易语言非真实API模块源码

系统结构:调用_NtQueryInformationProcess,调用_NtSetInformationThread,调用_NtDeviceIoControlFile,调用_NtFsControlFile,调用_NtWaitForSingleObject,调用_NtSetInformationFile,调用_NtCreateFile,调用_NtClose,调用_NtQueryInformationFile,调用_NtQueryEaFile,调用_NtReadFile,调用_CreateFileA,调用_CreateFileW,调用_ReadFile,调用_GetFileSize,辅_脱离调试挂钩子程序,辅_取调试器句柄,辅_未知_脱离调试挂钩子程序2,调用_NtRemoveProcessDebug,取变量地址_整数,RtlNtStatusToDosError,SetLastError,RtlDosPathNameToNtPathName_U,RtlInitUnicodeString,SizeOf_SECURITY_QUALITY,SizeOf_SecurityAttributes,GetLastError,RtlIsDosDeviceName_U,RtlEqualUnicodeString_SP,

======内核函数
           |  |
           |  |------ 调用_NtQueryInformationProcess
           |  |
           |  |------ 调用_NtSetInformationThread
           |  |
           |  |------ 调用_NtDeviceIoControlFile
           |  |
           |  |------ 调用_NtFsControlFile
           |  |
           |  |------ 调用_NtWaitForSingleObject
           |  |
           |  |------ 调用_NtSetInformationFile
           |  |
           |  |------ 调用_NtCreateFile
           |  |
           |  |------ 调用_NtClose
           |  |
           |  |------ 调用_NtQueryInformationFile
           |  |
           |  |------ 调用_NtQueryEaFile
           |  |
           |  |------ 调用_NtReadFile
           |  |
           |  |------ 调用_CreateFileA
           |  |
           |  |------ 调用_CreateFileW
           |  |
           |  |------ 调用_ReadFile
           |  |
           |  |------ 调用_GetFileSize
           |  |
           |  |
======反调试
           |  |
           |  |------ 辅_脱离调试挂钩子程序
           |  |
           |  |------ 辅_取调试器句柄
           |  |
           |  |------ 辅_未知_脱离调试挂钩子程序2
           |  |
           |  |------ 调用_NtRemoveProcessDebug
           |  |
           |  |
======EcStart
           |  |
           |  |------ _启动子程序
           |  |
           |  |------ _临时子程序
           |  |
           |  |
======help
           |  |
           |  |------ 取变量地址_整数
           |  |
           |  |
======调用的Dll
           |  |
           |  |---[dll]------   _GetProcAddress
           |  |
           |  |---[dll]------   _GetModuleHandle
           |  |
           |  |---[dll]------   RtlNtStatusToDosError
           |  |
           |  |---[dll]------   SetLastError
           |  |
           |  |---[dll]------   RtlDosPathNameToNtPathName_U
           |  |
           |  |---[dll]------   RtlInitUnicodeString
           |  |
           |  |---[dll]------   _MultiByteToWideChar
           |  |
           |  |---[dll]------   SizeOf_SECURITY_QUALITY
           |  |
           |  |---[dll]------   SizeOf_SecurityAttributes
           |  |
           |  |---[dll]------   _GetProcessHeap
           |  |
           |  |---[dll]------   GetLastError
           |  |
           |  |---[dll]------   RtlIsDosDeviceName_U
           |  |
           |  |---[dll]------   RtlEqualUnicodeString_SP
           |  |
           |  |---[dll]------   _GetThreadContext
           |  |
           |  |---[dll]------   _CloseHandle
           |  |
           |  |---[dll]------   _GetCurrentThreadId
           |  |
           |  |---[dll]------   _OpenThread
           |  |
           |  |---[dll]------   _keybd_event
           |  |
           |  |---[dll]------   _SendInput
           |  |
           |  |---[dll]------   _DeviceIoControl
           |  |
           |  |---[dll]------   _NtRemoveProcessDebug
           |  |
           |  |---[dll]------   _NtFsControlFile
           |  |
           |  |---[dll]------   _NtQueryInformationFile
           |  |
           |  |---[dll]------   _NtClose
           |  |
           |  |---[dll]------   _CreateFileW
           |  |
           |  |---[dll]------   _CreateFileA
           |  |
           |  |---[dll]------   _NtDeviceIoControlFile
           |  |
           |  |---[dll]------   _NtSetInformationThread
           |  |
           |  |---[dll]------   _NtQueryInformationProcess
           |  |
           |  |---[dll]------   _NtWaitForSingleObject
           |  |
           |  |---[dll]------   _NtCreateFile
           |  |
           |  |---[dll]------   _NtSetInformationFile
           |  |
           |  |---[dll]------   _NtQueryEaFile
           |  |
           |  |---[dll]------   _NtReadFile
           |  |
           |  |---[dll]------   _ReadFile
           |  |
           |  |---[dll]------   _GetFileSize

