09月22日, 2014 2038次
Option Explicit Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long Private Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, lpThreadAttributes As Any, ByVal dwStackSize As Long, lpStartAddress As Long, lpParameter As Any, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long Private Declare Function VirtualFreeEx Lib "kernel32" (ByVal hProcess As Long, lpAddress As Any, ByVal dwSize As Long, ByVal dwFreeType As Long) As Long Private Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, lpAddress As Any, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Const PAGE_EXECUTE_READWRITE = &H40 Const MEM_COMMIT = &H1000 Const MEM_RELEASE = &H8000 Const MEM_DECOMMIT = &H4000 Const PROCESS_ALL_ACCESS = &H1F0FFF Dim OPcode As String Function Get_Result() As String Dim i As Long ReDim AsmCode(Len(OPcode) / 2 - 1) As Byte For i = 0 To UBound(AsmCode) AsmCode(i) = CByte("&H" & Mid(OPcode, i * 2 + 1, 2)) Next Get_Result = CallWindowProc(VarPtr(AsmCode(0)), 0, 0, 0, 0) End Function Function Get_Code() As String Get_Code = OPcode End Function Function Run_ASM(pid As Long) As Long Dim i As Long, tmp_Addr As Long, RThwnd As Long, h As Long ReDim AsmCode(Len(OPcode) / 2 - 1) As Byte For i = 0 To UBound(AsmCode) AsmCode(i) = CByte("&H" & Mid(OPcode, i * 2 + 1, 2)) Next h = OpenProcess(PROCESS_ALL_ACCESS, False, pid) tmp_Addr = VirtualAllocEx(h, ByVal 0&, UBound(AsmCode) + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE) WriteProcessMemory h, ByVal tmp_Addr, ByVal VarPtr(AsmCode(0)), UBound(AsmCode) + 1, ByVal 0& RThwnd = CreateRemoteThread(h, ByVal 0&, 0, ByVal tmp_Addr, ByVal 0&, ByVal 0&, ByVal 0&) VirtualFreeEx h, tmp_Addr, UBound(AsmCode) + 1, MEM_RELEASE CloseHandle RThwnd CloseHandle h OPcode = "" End Function Function Int2Hex(Value As Long, n As Long) As String '高地位互换 Dim tmp1 As String, tmp2 As String, i As Long tmp1 = Right("0000000" + Hex(Value), n) For i = 0 To Len(tmp1) / 2 - 1 tmp2 = tmp2 + Mid(tmp1, Len(tmp1) - 1 - 2 * i, 2) Next i Int2Hex = tmp2 End Function Function Leave() As Long OPcode = OPcode + "C9" End Function Function Pushad() As Long OPcode = OPcode + "60" End Function Function Popad() As Long OPcode = OPcode + "61" End Function Function Nop() As Long OPcode = OPcode + "90" End Function Function Ret() As Long OPcode = OPcode + "C3" End Function Function RetA(i As Long) As Long OPcode = OPcode + Int2Hex(i, 4) End Function Function IN_AL_DX() As Long OPcode = OPcode + "EC" End Function Function TEST_EAX_EAX() As Long OPcode = OPcode + "85C0" End Function 'Add '+++++++++++++++++++++++++++++++++++ Function Add_EAX_EDX() As Long OPcode = OPcode + "03C2" End Function Function Add_EBX_EAX() As Long OPcode = OPcode + "03D8" End Function Function Add_EAX_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "0305" + Int2Hex(i, 8) End Function Function Add_EBX_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "031D" + Int2Hex(i, 8) End Function Function Add_EBP_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "032D" + Int2Hex(i, 8) End Function Function Add_EAX(i As Long) As Long OPcode = OPcode + "05" + Int2Hex(i, 8) End Function Function Add_EBX(i As Long) As Long OPcode = OPcode + "83C3" + Int2Hex(i, 8) End Function Function Add_ECX(i As Long) As Long OPcode = OPcode + "83C1" + Int2Hex(i, 8) End Function Function Add_EDX(i As Long) As Long OPcode = OPcode + "83C2" + Int2Hex(i, 8) End Function Function Add_ESI(i As Long) As Long