百思不解，特种形态的DLL被外部EXE调用的问题！

冥界3大法王

@only998
正好老兄在场，借机问个同类型的问题吧！

我的设计是这样的：
通过DLL（x64dbg的*.dp64）连接上之后，我外部*.exe能不能执行 DbgCmdExec(PAnsiChar(AnsiString('StepOver')));

我那个是*.dpr (生成x64dbg的*.dp64 【其实就是特种形态的DLL】)
我写把过程弄好之后，弄了一个导出函数。

[Delphi] 纯文本查看 复制代码

library MoreTool;
{$RTTI EXPLICIT METHODS([]) PROPERTIES([]) FIELDS([])}
{$WEAKLINKRTTI ON}

uses
  Windows,
  Messages,
  vcl.Forms,
  bridgemain in 'plugin\bridgemain.pas',
  _plugins in 'plugin\_plugins.pas';

{$ALIGN 1}
        {$WARN UNSAFE_CODE OFF}
        {$WARN UNSAFE_TYPE OFF}
        {$WARN UNSAFE_CAST OFF}
  {$IFDEF WIN64}
  {$E dp64}
  {$ELSE}
  {$E dp32}
  {$ENDIF}

var
  SaveDLLProc: TDLLProc;
  g_pluginHandle: THandle = 0;
  g_hMenu: Cardinal = 0;
  g_hMenuDisasm: Cardinal = 0;
  g_Inst: Cardinal = 0;
  g_hWnD: Cardinal = 0;
  g_loadedname: array[0..8] of PAnsiChar;

function ShellExecuteA(hWnd: hWnd; Operation, FileName, Parameters, Directory: PAnsiChar; ShowCmd: Integer): HINST; stdcall; external 'shell32.dll' name 'ShellExecuteA';

const
  PLUGIN_NAME: PAChar = 'MoreTool';
  PLUGIN_AUTH: PAChar = 'remek002';
  PLUGIN_VERS: Integer = 01;
  MENU_CALC = 1;
  MENU_NOTEPAD = 2;
  MENU_DISASM_CALC = 3;
  MENU_DISASM_NOTEPAD = 4;

{$R MoreTool.res}

procedure RegisterInitProc(cbType: cbType; callbackInfo: Pointer); cdecl;
var
  info: PPLUG_CB_INITDEBUG;
begin
  ZeroMemory(@g_loadedname, SizeOf(g_loadedname));
  info := PPLUG_CB_INITDEBUG(callbackInfo);
  g_loadedname[0] := info^.szFileName;
  BridgeSettingSet('Last File', 'Last', g_loadedname[0]);
end;

procedure RegisterMenuProc(cbType: cbType; callbackinfo: Pointer); cdecl;
var
  info: PPLUG_CB_MENUENTRY;
begin
  info := PPLUG_CB_MENUENTRY(callbackinfo);
  case (info^.hEntry) of
    MENU_CALC:
      begin
        ShellExecuteA(GuiGetWindowHandle, 'OPEN', 'calc.exe', '', 'C:\Windows\system32', SW_SHOWNORMAL);
      end;
    MENU_NOTEPAD:
      begin
        ShellExecuteA(GuiGetWindowHandle, 'OPEN', 'notepad.exe', '', 'C:\Windows\system32', SW_SHOWNORMAL);
      end;
    MENU_DISASM_CALC:
      begin
        ShellExecuteA(GuiGetWindowHandle, 'OPEN', 'calc.exe', '', 'C:\Windows\system32', SW_SHOWNORMAL);
      end;
    MENU_DISASM_NOTEPAD:
      begin
        ShellExecuteA(GuiGetWindowHandle, 'OPEN', 'notepad.exe', '', 'C:\Windows\system32', SW_SHOWNORMAL);
      end;
  end;
end;

function calc(argc: Integer; argv: PPAnsiChar): Boolean; cdecl;
begin
  ShellExecuteA(GuiGetWindowHandle, 'OPEN', 'calc.exe', '', 'C:\Windows\system32', SW_SHOWNORMAL);
end;

function notepad(argc: Integer; argv: PPAnsiChar): Boolean; cdecl;
begin
  ShellExecuteA(GuiGetWindowHandle, 'OPEN', 'notepad.exe', '', 'C:\Windows\system32', SW_SHOWNORMAL);
end;

function x_dbg_Plugininit(PlugInitInfo: PPLUG_INITSTRUCT): Boolean; cdecl;
begin
  g_pluginHandle := PlugInitInfo^.pluginHandle;               //Address: 0043E7DC
  PlugInitInfo^.sdkVersion := PLUG_SDKVERSION;
  PlugInitInfo^.PluginVersion := PLUGIN_VERS;
  lstrcpyA(PlugInitInfo^.pluginName, PLUGIN_NAME);
  _plugin_registercallback(g_pluginHandle, CB_MENUENTRY, RegisterMenuProc);
  _plugin_registercallback(g_pluginHandle, CB_INITDEBUG, RegisterInitProc);
  Result := True;
end;

procedure x_dbg_Pluginsetup(PlugSetupInfo: PPLUG_SETUPSTRUCT); cdecl;
begin
  g_hMenu := PlugSetupInfo^.hMenu;
  g_hMenuDisasm := PlugSetupInfo^.hMenuDisasm;

