vb6内联汇编，调用函数指针，不注册调用com

分类：VB作者：佚名

vb6执行汇编代码一般是使用CallWindowProc，这个方法有参数限制，内部还会执行一些其它调用再到函数指针，我用它调用com里面的“DllGetClassObject”函数时居然出错了，不知道怎么回事，于是乎寻求其它办法，用vc写个dll调用函数指针挺好用的，可惜多了个dll文件。后来采取修改vb模块内函数代码，用AddressOf获取vb函数地址后，再用VirtualProtect修改权限，这样就可以用CopyMemory把汇编代码复制过来，可谓偷梁换柱啊，以后执行这个vb函数就直接运行汇编代码了，不过ide下没效果，得生成exe文件才行，这样就不好调试了。

在网上看到了一种神奇的方法，手动构造一个类，将汇编代码的运行地址写进vtable，前三个方法是IUnknown接口的方法：

HRESULT QueryInterface([in] IID *riid,[in,out] IUnknown **ppvObject);
long AddRef();
long Release();

后面的方法就随意了，我添加了10个调用函数地址的方法，分别对应0个参数-9个参数的呼叫，而且不区分stdcall和cdecl调用约定，ide状态下也正常。

原贴地址：http://demon.tw/programming/vb6-repick-inline-assembly.html

最初只是想不注册调用com，没想折腾出这些东西来的，这是我改过的代码，欢迎测试

Option Explicit

Private Type CLSID
    d1 As Long
    d2 As Integer
    d3 As Integer
    d4(7) As Byte
End Type

Public Declare Function LoadLibraryW Lib "Kernel32.dll" (ByVal lpFileName As Long) As Long
Public Declare Function GetProcAddress Lib "Kernel32.dll" (ByVal hModule As Long,ByVal lpProcName As String) As Long
Public Declare Function CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByVal Destination As Long,ByVal Source As Long,ByVal Length As Long) As Long
Public Declare Function VirtualProtect Lib "kernel32" (ByVal lpAddress As Any,ByVal dwSize As Long,ByVal flNewProtect As Long,lpflOldProtect As Long) As Long
Public Declare Function CLSIDFromString Lib "ole32.dll" (ByVal lpsz As Long,pclsid As Long) As Long
Declare Function CallWindowProcA Lib "user32.dll" (ByVal lpPrevWndFunc As Long,ByVal hWnd As Long,ByVal Msg As Long,ByVal wParam As Long,ByVal lParam As Long) As Long

Dim m_cthis As Long
Dim m_vtab(20) As Long
Dim m_acode(100) As Long
Dim m_ICallFunAddr As ICallFunAddr

'member索引从0开始，IUnknown3个成员函数，IDispatch4个成员函数，IClassFactory.CreateInstance在3号位置
Public Function GetClassMemberAddr(ByVal cthis As Long,ByVal member As Long) As Long
    Dim vtab As Long
    Dim fun As Long
    CopyMemory VarPtr(vtab),ByVal cthis,4
    CopyMemory VarPtr(fun),ByVal vtab + member * 4,4
    GetClassMemberAddr = fun
End Function

Public Function Dll_GetClassObject(dllname As String,sclsid As String,siid As String) As Object
Dim dll As Long
Dim hr As Long
Dim clsid_icf As CLSID
Dim clsid_cls As CLSID
Dim clsid_iid As CLSID
Dim icf As IClassFactory
Dim funDllGetClassObject As Long
Dim funCreateInstance As Long
Dim funRelease As Long
Dim calladdr As ICallFunAddr
    Set calladdr = MakeCallFunAddrObj
    dll = LoadLibraryW(StrPtr(dllname))
    If dll > 0 Then
        funDllGetClassObject = GetProcAddress(dll,"DllGetClassObject")
        If funDllGetClassObject > 0 Then
            hr = CLSIDFromString(StrPtr("{00000001-0000-0000-C000-000000000046}"),clsid_icf.d1)
            hr = CLSIDFromString(StrPtr(sclsid),clsid_cls.d1)
            hr = CLSIDFromString(StrPtr(siid),clsid_iid.d1)
            'hr = CallWindowProcA(funDllGetClassObject,VarPtr(clsid_cls.d1),VarPtr(clsid_icf.d1),VarPtr(icf),0)
            hr = calladdr.arg3(funDllGetClassObject,VarPtr(icf))
            hr = icf.CreateInstance(0,VarPtr(clsid_iid.d1),Dll_GetClassObject)
            'funCreateInstance = GetClassMemberAddr(icf,3)
            'funRelease = GetClassMemberAddr(icf,2)
            'hr = calladdr.arg4(funCreateInstance,icf,VarPtr(Dll_GetClassObject))
            'hr = calladdr.arg1(funRelease,icf)
            'MsgBox TypeName(obj)
        End If
        'FreeLibrary dll
    Else
        MsgBox "dll加载失败"
    End If
End Function

