C语言内嵌汇编API内存搜索引擎实例(2)

DWORD __stdcall GetKernel32Module() 
{ 
    _asm 
    { 
        PUSH    EBP 
        XOR     ECX, ECX 
        //MOV     ESI, [FS:ECX + 0x30]        ; ESI = &(PEB) ([FS:0x30])
        MOV     ESI, FS:[0X30] 
        MOV     ESI, [ESI + 0x0C]           ; ESI = PEB->Ldr     
        MOV     ESI, [ESI + 0x1C]           ; ESI = PEB->Ldr.InInitOrder
next_module:     
        MOV     EBP, [ESI + 0x08]           ; EBP = InInitOrder[X].base_address     
        MOV     EDI, [ESI + 0x20]           ; EBP = InInitOrder[X].module_name (unicode)    
        MOV     ESI, [ESI]                  ; ESI = InInitOrder[X].flink (next module)     
        CMP     [EDI + 12*2], CL            ; modulename[12] == 0 ?     
        JNE     next_module                 ; No: try next module. 
        MOV     EAX, EBP 
        POP     EBP 
    } 
} 
int main(int argc, char* argv[]) 
{ 
    printf("write by xiaoju !\n"); 
    printf("*****************\n"); 
    DWORD dwBaseKernel32 = GetKernel32Module(); 
    printf("Kernel32的模块地址:%08x\n",dwBaseKernel32); 
 
    DWORD LoadLibraryCRC32= CalcBufferCRC("LoadLibraryA") ; 
    printf("LoadLibraryA的CRC值(静态写到程序中):%08x\n\n", LoadLibraryCRC32); 
     
    DWORD dwAddrLoadLibrary = GetProcAddressA((HANDLE)dwBaseKernel32, 0x577a7461);  
    printf("在程序中动态得到的LoadLibraryA的地址:%08x\n", dwAddrLoadLibrary); 
    getchar(); 
    return 0; 
}