【类人猿】TC内联汇编库

类人猿 · 发表于 2017-8-29 23:50:26

本帖最后由楚楚于 2017-8-30 21:09 编辑

TC可以直接内联汇编，这个库是本人初稿，新建个T文件辅助进去即可。此库给大家吃一颗定心丸。TC图色超强，内存一样无比强大。学TC一起放手干吧！
免费无私公开给大家拿去完善。

function 远程注入数据(Hwnd,字节集)
字节集=字节集&" C3"
var size_Str=strlen(strreplace(字节集," ",""))+20
var addr= (申请指定窗口内存空间(Hwnd,size_Str))
//调试输出(strformat("%x", addr))
写data(Hwnd,addr,字节集)
var PID=根据窗口句柄获取进程pid(Hwnd)
var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
var RetValue=dllcall("kernel32.dll","long","CreateRemoteThread","DWROD",进程句柄,"int",0,"int",0,"DWROD",addr,"DWROD",0,"DWROD",0,"DWROD",0)
end
function 申请指定窗口内存空间(Hwnd,size)
var PID=根据窗口句柄获取进程pid(Hwnd)
var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
var Addr=dllcall("kernel32.dll","long","VirtualAllocEx","long",进程句柄,"int",0,"long",size,"long",4096,"int",64)
return Addr
end
function 写Unicode(Hwnd,addr,Str_Unicode)
var UnicodeStr=""
var len=strlen(Str_Unicode)
var StrValue
var AddValue=0
for(var i = 0; i < len; i++)
StrValue=strgetat(Str_Unicode,i)
写2byte(Hwnd,addr+AddValue,StrValue)
AddValue=AddValue+2
end
end
function 写Ascii(Hwnd,addr,Str_Ascii)
var AsciiCode=""
var len=strlen(Str_Ascii)
for(var i = 0; i < len; i++)
AsciiCode = AsciiCode &" "& strformat("%x",strgetat(Str_Ascii,i))
AsciiCode=strtrim(AsciiCode)//去掉两头空格
// 调试输出(AsciiCode)
写data(Hwnd,addr,AsciiCode)
end
end
function 写data(Hwnd,addr,ByteArray)
var Ret=0
var RetArray
var n = strsplit(ByteArray," ",RetArray) //RetArray是返回数组
var VarValue
var PID=information(Hwnd,5)
var 进程句柄
for(var i=0;i <n;i++)
VarValue=进制_十六转十(RetArray[i])
进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
// 调试输出("进程句柄:"& 进程句柄)
Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr+i,"DWORD*",getvarpointer(VarValue)+8,"int",1,"int*",0)
// 调试输出("写入是否成功: "& Ret)
end
return Ret
//调试输出("坐标是的值是:"& Value)
end
function 写float(Hwnd,addr,value)
var Ret
var VarValue=floattohex(value)
if(value<=4294967295)
var PID=information(Hwnd,5)
var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
traceprint("进程句柄:"& 进程句柄)
Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
traceprint("写入是否成功: "& Ret)
return Ret
else
return 0
end
end
function 写4byte(Hwnd,addr,value)
var Ret
if(value<=4294967295)
var VarValue=value
var PID=information(Hwnd,5)
var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
// 调试输出("进程句柄:"& 进程句柄)
Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
// 调试输出("写入是否成功: "& Ret)
return Ret
else
return 0
end
//调试输出("坐标是的值是:"& Value)
end
function 写2byte(Hwnd,addr,value)
var Ret
if(value<=65535)
var VarValue=value
var PID=information(Hwnd,5)
var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
// 调试输出("进程句柄:"& 进程句柄)
Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",2,"int*",0)
// 调试输出("写入是否成功: "& Ret)
return Ret
else
return 0
end
//调试输出("坐标是的值是:"& Value)
end
function 写byte(Hwnd,addr,value)
var Ret
if(value<=255)
var VarValue=value
var PID=information(Hwnd,5)
var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
traceprint("进程句柄:"& 进程句柄)
Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",1,"int*",0)
traceprint("写入是否成功: "& Ret)
return Ret
else
return 0
end
//调试输出("坐标是的值是:"& Value)
end
function 读4dword(Hwnd,addr)
var VarValue=0//这个很重要哦,赋值表示他是一个整数型
var PID=information(Hwnd,5)
var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
dllcall("kernel32.dll","BOOL","ReadProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
return VarValue
end
function 根据窗口句柄获取进程pid(窗口句柄)
var PID=information(窗口句柄,5)
return PID
end
function 申请本地内存空间(Size)
var 申请本地内存指针
申请本地内存指针=dllcall("kernel32.dll","DWROD","LocalAlloc","DWORD",0,"DWORD",Size)//第一个参数为0即可,第二个参数是4字节数
return 申请本地内存指针
end
function 获取本地内存指针大小(内存指针)
var Size
Size=dllcall("kernel32.dll","DWROD","LocalSize","DWORD",内存指针)//这个是读取内存空间的大小
return Size
end
function 释放本地内存指针(内存指针)//==============返回值是0的话就成功
var RetValue
RetValue=dllcall("kernel32.dll","DWROD","LocalFree","HLOCAL",内存指针)//第一个参数为0即可,第二个参数是4字节数
return RetValue
end
function 进制_十六转十(十六进制文本)//传进去的二进制必须为文本型
var i,数组文本,临时文本,计算结果
数组文本 = "0123456789ABCDEF"
临时文本 = struppercase(十六进制文本)
for(i = 0; i < strlen(十六进制文本); i++)
