yizhenweifeng的专栏

内存加载dll Loading a DLL from memory Loading a DLL from memory This tutorial describes a technique how a dynamic link library (DLL) can be loaded from memory without storing it on the hard-disk first. Author: Joachim Bauch Contact: [email protected] Copyright: Creative Commons License (by-sa) Contents • Overview • Windows executables - the PE format • DOS header / stub • PE header • Section header • Loading the library • Allocate memory • Copy sections • Base relocation • Resolve imports • Protect memory • Notify library • Exported functions • Freeing the library • MemoryModule • Downloads • Known issues • License • Ports • Copyright Overview The default windows API functions to load external libraries into a program (LoadLibrary, LoadLibraryEx) only work with files on the filesystem. It's therefore impossible to load a DLL from memory. But sometimes, you need exactly this functionality (e.g. you don't want to distribute a lot of files or want to make disassembling harder). Common workarounds for this problems are to write the DLL into a temporary file first and import it from there. When the program terminates, the temporary file gets deleted. In this tutorial, I will describe first, how DLL files are structured and will present some code that can be used to load a DLL completely from memory - without storing on the disk first. Windows executables - the PE format Most windows binaries that can contain executable code (.exe, .dll, .sys) share a common file format that consists of the following parts: DOS header DOS stub PE header Section header Section 1 Section 2 . . . Section n All structures given below can be found in the header file winnt.h. DOS header / stub The DOS header is only used for backwards compatibility. It precedes the DOS stub that normally just displays an error message about the program not being able to be run from DOS mode. Microsoft defines the DOS header as follows: typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header WORD e_magic; // Magic number WORD e_cblp; // Bytes on last page of file WORD e_cp; // Pages in file WORD e_crlc; // Relocations WORD e_cparhdr; // Size of header in paragraphs WORD e_minalloc; // Minimum extra paragraphs needed WORD e_maxalloc; // Maximum extra paragraphs needed WORD e_ss; // Initial (relative) SS value WORD e_sp; // Initial SP value WORD e_csum; // Checksum WORD e_ip; // Initial IP value WORD e_cs; // Initial (relative) CS value WORD e_lfarlc; // File address of relocation table WORD e_ovno; // Overlay number WORD e_res[4]; // Reserved words WORD e_oemid; // OEM identifier (for e_oeminfo) WORD e_oeminfo; // OEM information; e_oemid specific WORD e_res2[10]; // Reserved words LONG e_lfanew; // File address of new exe header } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; PE header The PE header contains informations about the different sections inside the executable that are used to store code and data or to define imports from other libraries or exports this libraries provides. It's defined as follows: typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER32 OptionalHeader; } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; The FileHeader describes the physical format of the file, i.e. contents, informations about symbols, etc: typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD NumberOfSections; DWORD TimeDateStamp; DWORD PointerToSymbolTable; DWORD NumberOfSymbols; WORD SizeOfOptionalHeader; WORD Characteristics; } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; The OptionalHeader contains informations about the logical format of the library, including required OS version, memory requirements and entry points: typedef struct _IMAGE_OPTIONAL_HEADER { //

内存加载动态库 MemoryLoadLibrary 有例子。 /* * Memory DLL loading code * Version 0.0.3 * * Copyright (c) 2004-2013 by Joachim Bauch / [email protected] * http://www.joachim-bauch.de * * The contents of this file are subject to the Mozilla Public License Version * 2.0 (the "License"); you may not use this file except in compliance with * the License. You may obtain a copy of the License at * http://www.mozilla.org/MPL/ * * Software distributed under the License is distributed on an "AS IS" basis, * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License * for the specific language governing rights and limitations under the * License. * * The Original Code is MemoryModule.h * * The Initial Developer of the Original Code is Joachim Bauch. * * Portions created by Joachim Bauch are Copyright (C) 2004-2013 * Joachim Bauch. All Rights Reserved. * */ #ifndef __MEMORY_MODULE_HEADER #define __MEMORY_MODULE_HEADER #include typedef void *HMEMORYMODULE; typedef void *HMEMORYRSRC; typedef void *HCUSTOMMODULE; #ifdef __cplusplus extern "C" { #endif typedef HCUSTOMMODULE (*CustomLoadLibraryFunc)(LPCSTR, void *); typedef FARPROC (*CustomGetProcAddressFunc)(HCUSTOMMODULE, LPCSTR, void *); typedef void (*CustomFreeLibraryFunc)(HCUSTOMMODULE, void *); /** * Load DLL from memory location. * * All dependencies are resolved using default LoadLibrary/GetProcAddress * calls through the Windows API. */ HMEMORYMODULE MemoryLoadLibrary(const void *); /** * Load DLL from memory location using custom dependency resolvers. * * Dependencies will be resolved using passed callback methods. */ HMEMORYMODULE MemoryLoadLibraryEx(const void *, CustomLoadLibraryFunc, CustomGetProcAddressFunc, CustomFreeLibraryFunc, void *); /** * Get address of exported method. */ FARPROC MemoryGetProcAddress(HMEMORYMODULE, LPCSTR); /** * Free previously loaded DLL. */ void MemoryFreeLibrary(HMEMORYMODULE); /** * Find the location of