  _plugin_menuaddentry(g_hMenuDisasm, MENU_DISASM_CALC, 'Open Calc');
  _plugin_menuaddseparator(g_hMenuDisasm);
  _plugin_menuaddentry(g_hMenuDisasm, MENU_DISASM_NOTEPAD, 'Open Notepad');

  _plugin_menuaddentry(g_hMenu, MENU_CALC, 'Open Calc');
  _plugin_menuaddseparator(g_hMenu);
  _plugin_menuaddentry(g_hMenu, MENU_NOTEPAD, 'Open Notepad');

  if not (_plugin_registercommand(g_pluginHandle, 'Calc', calc, false)) then
    _plugin_logputs('[MapMaster] ErroR Registering The "Calc" command! ');
  if not (_plugin_registercommand(g_pluginHandle, 'Notepad', notepad, false)) then
    _plugin_logputs('[MapMaster] ErroR Registering The "Notepad" command! ');
  // Add Plugin info
  _plugin_logprintf('[***] %s Plugin v%i by %s '#10, PLUGIN_NAME, PLUGIN_VERS, PLUGIN_AUTH);
end;

function x_dbg_plugstop(): Boolean; cdecl;
begin
  //
  _plugin_unregistercallback(g_pluginHandle, CB_MENUENTRY);
  _plugin_unregistercallback(g_pluginHandle, CB_INITDEBUG);
  Result := True;
end;

procedure Super; stdcall;
begin
  Application.MessageBox(PWideChar('我被调用啦！！！'), PWideChar('你好'), 0);     ===>这句没问题被执行了！
  DbgCmdExec(PAnsiChar(AnsiString('StepOver')));                                           ========》这句死活没动静！
end;

exports
  Super,                                                    ============>导出了！
  x_dbg_Plugininit name 'pluginit',
  x_dbg_Pluginsetup name 'plugsetup',
  x_dbg_plugstop name 'plugstop';

procedure DLLEntryPoint(dwReason: DWORD);
var
  szPluginName: array[0..MAX_PATH - 1] of ACHAR;
begin
  if (dwReason = DLL_PROCESS_DETACH) then
  begin
    lstrcatA(szPluginName, PLUGIN_NAME);
    lstrcatA(szPluginName, ' Unloaded By DLL_PROCESS_DETACH');
    OutputDebugStringA(szPluginName);
  end;
  if Assigned(SaveDLLProc) then
    SaveDLLProc(dwReason);
end;

begin
  g_Inst := HInstance;
  SaveDLLProc := @DLLProc;
  DLLProc := @DLLEntryPoint;
  Application.MessageBox(PWideChar('执行成功'), PWideChar('你好'), 0);
end.

主程序 Project.exe中调用DLL的代码是：

[mw_shl_code=delphi,true]unit Unit2;
interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants,
  System.Classes, Vcl.Graphics, Vcl.Controls, Vcl.Forms, Vcl.Dialogs,
  Vcl.StdCtrls;

type
  TForm2 = class(TForm)
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form2: TForm2;

implementation

uses
  bridgemain, _plugins;

{$R *.dfm}

procedure TForm2.Button1Click(Sender: TObject);   {下面是调用的关键代码}
var
  My: procedure; stdcall;
var
  Hand: Cardinal;
begin
  Hand := LoadLibrary('C:\Users\Administrator\Desktop\Mdebug32\x64dbg_2023-08-01\x64\plugins\MoreTool.dp64');
  if Hand <> 0 then
  begin
    ShowMessage(Hand.ToString);
    My := GetProcAddress(Hand, 'Super');
//    DbgCmdExec(PAnsiChar(AnsiString('StepOver')));    直接调用肯定完犊子！！！
  end;

end;

end.

冥界3大法王

f637hgfq 发表于 2023-8-11 11:21
好帖，给楼主点赞

好在哪呢？

bester

你loadlibrary把dll加载到你的进程空间里面，你的进程空间不存在DbgCmdExec，就这么简单，你想过桥式调用该函数， 不如考虑进程通信

冥界3大法王

bester 发表于 2023-8-11 11:58
你loadlibrary把dll加载到你的进程空间里面，你的进程空间不存在DbgCmdExec，就这么简单，你想过桥式调用该 ...

@bester
前天我就懒惰了~~
我还说想录制个语音视频QQ上发你看一下呢。。
结果我懒惰了，拖到了今天。。

通信？没学过，好弄不？有实例不？
现在想到一个笨办法，插件中弄个timer计时器，设个热键读取配置
外部*.exe中随时修改配置
====================================
不过话说回来，我的x64dbg.dp64插件版快弄好了。
上面是另一种实现的策略。

bester

冥界3大法王 发表于 2023-8-11 12:04
@bester
前天我就懒惰了~~
我还说想录制个语音视频QQ上发你看一下呢。。

timer读取最大的两个问题：如果time设置的很小会造成不必要的负担，也可能造成读写安全问题(我是从线程安全的角度考虑)，如果time设置比较大，又会造成延迟问题，总之这个方案不合理，属于下下策

阳光般丶楠神

最近这段儿时间一直在学习，所以我尽可能的往这些有技术贴里钻
还有大牛的技术经验分享，还能学到很多有用的技能！