'以下代码为一个参数的例子
'00401508 >    55            PUSH EBP
'00401509      8BEC          MOV EBP,ESP
'0040150B      FF75 10       PUSH DWORD PTR SS:[EBP+10]
'0040150E      FF55 0C       CALL DWORD PTR SS:[EBP+C]
'00401511      C9            LEAVE
'00401512      C2 0C00       RETN C
'call方式stdcall和cdecl都可以
'在pcode地址处写入汇编代码，argc压入的参数个数，返回汇编长度
Public Function MakeCallFunAddrCode(ByVal pcode As Long,ByVal argc As Long) As Long
    Dim n As Long
    Dim p As Long
    Dim code As Long
    
    p = pcode
    'push ebp
    code = &HEC8B55
    CopyMemory p,VarPtr(code),3
    p = p + 3
    'push arg
    For n = argc To 1 Step -1
        code = (n * 4 + 12) * &H10000 + &H75FF
        CopyMemory p,3
        p = p + 3
    Next
    'call
    code = &HC55FF
    CopyMemory p,3
    p = p + 3
    'leave retn
    code = (argc * 4 + 8) * &H10000 + &HC2C9&
    CopyMemory p,4
    p = p + 4
    'nop
    code = &H90909090
    n = 4 - p Mod 4 '为以后的代码4字节对齐，代码前后都加入nop
    CopyMemory p,n
    MakeCallFunAddrCode = p + n - pcode
End Function

'    function QueryInterface(riid:^GUID; out ppvObj:^^void);
'    function AddRef: UI4;
'    function Release: UI4;
'00401480 >    8B4424 04     MOV EAX,DWORD PTR SS:[ESP+4]
'00401484      8B4C24 0C     MOV ECX,DWORD PTR SS:[ESP+C]
'00401488 >    8901          MOV DWORD PTR DS:[ECX],EAX
'0040148A      33C0          XOR EAX,EAX
'0040148C      C2 0C00       RETN 0C
'0040148F      90            NOP
'00401490      33C0          XOR EAX,EAX
'00401492      40            INC EAX
'00401493      C2 0400       RETN 4
Public Function MakeCallFunAddrObj() As ICallFunAddr
    Dim n As Long
    Dim p As Long
    Dim narg As Long
    Dim nfun As Long
    
    If Not m_ICallFunAddr Is Nothing Then
        Set MakeCallFunAddrObj = m_ICallFunAddr
        Exit Function
    End If
    
    m_cthis = VarPtr(m_vtab(0))
    'QueryInterface
    m_acode(0) = &H424448B
    m_acode(1) = &HC244C8B
    m_acode(2) = &HC0330189
    m_acode(3) = &H90000CC2
   'AddRef Release共用
    m_acode(4) = &HC240C033
    m_acode(5) = &H90900004
    
    m_vtab(0) = VarPtr(m_acode(0))
    m_vtab(1) = VarPtr(m_acode(4))
    m_vtab(2) = m_vtab(1)
    
    p = VarPtr(m_acode(6))
    nfun = 3
    For narg = 0 To 9
        n = MakeCallFunAddrCode(p,narg)
        m_vtab(nfun) = p
        p = p + n
        nfun = nfun + 1
    Next
    
    p = VarPtr(m_cthis)
    CopyMemory VarPtr(m_ICallFunAddr),VarPtr(p),4
    Set MakeCallFunAddrObj = m_ICallFunAddr
End Function


以下是调用测试

Dim m_ICallFunAddr As ICallFunAddr

Private Sub Test_com()
Dim obj As Object
    Set obj = Dll_GetClassObject("D:\Administrator\Documents\VB6.0\内联汇编_类成员函数调用\aatest2.dll","{6D926E71-56E7-467D-B64F-E7571EF1B806}","{B1F1024A-7CF1-44C8-B34B-B7BE383F4825}")
    MsgBox TypeName(obj)
    obj.testadd 1,2,"abc"
End Sub

Public Sub Test_CallClassMember()
    Dim fun As Long
    Dim c As New Class1
    Dim p As Long
    Dim n As Long
    p = ObjPtr(c)
    fun = GetClassMemberAddr(p,7)
    n = 3
    m_ICallFunAddr.arg3 fun,p,1,VarPtr(n)
End Sub

'中断
Sub Test_int3()
    Dim code As Long
    code = &H9090C3CC
    m_ICallFunAddr.Arg0 VarPtr(code)
End Sub