计算结果 = 计算结果 * 16 + strfind(数组文本,strsub(临时文本,i,i+1))
end
return 计算结果
end
function 进制_十转十六(十进制数值)
var 余数,计算结果
var 余数数组 = array("0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "A", "B", "C", "D", "E", "F")
while(十进制数值 >= 0)
余数 = 十进制数值 % 16
计算结果 = 余数数组[余数] & 计算结果
十进制数值 = (十进制数值 - 余数) / 16
if(十进制数值 <= 0)
break
end
end
return (计算结果)
end
function 进制_十转二(十进制数值)
var 余数,计算结果
while(十进制数值 > 1)
余数 = 十进制数值 % 2
十进制数值 = cint(十进制数值 / 2)
计算结果 = cstring(余数) & 计算结果
end
计算结果 = cstring(十进制数值) & 计算结果
return 计算结果
end
function 进制_二转十(二进制文本数据)//传进去的二进制必须为文本型
var i,计算结果
for(i = 0; i < strlen(二进制文本数据); i++)
if(cint(strsub(二进制文本数据,i,i+1)) < 10)
计算结果 = 计算结果 + cint(strsub(二进制文本数据,i,i+1)) * mpow(2,strlen(二进制文本数据) - i - 1)
end
end
return 计算结果
end
功能进制_双精度浮点转16(双精度数值)
变量 VarValue1=0 //初始化
变量 VarValue2=0 //初始化
变量 varrvalue=""
变量双精度数值地址=获取变量地址(双精度数值)
// 消息框(字符串格式化( "%X",双精度数值地址))
动态库调用("kernel32.dll","VOID","RtlMoveMemory","DWORD*",获取变量指针(VarValue1)+8,"VOID*",双精度数值地址,"DWORD",4)
VarValue1=字符串格式化( "%X",VarValue1)
// 消息框(VarValue1)
动态库调用("kernel32.dll","VOID","RtlMoveMemory","DWORD*",获取变量指针(VarValue2)+8,"DWORD*",双精度数值地址+4 ,"DWORD",4)
VarValue2=字符串格式化( "%X",VarValue2)
// 消息框(VarValue2)
varrvalue=VarValue2 & VarValue1
// 消息框 (varrvalue)
如果 (字符串长度(varrvalue)==9)
varrvalue=varrvalue & "00000000"
返回 varrvalue
否则如果 (字符串长度(varrvalue)==16 )
返回 varrvalue
否则如果 (字符串长度(varrvalue)==2)
varrvalue="0"
返回 varrvalue
结束
结束
function W_GetCode()
W_GetCode = PublicCode
end
function W_HighAndLow(Value , n) //高低位互换,n的值为2/4/8
var tmp1 , tmp2 , i,LenStr
tmp1 = strright("0000000"& cstring(strformat("%x",Value)), n) //补位
LenStr=strlen(tmp1)
for(i = 0; i< LenStr / 2 ;i++)
tmp2 = tmp2 &strsub(tmp1, LenStr - 2 - 2 * i, LenStr -2 * i) //逆向排序
end//=======================================这里出错
return tmp2
end
function Leave()
PublicCode = PublicCode & "C9"
end
function Pushad()
PublicCode = PublicCode & "60"
end
function Popad()
PublicCode = PublicCode & "61"
end
function Nop()
PublicCode = PublicCode & "90"
end
function Ret()
PublicCode = PublicCode & "C3"
end
function Retn(i) //这个是新加的
PublicCode = PublicCode & "C2"& W_HighAndLow(i, 4)
end
function RetA(i )
PublicCode = PublicCode & W_HighAndLow(i, 4)
end
function IN_AL_DX()
PublicCode = PublicCode & "EC"
end
function TEST_EAX_EAX()
PublicCode = PublicCode & "85C0"
end
//'Add
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Add_EAX_EDX()
PublicCode = PublicCode & "03C2"
end
function Add_EBX_EAX()
PublicCode = PublicCode & "03D8"
end
function Add_EAX_DWORD_Ptr(i )
PublicCode = PublicCode & "0305" & W_HighAndLow(i, 8)
end
function Add_EBX_DWORD_Ptr(i )
PublicCode = PublicCode & "031D" & W_HighAndLow(i, 8)
end
function Add_EBP_DWORD_Ptr(i )
PublicCode = PublicCode & "032D" & W_HighAndLow(i, 8)
end
function Add_EAX(i )
PublicCode = PublicCode & "05" & W_HighAndLow(i, 8)
end
function Add_EBX(i )
PublicCode = PublicCode & "83C3" & W_HighAndLow(i, 8)
end
function Add_ECX(i )
PublicCode = PublicCode & "83C1" & W_HighAndLow(i, 8)
end
function Add_EDX(i )
PublicCode = PublicCode & "83C2" & W_HighAndLow(i, 8)
end
function Add_ESI(i )
PublicCode = PublicCode & "83C6" & W_HighAndLow(i, 8)
end
function Add_ESP(i )
PublicCode = PublicCode & "83C4" & W_HighAndLow(i, 8)
end
//'Call
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Call_EAX()
PublicCode = PublicCode & "FFD0"
end
function Call_EBX()
PublicCode = PublicCode & "FFD3"
end
function Call_ECX()
PublicCode = PublicCode & "FFD1"
end
function Call_EDX()
PublicCode = PublicCode & "FFD2"
end
function Call_ESI()
PublicCode = PublicCode & "FFD6"
end
function Call_ESP()
PublicCode = PublicCode & "FFD4"
end
function Call_EBP()
PublicCode = PublicCode & "FFD5"
end
function Call_EDI()
PublicCode = PublicCode & "FFD7"
end
function Call_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "FF15" & W_HighAndLow(i, 8)
end
//function Call_DWORD_Ptr_Value(i ) //这个是新加进去的，这个时候错误的
//PublicCode = PublicCode & "E8" & W_HighAndLow(i, 8)
//end
function Call_DWORD_Ptr_EAX()
PublicCode = PublicCode & "FF10"
end
function Call_DWORD_Ptr_EBX()
PublicCode = PublicCode & "FF13"
