加入我们，或者，欢迎回来。
您需要 登录 才可以下载或查看，没有账号？注册会员
×
本帖最后由 SixRC 于 2017-12-1 00:25 编辑
把上次那个脚本完善了 上次想补的东西基本补全了
然后 虽然标题是 1.0 事实上可能没有下一版本了 未知 因为把想实现的实现了..而没有新的兴趣需求
这次完善后 基本上ok了 当然不可避免的东西不可避免 具体使用见脚本及范例
鉴于调用ps滤镜的一些特殊性 不可能面面俱到
我写脚本的时候想的只是作为一种参考 所以写了对 bitmap 对象使用滤镜 而没有其他
而有特殊需要的人可以自行改造脚本 做成画面滤镜啊什么的
也可以拓展脚本等等
希望对同样对这方面感兴趣的人有所帮助
不足大概是注释写的不够全
不过啊 假如有用心去看 ps sdk 就没什么问题的
先这样吧 不知道说什么好
上床上床！
2017.12.01
写了一个排序滤镜 用它调用 然后发现一些bug 已修正
[fold=代码][pre lang="ruby"]#---------------------------------------------------------------------------
# ---- SixRC 于 2017.11.21
#
# 调用 ps 滤镜 1.0
# 这个脚本的使用需要一定的脚本及反汇编基础 及对这脚本原理的一些了解
# 关于原理 调用 ps 插件 就是模仿 ps 去调用 完成几个 api 就行了
# 相关信息请查阅 ps sdk 这个脚本基于 cs6
# sdk 能解答以下脚本的很多相关问题 比方 FilterRecord Struct
# 比方调用滤镜的参数等等等等
# 这个脚本实现的 api 全是汇编写的 每一句都在下面附了 以便参考理解和修改
# 实现了必须的几个 api
# 需要反汇编才能用 是因为滤镜一般都会在使用前弹出一个设置参数的窗口
# 这个弹出的过程请自己黑掉 让它跳过这个过程
# 还有就是参数的设置 因为上个原因 如果需要非默认参数 也请自己去黑
# 两个要黑的都在 selector = 3 的那次调用 不难的
# 写这个脚本的初衷主要其实不是为了用 而是作为一种参考
# 有任何其他方面功能的需要 请自行基于此修改构造
# 比方黑成画面滤镜啊 freeze 的时候啊 等等
# 然后是这个脚本的使用
# xxx= PSFilter.new
# xxx.dll="xxx.8bf"
# xxx.filter="xxx"
# xxx.bitmap=bitmap ( Bitmap.new('xx') )
# xxx.process
#---------------------------------------------------------------------------
class PSFilter
Ret="\x33\xC0\xC3"
PlugInMonitor=[0x33,0x33,0x02,0x00,0xD7,0xA3,0x00,0x00,0x7C,0x54,0x00,0x00,
0xCD,0x4C,0x00,0x00,0x9A,0x99,0x00,0x00,0x67,0x26,0x00,0x00,
0x5C,0x0F,0x00,0x00,0x0D,0x50,0x00,0x00,0x39,0x54,0x00,0x00,
0x00,0x00,0x01,0x00].pack('C*')
LoadLibrary=Win32API.new('kernel32','LoadLibraryA','p','l')
FreeLibrary=Win32API.new('kernel32','FreeLibrary','l','l')
GetProcAddress=Win32API.new('kernel32','GetProcAddress','lp','l')
CWP=Win32API.new('user32','CallWindowProc','pllll','l')
Kernel32=LoadLibrary.call('kernel32')
HeapCreate=GetProcAddress.call(Kernel32,'HeapCreate')
HeapAlloc=GetProcAddress.call(Kernel32,'HeapAlloc')
HeapDestroy=GetProcAddress.call(Kernel32,'HeapDestroy')
HeapReAlloc=GetProcAddress.call(Kernel32,'HeapReAlloc')
PropertyProcs=[0,2,Ret,Ret].pack('SSpp')
# 获取位图数据地址
# esp+4 = __id__*2+16
GetAddr=[
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x8B,0x00, # mov eax,[eax]
0x8B,0x40,0x08, # mov eax,[eax+8]
0x8B,0x40,0x10, # mov eax,[eax+10]
0xC2,0x10,0x00 # ret 10
].pack('C*')
# BGRA -> RGBA 及 正序 反之同
# esp+4 目标地址
# esp+8 源地址
# esp+0C 宽
# esp+10 高
Convert=[
0x55, # push ebp
0x89,0xE5, # mov ebp,esp
0x8B,0x7D,0x08, # mov edi,[ebp+8]
