学步园

下面的代码易语言核心runtime（核心支持库krnln.fne）的易格式loader和部分核心services的逆向工程分析。仅仅是逆向分析而已，代码没有经过任何优化。其他就没什么好说的了，具体就看代码吧。

注：和E-Code Explorer配合使用会有意想不到的效果:)

////////////////////////////////////////////////////////////
////   MicroLoader v0.01
////   filename:   MicroLoader.cpp
////   coder:   monkeycz
////   create time: 2005/09/29 23:21
////   fix time:   2005/10/21
////////////////////////////////////////////////////////////

#include "MicroLoader.h"

PIMAGE_DOS_HEADER DosHeader = NULL;
PIMAGE_NT_HEADERS NtHeader = NULL;
PIMAGE_SECTION_HEADER SectionHeader = NULL;
PAPP_HEADER_INFO ECodeHeaderInfo = NULL;
PSECTION_INFO ThisSectionInfo = NULL;
PRELOCATION_INF ThisRelocationInfo = NULL;
UINT32 NumberOfSections = 0;
UINT32 ESectionVA = 0;
char SectionName[IMAGE_SIZEOF_SHORT_NAME + 1];
UINT32 ServerPointTable[ESERVERCOUNT];

typedef void (__stdcall* ECODESTART)(void);
ECODESTART ECodeStart = NULL;

PFN_GET_LIB_INFO GetThisNewInfo = NULL;

PSECTION_INFO pConstSectionOffset = NULL;
PSECTION_INFO pWinFormSectionOffset = NULL;
PSECTION_INFO pHelpFuncSectionOffset = NULL;
PSECTION_INFO pCodeSectionOffset = NULL;
PSECTION_INFO pVarSectionOffset = NULL;

PDLLCMD DllCmdHead = NULL;
PDLLCMD ThisDllCmd = NULL;
UINT32 DllCmdNO = 0;

PLIBINFO LibInfoHead = NULL;
PLIBINFO ThisLibInfo = NULL;
LIBSTRINGINFO ThisLibStringInfo;
UINT32 LibCount = 0;

UINT32 SaveAAddress = 0;

typedef void (__stdcall* UNKNOWFUN)(void);
UNKNOWFUN UnKnowFun = NULL;
HMODULE ThisLibrary = NULL;

HANDLE ThisHeap = NULL;

char* LibStringHead = NULL;
char* ThisLibString = NULL;

char ThisLibFileName[256];

PFN_EXECUTE_CMD** ThisCmdsFuncHead = NULL;
UINT32 LibCmdNO = 0;

PFN_NOTIFY_SYS MyNotifySys = NULL;
PFN_NOTIFY_LIB ThisNotifyLib = NULL;

char* ThisCmdLine = NULL;

char FileName_Full[256];
char FileName_Name[256];
char FileName_Path[256];

typedef void (__stdcall* GETNEWSOCK)(UINT32 Param1);
GETNEWSOCK GetNewSock = NULL;

char ErrorString[256];

INT ThisBaseCmdOffset = -1;
PFN_EXECUTE_CMD* ThisExecuteCmdPoint = NULL;

//定义临时变量
UINT32 i = 0;
UINT32 temp = 0;
UINT32* ptemp = NULL;
bool FindOK = false;

//声明函数
void Exit(void);
void _cdecl ServerFunction_09(UINT32 Param1);
UINT32 _cdecl ServerFunction_06(UINT32 Param1);