end
//'Cmp
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Cmp_EAX(i)
if ((i<= 255) && (i >= 0))
PublicCode = PublicCode & "83F8" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "3D" & W_HighAndLow(i, 8)
end
end
function Cmp_EAX_EDX()
PublicCode = PublicCode & "3BC2"
end
function Cmp_EAX_DWORD_Ptr(i )
PublicCode = PublicCode & "3B05" & W_HighAndLow(i, 8)
end
function Cmp_DWORD_Ptr_EAX(i )
PublicCode = PublicCode & "3905" & W_HighAndLow(i, 8)
end
//'DEC
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Dec_EAX()
PublicCode = PublicCode & "48"
end
function Dec_EBX()
PublicCode = PublicCode & "4B"
end
function Dec_ECX()
PublicCode = PublicCode & "49"
end
function Dec_EDX()
PublicCode = PublicCode & "4A"
end
//'Idiv
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Idiv_EAX()
PublicCode = PublicCode & "F7F8"
end
function Idiv_EBX()
PublicCode = PublicCode & "F7FB"
end
function Idiv_ECX()
PublicCode = PublicCode & "F7F9"
end
function Idiv_EDX()
PublicCode = PublicCode & "F7FA"
end
//'Imul
//'&&&&&&&
//&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Imul_EAX_EDX()
PublicCode = PublicCode & "0FAFC2"
end
function Imul_EAX(i )
PublicCode = PublicCode & "6BC0" & W_HighAndLow(i, 2)
end
function ImulB_EAX(i )
PublicCode = PublicCode & "69C0" & W_HighAndLow(i, 8)
end
//'INC
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Inc_EAX()
PublicCode = PublicCode & "40"
end
function Inc_EBX()
PublicCode = PublicCode & "43"
end
function Inc_ECX()
PublicCode = PublicCode & "41"
end
function Inc_EDX()
PublicCode = PublicCode & "42"
end
function Inc_EDI()
PublicCode = PublicCode & "47"
end
function Inc_ESI()
PublicCode = PublicCode & "46"
end
function Inc_DWORD_Ptr_EAX()
PublicCode = PublicCode & "FF00"
end
function Inc_DWORD_Ptr_EBX()
PublicCode = PublicCode & "FF03"
end
function Inc_DWORD_Ptr_ECX()
PublicCode = PublicCode & "FF01"
end
function Inc_DWORD_Ptr_EDX()
PublicCode = PublicCode & "FF02"
end
//'JMP/JE/JNE
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function JMP_EAX()
PublicCode = PublicCode & "FFE0"
end
//'Mov
function Mov_DWORD_Ptr_Addr_EAX(i)
PublicCode = PublicCode & "A3" & W_HighAndLow(i, 8)
end
function Mov_DWORD_Ptr_Addr_AL(i)
PublicCode = PublicCode & "A2" & W_HighAndLow(i, 8)
end
function Mov_DWORD_Ptr_Addr_AH(i)
PublicCode = PublicCode & "8825" & W_HighAndLow(i, 8)
end
function Mov_EAX_Value(i )
PublicCode = PublicCode & "B8" & W_HighAndLow(i, 8)
end
function Mov_EBX_Value(i )
PublicCode = PublicCode & "BB" & W_HighAndLow(i, 8)
end
function Mov_ECX_Value(i )
PublicCode = PublicCode & "B9" & W_HighAndLow(i, 8)
end
function Mov_EDX_Value(i )
PublicCode = PublicCode & "BA" & W_HighAndLow(i, 8)
end
function Mov_ESI_Value(i )
PublicCode = PublicCode & "BE" & W_HighAndLow(i, 8)
end
function Mov_ESP_Value(i )
PublicCode = PublicCode & "BC" & W_HighAndLow(i, 8)
end
function Mov_EBP_Value(i )
PublicCode = PublicCode & "BD" & W_HighAndLow(i, 8)
end
function Mov_EDI_Value(i )
PublicCode = PublicCode & "BF" & W_HighAndLow(i, 8)
end
function Mov_EBX_DWORD_Ptr(i )
PublicCode = PublicCode & "8B1D" & W_HighAndLow(i, 8)
end
function Mov_ECX_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "8B0D" & W_HighAndLow(i, 8)
end
function Mov_EAX_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "A1" & W_HighAndLow(i, 8)
end
function Mov_EDX_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "8B15" & W_HighAndLow(i, 8)
end
function Mov_ESI_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "8B35" & W_HighAndLow(i, 8)
end
function Mov_ESP_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "8B25" & W_HighAndLow(i, 8)
end
function Mov_EBP_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "8B2D" & W_HighAndLow(i, 8)
end
function Mov_EAX_DWORD_Ptr_EAX()
PublicCode = PublicCode & "8B00"
end
function Mov_EAX_DWORD_Ptr_EBP()
PublicCode = PublicCode & "8B4500"
end
function Mov_EAX_DWORD_Ptr_EBX()
PublicCode = PublicCode & "8B03"
end
function Mov_EAX_DWORD_Ptr_ECX()
PublicCode = PublicCode & "8B01"
end
function Mov_EAX_DWORD_Ptr_EDX()
PublicCode = PublicCode & "8B02"
