逆向分析_DLL基礎(3)

DLL基礎(3) DllMain處理

(一) 創建dll release項目(sum)

//sum.cpp
#include<windows.h>
#include<stdio.h>

extern "C" int __declspec(dllexport)  __stdcall add(int x, int y);

int __stdcall add(int x, int y)
{
	return x + y;
}

BOOL WINAPI DllMain(
    HINSTANCE hinstDLL,
    DWORD     fdwReason,
    LPVOID    lpvReserved
){
    switch (fdwReason) //Dll被調用的原因
    {
    case DLL_PROCESS_ATTACH:
        printf("process attach of dll\n");
        break;
    case DLL_THREAD_ATTACH:
        printf("thread attach of dll\n");
        break;
    case DLL_THREAD_DETACH:
        printf("thread detach of dll\n");
        break;
    case DLL_PROCESS_DETACH:
        printf("process detach of dll\n");
        break;
    }
    return TRUE;
}

(二) 靜態加載DLL

創建Win32 Console空項目，添加文件my_dll_main.cpp,把sum.lib sum.dll複製到該項目下

//my_dll_main.cpp
//#define APIENTRY WINAPI
//#define WINAPI __stdcall
/*
BOOL WINAPI DllMain(
  _In_ HINSTANCE hinstDLL,
  _In_ DWORD     fdwReason,
  _In_ LPVOID    lpvReserved
);
*/

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

#pragma comment(lib,"sum.lib")

typedef int(__stdcall *lpAddFunc)(int,int);  //宏定義函數指針類型

int main(int argc, char *argv[])
{
	HINSTANCE hDll;			//DLL 句柄	
	lpAddFunc addFunc;		//函數指針
	hDll = LoadLibrary("sum.dll");
	if(hDll != NULL)
	{
		//addFunc = (lpAddFunc)GetProcAddress(hDll,"add");
        addFunc = (lpAddFunc)GetProcAddress(hDll, MAKEINTRESOURCE(1));
        //MAKEINTRESOURCE 直接使用導出文件中的序號
		if(addFunc != NULL)
		{
			int result = addFunc(2,3);
			printf("%d\n", result);
			system("pause");
		}
	}
	FreeLibrary(hDll);
	return 0;
}

進程中的每個DLL模塊被全局唯一的32字節的HINSTANCE句柄標識，只有在特定的進程內部有效,句柄代表了DLL模塊在進程虛擬空間中的起始地址。

GetProcAddress(hDll, MAKEINTRESOURCE(1))直接通過.def文件中add函數指定的順序號訪問函數,MAKEINTRESOURCE是一個通過序號獲取函數名的宏。