//实现核心基本命令
void _cdecl bnot (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
pRetData->m_int = ~(pArgInf->m_int);
pRetData->m_dtDataType = SDT_INT;
return;
}

void _cdecl band (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
INT result = 0;
result = pArgInf->m_int;
for(int i = 1; i <= (nArgCount - 1); i++)
{
  result = result & (pArgInf + i)->m_int;
}
pRetData->m_int = result;
pRetData->m_dtDataType = SDT_INT;
return;
}

void _cdecl bor (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
INT result = 0;
result = pArgInf->m_int;
for(int i = 1; i <= (nArgCount - 1); i++)
{
  result = result | (pArgInf + i)->m_int;
}
pRetData->m_int = result;
pRetData->m_dtDataType = SDT_INT;
return;
}

void _cdecl bxor (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
INT result = 0;
result = pArgInf->m_int;
for(int i = 1; i <= (nArgCount - 1); i++)
{
  result = result ^ (pArgInf + i)->m_int;
}
pRetData->m_int = result;
pRetData->m_dtDataType = SDT_INT;
return;
}

void _cdecl shl (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
pRetData->m_int = pArgInf->m_int << (pArgInf + 1)->m_int;
pRetData->m_dtDataType = SDT_INT;
return;
}

void _cdecl shr (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
pRetData->m_int = pArgInf->m_int >> (pArgInf + 1)->m_int;
pRetData->m_dtDataType = SDT_INT;
return;
}

void _cdecl pstr (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
char* ThisStr = NULL, *NewStr = NULL;
UINT32 ThisStrLen = 0;

ThisStr = (char*)pArgInf->m_int;

try
{
  ThisStrLen = strlen(ThisStr);
}
catch(...)
{
  MessageBoxA(0, ERROR_021, "error", MB_ICONERROR);
  ServerFunction_09(0);
  return;
}

if(ThisStrLen != 0)
{
  NewStr = (char *)ServerFunction_06(ThisStrLen + 1);

  memcpy(NewStr, ThisStr, ThisStrLen + 1);
}
else
{
  NewStr = NULL;
}
 
pRetData->m_pText = NewStr;
pRetData->m_dtDataType = SDT_TEXT;
return;
}

void _cdecl pbin (PMDATA_INF pRetData, INT nArgCount, PMDATA_INF pArgInf)
{
unsigned char* ThisBin = NULL, *NewBin = NULL;
UINT32 ThisBinLen = 0, *NewBinHead = NULL;

ThisBin = (unsigned char*)pArgInf->m_int;
ThisBinLen = (UINT32)(pArgInf++)->m_int;

if(ThisBinLen != 0)
{
  NewBin = (unsigned char *)ServerFunction_06(ThisBinLen + 8);
  NewBinHead = (UINT32*)NewBin;

  memcpy(NewBin + 8, ThisBin, ThisBinLen);
 
  (*NewBinHead) = 0x0001;
  (*(NewBinHead++)) = ThisBinLen;
}
else
{
  NewBin = NULL;
}

pRetData->m_pBin = NewBin;
pRetData->m_dtDataType = SDT_BIN;
return;
}

//核心代码从这里开始:)

void Exit(void)
{
if(DllCmdHead != NULL)
{
  free(DllCmdHead);
}

if(LibInfoHead != NULL)
{
  ThisLibInfo = LibInfoHead;
  for(UINT32 i = 1; i <= LibCount; i++)
  {
    if(ThisLibInfo->ThisLibHandle == NULL || ThisLibInfo->ThisLibInfo == NULL)
    {
    continue;
    }
   
    ThisNotifyLib = ThisLibInfo->ThisLibInfo->m_pfnNotify;
    if(ThisNotifyLib != NULL)
    {
    ThisNotifyLib(NL_FREE_LIB_DATA, 0, 0);
    }
   
    FreeLibrary(ThisLibInfo->ThisLibHandle);
    ThisLibInfo->ThisLibHandle = NULL;
    ThisLibInfo->ThisLibInfo = NULL;

    ThisLibInfo++;
  }
 
  free(LibInfoHead);
}

if(ThisHeap != NULL)
{
  HeapDestroy(ThisHeap);
}

}

__declspec(naked) void _cdecl ServerFunction_09(UINT32 Param1)
{
__asm
{
  push ebp
  mov ebp, esp
}

if(SaveAAddress != NULL)
{
  UnKnowFun = (UNKNOWFUN)SaveAAddress;
  UnKnowFun();
}

Exit();

ExitProcess(Param1);