0x8B,0x65,0x14, # mov esp,[ebp+14]
0x89,0xE3, # mov ebx,esp
0x44, # inc esp
0x8B,0x45,0x10, # mov eax,[ebp+10]
0x89,0xC6, # mov esi,eax
0xC1,0xE6,0x03, # shl esi,3
0xC1,0xE0,0x02, # shl eax,2
0x0F,0xAF,0xE0, # imul esp,eax
0x8B,0x45,0x0C, # mov eax,[ebp+0C]
0x01,0xC4, # add esp,eax
# L1
0x8B,0x4D,0x10, # mov ecx,[ebp+10]
0x29,0xF4, # sub esp,esi
# L2
0x58, # pop eax
0x0F,0xC8, # bswap eax
0xC1,0xC8,0x08, # ror eax,8
0x89,0x07, # mov [edi],eax
0x83,0xC7,0x04, # add edi,4
0x49, # dec ecx
0x75,0xF2, # jne L2
0x4B, # dec ebx
0x75,0xEA, # jne L1
0x89,0xEC, # mov esp,ebp
0x5D, # pop ebp
0xC2,0x10,0x00 # ret 10
].pack('C*')
def initialize
# hHeap, src, dest, temp1, temp2, update?, @FRS
@buf="\0"*4*7
@aob=[@buf].pack('p').unpack('l')[0]
# 宽 高 x y 末颜色通道 始通道 数据地址指针
@update="\0"*4*7
# BufferProcs
@AllocateBufferProc=[
0x6A,0x08, # push 8
0x6A,0x08, # push 8
0xFF,0x35,@buf, # push hHeap
0xB8,HeapAlloc, # mov eax,HeapAlloc
0xFF,0xD0, # call eax
0x50, # push eax
0xFF,0x74,0x24,0x08, # push [esp+8]
0x6A,0x08, # push 8
0xFF,0x35,@buf, # push hHeap
0xB8,HeapAlloc, # mov eax,HeapAlloc
0xFF,0xD0, # call eax
0x5A, # pop edx
0x89,0x02, # mov [edx],eax
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x89,0x42,0x04, # mov [edx+4],eax
0x8B,0x44,0x24,0x08, # mov eax,[esp+8]
0x89,0x10, # mov [eax],edx
0x31,0xC0, # xor eax,eax
0xC3 # ret
].pack('C6pClC11pClC*')
@LockBufferProc=[
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x8B,0x00, # mov eax,[eax]
0xC3 # ret
].pack('C*')
@BufferSpaceProc=[
0xB8,0x1F400000, # mov eax,1F400000
0xC3 # ret
].pack('ClC')
@ReserveSpaceProc=[
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x3D,0x00,0x00,0x00,0x19, # cmp eax,19000000
0x72,0x06, # jb OK
0xB8,0x94,0xFF,0xFF,0xFF, # mov eax,0FFFFFF94
0xC3, # ret
# OK:
0x31,0xC0, # xor eax,eax
0xC3 # ret
].pack('C*')
@BufferProcs=[1,8,@AllocateBufferProc,@LockBufferProc,Ret,Ret,
@BufferSpaceProc,@ReserveSpaceProc,Ret,Ret].pack('SSp*')
# HandleProcs
@NewPIHandleProc=[
0x6A,0x08, # push 8
0x6A,0x08, # push 8
0xFF,0x35,@buf, # push hHeap
0xB8,HeapAlloc, # mov eax,HeapAlloc
0xFF,0xD0, # call eax
0x50, # push eax
0xFF,0x74,0x24,0x08, # push [esp+8]
0x6A,0x08, # push 8
0xFF,0x35,@buf, # push hHeap
0xB8,HeapAlloc, # mov eax,HeapAlloc
0xFF,0xD0, # call eax
0x5A, # pop edx
0x89,0x02, # mov [edx],eax
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x89,0x42,0x04, # mov [edx+4],eax
0x89,0xD0, # mov eax,edx