调用的DLL命令:

.DLL命令 _GetProcAddress, 整数型, , "GetProcAddress"
    .参数 hModule
    .参数 Name, 文本型

.DLL命令 _GetModuleHandle, 整数型, , "GetModuleHandleA"
    .参数 Name, 文本型

.DLL命令 RtlNtStatusToDosError, 整数型, "ntdll.dll", "RtlNtStatusToDosError"
    .参数 Status

.DLL命令 SetLastError, , , "SetLastError"
    .参数 dwErrCode

.DLL命令 RtlDosPathNameToNtPathName_U, 整数型, "ntdll.dll", "RtlDosPathNameToNtPathName_U"
    .参数 DosFileName
    .参数 NtFileName, UNICODE_STRING
    .参数 FilePart
    .参数 RelativeName, RTL_RELATIVE_NAME

.DLL命令 RtlInitUnicodeString, , "ntdll.dll", "RtlInitUnicodeString"
    .参数 DestinationString, UNICODE_STRING
    .参数 SourceString

.DLL命令 _MultiByteToWideChar, 整数型, , "MultiByteToWideChar"
    .参数 CodePage, 整数型
    .参数 dwFlags, 整数型
    .参数 lpMultiByteStr, 文本型
    .参数 cchMultiByte, 整数型
    .参数 lpWideCharStr, 整数型
    .参数 cchWideChar, 整数型

.DLL命令 SizeOf_SECURITY_QUALITY, 整数型, , "GlobalSize"
    .参数 obj, SECURITY_QUALITY_OF_SERVICE

.DLL命令 SizeOf_SecurityAttributes, 整数型, , "GlobalSize"
    .参数 obj, SECURITY_ATTRIBUTES

.DLL命令 _GetProcessHeap, 整数型, , "GetProcessHeap"

.DLL命令 GetLastError, 整数型

.DLL命令 RtlIsDosDeviceName_U, 整数型, "ntdll.dll", "RtlIsDosDeviceName_U"
    .参数 szBuffer

.DLL命令 RtlEqualUnicodeString_SP, 逻辑型, "ntdll.dll", "RtlEqualUnicodeString"
    .参数 String1, UNICODE_STRING
    .参数 String2, 整数型
    .参数 CaseInSensitive, 逻辑型

.DLL命令 _GetThreadContext, 整数型, , "GetThreadContext"
    .参数 hThread, 整数型
    .参数 lpContext, 整数型

.DLL命令 _CloseHandle, 整数型, , "CloseHandle"
    .参数 hObject, 整数型

.DLL命令 _GetCurrentThreadId, 整数型, , "GetCurrentThreadId"

.DLL命令 _OpenThread, 整数型, , "OpenThread"
    .参数 dwDesiredAccess, 整数型
    .参数 bInheritHandle, 整数型
    .参数 dwThreadId, 整数型

.DLL命令 _keybd_event, , "user32.dll", "keybd_event"
    .参数 bVk, 字节型
    .参数 bScan, 字节型
    .参数 dwFlags, 整数型
    .参数 dwExtraInfo, 整数型

.DLL命令 _SendInput, 整数型, "user32.dll", "SendInput"
    .参数 cInputs, 整数型
    .参数 pInputs, INPUT
    .参数 cbSize, 整数型

.DLL命令 _DeviceIoControl, 逻辑型, "kernel32.dll", "DeviceIoControl"
    .参数 hDevice, 整数型
    .参数 dwIoControlCode, 整数型
    .参数 lpInBuffer, 整数型
    .参数 nInBufferSize, 整数型
    .参数 lpOutBuffer, 整数型
    .参数 nOutBufferSize, 整数型
    .参数 lpBytesReturned, 整数型
    .参数 lpOverlapped, 整数型

.DLL命令 _NtRemoveProcessDebug, 整数型, "ntdll.dll", "NtRemoveProcessDebug"
    .参数 hProcess