__asm
{
  ret
}
}

INT WINAPI ThisNotifySys(INT nMsg, DWORD dwParam1 = 0, DWORD dwParam2 = 0)
{
PMDATA_INF ThisDataInfo = NULL;
void* temppoint= NULL;
DWORD temp = 0;

switch(nMsg)
{
  case NAS_GET_APP_ICON:
    //通知系统创建并返回程序的图标
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NAS_GET_APP_ICON);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);    
    break;
  case NAS_GET_LIB_DATA_TYPE_INFO:
    //返回指定库定义数据类型的PLIB_DATA_TYPE_INFO定义信息指针
    temp = dwParam1;
    if((temp >> 30) == 0)
    {
    ThisLibInfo = LibInfoHead;
    ThisLibInfo += ((temp >> 16) - 1);
    return (INT)(ThisLibInfo->ThisLibInfo->m_pDataType + (((temp << 16) >> 16) - 1));
    }
    break;
  case NAS_GET_HBITMAP:
    //返回非NULL的HBITMAP句柄（注意使用完毕后释放），否则返回NULL
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NAS_GET_HBITMAP);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);    
    break;
  case NAS_GET_LANG_ID:
    //返回当前系统或运行环境所支持的语言ID
    return 1;
  case NAS_GET_VER:
    //返回当前系统或运行环境的版本号
    return 0x00000004;
  case NAS_GET_PATH:
    //返回当前开发或运行环境的某一类目录或文件名，目录名以“/”结束
    switch(dwParam1)
    {
    case 1:
      strcpy((char*)dwParam2, FileName_Path);
      return (INT)FileName_Path;
      break;
    case 2001:
      strcpy((char*)dwParam2, FileName_Path);
      return (INT)FileName_Path;
      break;
    case 2002:
      strcpy((char*)dwParam2, FileName_Name);
      return (INT)FileName_Name;
      break;
    default:
      return NULL;  
    }
  case NRS_UNIT_DESTROIED:
    //通知系统指定的单元已经被销毁。
    //和窗口组建相关，不处理。
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_UNIT_DESTROIED);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_CONVERT_NUM_TO_INT:
    //转换其它数值格式到整数
    ThisDataInfo = (PMDATA_INF)dwParam1;
    switch(ThisDataInfo->m_dtDataType)
    {
    case SDT_SHORT:
      return (int)(ThisDataInfo->m_short);
    case SDT_INT:
      return (int)(ThisDataInfo->m_int);
    case SDT_INT64:
      return (int)(ThisDataInfo->m_int64);
    case SDT_FLOAT:
      return (int)(ThisDataInfo->m_float);
    case SDT_DOUBLE:
      return (int)(ThisDataInfo->m_double);
    default:
      return 0;
    }
    break;
  case NRS_GET_CMD_LINE_STR:
    //取当前命令行文本
    return (INT)ThisCmdLine;
  case NRS_GET_EXE_PATH_STR:
    //取当前执行文件所处目录名称
    return (INT)FileName_Path;
  case NRS_GET_EXE_NAME:
    //取当前执行文件名称
    return (INT)FileName_Name;
  case NRS_GET_UNIT_PTR:
    //取单元对象指针
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_GET_UNIT_PTR);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_GET_AND_CHECK_UNIT_PTR:
    //取单元对象指针
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_GET_AND_CHECK_UNIT_PTR);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_EVENT_NOTIFY:
    //通知系统产生了事件
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_EVENT_NOTIFY);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  /*
  在新版本的支持库中不支持
  case NRS_STOP_PROCESS_EVENT_NOTIFY:
    //通知系统暂停处理事件通知
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_STOP_PROCESS_EVENT_NOTIFY);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_CONTINUE_PROCESS_EVENT_NOTIFY:
    //通知系统继续处理事件通知
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_CONTINUE_PROCESS_EVENT_NOTIFY);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  */