0xC3 # ret
].pack('C6pClC11pClC*')
@GetPIHandleSizeProc=[
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x8B,0x40,0x04, # mov eax,[eax+4]
0xC3 # ret
].pack('C*')
@SetPIHandleSizeProc=[
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x8B,0x54,0x24,0x08, # mov edx,[esp+8]
0x89,0x50,0x04, # mov [eax+4],edx
0x8B,0x00, # mov eax,[eax]
0x52, # push edx
0x50, # push eax
0x6A,0x08, # push 8
0xFF,0x35,@buf, # push hHeap
0xB8,HeapReAlloc, # mov eax,HeapReAlloc
0xFF,0xD0, # call eax
0x8B,0x54,0x24,0x04, # mov edx,[esp+4]
0x89,0x02, # mov [edx],eax
0x31,0xC0, # xor eax,eax
0xC3 # ret
].pack('C19pClC*')
@LockPIHandleProc=@LockBufferProc
@HandleProcs=[0,8,@NewPIHandleProc,Ret,@GetPIHandleSizeProc,
@SetPIHandleSizeProc,@LockPIHandleProc,
Ret,Ret,Ret].pack('SSp*')
# BigDocumentStruct
@BigDocumentStruct=[0].pack('l')*23
# AdvanceStateProc
@get_1=[
# L1
0x89,0xD9, # mov ecx,ebx
# L2
0x8A,0x16, # mov dl,[esi]
0x88,0x17, # mov [edi],dl
0x83,0xC7,0x04, # add edi,4
0x46, # inc esi
0x49, # dec ecx
0x75,0xF5, # jne L2
0x01,0xEF, # add edi,ebp
0x48, # dec eax
0x75,0xEE, # jne L1
0xC3 # ret
].pack('C*')
@get_2=[
# L1
0x89,0xD9, # mov ecx,ebx
# L2
0x66,0x8B,0x16, # mov dx,[esi]
0x66,0x89,0x17, # mov [edi],dx
0x83,0xC7,0x04, # add edi,4
0x83,0xC6,0x02, # add esi,2
0x49, # dec ecx
0x75,0xF1, # jne L2
0x01,0xEF, # add edi,ebp
0x48, # dec eax
0x75,0xEA, # jne L1
0xC3 # ret
].pack('C*')
@get_3=[
# L1
0x89,0xD9, # mov ecx,ebx
# L2
0x66,0x8B,0x16, # mov dx,[esi]
0x66,0x89,0x17, # mov [edi],dx
0x8A,0x56,0x02, # mov dl,[esi+2]
0x88,0x57,0x02, # mov [edi+2],dl
0x83,0xC7,0x04, # add edi,4
0x83,0xC6,0x03, # add esi,3
0x49, # dec ecx
0x75,0xEB, # jne L2
0x01,0xEF, # add edi,ebp
0x48, # dec eax
0x75,0xE4, # jne L1
0xC3 # ret
].pack('C*')
@get_4=[
# L1
0x89,0xD9, # mov ecx,ebx
0xF3,0xA5, # rep movsd
0x01,0xEF, # add edi,ebp
0x48, # dec eax
0x75,0xF7, # jne L1
0xC3 # ret
].pack('C*')
@get_dest=[
0xC7,0x05,@aob+20,0, # mov buf[5],0
0xBB,@update, # mov ebx,@update
0x8B,0x73,0x18, # mov esi,[ebx+18]
0x8B,0x36, # mov esi,[esi]
0x8B,0x3D,@aob+8, # mov edi,buf[2]
0xA1,@aob+24, # mov edi,@FRS
0x0F,0xB7,0x40,0x12, # movzx eax,word [eax+12]
0x89,0xC5, # mov ebp,eax
0x2B,0x2B, # sub ebp,[ebx]
0xC1,0xE5,0x02, # shl ebp,2
0x8B,0x53,0x0C, # mov edx,[ebx+0C]
0xF7,0xEA, # imul edx
0x03,0x43,0x08, # add eax,[ebx+8]
0x8D,0x3C,0x87, # lea edi,[edi+eax*4]
0x03,0x7B,0x14, # add edi,[ebx+14]
