#include <windows.h>
#include <stdio.h>void PopMessageBox()
{__asm{jmp startfind_function:push ebpmov ebp,esp

mov eax,fs:[0x30]                //fs points to teb in user mode，get pointer to pebmov eax,[eax+0x0c]                //get peb->ldrmov eax,[eax+0x14]                //get peb->ldr.InMemoryOrderModuleList.Flink(1st entry)
module_loop:mov eax,[eax]                    //skip the first entry or get the next entrymov esi,[eax+0x28]                //get the BaseDllName->Buffercmp byte ptr [esi+0x0c],'3'        //test the module's seventh's wchar is '3' or not，kernel32.dll
        jne module_loop//====================================//find kernel32.dll module//====================================mov eax,[eax+0x10]                //LDR_DATA_TABLE_ENTRY->DllBase//====================================//kernel32.dll PE Header//====================================
        mov edi,eaxadd edi,[edi+0x3c]                //IMAGE_DOS_HEADER->e_lfanew//====================================//kernel32.dll export directory table//====================================mov edi,[edi+0x78]                //IMAGE_NT_HEADERS->OptinalHeader.DataDirectory[EAT].VirtualAddress
        add edi,eaxmov ebx,edi    // ebx is EAT's virtual address,we’ll use it later//====================================//kernel32.dll Name Pointer Table//====================================mov edi,[ebx+0x20]                //IMAGE_EXPORT_DESCRIPTOR->AddressOfNames RVA
        add edi,eaxxor ecx,ecx                        //NameOrdinals

name_loop:mov esi,[edi+ecx*4]add esi,eaxinc ecxmov edx,[esp+8]                    //first parameter
        cmp dword ptr [esi],edxjne name_loopmov edx,[esp+0xc]                //second parametercmp dword ptr [esi+4],edxjne name_loop//======================================//kernel32.dll Ordinal Table//======================================mov edi,[ebx+0x24]add edi,eaxmov ecx,[edi+ecx*2]and ecx,0xFFFF                   //cause ordinal is USHORT of size,so we just use its lower 16-bits//======================================//kernel32.dll Address Table//======================================mov edi,[ebx+0x1c]add edi,eaxdec ecx    //subtract ordinal basesal ecx,2mov edi,[edi+ecx]add eax,edipop ebpret 8start://====================================// Get GetProcAddress's address//====================================push 0x41636f72    //rocApush 0x50746547    //Getp
        call find_functionpush eax                        //store GetProcAddress in stack//====================================//Get LoadLibraryA's address//====================================push 0x7262694c    //Librpush 0x64616f4c    //Load
        call find_functionpush eax                        //store LoadLibraryA in stack//            stack snap//-----------------------------high address//    GetProcAddress's address//-----------------------------//    LoadLibraryA's address      <-----------------esp//-----------------------------low address//====================================// Get User32.dll's image base//====================================push 0x3233                        //32push 0x72657375                    //userpush esp                        //lpFileNamecall eax                        //call LoadLibraryA("user32.dll")
add esp,8                        //cause we push user32 string//====================================//Get MessageBox's address//====================================push 0x41786f                    //oxApush 0x42656761                    //ageBpush 0x7373654d                    //Messpush esp                        //lpProcNamepush eax                        //hModulecall [esp+0x18]                    //call GetProcAddress(hModule,"MessageBoxA")
add esp,0xc                        //cause we push MessageBoxA string
push 0push 0push 0push 0call eax                        //call MessagBoxA(0,0,0,0)
add esp,8                        //cause we push GetProcAddress and LoadLibrary in stack
    }
}int main()
{PopMessageBox();return 0;
}