.DLL命令 _NtFsControlFile, 整数型, "ntdll.dll", "NtFsControlFile"
    .参数 FileHandle
    .参数 Event
    .参数 ApcRoutine
    .参数 ApcContext
    .参数 IoStatusBlock
    .参数 FsControlCode
    .参数 InputBuffer
    .参数 InputBufferLength
    .参数 OutputBuffer
    .参数 OutputBufferLength

.DLL命令 _NtQueryInformationFile, 整数型, "ntdll.dll", "NtQueryInformationFile"
    .参数 FileHandle
    .参数 IoStatusBlock
    .参数 FileInformation
    .参数 Length
    .参数 FileInformationClass

.DLL命令 _NtClose, 整数型, "ntdll.dll", "NtClose"
    .参数 Handle

.DLL命令 _CreateFileW, 整数型, "kernel32.dll", "CreateFileW"
    .参数 lpFileName
    .参数 dwDesiredAccess
    .参数 dwShareMode
    .参数 lpSecurityAttributes
    .参数 dwCreationDisposition
    .参数 dwFlagsAndAttributes
    .参数 hTemplateFile

.DLL命令 _CreateFileA, 整数型, "kernel32.dll", "CreateFileA"
    .参数 lpFileName, 文本型
    .参数 dwDesiredAccess
    .参数 dwShareMode
    .参数 lpSecurityAttributes
    .参数 dwCreationDisposition
    .参数 dwFlagsAndAttributes
    .参数 hTemplateFile

.DLL命令 _NtDeviceIoControlFile, 整数型, "ntdll.dll", "NtDeviceIoControlFile"
    .参数 FileHandle
    .参数 Event
    .参数 ApcRoutine
    .参数 ApcContext
    .参数 IoStatusBlock
    .参数 IoControlCode
    .参数 InputBuffer
    .参数 InputBufferLength
    .参数 OutputBuffer
    .参数 OutputBufferLength

.DLL命令 _NtSetInformationThread, 整数型, "ntdll.dll", "NtSetInformationThread"
    .参数 ThreadHandle
    .参数 ThreadInformationClass
    .参数 ThreadInformation
    .参数 ThreadInformationLength

.DLL命令 _NtQueryInformationProcess, 整数型, "ntdll.dll", "NtQueryInformationProcess"
    .参数 ProcessHandle
    .参数 ProcessInformationClass
    .参数 ProcessInformation
    .参数 ProcessInformationLength
    .参数 ReturnLength

.DLL命令 _NtWaitForSingleObject, 整数型, "ntdll.dll", "NtWaitForSingleObject"
    .参数 Handle
    .参数 Alertable
    .参数 Timeout

.DLL命令 _NtCreateFile, 整数型, "ntdll.dll", "NtCreateFile"
    .参数 FileHandle
    .参数 DesiredAccess
    .参数 ObjectAttributes
    .参数 IoStatusBlock
    .参数 AllocationSize
    .参数 FileAttributes
    .参数 ShareAccess
    .参数 CreateDisposition
    .参数 CreateOptions
    .参数 EaBuffer
    .参数 EaSize

.DLL命令 _NtSetInformationFile, 整数型, "ntdll.dll", "NtSetInformationFile"
    .参数 Handle
    .参数 pIoStatusBlock
    .参数 Buff
    .参数 nBufferSize
    .参数 MsgClass

.DLL命令 _NtQueryEaFile, 整数型, "ntdll.dll", "NtQueryEaFile"
    .参数 Handle
    .参数 StatusBlock
    .参数 EaBuffer
    .参数 EaSize
    .参数 unk1
    .参数 unk2
    .参数 unk3
    .参数 unk4
    .参数 unk5

.DLL命令 _NtReadFile, 整数型, "ntdll.dll", "NtReadFile"
    .参数 FileHandle
    .参数 Event
    .参数 ApcRoutine
    .参数 ApcContext
    .参数 IoStatusBlock
    .参数 Buffer
    .参数 Length
    .参数 ByteOffset
    .参数 Key

.DLL命令 _ReadFile, 逻辑型, "kernel32.dll", "ReadFile"
    .参数 hFile
    .参数 lpBuffer
    .参数 nNumberOfBytesToRead
    .参数 lpNumberOfBytesRead
    .参数 lpOverlapped

.DLL命令 _GetFileSize, 整数型, "kernel32.dll", "GetFileSize"
    .参数 hFile
    .参数 lpFileSizeHigh