end
function Mov_EAX_DWORD_Ptr_EDI()
PublicCode = PublicCode & "8B07"
end
function Mov_EAX_DWORD_Ptr_ESP()
PublicCode = PublicCode & "8B0424"
end
function Mov_EAX_DWORD_Ptr_ESI()
PublicCode = PublicCode & "8B06"
end
function Mov_EAX_DWORD_Ptr_EAX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B40" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B80" & W_HighAndLow(i, 8)
end
end
function Mov_EAX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B4424" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B8424" & W_HighAndLow(i, 8)
end
end
function Mov_EAX_DWORD_Ptr_EBX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B43" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B83" & W_HighAndLow(i, 8)
end
end
function Mov_EAX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B41" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B81" & W_HighAndLow(i, 8)
end
end
function Mov_EAX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B42" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B82" & W_HighAndLow(i, 8)
end
end
function Mov_EAX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B47" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B87" & W_HighAndLow(i, 8)
end
end
function Mov_EAX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B45" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B85" & W_HighAndLow(i, 8)
end
end
function Mov_EAX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B46" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B86" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_EAX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B58" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B98" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B5C24" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B9C24" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_EBX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B5B" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B9B" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B59" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B99" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B5A" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B9A" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B5F" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B9F" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B5D" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B9D" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B5E" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B9E" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_EAX_Add(i) //这里出错过
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B48" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B88" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B4C24" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B8C24" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_EBX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B4B" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B8B" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B49" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B89" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B4A" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B8A" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B4F" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B8F" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B4D" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B8D" & W_HighAndLow(i, 8)
end
end
function Mov_ECX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B4E" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B8E" & W_HighAndLow(i, 8)
end
end
function Mov_EDX_DWORD_Ptr_EAX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B50" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B90" & W_HighAndLow(i, 8)
end
end
function Mov_EDX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B5424" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B9424" & W_HighAndLow(i, 8)
end
end
function Mov_EDX_DWORD_Ptr_EBX_Add(i)
