用VC创建不导入任何DLL的WIN32程序

http://blog.vckbase.com/Files/BastEt/testnodll.zip

VC2003编译，我想用VC6肯定也能编译通过，不过机器上没装，哪个有空帮我看看在VC6下能达到多少字节？

原始文章来自:http://blog.csdn.net/sunwang123456/archive/2005/10/18/508706.aspx

#define WIN32_LEAN_AND_MEAN

#define WINVER 0x0500

#include <windows.h>

//==========================日啊，好麻烦的结构啊，晕死他的BOOLEAN了，搞得不能对齐。==========

#pragma pack(push,8)

typedef struct _PEB_LDR_DATA

{

ULONG Length;

BOOLEAN Initialized;

PVOID SsHandle;

LIST_ENTRY InLoadOrderModuleList;

LIST_ENTRY InMemoryOrderModuleList;

LIST_ENTRY InInitializationOrderModuleList;

} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef struct _UNICODE_STRING

{

USHORT Length;

USHORT MaximumLength;

PWSTR Buffer;

} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _LDR_MODULE {

LIST_ENTRY InLoadOrderModuleList;

LIST_ENTRY InMemoryOrderModuleList;

LIST_ENTRY InInitializationOrderModuleList;

PVOID BaseAddress;

PVOID EntryPoint;

ULONG SizeOfImage;

UNICODE_STRING FullDllName;

UNICODE_STRING BaseDllName;

ULONG Flags;

SHORT LoadCount;

SHORT TlsIndex;

LIST_ENTRY HashTableEntry;

ULONG TimeDateStamp;

} LDR_MODULE, *PLDR_MODULE;

typedef struct RTL_DRIVE_LETTER_CURDIR

{

USHORT Flags;

USHORT Length;

ULONG TimeStamp;

UNICODE_STRING DosPath;

} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;

typedef struct _RTL_USER_PROCESS_PARAMETERS

{

ULONG AllocationSize;

ULONG Size;

ULONG Flags;

ULONG DebugFlags;

HANDLE hConsole;

ULONG ProcessGroup;

HANDLE hStdInput;

HANDLE hStdOutput;

HANDLE hStdError;

UNICODE_STRING CurrentDirectoryName;

HANDLE CurrentDirectoryHandle;

UNICODE_STRING DllPath;

UNICODE_STRING ImagePathName;

UNICODE_STRING CommandLine;

PWSTR Environment;

ULONG dwX;

ULONG dwY;

ULONG dwXSize;

ULONG dwYSize;

ULONG dwXCountChars;

ULONG dwYCountChars;

ULONG dwFillAttribute;

ULONG dwFlags;

ULONG wShowWindow;

UNICODE_STRING WindowTitle;

UNICODE_STRING Desktop;

UNICODE_STRING ShellInfo;

UNICODE_STRING RuntimeInfo;

RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];

} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

typedef VOID (_stdcall *PPEBLOCKROUTINE)(PVOID);

typedef struct _PEB_FREE_BLOCK

{

struct _PEB_FREE_BLOCK* Next;

ULONG Size;

} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;

struct PEB

{

BOOLEAN InheritedAddressSpace;

BOOLEAN ReadImageFileExecOptions;

BOOLEAN BeingDebugged;

BOOLEAN Spare;

HANDLE Mutant;

PVOID ImageBaseAddress;

PPEB_LDR_DATA LoaderData;

PRTL_USER_PROCESS_PARAMETERS ProcessParameters;

PVOID SubSystemData;

PVOID ProcessHeap;

PVOID FastPebLock;

PPEBLOCKROUTINE FastPebLockRoutine;

PPEBLOCKROUTINE FastPebUnlockRoutine;

ULONG EnvironmentUpdateCount;

PVOID *KernelCallbackTable;

PVOID EventLogSection;

PVOID EventLog;

PPEB_FREE_BLOCK FreeList;

ULONG TlsExpansionCounter;

PVOID TlsBitmap;

ULONG TlsBitmapBits[0x2];

PVOID ReadOnlySharedMemoryBase;

PVOID ReadOnlySharedMemoryHeap;

PVOID *ReadOnlyStaticServerData;

PVOID AnsiCodePageData;

PVOID OemCodePageData;

PVOID UnicodeCaseTableData;

ULONG NumberOfProcessors;

ULONG NtGlobalFlag;

BYTE Spare2[0x4];

LARGE_INTEGER CriticalSectionTimeout;

ULONG HeapSegmentReserve;

ULONG HeapSegmentCommit;

ULONG HeapDeCommitTotalFreeThreshold;

ULONG HeapDeCommitFreeBlockThreshold;

ULONG NumberOfHeaps;

ULONG MaximumNumberOfHeaps;

PVOID **ProcessHeaps;

PVOID GdiSharedHandleTable;

PVOID ProcessStarterHelper;

PVOID GdiDCAttributeList;

PVOID LoaderLock;