0x8B,0x43,0x04, # mov eax,[ebx+4]
0x8B,0x53,0x10, # mov edx,[ebx+10]
0x2B,0x53,0x14, # sub edx,[ebx+14]
0x8B,0x1B, # mov ebx,[ebx]
0xB9,@get_4, # mov ecx,@get_4
0x75,0x05, # jne L1
0xB9,@get_1, # mov ecx,@get_1
# L1
0x4A, # dec edx
0x75,0x05, # jne L2
0xB9,@get_2, # mov ecx,@get_2
# L2
0x4A, # dec edx
0x75,0x05, # jne L3
0xB9,@get_3, # mov ecx,@get_3
# L3
0xFF,0xE1 # jmp ecx
].pack('C2llCpC7lClC37pC3pC4pC4pCC')
@set_data=[
0x8B,0x44,0x24,0x04, # mov eax,[esp+4]
0x85,0xC0, # test eax,eax
0x75,0x0D, # jne L0
0xC7,0x05,@aob+20,0, # mov buf[5],0
0xC2,0x1C,0x00, # ret 1C
# L0
0xC7,0x05,@aob+20,1, # mov buf[5],1
0x8D,0x74,0x24,0x04, # lea esi,[esp+4]
0xB9,7, # mov ecx,7
0xFC, # cld
0xBF,@update, # mov edi,@update
0xF3,0xA5, # rep movsd
0x8B,0x44,0x24,0x14, # mov eax.[esp+14]
0x2B,0x44,0x24,0x18, # sub eax,[esp+18]
0x40, # inc eax
0x8B,0x54,0x24,0x04, # mov edx,[esp+4]
0x89,0xC5, # mov ebp,eax
0xF7,0xEA, # imul edx
0x8B,0x7C,0x24,0x1C, # mov edi,[esp+1C]
0x89,0x47,0x04, # mov [edi+4],eax
0x8B,0x3F, # mov edi,[edi]
0x8B,0x35,@aob+4, # mov esi,buf[1]
0xA1,@aob+24, # mov eax,@FRS
0x0F,0xB7,0x40,0x12, # movzx eax,word [eax+12]
0x89,0xC3, # mov ebx,eax
0x2B,0x5C,0x24,0x04, # sub ebx,[esp+4]
0xC1,0xE3,0x02, # shl ebx,2
0x8B,0x54,0x24,0x10, # mov edx,[esp+10]
0xF7,0xEA, # imul edx
0x03,0x44,0x24,0x0C, # add eax,[esp+0C]
0x8D,0x34,0x86, # lea esi,[esi+eax*4]
0x03,0x74,0x24,0x18, # add esi,[esp+18]
0x8B,0x44,0x24,0x08, # mov eax,[esp+8]
# L1
0x8B,0x4C,0x24,0x04, # mov ecx,[esp+4]
# L2
0x8B,0x16, # mov edx,[esi]
0x89,0x17, # mov [edi],edx
0x83,0xC6,0x04, # add esi,4
0x01,0xEF, # add edi,ebp
0x49, # dec ecx
0x75,0xF4, # jne L2
0x01,0xDE, # add esi,ebx
0x48, # dec eax
0x75,0xEB, # jne L1
0xC2,0x1C,0x00 # ret 1C
].pack('C10llC5llC5lC2pC30lClC*')
@chgwh=[
0x66,0x8B,0x58,0x34, # mov bx,[eax+34]
0x66,0x29,0x58,0x38, # sub [eax+38],bx
0x66,0x8B,0x58,0x36, # mov bx,[eax+36]
0x66,0x29,0x58,0x3A, # sub [eax+3A],bx
0x66,0x8B,0x58,0x40, # mov bx,[eax+40]
0x66,0x29,0x58,0x44, # sub [eax+44],bx
0x66,0x8B,0x58,0x42, # mov bx,[eax+42]
0x66,0x29,0x58,0x46, # sub [eax+46],bx
0x8B,0x80,0x90,0x01,0x00,0x00, # mov eax,[eax+190]
0x8B,0x58,0x1C, # mov ebx,[eax+1C]
0x29,0x58,0x24, # sub [eax+24],ebx
0x8B,0x58,0x20, # mov ebx,[eax+20]
0x29,0x58,0x28, # sub [eax+28],ebx
0x8B,0x58,0x2C, # mov ebx,[eax+2C]
0x29,0x58,0x34, # sub [eax+34],ebx
0x8B,0x58,0x30, # mov ebx,[eax+30]
0x29,0x58,0x38, # sub [eax+38],ebx