OPcode = OPcode + "83C6" + Int2Hex(i, 8) End Function Function Add_ESP(i As Long) As Long OPcode = OPcode + "83C4" + Int2Hex(i, 8) End Function 'Call '+++++++++++++++++++++++++++++++++++ Function Call_EAX() As Long OPcode = OPcode + "FFD0" End Function Function Call_EBX() As Long OPcode = OPcode + "FFD3" End Function Function Call_ECX() As Long OPcode = OPcode + "FFD1" End Function Function Call_EDX() As Long OPcode = OPcode + "FFD2" End Function Function Call_ESI() As Long OPcode = OPcode + "FFD2" End Function Function Call_ESP() As Long OPcode = OPcode + "FFD4" End Function Function Call_EBP() As Long OPcode = OPcode + "FFD5" End Function Function Call_EDI() As Long OPcode = OPcode + "FFD7" End Function Function Call_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "FF15" + Int2Hex(i, 8) End Function Function Call_DWORD_Ptr_EAX() As Long OPcode = OPcode + "FF10" End Function Function Call_DWORD_Ptr_EBX() As Long OPcode = OPcode + "FF13" End Function 'Cmp '+++++++++++++++++++++++++++++++++++ Function Cmp_EAX(i As Long) As Long If i <= 255 Then OPcode = OPcode + "83F8" + Int2Hex(i, 2) Else OPcode = OPcode + "3D" + Int2Hex(i, 8) End If End Function Function Cmp_EAX_EDX() As Long OPcode = OPcode + "3BC2" End Function Function Cmp_EAX_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "3B05" + Int2Hex(i, 8) End Function Function Cmp_DWORD_Ptr_EAX(i As Long) As Long OPcode = OPcode + "3905" + Int2Hex(i, 8) End Function 'DEC '+++++++++++++++++++++++++++++++++++ Function Dec_EAX() As Long OPcode = OPcode + "48" End Function Function Dec_EBX() As Long OPcode = OPcode + "4B" End Function Function Dec_ECX() As Long OPcode = OPcode + "49" End Function Function Dec_EDX() As Long OPcode = OPcode + "4A" End Function 'Idiv '+++++++++++++++++++++++++++++++++++ Function Idiv_EAX() As Long OPcode = OPcode + "F7F8" End Function Function Idiv_EBX() As Long OPcode = OPcode + "F7FB" End Function Function Idiv_ECX() As Long OPcode = OPcode + "F7F9" End Function Function Idiv_EDX() As Long OPcode = OPcode + "F7FA" End Function 'Imul '+++++++++++++++++++++++++++++++++++ Function Imul_EAX_EDX() As Long OPcode = OPcode + "0FAFC2" End Function Function Imul_EAX(i As Long) As Long OPcode = OPcode + "6BC0" + Int2Hex(i, 2) End Function Function ImulB_EAX(i As Long) As Long OPcode = OPcode + "69C0" + Int2Hex(i, 8) End Function 'INC '+++++++++++++++++++++++++++++++++++ Function Inc_EAX() As Long OPcode = OPcode + "40" End Function Function Inc_EBX() As Long OPcode = OPcode + "43" End Function Function Inc_ECX() As Long OPcode = OPcode + "41" End Function Function Inc_EDX() As Long OPcode = OPcode + "42" End Function Function Inc_EDI() As Long OPcode = OPcode + "47" End Function Function Inc_ESI() As Long OPcode = OPcode + "46" End Function Function Inc_DWORD_Ptr_EAX() As Long OPcode = OPcode + "FF00" End Function Function Inc_DWORD_Ptr_EBX() As Long OPcode = OPcode + "FF03" End Function Function Inc_DWORD_Ptr_ECX() As Long OPcode = OPcode + "FF01" End Function Function Inc_DWORD_Ptr_EDX() As Long OPcode = OPcode + "FF02" End Function 'JMP/JE/JNE '+++++++++++++++++++++++++++++++++++ Function JMP_EAX() As Long OPcode = OPcode + "FFE0" End Function 'Mov Function Mov_DWORD_Ptr_EAX(i As Long) As Long OPcode = OPcode + "A3" + Int2Hex(i, 8) End Function Function Mov_EAX(i As Long) As Long OPcode = OPcode + "B8" + Int2Hex(i, 8) End Function Function Mov_EBX(i As Long) As Long OPcode = OPcode + "BB" + Int2Hex(i, 