ULONG OSMajorVersion;

ULONG OSMinorVersion;

ULONG OSBuildNumber;

ULONG OSPlatformId;

ULONG ImageSubSystem;

ULONG ImageSubSystemMajorVersion;

ULONG ImageSubSystemMinorVersion;

ULONG GdiHandleBuffer[0x22];

ULONG PostProcessInitRoutine;

ULONG TlsExpansionBitmap;

BYTE TlsExpansionBitmapBits[0x80];

ULONG SessionId;

};

typedef struct _CLIENT_ID

{

HANDLE UniqueProcess;

HANDLE UniqueThread;

} CLIENT_ID, *PCLIENT_ID;

typedef struct _GDI_TEB_BATCH

{

ULONG Offset;

ULONG HDC;

ULONG Buffer[0x136];

} GDI_TEB_BATCH, *PGDI_TEB_BATCH;

struct TEB

{

NT_TIB Tib; /* 00h */

PVOID EnvironmentPointer; /* 1Ch */

CLIENT_ID Cid; /* 20h */

PVOID ActiveRpcInfo; /* 28h */

PVOID ThreadLocalStoragePointer; /* 2Ch */

PEB *Peb; /* 30h */

ULONG LastErrorValue; /* 34h */

ULONG CountOfOwnedCriticalSections; /* 38h */

PVOID CsrClientThread; /* 3Ch */

void* Win32ThreadInfo; /* 40h */

ULONG Win32ClientInfo[0x1F]; /* 44h */

PVOID WOW32Reserved; /* C0h */

LCID CurrentLocale; /* C4h */

ULONG FpSoftwareStatusRegister; /* C8h */

PVOID SystemReserved1[0x36]; /* CCh */

PVOID Spare1; /* 1A4h */

LONG ExceptionCode; /* 1A8h */

UCHAR SpareBytes1[0x28]; /* 1ACh */

PVOID SystemReserved2[0xA]; /* 1D4h */

GDI_TEB_BATCH GdiTebBatch; /* 1FCh */

ULONG gdiRgn; /* 6DCh */

ULONG gdiPen; /* 6E0h */

ULONG gdiBrush; /* 6E4h */

CLIENT_ID RealClientId; /* 6E8h */

PVOID GdiCachedProcessHandle; /* 6F0h */

ULONG GdiClientPID; /* 6F4h */

ULONG GdiClientTID; /* 6F8h */

PVOID GdiThreadLocaleInfo; /* 6FCh */

PVOID UserReserved[5]; /* 700h */

PVOID glDispatchTable[0x118]; /* 714h */

ULONG glReserved1[0x1A]; /* B74h */

PVOID glReserved2; /* BDCh */

PVOID glSectionInfo; /* BE0h */

PVOID glSection; /* BE4h */

PVOID glTable; /* BE8h */

PVOID glCurrentRC; /* BECh */

PVOID glContext; /* BF0h */

LONG LastStatusValue; /* BF4h */

UNICODE_STRING StaticUnicodeString; /* BF8h */

WCHAR StaticUnicodeBuffer[0x105]; /* C00h */

PVOID DeallocationStack; /* E0Ch */

PVOID TlsSlots[0x40]; /* E10h */

LIST_ENTRY TlsLinks; /* F10h */

PVOID Vdm; /* F18h */

PVOID ReservedForNtRpc; /* F1Ch */

PVOID DbgSsReserved[0x2]; /* F20h */

ULONG HardErrorDisabled; /* F28h */

PVOID Instrumentation[0x10]; /* F2Ch */

PVOID WinSockData; /* F6Ch */

ULONG GdiBatchCount; /* F70h */

USHORT Spare2; /* F74h */

BOOLEAN IsFiber; /* F76h */

UCHAR Spare3; /* F77h */

ULONG Spare4; /* F78h */

ULONG Spare5; /* F7Ch */

PVOID ReservedForOle; /* F80h */

ULONG WaitingOnLoaderLock; /* F84h */

ULONG Unknown[11]; /* F88h */

PVOID FlsSlots; /* FB4h */

PVOID WineDebugInfo; /* Needed for WINE DLL's */

};

#pragma pack(pop)

#pragma comment(linker,"/merge:.rdata=.data")

#pragma comment(linker,"/merge:.text=.data")

inline bool mystrcmp (const char * src,const char * dst)

{

int ret = 0 ;

while( ! (ret = *(unsigned char *)src - *(unsigned char *)dst) && *dst)

++src, ++dst;

return ret==0;

}

unsigned int GetFunctionByName(unsigned int ImageBase,const char*FuncName)

{

IMAGE_DOS_HEADER *pdoshdr=(IMAGE_DOS_HEADER *)ImageBase;

PIMAGE_NT_HEADERS32 pnthdr=(PIMAGE_NT_HEADERS32)(ImageBase+pdoshdr->e_lfanew);

if(pnthdr->Signature!=IMAGE_NT_SIGNATURE)

return 0;