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B53" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B93" & W_HighAndLow(i, 8 ) //这里出错过
end
end
function Mov_EDX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B51" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B91" & W_HighAndLow(i, 8)
end
end
function Mov_EDX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B52" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B92" & W_HighAndLow(i, 8)
end
end
function Mov_EDX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B57" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B97" & W_HighAndLow(i, 8)
end
end
function Mov_EDX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B55" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B95" & W_HighAndLow(i, 8)
end
end
function Mov_EDX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8B56" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8B96" & W_HighAndLow(i, 8)
end
end
function Mov_EBX_DWORD_Ptr_EAX()
PublicCode = PublicCode & "8B18"
end
function Mov_EBX_DWORD_Ptr_EBP()
PublicCode = PublicCode & "8B5D00"
end
function Mov_EBX_DWORD_Ptr_EBX()
PublicCode = PublicCode & "8B1B"
end
function Mov_EBX_DWORD_Ptr_ECX()
PublicCode = PublicCode & "8B19"
end
function Mov_EBX_DWORD_Ptr_EDX()
PublicCode = PublicCode & "8B1A"
end
function Mov_EBX_DWORD_Ptr_EDI()
PublicCode = PublicCode & "8B1F"
end
function Mov_EBX_DWORD_Ptr_ESP()
PublicCode = PublicCode & "8B1C24"
end
function Mov_EBX_DWORD_Ptr_ESI()
PublicCode = PublicCode & "8B1E"
end
function Mov_ECX_DWORD_Ptr_EAX()
PublicCode = PublicCode & "8B08"
end
function Mov_ECX_DWORD_Ptr_EBP()
PublicCode = PublicCode & "8B4D00"
end
function Mov_ECX_DWORD_Ptr_EBX()
PublicCode = PublicCode & "8B0B"
end
function Mov_ECX_DWORD_Ptr_ECX()
PublicCode = PublicCode & "8B09"
end
function Mov_ECX_DWORD_Ptr_EDX()
PublicCode = PublicCode & "8B0A"
end
function Mov_ECX_DWORD_Ptr_EDI()
PublicCode = PublicCode & "8B0F"
end
function Mov_ECX_DWORD_Ptr_ESP()
PublicCode = PublicCode & "8B0C24"
end
function Mov_ECX_DWORD_Ptr_ESI()
PublicCode = PublicCode & "8B0E"
end
function Mov_EDX_DWORD_Ptr_EAX()
PublicCode = PublicCode & "8B10"
end
function Mov_EDX_DWORD_Ptr_EBP()
PublicCode = PublicCode & "8B5500"
end
function Mov_EDX_DWORD_Ptr_EBX()
PublicCode = PublicCode & "8B13"
end
function Mov_EDX_DWORD_Ptr_ECX()
PublicCode = PublicCode & "8B11"
end
function Mov_EDX_DWORD_Ptr_EDX()
PublicCode = PublicCode & "8B12"
end
function Mov_EDX_DWORD_Ptr_EDI()
PublicCode = PublicCode & "8B17"
end
function Mov_EDX_DWORD_Ptr_ESI()
PublicCode = PublicCode & "8B16"
end
function Mov_EDX_DWORD_Ptr_ESP()
PublicCode = PublicCode & "8B1424"
end
function Mov_EAX_EBP()
PublicCode = PublicCode & "8BC5"
end
function Mov_EAX_EBX()
PublicCode = PublicCode & "8BC3"
end
function Mov_EAX_ECX()
PublicCode = PublicCode & "8BC1"
end
function Mov_EAX_EDI()
PublicCode = PublicCode & "8BC7"
end
function Mov_EAX_EDX()
PublicCode = PublicCode & "8BC2"
end
function Mov_EAX_ESI()
PublicCode = PublicCode & "8BC6"
end
function Mov_EAX_ESP()
PublicCode = PublicCode & "8BC4"
end
function Mov_EBX_EBP()
PublicCode = PublicCode & "8BDD"
end
function Mov_EBX_EAX()
PublicCode = PublicCode & "8BD8"
end
function Mov_EBX_ECX()
PublicCode = PublicCode & "8BD9"
end
function Mov_EBX_EDI()
PublicCode = PublicCode & "8BDF"
end
function Mov_EBX_EDX()
PublicCode = PublicCode & "8BDA"
end
function Mov_EBX_ESI()
PublicCode = PublicCode & "8BDE"
end
function Mov_EBX_ESP()
PublicCode = PublicCode & "8BDC"
end
function Mov_ECX_EBP()
PublicCode = PublicCode & "8BCD"
end
function Mov_ECX_EAX()
PublicCode = PublicCode & "8BC8"
end
function Mov_ECX_EBX()
PublicCode = PublicCode & "8BCB"
end
function Mov_ECX_EDI()
PublicCode = PublicCode & "8BCF"
end
function Mov_ECX_EDX()
PublicCode = PublicCode & "8BCA"
end
function Mov_ECX_ESI()
PublicCode = PublicCode & "8BCE"
end
function Mov_ECX_ESP()
PublicCode = PublicCode & "8BCC"
end
function Mov_EDX_EBP()
PublicCode = PublicCode & "8BD5"
end
function Mov_EDX_EBX()
PublicCode = PublicCode & "8BD3"
end
function Mov_EDX_ECX()