8) End Function Function Mov_ECX(i As Long) As Long OPcode = OPcode + "B9" + Int2Hex(i, 8) End Function Function Mov_EDX(i As Long) As Long OPcode = OPcode + "BA" + Int2Hex(i, 8) End Function Function Mov_ESI(i As Long) As Long OPcode = OPcode + "BE" + Int2Hex(i, 8) End Function Function Mov_ESP(i As Long) As Long OPcode = OPcode + "BC" + Int2Hex(i, 8) End Function Function Mov_EBP(i As Long) As Long OPcode = OPcode + "BD" + Int2Hex(i, 8) End Function Function Mov_EDI(i As Long) As Long OPcode = OPcode + "BF" + Int2Hex(i, 8) End Function Function Mov_EBX_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "8B1D" + Int2Hex(i, 8) End Function Function Mov_ECX_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "8B0D" + Int2Hex(i, 8) End Function Function Mov_EAX_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "A1" + Int2Hex(i, 8) End Function Function Mov_EDX_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "8B15" + Int2Hex(i, 8) End Function Function Mov_ESI_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "8B35" + Int2Hex(i, 8) End Function Function Mov_ESP_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "8B25" + Int2Hex(i, 8) End Function Function Mov_EBP_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "8B2D" + Int2Hex(i, 8) End Function Function Mov_EAX_DWORD_Ptr_EAX() As Long OPcode = OPcode + "8B00" End Function Function Mov_EAX_DWORD_Ptr_EBP() As Long OPcode = OPcode + "8B4500" End Function Function Mov_EAX_DWORD_Ptr_EBX() As Long OPcode = OPcode + "8B03" End Function Function Mov_EAX_DWORD_Ptr_ECX() As Long OPcode = OPcode + "8B01" End Function Function Mov_EAX_DWORD_Ptr_EDX() As Long OPcode = OPcode + "8B02" End Function Function Mov_EAX_DWORD_Ptr_EDI() As Long OPcode = OPcode + "8B07" End Function Function Mov_EAX_DWORD_Ptr_ESP() As Long OPcode = OPcode + "8B0424" End Function Function Mov_EAX_DWORD_Ptr_ESI() As Long OPcode = OPcode + "8B06" End Function Function Mov_EAX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B40" + Int2Hex(i, 2) Else OPcode = OPcode + "8B80" + Int2Hex(i, 8) End If End Function Function Mov_EAX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B4424" + Int2Hex(i, 2) Else OPcode = OPcode + "8B8424" + Int2Hex(i, 8) End If End Function Function Mov_EAX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B43" + Int2Hex(i, 2) Else OPcode = OPcode + "8B83" + Int2Hex(i, 8) End If End Function Function Mov_EAX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B41" + Int2Hex(i, 2) Else OPcode = OPcode + "8B81" + Int2Hex(i, 8) End If End Function Function Mov_EAX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B42" + Int2Hex(i, 2) Else OPcode = OPcode + "8B82" + Int2Hex(i, 8) End If End Function Function Mov_EAX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B47" + Int2Hex(i, 2) Else OPcode = OPcode + "8B87" + Int2Hex(i, 8) End If End Function Function Mov_EAX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B45" + Int2Hex(i, 2) Else OPcode = OPcode + "8B85" + Int2Hex(i, 8) End If End Function Function Mov_EAX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B46" + Int2Hex(i, 2) Else OPcode = OPcode + "8B86" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B58" + Int2Hex(i, 2) Else OPcode = OPcode + "8B98" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B5C24" + Int2Hex(i, 2) Else OPcode = OPcode + "8B9C24" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B5B" + Int2Hex(i, 2) Else OPcode = OPcode + "8B9B" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B59" + Int2Hex(i, 2) Else OPcode = OPcode + "8B99" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B5A" + Int2Hex(i, 2) Else OPcode = OPcode + "8B9A" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B5F" + Int2Hex(i, 2) Else OPcode = OPcode + "8B9F" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B5D" + Int2Hex(i, 2) Else OPcode = OPcode + "8B9D" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B5E" + Int2Hex(i, 2) Else OPcode = OPcode + "8B9E" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B48" + Int2Hex(i, 2) Else OPcode = OPcode + "8B88" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B4C24" + Int2Hex(i, 2) Else OPcode = OPcode + "8B8C24" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B4B" + Int2Hex(i, 2) Else OPcode = OPcode + "8B8B" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B49" + Int2Hex(i, 2) Else OPcode = OPcode + "8B89" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B4A" + Int2Hex(i, 2) Else OPcode = OPcode + "8B8A" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B4F" + Int2Hex(i, 2) Else OPcode = OPcode + "8B8F" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B4D" + Int2Hex(i, 2) Else OPcode = OPcode + "8B8D" + Int2Hex(i, 8) End If End Function Function Mov_ECX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B4E" + Int2Hex(i, 2) Else OPcode = OPcode + "8B8E" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B50" + Int2Hex(i, 2) Else OPcode = OPcode + "8B90" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B5424" + Int2Hex(i, 2) Else OPcode = OPcode + "8B9424" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B53" + Int2Hex(i, 2) Else OPcode = OPcode + "8B93" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B51" + Int2Hex(i, 2) Else OPcode = OPcode + "8B91" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B52" + Int2Hex(i, 2) Else OPcode = OPcode + "8B92" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B57" + Int2Hex(i, 2) Else OPcode = OPcode + "8B97" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B55" + Int2Hex(i, 2) Else OPcode = OPcode + "8B95" + Int2Hex(i, 8) End If End Function Function Mov_EDX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8B56" + Int2Hex(i, 2) Else OPcode = OPcode + "8B96" + Int2Hex(i, 8) End If End Function Function Mov_EBX_DWORD_Ptr_EAX() As Long OPcode = OPcode + "8B18" End Function Function Mov_EBX_DWORD_Ptr_EBP() As Long OPcode = OPcode + "8B5D00" End Function Function Mov_EBX_DWORD_Ptr_EBX() As Long OPcode = OPcode + "8B1B" End Function Function Mov_EBX_DWORD_Ptr_ECX() As Long OPcode = OPcode + "8B19" End Function Function Mov_EBX_DWORD_Ptr_EDX() As Long OPcode = OPcode + "8B1A" End Function Function Mov_EBX_DWORD_Ptr_EDI() As Long OPcode = OPcode + "8B1F" End Function Function Mov_EBX_DWORD_Ptr_ESP() As Long OPcode = OPcode + "8B1C24" End Function Function Mov_EBX_DWORD_Ptr_ESI() As Long OPcode = OPcode + "8B1E" End Function Function Mov_ECX_DWORD_Ptr_EAX() As Long OPcode = OPcode + "8B08" End Function Function Mov_ECX_DWORD_Ptr_EBP() As Long OPcode = OPcode + "8B4D00" End Function Function Mov_ECX_DWORD_Ptr_EBX() As Long OPcode = OPcode + "8B0B" End Function Function Mov_ECX_DWORD_Ptr_ECX() As Long OPcode = OPcode + "8B09" End Function Function Mov_ECX_DWORD_Ptr_EDX() As Long OPcode = OPcode + "8B0A" End Function Function Mov_ECX_DWORD_Ptr_EDI() As Long OPcode = OPcode + "8B0F" End Function