PIMAGE_DATA_DIRECTORY pidd=&pnthdr->OptionalHeader.DataDirectory[0];

IMAGE_EXPORT_DIRECTORY *pied=(IMAGE_EXPORT_DIRECTORY *)(ImageBase+pidd->VirtualAddress);

LONG *pfuncnames=(LONG *)(ImageBase+pied->AddressOfNames);

for(unsigned int i=0;i<pied->NumberOfNames;i++)

{

PSTR pfunc=(PSTR)(ImageBase+pfuncnames[i]);

if(mystrcmp(pfunc,FuncName))

{

WORD *EOT=(WORD *)(pied->AddressOfNameOrdinals+ImageBase);

LONG *EAT=(LONG *)(pied->AddressOfFunctions+ImageBase);

int index=EOT[i];

return (ImageBase+EAT[index]);

}

}

return 0;

}

typedef HMODULE (WINAPI *TLoadLibraryA)(LPCSTR lpFileName);

typedef BOOL (WINAPI *TFreeLibrary)(HMODULE hModule);

typedef void (WINAPI *TExitProcess)(UINT uExitCode);

typedef int (WINAPI *TMessageBox)(HWND hWnd,LPCSTR lpText,LPCSTR lpCaption,UINT uType);

extern "C" void WinMainCRTStartup()

{

unsigned int kernel32imagebase,user32imagebase;

char title[]="ddd&&*U( sunwang need beauty %^%&*";

char caption[]="hack";

char user32[]="user32";

TEB *pteb=NULL;

__asm mov eax,fs:[18h]

__asm mov pteb,eax

PEB *ppeb=pteb->Peb;

PPEB_LDR_DATA pldr=ppeb->LoaderData;

PLDR_MODULE pmodule=(PLDR_MODULE)pldr->InLoadOrderModuleList.Flink;

PLDR_MODULE pntdllmodule=(PLDR_MODULE)pmodule->InLoadOrderModuleList.Flink;

PLDR_MODULE pkernel32module=(PLDR_MODULE)pntdllmodule->InLoadOrderModuleList.Flink;

kernel32imagebase=(unsigned int)pkernel32module->BaseAddress;

TLoadLibraryA pLoadLibraryA=(TLoadLibraryA)GetFunctionByName(kernel32imagebase,"LoadLibraryA");

TFreeLibrary pFreeLibrary=(TFreeLibrary)GetFunctionByName(kernel32imagebase,"FreeLibrary");

TExitProcess pExitProcess=(TExitProcess)GetFunctionByName(kernel32imagebase,"ExitProcess");

user32imagebase=(unsigned int)pLoadLibraryA(user32);

TMessageBox pMessageBox=(TMessageBox)GetFunctionByName(user32imagebase,"MessageBoxA");

pMessageBox(NULL,title,caption,MB_OK);

pFreeLibrary((HMODULE)user32imagebase);

pExitProcess(0);

}

Trackback: http://tb.donews.net/TrackBack.aspx?PostId=596178
[点击此处收藏本文
] 发表于2005年10月21日 9:46 AM

function hide(){showComment();}

wakeman
发表于2005-12-28 10:40 AM IP: 221.235.61.*
vc6下编译通不过

unresolved external symbol __chkesp

应该是哪个地方缓冲区定义超过了**字节把，大概是4000个字节左右

懒得追究了

呵呵

009 发表于2006-03-04 10:49 PM IP: 219.236.72.*
我VC6可以的

--------------------Configuration: main - Win32 Debug--------------------

Compiling...

main.cpp

NOTE: WINVER has been defined as 0x0500 or greater which enables

Windows NT 5.0 and Windows 98 features. When these headers were released,

Windows NT 5.0 beta 1 and Windows 98 beta 2.1 were the current versions.

For this release when WINVER is defined as 0x0500 or greater, you can only

build beta or test applications. To build a retail application,

set WINVER to 0x0400 or visit http://www.microsoft.com/msdn/sdk
to see if retail Windows NT 5.0 or Windows 98 headers are available.

See the SDK release notes for more information.

Linking...

LINK : warning LNK4078: multiple ".data" sections found with different attributes (40000040)

LINK : warning LNK4078: multiple ".data" sections found with different attributes (60000020)

main.exe - 0 error(s), 0 warning(s)

Shilyx
发表于2007-06-16 10:55 AM IP: 202.110.209.*
我用VC6编译的是1636字节大小

发表于2007-06-16 10:55 AM IP: 202.110.209.*
是1536

Star 发表于2008-04-15 7:06 PM IP: 218.5.3.*
函数mystrcmp()改一下

inline bool mystrcmp(const char 8src, const char *dst)

{

while(*dst) if(*src++!=*dst++) return 0;

return 1;

}

2003下编译是1024字节,改之前是1536字节.因为这个函数节省了几个字节,整体刚好可以少了filealignment=0x200个字节.