PublicCode = PublicCode & "8BD1"
end
function Mov_EDX_EDI()
PublicCode = PublicCode & "8BD7"
end
function Mov_EDX_EAX()
PublicCode = PublicCode & "8BD0"
end
function Mov_EDX_ESI()
PublicCode = PublicCode & "8BD6"
end
function Mov_EDX_ESP()
PublicCode = PublicCode & "8BD4"
end
function Mov_ESI_EBP()
PublicCode = PublicCode & "8BF5"
end
function Mov_ESI_EBX()
PublicCode = PublicCode & "8BF3"
end
function Mov_ESI_ECX()
PublicCode = PublicCode & "8BF1"
end
function Mov_ESI_EDI()
PublicCode = PublicCode & "8BF7"
end
function Mov_ESI_EAX()
PublicCode = PublicCode & "8BF0"
end
function Mov_ESI_EDX()
PublicCode = PublicCode & "8BF2"
end
function Mov_ESI_ESP()
PublicCode = PublicCode & "8BF4"
end
function Mov_ESP_EBP()
PublicCode = PublicCode & "8BE5"
end
function Mov_ESP_EBX()
PublicCode = PublicCode & "8BE3"
end
function Mov_ESP_ECX()
PublicCode = PublicCode & "8BE1"
end
function Mov_ESP_EDI()
PublicCode = PublicCode & "8BE7"
end
function Mov_ESP_EAX()
PublicCode = PublicCode & "8BE0"
end
function Mov_ESP_EDX()
PublicCode = PublicCode & "8BE2"
end
function Mov_ESP_ESI()
PublicCode = PublicCode & "8BE6"
end
function Mov_EDI_EBP()
PublicCode = PublicCode & "8BFD"
end
function Mov_EDI_EAX()
PublicCode = PublicCode & "8BF8"
end
function Mov_EDI_EBX()
PublicCode = PublicCode & "8BFB"
end
function Mov_EDI_ECX()
PublicCode = PublicCode & "8BF9"
end
function Mov_EDI_EDX()
PublicCode = PublicCode & "8BFA"
end
function Mov_EDI_ESI()
PublicCode = PublicCode & "8BFE"
end
function Mov_EDI_ESP()
PublicCode = PublicCode & "8BFC"
end
function Mov_EBP_EDI()
PublicCode = PublicCode & "8BDF"
end
function Mov_EBP_EAX()
PublicCode = PublicCode & "8BE8"
end
function Mov_EBP_EBX()
PublicCode = PublicCode & "8BEB"
end
function Mov_EBP_ECX()
PublicCode = PublicCode & "8BE9"
end
function Mov_EBP_EDX()
PublicCode = PublicCode & "8BEA"
end
function Mov_EBP_ESI()
PublicCode = PublicCode & "8BEE"
end
function Mov_EBP_ESP()
PublicCode = PublicCode & "8BEC"
end
//'Push
//'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
function Push(i)
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "6A" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "68" & W_HighAndLow(i, 8)
end
end
function Push_DWORD_Ptr_Addr(i )
PublicCode = PublicCode & "FF35" & W_HighAndLow(i, 8)
end
function Push_EAX()
PublicCode = PublicCode & "50"
end
function Push_ECX()
PublicCode = PublicCode & "51"
end
function Push_EDX()
PublicCode = PublicCode & "52"
end
function Push_EBX()
PublicCode = PublicCode & "53"
end
function Push_ESP()
PublicCode = PublicCode & "54"
end
function Push_EBP()
PublicCode = PublicCode & "55"
end
function Push_ESI()
PublicCode = PublicCode & "56"
end
function Push_EDI()
PublicCode = PublicCode & "57"
end
//'LEA
function Lea_EAX_DWORD_Ptr_EAX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D40" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D80" & W_HighAndLow(i, 8)
end
end
function Lea_EAX_DWORD_Ptr_EBX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D43" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D83" & W_HighAndLow(i, 8)
end
end
function Lea_EAX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D41" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D81" & W_HighAndLow(i, 8)
end
end
function Lea_EAX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D42" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D82" & W_HighAndLow(i, 8)
end
end
function Lea_EAX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D46" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D86" & W_HighAndLow(i, 8)
end
end
function Lea_EAX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D40" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D80" & W_HighAndLow(i, 8)
end
end
function Lea_EAX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D4424" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D8424" & W_HighAndLow(i, 8)
end
end