Sub Test_CallFunAddr()
    Dim dll As Long
    Dim addr As Long
    Dim buf As String
    Dim n As Long
    Dim s As String
    
    buf = String(500,"0")
    dll = LoadLibraryW(StrPtr("user32.dll"))
    addr = GetProcAddress(dll,"wsprintfW")
    'cdecl方式
    n = m_ICallFunAddr.arg4(addr,StrPtr(buf),StrPtr("字符串:%s,数字%d"),StrPtr("中文12345+"),1234)
    addr = GetProcAddress(dll,"MessageBoxW")
    'stdcall方式
    m_ICallFunAddr.arg4 addr,Me.hWnd,StrPtr("MessageBoxW"),vbOKCancel
    s = Left(buf,n)
    s = "长度:" & n & vbCrLf & s
    MsgBox s
End Sub

Private Sub Form_Load()
    Set m_ICallFunAddr = MakeCallFunAddrObj
    Test_com
    'Test_CallClassMember
    'Test_int3
    'Test_CallFunAddr
End Sub


类型库，用vc6的mktyplib生成

[
    uuid(2399BACC-768E-4e37-8B98-80EC39BE4772)
]
library tlb_callFunAddr
{
	importlib("stdole2.tlb");

	[uuid(316462C8-FDBA-45f7-856B-325C1AD39737),odl]
	interface ICallFunAddr : IUnknown
	{
		long Arg0([in] long addr);
		long Arg1([in] long addr,[in] long arg1);
		long Arg2([in] long addr,[in] long arg1,[in] long arg2);
		long Arg3([in] long addr,[in] long arg2,[in] long arg3);
		long Arg4([in] long addr,[in] long arg3,[in] long arg4);
		long Arg5([in] long addr,[in] long arg4,[in] long arg5);
		long Arg6([in] long addr,[in] long arg5,[in] long arg6);
		long Arg7([in] long addr,[in] long arg6,[in] long arg7);
		long Arg8([in] long addr,[in] long arg7,[in] long arg8);
		long Arg9([in] long addr,[in] long arg8,[in] long arg9);
	};

	[uuid(00000001-0000-0000-C000-000000000046),odl]
	interface IClassFactory : IUnknown
	{
		long CreateInstance([in] long pUnkOuter,[in] long riid,[in] IUnknown** ppvObject);
		long LockServer([in] long fLock);
	};
};


