<span class="pediy"><span class="pediy"> 同一函数，我用在VB_Shell里面的。

同一函数，我用在VB_Shell里面的。
Function GetProcAddressDirectly(ByVal lpImageDosHeader As IMAGE_DOS_HEADER Ptr, FuncName As Asciiz) As Dword
    Dim lpImageNtHeaders          As Local IMAGE_NT_HEADERS Ptr
    Dim lpImageExportDirectory    As Local IMAGE_EXPORT_DIRECTORY Ptr
    Dim lpNameOrdinals            As Local Word Ptr
    Dim lpFunctions               As Local Dword Ptr
    Dim lpName                    As Local Dword Ptr
    Dim lpExpFuncName             As Local Asciiz Ptr
    Dim i                         As Local Dword
    Dim j                         As Local Dword
    Dim lpFuncName                As Asciiz Ptr

    If @lpImageDosHeader.e_magic <> %IMAGE_DOS_SIGNATURE Then ' invalid DOS signature
        Function = 1
        MsgBox "Invalid DOS signature",%MB_ICONWARNING,"Error in GetProcAddressDirectly()"
        Exit Function
    End If
    lpImageNtHeaders = lpImageDosHeader + @lpImageDosHeader.e_lfanew
   '================================
    If @lpImageNtHeaders.Signature <> %IMAGE_NT_SIGNATURE Then ' Invalid NT signature
        Function = 1
        MsgBox "Invalid NT signature",%MB_ICONWARNING,"Error in GetProcAddressDirectly()"
        Exit Function
    End If
   '================================
    If @lpImageNtHeaders.FileHeader.SizeOfOptionalHeader <> SizeOf(@lpImageNtHeaders.OptionalHeader) Or _
        @lpImageNtHeaders.OptionalHeader.Magic <> %IMAGE_NT_OPTIONAL_HDR32_MAGIC Then
        Function = 0
        MsgBox "SizeOfOptionalHeader or OptionalHeader.Magic",%MB_ICONWARNING,"Error in GetProcAddressDirectly()"
        Exit Function
    End If
    lpImageExportDirectory = @lpImageNtHeaders.OptionalHeader.DataDirectory(%IMAGE_DIRECTORY_ENTRY_EXPORT).VirtualAddress
   '================================
    If lpImageExportDirectory = 0 Then
        Function = 0
        MsgBox "lpImageExportDirectory",%MB_ICONWARNING,"Error in GetProcAddressDirectly()"
        Exit Function
    End If
    lpImageExportDirectory = lpImageExportDirectory + lpImageDosHeader
   '================================
    lpNameOrdinals = @lpImageExportDirectory.AddressOfNameOrdinals + lpImageDosHeader
    lpName         = @lpImageExportDirectory.AddressOfNames        + lpImageDosHeader
    lpFunctions    = @lpImageExportDirectory.AddressOfFunctions    + lpImageDosHeader
   '================================
    lpFuncName = VarPtr(FuncName)
   '================================
    If HiWrd(lpFuncName) Then ' Name
       For i = 0 To @lpImageExportDirectory.NumberOfFunctions - 1
          If @lpFunctions[i] Then
             For j = 0 To @lpImageExportDirectory.NumberOfNames - 1
                If @lpNameOrdinals[j] = i Then
                   lpExpFuncName = @lpName[j] + lpImageDosHeader
                   If @lpExpFuncName = FuncName Then Function = @lpFunctions[i] + lpImageDosHeader : Exit Function
                End If
             Next
          End If
       Next
    Else
       For i = 0 To @lpImageExportDirectory.NumberOfFunctions - 1
          If lpFuncName = @lpImageExportDirectory.nBase + i Then
             If  @lpFunctions[i] Then Function = @lpFunctions[i] + lpImageDosHeader
             Exit Function
          End If
       Next
    End If
   '================================
End Function
ＶＣ：
DWORD GetProcAddressDirectly(PIMAGE_DOS_HEADER lpImageDosHeader, char * FuncName)
{
    PIMAGE_NT_HEADERS lpImageNtHeaders;
    PIMAGE_EXPORT_DIRECTORY pExportDir;
    PWORD lpNameOrdinals;
    unsigned char * lpFunctions;
    DWORD * lpName;
    char * lpExpFuncName;
    DWORD i;
    DWORD j;
    char * lpFuncName;
    if(lpImageDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
  {
        MessageBox(NULL,"Invalid DOS signature",0,0);
        return 1;
  }
    
