MessageBoxA和CreatFileA的调用

#include <windows.h>
#include <stdio.h>

FARPROC  getProcAddress(HMODULE hModuleBase);
DWORD getKernel32();

int EntryMain()
{
    //声明定义GetProcAddress
    typedef FARPROC(WINAPI *FN_GetProcAddress)(
        _In_ HMODULE hModule,
        _In_ LPCSTR lpProcName
        );

    //获取GetProcAddress真实地址
    FN_GetProcAddress fn_GetProcAddress = (FN_GetProcAddress)getProcAddress((HMODULE)getKernel32());


    //声明定义CreateFileA
    typedef HANDLE(WINAPI *FN_CreateFileA)(
            __in     LPCSTR lpFileName,
            __in     DWORD dwDesiredAccess,
            __in     DWORD dwShareMode,
            __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes,
            __in     DWORD dwCreationDisposition,
            __in     DWORD dwFlagsAndAttributes,
            __in_opt HANDLE hTemplateFile
        );
    //将来的替换，地址全部动态获取
    //FN_CreateFileA fn_CreateFileA = (FN_CreateFileA)GetProcAddress(LoadLibrary("kernel32.dll"), "CreateFileA");
    //带引号的字符串打散处理
    char xyCreateFile[] = { 'C','r','e','a','t','e','F','i','l','e','A',0 };
    //动态获取CreateFile的地址
    FN_CreateFileA fn_CreateFileA = (FN_CreateFileA)fn_GetProcAddress((HMODULE)getKernel32(), xyCreateFile);
    char xyNewFile[] = { '1','.','t','x','t','\0'};
    fn_CreateFileA(xyNewFile, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);


    //定义LoadLibraryA
    typedef HMODULE(WINAPI *FN_LoadLibraryA)(
            __in LPCSTR lpLibFileName
        );
    char xyLoadLibraryA[] = { 'L','o','a','d','L','i','b','r','a','r','y','A',0};
    //动态获取LoadLibraryA的地址
    FN_LoadLibraryA fn_LoadLibraryA = (FN_LoadLibraryA)fn_GetProcAddress((HMODULE)getKernel32(), xyLoadLibraryA);


    //定义MessageBoxA
    typedef int (WINAPI *FN_MessageBoxA)(
            __in_opt HWND hWnd,
            __in_opt LPCSTR lpText,
            __in_opt LPCSTR lpCaption,
            __in UINT uType);

            //原来的：MessageBoxA(NULL, "Hello world", "tip", MB_OK);
            char xy_user32[] = { 'u','s','e','r','3','2','.','d','l','l',0 };
            char xy_MessageBoxA[] = { 'M','e','s','s','a','g','e','B','o','x','A',0 };
            FN_MessageBoxA fn_MessageBoxA = (FN_MessageBoxA)fn_GetProcAddress(fn_LoadLibraryA(xy_user32), xy_MessageBoxA);
            char xy_Hello[] = { 'H','e','l','l','o',' ','w','o','r','l','d',0 };
            char xy_tip[] = { 't','i','p' };
            fn_MessageBoxA(NULL, xy_Hello, xy_tip, MB_OK);
            return 0;
}

//内嵌汇编获取Kernel32的地址
__declspec(naked) DWORD getKernel32()
{
    __asm
    {
        mov eax, fs:[30h]
        mov eax, [eax + 0ch]
        mov eax, [eax + 14h]
        mov eax, [eax]
        mov eax, [eax]
        mov eax, [eax + 10h]
        ret
    }
}

//获取GetProcAddress的地址
FARPROC getProcAddress(HMODULE hModuleBase)
{
    PIMAGE_DOS_HEADER lpDosHeader = (PIMAGE_DOS_HEADER)hModuleBase;
    PIMAGE_NT_HEADERS32 lpNtHeader = (PIMAGE_NT_HEADERS)((DWORD)hModuleBase + lpDosHeader->e_lfanew);
    if (!lpNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size) {
        return NULL;
    }
    if (!lpNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) {
        return NULL;
    }
    PIMAGE_EXPORT_DIRECTORY lpExports = (PIMAGE_EXPORT_DIRECTORY)((DWORD)hModuleBase + (DWORD)lpNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
    PDWORD lpdwFunName = (PDWORD)((DWORD)hModuleBase + (DWORD)lpExports->AddressOfNames);
    PWORD lpword = (PWORD)((DWORD)hModuleBase + (DWORD)lpExports->AddressOfNameOrdinals);
    PDWORD lpdwFunAddr = (PDWORD)((DWORD)hModuleBase + (DWORD)lpExports->AddressOfFunctions);

    DWORD dwLoop = 0;
    FARPROC pRet = NULL;
    for (; dwLoop <= lpExports->NumberOfNames - 1; dwLoop++) {
        char* pFunName = (char*)(lpdwFunName[dwLoop] + (DWORD)hModuleBase);

        if (pFunName[0] == 'G'&&
            pFunName[1] == 'e'&&
            pFunName[2] == 't'&&
            pFunName[3] == 'P'&&
            pFunName[4] == 'r'&&
            pFunName[5] == 'o'&&
            pFunName[6] == 'c'&&
            pFunName[7] == 'A'&&
            pFunName[8] == 'd'&&
            pFunName[9] == 'd'&&
            pFunName[10] == 'r'&&
            pFunName[11] == 'e'&&
            pFunName[12] == 's'&&
            pFunName[13] == 's')
        {
            pRet = (FARPROC)(lpdwFunAddr[lpword[dwLoop]] + (DWORD)hModuleBase);
            break;
        }
    }
    return pRet;
}