clsid我是用eXeScope查看的，挺好用的一个软件，汇编是ollydbg里面打的，也用它调试。

vb6生成的pdb调试文件貌似每次生成新的，要手动删除以前的，害我调试错乱，花了好多时间。

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。

相关推荐

VB Format函数
Format[$] ( expr [ , fmt ] ) format 返回变体型 format$ 强制返回为文本 -------------------------------- 数字类型的格式化 --------------------------------     固定格式参数：     General Number 普通数字，如可以用来去掉千位分隔号     format$("100,1
vb6/ASP FORMAT MM/DD/YYYY
VB6或者ASP 格式化时间为 MM/dd/yyyy 格式，竟然没有好的办法， Format 或者FormatDateTime 竟然结果和系统设置的区域语言的日期和时间格式相关。意思是尽管你用诸如 Format(Now, "MM/dd/yyyy")，如果系统的设置格式区域语言的日期和时间格式分隔符是"-",那他还会显示为 MM-dd-yyyy     只有拼凑： <%response.write
VB.net 捕获项目全局异常
在项目中添加如下代码：新建窗口来显示异常信息。 Namespace My ‘全局错误处理，新的解决方案直接添加本ApplicationEvents.vb 到工程即可 ‘添加后还需要一个From用来显示错误。如果到这步还不会则需要先打好基础啦 ‘======================================================== ‘以下事件
实现用VB.Net/(C#)开发K/3 BOS 插件的真正可行方法
转了这一篇文章，原来一直想用C#做k3的插件开发，vb没有C#用的爽呀，这篇文章写与2011年，看来我以前没有认真去找这个方法呀。 https://blog.csdn.net/chzjxgd/article/details/6176325 金蝶K3 BOS的插件官方是用VB6编写的，如果  能用.Net下的语言工具开发BOS插件是一件很愉快的事情，其中缘由不言而喻，而本文则是个人首创，实现在了用V
vb，wps，excel 分裂
Sub 分列() ‘以空格为分隔符，连续空格只算1个。对所选中的单元格进行处理 Dim m As Range, tmpStr As String, s As String Dim x As Integer, y As Integer, subStr As String If MsgBox("确定要分列处理吗？请确定分列的数据会覆盖它后面的单元格！", _
VB文件 hash 查看器
  窗体代码 1 Private Sub Text1_OLEDragDrop(Data As DataObject, Effect As Long, Button As Integer, Shift As Integer, X As Single, Y As Single) 2 Dim path As String, hash As String 3 For Each fil
VB.NET MYSQL DataGridView 增删改查INSERT,SELECT,UPDATE,DELETE
  Imports MySql.Data.MySqlClient Public Class Form1 ‘ GLOBAL DECLARATIONS Dim conString As String = "Server=localhost;Database=net2;Uid=root;Pwd=123456;" Dim con As New MySqlConnection
VB.NET 使用ADODB連接資料庫滙出到EXCEL
‘導入命名空間 Imports ADODB Imports Microsoft.Office.Interop   Private Sub A1() Dim Sql As String Dim Cnn As New ADODB.Connection Dim Rs As New ADODB.Recordset Dim S As String   S = "Provider=OraOLEDB.Oracl
vb.net 多线程運用 ping
Imports System.IO Imports System.Threading Imports System.Diagnostics Public Class Form1 Dim A(254) As String    Function ping(ByVal IP As Integer) As String Dim IPAddress As String IPAddress = "10.0.
VB等待进程结束
VB运行EXE程序，并等待其运行结束 参考：https://blog.csdn.net/useway/article/details/5494084 Private Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long Pr
vb中去掉string数组的一部分
今天碰到一个问题，登陆的时候，如果不需要验证手机号为空，则不去验证手机号 因为登陆的时候所有的验证信息都存放在一个数组里 Dim CheckUserInfo() As String ={UserBirthday, SecEmail, UserMob, UserSex, RealNameFirst, RealName, CheckCardID, CheckCardType, Contactemail
VB如何连接SQL Server数据库
在VB6.0中，数据访问接口有三种： 1、ActiveX数据对象（ADO） 2、远程数据对象（RDO） 3、数据访问对象（DAO） 1.使用ADO（ActiveX Data Objec，ActiveX数据对象）连接SQL Server 1）使用ADO控件连接 使用ADO控件的ConnectionString属性就可以连接SQL Server，该属性包含一个由分号分隔的argument=value语
Visual Basic 6.0VB6.0详细安装过程
注：大家如果没有VB6.0的安装文件，可自行百度一下下载，一般文件大小在200M左右的均为完整版的软件，可以使用。   特别提示：安装此软件的时候最好退出360杀毒软件（包括360安全卫士，电脑管家等，如果电脑上有这些软件的话），因为现如今的360杀毒软件直接会对VB6.0软件误报，这样的话就可能会在安装过程中被误报阻止而导致安装失败，或者是安装后缺乏很多必须的组件（其它的杀毒软件或安全卫士之类的
使用VB6读取数据库资源并发送邮件原创
Private Sub Form_Load() Call conndb End Sub Private Function conndb() Dim cn As New ADODB.Connection Dim rs As New ADODB.Recordset Dim strCn, sql As String Dim db_host As String Dim db_user As String
POS VB
  PPSM06S70:  Add  moddate  EDITSPRINTJOB:  MAX(TO_CHAR(ETRN.MODDATE, ‘yyyy/mm/dd/HH24:MI AM‘)) ACTUAL_SHIPDATE   4.Test Scenario (1) ：Query SQL Test DN:8016578337 SELECT CTRN.TKCTID TRUCK_ID,        
vb.net 水晶報表CrystalReport 動態設定資料庫來源
  沒有出現CrystalReportViewer時,須安裝CRforVS_13_0. 新增1個數據集,新增1個數據表,添加二列,列名要和資料庫名一樣. 修改目標Framework 修改app.config, <startup >改成<startup useLegacyV2RuntimeActivationPolicy ="true">  CrystalReport1.rpt增加數據庫專家 在表單
VB.net 与线程
Imports System.Threading Imports System Public Class Form1 Dim th1, th2 As Thread Public Sub Method1() Dim i As Integer For i = 1 To 100 If Me.Label1.BackColor =
vb.net Process32First和Module32First
Friend Const PROCESS_ALL_ACCESS = &H1F0FFF = 2035711 Friend Const PROCESS_VM_READ = &H10 Friend Const PROCESS_VM_WRITE = &H20 Friend Const PAGE_READONLY = &H2 Friend Const PAGE_READWRITE = &H4 Friend
vb.net 分割byte数组的方法SplitBytes
以下代码随手写的 并没有大量测试 效率也有待提升 如果需要C#的请自行转换 Function SplitBytes(Data As Byte(), Delimiter As Byte()) As List(Of Byte()) Dim i = 0 Dim List As New List(Of Byte()) Dim bytes As New
VB.NET连接SQL_Server实例
Imports System.Data.SqlClient Public Class Form1 REM Public conn1 As SqlConnection = New SqlConnection("server=.; Integrated Security=False;Initial Catalog= mydatabase1; User ID= sa;password")
pythonJavaScriptjavaHTMLPHPreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-boot