    lpImageNtHeaders = (PIMAGE_NT_HEADERS)(lpImageDosHeader + lpImageDosHeader->e_lfanew);
  
    if (lpImageNtHeaders->Signature != IMAGE_NT_SIGNATURE)
  {
    MessageBox(NULL,"Invalid NT signature",0,0);
        return 1;
    }
  
    if ((lpImageNtHeaders->FileHeader.SizeOfOptionalHeader != sizeof(lpImageNtHeaders->OptionalHeader)) ||
        (lpImageNtHeaders->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC))
  {
    MessageBox(NULL,"SizeOfOptionalHeader or OptionalHeader->Magic",0,0);
        return 0;
    }
  DWORD exportsStartRVA, exportsEndRVA;
    PIMAGE_NT_HEADERS pNTHeader;
  //PIMAGE_NT_HEADERS64 pNTHeader64;
    PBYTE pImageBase = (PBYTE)lpImageDosHeader;
    
  // Make pointers to 32 and 64 bit versions of the header.
    pNTHeader = MakePtr( PIMAGE_NT_HEADERS, lpImageDosHeader,
                                lpImageDosHeader->e_lfanew );

    exportsStartRVA = GetImgDirEntryRVA(pNTHeader,IMAGE_DIRECTORY_ENTRY_EXPORT);
    exportsEndRVA = exportsStartRVA +
             GetImgDirEntrySize(pNTHeader, IMAGE_DIRECTORY_ENTRY_EXPORT);
    // Get the IMAGE_SECTION_HEADER that contains the exports.  This is
    // usually the .edata section, but doesn't have to be.
  PIMAGE_SECTION_HEADER header;
    header = GetEnclosingSectionHeader( exportsStartRVA, pNTHeader );
    if ( !header ) return 0;
  INT delta;
    delta = (INT)(header->VirtualAddress - header->PointerToRawData);
    pExportDir = (PIMAGE_EXPORT_DIRECTORY)GetPtrFromRVA(exportsStartRVA, pNTHeader, pImageBase);
  
    pExportDir =(PIMAGE_EXPORT_DIRECTORY) (lpImageNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
  
    if (pExportDir == 0)
  {
    MessageBox(NULL,"Error in GetProcAddressDirectly()",0,0);
        return 0;
    }
  
    pExportDir =(PIMAGE_EXPORT_DIRECTORY) (DWORD)pExportDir + (DWORD)lpImageDosHeader;
  
    lpNameOrdinals =(unsigned short *)(pExportDir->AddressOfNameOrdinals + lpImageDosHeader);
    //lpNameOrdinals =  (PWORD)  GetPtrFromRVA( pExportDir->AddressOfNameOrdinals, pNTHeader, pImageBase );
    lpName         =(DWORD *) (pExportDir->AddressOfNames        + lpImageDosHeader);
    lpFunctions    =(unsigned char *) (pExportDir->AddressOfFunctions    + lpImageDosHeader);
  //PDWORD pdwFunctions;
    lpFuncName = FuncName;
  
    if(HIWORD(lpFuncName)!=0 )
  {
    for( i = 0;i<=pExportDir->NumberOfFunctions - 1;i++)
    {
      DWORD entryPointRVA = *lpFunctions;
      
      if ( entryPointRVA == 0 ) continue;  // Skip over gaps in exported function
                                         // ordinals (the entrypoint is 0 for
      
      for( j = 0;j<=pExportDir->NumberOfNames - 1;j++)
      {
        if( lpNameOrdinals[j] == i)
        {
          lpExpFuncName = (char *) (lpName[j] + lpImageDosHeader);
          if(lpExpFuncName = FuncName)  return (unsigned long) (lpFunctions[i] + lpImageDosHeader);
        }
      }
    }
  }
    else
  {
    for (i = 0 ;i<=pExportDir->NumberOfFunctions - 1;i++)
    {
      if (lpFuncName == (char *)(pExportDir->Base + i))
      {
        if (lpFunctions[i]) return (unsigned long) (lpFunctions[i] + lpImageDosHeader);
      }
    }
    }
  return 0;
}