效能桌面便笺专业版_3.10(Build 327)绿色破解版

ASProtect.SKE.V2.4.Beta.09.11

1.1、寻找 main 函数入口............................................................004 1.2、一个简单的小例子.............................................................010 1.3、if-else 分支的识别技巧 .......................................................013 1.4、循环分支的识别技巧 ..........................................................022 1.5、switch-case 识别技巧初探......................................................031 1.6、switch-case 识别技巧提高......................................................038 1.7、加法与减法的识别与优化原理...................................................048 1.8、乘法识别与优化原理...........................................................052 1.9、除法与取模运算的识别与优化原理...............................................056 2、几种函数调用方式的识别技巧 2.1、几种调用方式的区别 2.2、sdtcall 与 Pascal 的识别与区分 2.3、__cdecl 与 fastcall 的识别与区分 3、指针与指针函数的识别技巧 4、数组与结构体的识别技巧 5、最后一役(出一个比较难且有代表性的例子)

软件质量是被大多数程序员挂在嘴上而不是放在心上的东西！ 除了完全外行和真正的编程高手外，初读本书，你最先的感受将是惊慌： “哇！我以 前捏造的 C++/C 程序怎么会有那么多的毛病？” 别难过，作者只不过比你早几年、多几次惊慌而已。 请花一两个小时认真阅读这本百页经书，你将会获益匪浅，这是前面 N-1 个读者的 建议。 一、编程老手与高手的误区 自从计算机问世以来，程序设计就成了令人羡慕的职业，程序员在受人宠爱之后容 易发展成为毛病特多却常能自我臭美的群体。 如今在 Internet 上流传的“真正”的程序员据说是这样的： (1) 真正的程序员没有进度表，只有讨好领导的马屁精才有进度表，真正的程序员会让 领导提心吊胆。 (2) 真正的程序员不写使用说明书，用户应当自己去猜想程序的功能。 (3) 真正的程序员几乎不写代码的注释，如果注释很难写，它理所当然也很难读。 (4) 真正的程序员不画流程图，原始人和文盲才会干这事。 (5) 真正的程序员不看参考手册，新手和胆小鬼才会看。 (6) 真正的程序员不写文档也不需要文档，只有看不懂程序的笨蛋才用文档。 (7) 真正的程序员认为自己比用户更明白用户需要什么。 (8) 真正的程序员不接受团队开发的理念，除非他自己是头头。 (9) 真正的程序员的程序不会在第一次就正确运行，但是他们愿意守着机器进行若干个 30 小时的调试改错。 (10) 真正的程序员不会在上午 9:00 到下午 5:00 之间工作，如果你看到他在上午 9:00 工 作，这表明他从昨晚一直干到现在。 …… 具备上述特征越多，越显得水平高，资格老。所以别奇怪，程序员的很多缺点竟然 可以被当作优点来欣赏。就象在武侠小说中，那些独来独往、不受约束且带点邪气的高 手最令人崇拜。我曾经也这样信奉，并且希望自己成为那样的“真正”的程序员，结果 没有得到好下场。