  case NRS_DO_EVENTS:
    //通知Windows系统处理所有已有事件
    //我不觉得这种处理方式很好，确定的说，是一种很差的处理方式
    Sleep(1);
    break;
  case NRS_GET_UNIT_DATA_TYPE:
    //成功返回有效的 DATA_TYPE
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_GET_UNIT_DATA_TYPE);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_FREE_ARY:
    //释放指定数组数据
    //不会处理T_T,:(
    MessageBoxA(0, ERROR_020, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_MALLOC:
    //分配指定空间的内存，所有与易程序交互的内存都必须使用本通知分配
    temppoint = HeapAlloc(ThisHeap, 0, dwParam1);
    if(temppoint == NULL)
    {
    if(dwParam2 == 0)
    {
      MessageBoxA(0, ERROR_017, "error", MB_ICONERROR);
      ServerFunction_09(0);
      return 0;
    }
    else
    {
      return 0;
    }
    }
    return (INT)temppoint;
  case NRS_MFREE:
    //释放已分配的指定内存
    if(dwParam1 != NULL)
    {
    HeapFree(ThisHeap, 0, (void *)dwParam1);
    }
    break;
  case NRS_MREALLOC:
    //重新分配内存
    temppoint = HeapReAlloc(ThisHeap, 0, (void *)dwParam1, dwParam2);
    if(temppoint == NULL)
    {
    MessageBoxA(0, ERROR_018, "error", MB_ICONERROR);
    ServerFunction_09(0);
    return 0;
    }
    return (INT)temppoint;
  case NRS_RUNTIME_ERR:
    //通知系统已经产生运行时错误
    sprintf(ErrorString, "%s/n/nError String is %s", ERROR_019, (char*)dwParam1);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_EXIT_PROGRAM:
    //通知系统退出用户程序
    ServerFunction_09(dwParam1);
    break;
  case NRS_EVENT_NOTIFY2:
    //以第二类方式通知系统产生了事件
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_EVENT_NOTIFY2);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_GET_WINFORM_COUNT:
    //返回当前程序的窗体数目
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_GET_WINFORM_COUNT);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_GET_WINFORM_HWND:
    //返回指定窗体的窗口句柄，如果该窗体尚未被载入，返回NULL
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_GET_WINFORM_HWND);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_GET_BITMAP_DATA:
    //返回指定HBITMAP的图片数据，成功返回包含BMP图片数据的HGLOBAL句柄，失败返回NULL
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_GET_BITMAP_DATA);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_FREE_COMOBJECT:
    //通知系统释放指定的DTP_COM_OBJECT类型COM对象
    //不支持COM对象，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_FREE_COMOBJECT);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;
  case NRS_CHK_TAB_VISIBLE:
    //当选择夹子夹被切换后, 使用本消息通知易系统
    //和窗口组建相关，不处理
    sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_016, NRS_CHK_TAB_VISIBLE);
    MessageBoxA(0, ErrorString, "error", MB_ICONERROR);
    ServerFunction_09(0);
    break;    
  case NRS_GET_PRG_TYPE:
    //返回当前用户程序的类型，为PT_DEBUG_RUN_VER（调试版）或PT_RELEASE_RUN_VER（发布版）
    return PT_RELEASE_RUN_VER;
  default:
    //如果发生例外,不处理
    break;
}

return 0;
}

bool Init(void)
{
ThisHeap = HeapCreate(0, 0x1000, 0);
if(ThisHeap == NULL)
{
  return false;
}

MyNotifySys = ThisNotifySys;

return true;
}

void _cdecl ServerFunction_00(UINT32 Param1)
{

sprintf(ErrorString, "%s/n/nIntra error number is %d.", ERROR_006, Param1);
MessageBoxA(0, ErrorString, "error", MB_ICONERROR);

ServerFunction_09(0);

return;
}

__declspec(naked) void _stdcall ServerFunction_01(void)
{

__asm
{
  pop temp
  push eax
  pop DllCmdNO
}

ThisDllCmd = DllCmdHead;
ThisDllCmd += DllCmdNO;