Function Mov_ECX_DWORD_Ptr_ESP() As Long OPcode = OPcode + "8B0C24" End Function Function Mov_ECX_DWORD_Ptr_ESI() As Long OPcode = OPcode + "8B0E" End Function Function Mov_EDX_DWORD_Ptr_EAX() As Long OPcode = OPcode + "8B10" End Function Function Mov_EDX_DWORD_Ptr_EBP() As Long OPcode = OPcode + "8B5500" End Function Function Mov_EDX_DWORD_Ptr_EBX() As Long OPcode = OPcode + "8B13" End Function Function Mov_EDX_DWORD_Ptr_ECX() As Long OPcode = OPcode + "8B11" End Function Function Mov_EDX_DWORD_Ptr_EDX() As Long OPcode = OPcode + "8B12" End Function Function Mov_EDX_DWORD_Ptr_EDI() As Long OPcode = OPcode + "8B17" End Function Function Mov_EDX_DWORD_Ptr_ESI() As Long OPcode = OPcode + "8B16" End Function Function Mov_EDX_DWORD_Ptr_ESP() As Long OPcode = OPcode + "8B1424" End Function Function Mov_EAX_EBP() As Long OPcode = OPcode + "8BC5" End Function Function Mov_EAX_EBX() As Long OPcode = OPcode + "8BC3" End Function Function Mov_EAX_ECX() As Long OPcode = OPcode + "8BC1" End Function Function Mov_EAX_EDI() As Long OPcode = OPcode + "8BC7" End Function Function Mov_EAX_EDX() As Long OPcode = OPcode + "8BC2" End Function Function Mov_EAX_ESI() As Long OPcode = OPcode + "8BC6" End Function Function Mov_EAX_ESP() As Long OPcode = OPcode + "8BC4" End Function Function Mov_EBX_EBP() As Long OPcode = OPcode + "8BDD" End Function Function Mov_EBX_EAX() As Long OPcode = OPcode + "8BD8" End Function Function Mov_EBX_ECX() As Long OPcode = OPcode + "8BD9" End Function Function Mov_EBX_EDI() As Long OPcode = OPcode + "8BDF" End Function Function Mov_EBX_EDX() As Long OPcode = OPcode + "8BDA" End Function Function Mov_EBX_ESI() As Long OPcode = OPcode + "8BDE" End Function Function Mov_EBX_ESP() As Long OPcode = OPcode + "8BDC" End Function Function Mov_ECX_EBP() As Long OPcode = OPcode + "8BCD" End Function Function Mov_ECX_EAX() As Long OPcode = OPcode + "8BC8" End Function Function Mov_ECX_EBX() As Long OPcode = OPcode + "8BCB" End Function Function Mov_ECX_EDI() As Long OPcode = OPcode + "8BCF" End Function Function Mov_ECX_EDX() As Long OPcode = OPcode + "8BCA" End Function Function Mov_ECX_ESI() As Long OPcode = OPcode + "8BCE" End Function Function Mov_ECX_ESP() As Long OPcode = OPcode + "8BCC" End Function Function Mov_EDX_EBP() As Long OPcode = OPcode + "8BD5" End Function Function Mov_EDX_EBX() As Long OPcode = OPcode + "8BD3" End Function Function Mov_EDX_ECX() As Long OPcode = OPcode + "8BD1" End Function Function Mov_EDX_EDI() As Long OPcode = OPcode + "8BD7" End Function Function Mov_EDX_EAX() As Long OPcode = OPcode + "8BD0" End Function Function Mov_EDX_ESI() As Long OPcode = OPcode + "8BD6" End Function Function Mov_EDX_ESP() As Long OPcode = OPcode + "8BD4" End Function Function Mov_ESI_EBP() As Long OPcode = OPcode + "8BF5" End Function Function Mov_ESI_EBX() As Long OPcode = OPcode + "8BF3" End Function Function Mov_ESI_ECX() As Long OPcode = OPcode + "8BF1" End Function Function Mov_ESI_EDI() As Long OPcode = OPcode + "8BF7" End Function Function Mov_ESI_EAX() As Long OPcode = OPcode + "8BF0" End Function Function Mov_ESI_EDX() As Long OPcode = OPcode + "8BF2" End Function Function Mov_ESI_ESP() As Long OPcode = OPcode + "8BF4" End Function Function Mov_ESP_EBP() As Long OPcode = OPcode + "8BE5" End Function Function Mov_ESP_EBX() As Long OPcode = OPcode + "8BE3" End Function Function Mov_ESP_ECX() As Long OPcode = OPcode + "8BE1" End Function Function Mov_ESP_EDI() As