要了解指针,多多少少会出现一些比较复杂的类型,所以我先介绍 一下如何完全理解一个复杂类型,要理解复杂类型其实很简单,一 个类型里会出现很多运算符,他们也像普通的表达式一样,有优先 级,其优先级和运算优先级一样,所以我总结了一下其原则: 从变量名处起,根据运算符优先级结合,一步一步分析. 下面让我们先从简单的类型开始慢慢分析吧:

此代码是遍历pc上usb设备。 包含控制器 hub port 设配id 等信息 usb其实和串口是一样的，其端口也是固定的（如果你不接扩展hub）。 有时一台电脑接多个相同的usb设备，如果接连个摄像头（前后各一个），我们如果区分打开的是哪一个呢？ 1、先把usb设备先遍历出来，得到usb信息（设备串等）。 2、通过打开usb设备时返回信息（这个很重要 //usb#vid_1d27&pid;_0600#5&10ef021e;&0&5#{c3b5f022-5a42-1980-1909-ea72095601b1}）。 3、遍历注册表得到usb设备信息（#define USB_REGPATH "SYSTEM\\CurrentControlSet\\Enum\\USB\\" ）。 4、通过第1条的设备串、第2条打开设备返回信息、注册表。就可以确定usb设备(控制器->hub->端口) read by jerry

当鼠标移动到CEdit上方是，显示提示信息，其实现主要是重载Cedit类

CSharp 调用C++ DLL; 参数为指针类型导出函数 c# Csharp调用 c++库 参数为导入和导出指针两种 包含C++ DLL源码 如fun(cont char* A,char*B) A为输入参数，B为输出参数-C# CSharp call C++ DLL lib dll function param use export and import eg： fun(cont char* A,char*B) A IN，B OUT TestDll\Debug\TestCallDll.exe .......\.....\TestCallDll.vshost.exe .......\.....\TestCallDll.vshost.exe.manifest .......\.....\TestDll.dll .......\.....\TestDll.lib .......\TestCallDll\Form1.cs .......\...........\Form1.Designer.cs .......\...........\Form1.resx .......\...........\obj\Debug\TestCallDll.csproj.FileListAbsolute.txt .......\...........\...\.....\TestCallDll.csproj.GenerateResource.Cache .......\...........\...\.....\TestCallDll.exe .......\...........\...\.....\TestCallDll.Form1.resources .......\...........\...\.....\TestCallDll.pdb .......\...........\...\.....\TestCallDll.Properties.Resources.resources .......\...........\Program.cs .......\...........\...perties\AssemblyInfo.cs .......\...........\..........\Resources.Designer.cs .......\...........\..........\Resources.resx .......\...........\..........\Settings.Designer.cs .......\...........\..........\Settings.settings .......\...........\TestCallDll.csproj .......\....Dll\dllmain.cpp .......\.......\ReadMe.txt .......\.......\stdafx.cpp .......\.......\stdafx.h .......\.......\targetver.h .......\.......\TestDll.cpp .......\.......\TestDll.def .......\.......\TestDll.h .......\.......\TestDll.vcproj .......\.......\TestDll.vcproj.PC-201008261742.Administrator.user .......\TestDll.sln .......\TestDll.suo .......\....CallDll\obj\Debug\TempPE .......\...........\...\Debug .......\...........\obj .......\...........\Properties .......\Debug .......\TestCallDll .......\TestDll TestDll

地球上两点的距离 点到点的距离公式 内有算法可以查看

Xilinx ISE 11.1 CRACK license.lic

tcp代理、tcp抓包、端口映射 调试tcp通信是用到.可以显示字符串和asci码。

Udp代理 udp转发 udp抓包可以显示16进制ASC码 vs2005编写

Qt 4.3 白皮书 QT中文版 pdf格式

qt e文的 C++ GUI Programming with Qt 4, Second Edition

霍尼韦尔 Max1000矩阵键盘协议，在文件里已经做了说明。如果有疑问请发Email。

此demo是用Atl开发的，里面有调用方法及接口说明。此的demo只能隐藏本地控件运行时的安全提示。 如果是服务器上下载的控件得需要证书。并且还得添加为信任站点。

此demo 用于windows服务的检测，启动、停止、安装，卸载等。

安定宝协议 Contact_ID 此协议一般用在安防产品上，现在很多国内的安防产品都在用，电信也在用。

occi使用手册(11g Release 1 (11.1))