function Lea_EAX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D47" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D87" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_EAX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D58" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D98" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D5C24" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D9C24" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_EBX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D5B" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D9B" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D59" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D99" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D5A" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D9A" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D5F" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D9F" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D5D" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D9D" & W_HighAndLow(i, 8)
end
end
function Lea_EBX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D5E" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D9E" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_EAX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D48" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D88" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D4C24" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D8C24" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_EBX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D4B" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D8B" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D49" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D89" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D4A" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D8A" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D4F" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D8F" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D4D" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D8D" & W_HighAndLow(i, 8)
end
end
function Lea_ECX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D4E" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D8E" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_EAX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D50" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D90" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_ESP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D5424" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D9424" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_EBX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D53" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D93" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_ECX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D51" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D91" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_EDX_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D52" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D92" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_EDI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D57" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D97" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_EBP_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D55" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D95" & W_HighAndLow(i, 8)
end
end
function Lea_EDX_DWORD_Ptr_ESI_Add(i )
if ((i<= 255) && (i>= 0))
PublicCode = PublicCode & "8D56" & W_HighAndLow(i, 2)
else
PublicCode = PublicCode & "8D96" & W_HighAndLow(i, 8)
end
end
function Pop_EAX()
PublicCode = PublicCode & "58"
end
function Pop_EBX()
PublicCode = PublicCode & "5B"
end
function Pop_ECX()
PublicCode = PublicCode & "59"
end
function Pop_EDX()
PublicCode = PublicCode & "5A"
end
function Pop_ESI()
PublicCode = PublicCode & "5E"
end
function Pop_ESP()
PublicCode = PublicCode & "5C"
end
function Pop_EDI()
PublicCode = PublicCode & "5F"
end
function Pop_EBP()
PublicCode = PublicCode & "5D"
end

复制代码

莫离 · 发表于 2017-8-30 17:19:28

此帖仅作者可见

		自动登录	找回密码
密码			立即注册

[源码分享] 【类人猿】TC内联汇编库

客服中心

投诉建议