Long OPcode = OPcode + "8BE7" End Function Function Mov_ESP_EAX() As Long OPcode = OPcode + "8BE0" End Function Function Mov_ESP_EDX() As Long OPcode = OPcode + "8BE2" End Function Function Mov_ESP_ESI() As Long OPcode = OPcode + "8BE6" End Function Function Mov_EDI_EBP() As Long OPcode = OPcode + "8BFD" End Function Function Mov_EDI_EAX() As Long OPcode = OPcode + "8BF8" End Function Function Mov_EDI_EBX() As Long OPcode = OPcode + "8BFB" End Function Function Mov_EDI_ECX() As Long OPcode = OPcode + "8BF9" End Function Function Mov_EDI_EDX() As Long OPcode = OPcode + "8BFA" End Function Function Mov_EDI_ESI() As Long OPcode = OPcode + "8BFE" End Function Function Mov_EDI_ESP() As Long OPcode = OPcode + "8BFC" End Function Function Mov_EBP_EDI() As Long OPcode = OPcode + "8BDF" End Function Function Mov_EBP_EAX() As Long OPcode = OPcode + "8BE8" End Function Function Mov_EBP_EBX() As Long OPcode = OPcode + "8BEB" End Function Function Mov_EBP_ECX() As Long OPcode = OPcode + "8BE9" End Function Function Mov_EBP_EDX() As Long OPcode = OPcode + "8BEA" End Function Function Mov_EBP_ESI() As Long OPcode = OPcode + "8BEE" End Function Function Mov_EBP_ESP() As Long OPcode = OPcode + "8BEC" End Function 'Push '+++++++++++++++++++++++++++++++++++ Function Push(i As Long) As Long 'If i <= 255 Then 'OPcode = OPcode + "6A" + Int2Hex(i, 2) 'Else OPcode = OPcode + "68" + Int2Hex(i, 8) 'End If End Function Function Push_DWORD_Ptr(i As Long) As Long OPcode = OPcode + "FF35" + Int2Hex(i, 8) End Function Function Push_EAX() As Long OPcode = OPcode + "50" End Function Function Push_ECX() As Long OPcode = OPcode + "51" End Function Function Push_EDX() As Long OPcode = OPcode + "52" End Function Function Push_EBX() As Long OPcode = OPcode + "53" End Function Function Push_ESP() As Long OPcode = OPcode + "54" End Function Function Push_EBP() As Long OPcode = OPcode + "55" End Function Function Push_ESI() As Long OPcode = OPcode + "56" End Function Function Push_EDI() As Long OPcode = OPcode + "57" End Function 'LEA Function Lea_EAX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D40" + Int2Hex(i, 2) Else OPcode = OPcode + "8D80" + Int2Hex(i, 8) End If End Function Function Lea_EAX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D43" + Int2Hex(i, 2) Else OPcode = OPcode + "8D83" + Int2Hex(i, 8) End If End Function Function Lea_EAX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D41" + Int2Hex(i, 2) Else OPcode = OPcode + "8D81" + Int2Hex(i, 8) End If End Function Function Lea_EAX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D42" + Int2Hex(i, 2) Else OPcode = OPcode + "8D82" + Int2Hex(i, 8) End If End Function Function Lea_EAX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D46" + Int2Hex(i, 2) Else OPcode = OPcode + "8D86" + Int2Hex(i, 8) End If End Function Function Lea_EAX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D40" + Int2Hex(i, 2) Else OPcode = OPcode + "8D80" + Int2Hex(i, 8) End If End Function Function Lea_EAX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D4424" + Int2Hex(i, 2) Else OPcode = OPcode + "8D8424" + Int2Hex(i, 8) End If End Function Function Lea_EAX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D47" + Int2Hex(i, 2) Else OPcode = OPcode + "8D87" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D58" + Int2Hex(i, 2) Else OPcode = OPcode + "8D98" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D5C24" + Int2Hex(i, 2) Else