Este es el código:
Código
format PE GUI 4.0 DLL entry DllEntryPoint include 'd:\Fasm\INCLUDE\win32ax.inc' section '.code' code readable executable proc DllEntryPoint hinstDLL,fdwReason,lpvReserved cmp [fdwReason],1 je mensage jne salir mensage: invoke LoadLibrary,"Kernel32.dll" invoke GetProcAddress,eax,"FindNextFileA" mov ebx,eax ; Dirección de la api en ebx mov [PunteroOri],ebx lea edx,dword[ebp-4] invoke VirtualProtectEx,-1,ebx,7,PAGE_EXECUTE_READWRITE,edx mov ecx,ApiOriginal lea edx,dword[ebp-4] invoke VirtualProtectEx,-1,ecx,7,PAGE_EXECUTE_READWRITE,edx mov al,byte[ebx] ; movemos el primer byte mov byte[ecx],al mov byte[ebx],0x68 ; push inc ebx inc ecx mov eax,dword[ebx] ; movemos 4 bytes mov dword[ecx],eax mov dword[ebx],Funcion ; dreccion funcion add ebx,4 add ecx,4 mov al,byte[ebx] ; ultimo byte mov byte[ecx],al mov byte[ebx],0xC3 ;ret inc ebx salir: ret endp Funcion: ApiOriginal: nop nop nop nop nop nop mov eax,[PunteroOri] add eax,6 jmp eax ret ; VOID ShowErrorMessage(HWND hWnd,DWORD dwError); proc ShowErrorMessage hWnd,dwError local lpBuffer:DWORD lea eax,[lpBuffer] invoke FormatMessage,FORMAT_MESSAGE_ALLOCATE_BUFFER+FORMAT_MESSAGE_FROM_SYSTEM,0,[dwError],LANG_NEUTRAL,eax,0,0 invoke MessageBoxA,[hWnd],[lpBuffer],NULL,MB_ICONERROR+MB_OK invoke LocalFree,[lpBuffer] ret endp ; VOID ShowLastError(HWND hWnd); proc ShowLastError hWnd invoke GetLastError stdcall ShowErrorMessage,[hWnd],eax ret endp section '.data' data readable writeable PunteroOri dd ? section '.idata' import data readable writeable library kernel,'KERNEL32.DLL',\ user,'USER32.DLL' import kernel,\ GetLastError,'GetLastError',\ SetLastError,'SetLastError',\ FormatMessage,'FormatMessageA',\ LocalFree,'LocalFree',\ LoadLibrary,'LoadLibraryA',\ GetProcAddress,'GetProcAddress',\ VirtualProtectEx,'VirtualProtectEx',\ ExitProcess,'ExitProcess' import user,\ MessageBoxA,'MessageBoxA' section '.edata' export data readable export 'ERRORMSG.DLL',\ ShowErrorMessage,'ShowErrorMessage',\ ShowLastError,'ShowLastError' section '.reloc' fixups data discardable
Tambien me gustaría que me explicasen como puedo debugear estas cosas ya que no lo tengo muy claro
saludos.