
     WORD LoadCount;
     WORD TlsIndex;
     union
     {
         LIST_ENTRY HashLinks;
         struct
         {
             PVOID SectionPointer;
             ULONG CheckSum;
         };
     };
     union
     {
         ULONG TimeDateStamp;
         PVOID LoadedImports;
     };
     void * EntryPointActivationContext;
     PVOID PatchInformation;
     LIST_ENTRY ForwarderLinks;
     LIST_ENTRY ServiceTagLinks;
     LIST_ENTRY StaticLinks;
 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

 //    把一个字符串做成一个 hash 值
 __declspec(naked) DWORD __stdcall HashString( WCHAR *name )
 {
     __asm
     {
         push esi;
         push edi;
         mov esi , [esp + 0x0C];
         xor edi , edi;
         cld;
 __iter:
         xor eax , eax;
         lodsw ;
         cmp al , ah;
         je __done;
         ror edi , 0x0D;
         add edi ,eax ;
         jmp __iter;
 __done:
         mov eax , edi;
         pop edi;
         pop esi;
         retn ;
     }
 }

 //    遍历 LDR 表，找到要找的 DLL 基址
 PVOID __stdcall GetDllBase( LIST_ENTRY *head  , DWORD hash )
 {
     PLDR_DATA_TABLE_ENTRY t;
     LIST_ENTRY *p = head->Flink;
     for ( ; p != head ; p = p->Flink )
     {
         t = (PLDR_DATA_TABLE_ENTRY)((char*)p - 0x10);
         if ( hash == HashString( t->BaseDllName.Buffer ) )
         {
             return t->DllBase;
         }
     }
     return ;
 }

 //    从 fs 段找到 TEB ，从 TEB 找到 PEB ，从 PEB 找到 LDR 表
 //    返回值为 LDR 表链的头节点
 __declspec(naked) LIST_ENTRY * __stdcall FindLDRTable()
 {
     __asm
     {
         push esi;
         xor eax , eax;
         mov eax , fs:[0x30];
         test eax , eax;
         js __k9x;
         mov eax , [eax + 0x0C];
         lea esi , [eax + 0x1C];
         mov eax , esi;
         jmp near __finish;
 __k9x:
         xor eax , eax;
 __finish:
         pop esi;
         ret;
     }
 }

 //    获取一个已经加载了的模块地址
 //    name 只是名字，不可以是路径带名字
 PVOID LoadLibraryIn( WCHAR *name )
 {
     return GetDllBase( FindLDRTable() , HashString( name ) );
 }

 int main()
 {
     //printf("0x%p\n" , HashString(L"kernel32.dll"));
     //printf("0x%p\n" , HashString(L"User32.dll"));

     printf( "0x%p \n" , LoadLibraryIn( L"kernel32.dll" ) );
     printf( "0x%p \n" , LoadLibraryA( "kernel32.dll" ) );
     printf( "0x%p \n" , LoadLibraryA( "ntdll.dll" ) );

     return ;
 }

用汇编来做3个关键函数，然后shellcode获取模块基址，计算PE，得到导出表，根据名称表找到对应的名字，地址表直接就能找到对应的函数地址了，

比较类似，自重定位，然后LoadLibrary GetProcAddress 了