OPcode = OPcode + "8D9C24" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D5B" + Int2Hex(i, 2) Else OPcode = OPcode + "8D9B" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D59" + Int2Hex(i, 2) Else OPcode = OPcode + "8D99" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D5A" + Int2Hex(i, 2) Else OPcode = OPcode + "8D9A" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D5F" + Int2Hex(i, 2) Else OPcode = OPcode + "8D9F" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D5D" + Int2Hex(i, 2) Else OPcode = OPcode + "8D9D" + Int2Hex(i, 8) End If End Function Function Lea_EBX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D5E" + Int2Hex(i, 2) Else OPcode = OPcode + "8D9E" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D48" + Int2Hex(i, 2) Else OPcode = OPcode + "8D88" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D4C24" + Int2Hex(i, 2) Else OPcode = OPcode + "8D8C24" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D4B" + Int2Hex(i, 2) Else OPcode = OPcode + "8D8B" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D49" + Int2Hex(i, 2) Else OPcode = OPcode + "8D89" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D4A" + Int2Hex(i, 2) Else OPcode = OPcode + "8D8A" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D4F" + Int2Hex(i, 2) Else OPcode = OPcode + "8D8F" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D4D" + Int2Hex(i, 2) Else OPcode = OPcode + "8D8D" + Int2Hex(i, 8) End If End Function Function Lea_ECX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D4E" + Int2Hex(i, 2) Else OPcode = OPcode + "8D8E" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_EAX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D50" + Int2Hex(i, 2) Else OPcode = OPcode + "8D90" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_ESP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D5424" + Int2Hex(i, 2) Else OPcode = OPcode + "8D9424" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_EBX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D53" + Int2Hex(i, 2) Else OPcode = OPcode + "8D93" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_ECX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D51" + Int2Hex(i, 2) Else OPcode = OPcode + "8D91" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_EDX_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D52" + Int2Hex(i, 2) Else OPcode = OPcode + "8D92" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_EDI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D57" + Int2Hex(i, 2) Else OPcode = OPcode + "8D97" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_EBP_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D55" + Int2Hex(i, 2) Else OPcode = OPcode + "8D95" + Int2Hex(i, 8) End If End Function Function Lea_EDX_DWORD_Ptr_ESI_Add(i As Long) As Long If i <= 255 Then OPcode = OPcode + "8D56" + Int2Hex(i, 2) Else OPcode = OPcode + "8D96" + Int2Hex(i, 8) End If End Function 'POP Function Pop_EAX() As Long OPcode = OPcode + "58" End Function Function Pop_EBX() As Long OPcode = OPcode + "5B" End Function Function Pop_ECX() As Long OPcode = OPcode + "59" End Function Function Pop_EDX() As Long OPcode = OPcode + "5A" End Function Function Pop_ESI() As Long OPcode = OPcode + "5E" End Function Function Pop_ESP() As Long OPcode = OPcode + "5C" End Function Function Pop_EDI() As Long OPcode = OPcode + "5F" End Function Function Pop_EBP() As Long OPcode = OPcode + "5D" End Function
暂无留言,赶快评论吧