0xC3 # ret
].pack('C*')
@AdvanceStateProc=[
0x31,0xC0, # xor eax,eax
0x60, # pushad
0xA1,@aob+24, # mov eax,@FRS
0xB9,@chgwh, # mov ecx,@chgwh
0xFF,0xD1, # call ecx
0x8B,0x1D,@aob+12, # mov ebx,temp1
0x89,0x58,0x4C, # mov [eax+4C],ebx
0x8B,0x1D,@aob+16, # mov ebx,temp2
0x89,0x58,0x54, # mov [eax+54],ebx
0xA1,@aob+20, # mov eax,buf[5]
0x85,0xC0, # test eax,eax
0x74,0x07, # je L1
0xB8,@get_dest, # mov eax,@get_dest
0xFF,0xD0, # call eax
# L1
0xA1,@aob+24, # mov eax,@FRS
0x8B,0x98,0x90,0x01,0x00,0x00, # mov ebx,[eax+190]
0x8B,0x0B, # mov ecx,[ebx]
0x85,0xC9, # test ecx,ecx
0x89,0xC1, # mov ecx,eax
0x74,0x57, # je L2
0x83,0xC1,0x4C, # add ecx,4C
0x51, # push ecx
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x3C, # push word [eax+3C]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x3E, # push word [eax+3E]
0xFF,0x73,0x1C, # push [ebx+1C]
0xFF,0x73,0x20, # push [ebx+20]
0xFF,0x73,0x24, # push [ebx+24]
0xFF,0x73,0x28, # push [ebx+28]
0xB8,@set_data, # mov eax,@set_data
0xFF,0xD0, # call eax
0xA1,@aob+24, # mov eax,@FRS
0x8B,0x98,0x90,0x01,0x00,0x00, # mov ebx,[eax+190]
0x8D,0x48,0x54, # lea ecx,[eax+54]
0x51, # push ecx
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x48, # push word [eax+48]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x4A, # push word [eax+4A]
0xFF,0x73,0x2C, # push [ebx+2C]
0xFF,0x73,0x30, # push [ebx+30]
0xFF,0x73,0x34, # push [ebx+34]
0xFF,0x73,0x38, # push [ebx+38]
0xB8,@set_data, # mov eax,@set_data
0xFF,0xD0, # call eax
0x61, # popad
0xC3, # ret
# L2
0x83,0xC1,0x4C, # add ecx,4C
0x51, # push ecx
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x3C, # push word [eax+3C]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x3E, # push word [eax+3E]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x34, # push word [eax+34]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x36, # push word [eax+36]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x38, # push word [eax+38]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x3A, # push word [eax+3A]
0xB8,@set_data, # mov eax,@set_data
0xFF,0xD0, # call eax
0xA1,@aob+24, # mov eax,@FRS
0x8D,0x48,0x54, # lea ecx,[eax+54]
0x51, # push ecx
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x48, # push word [eax+48]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x4A, # push word [eax+4A]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x40, # push word [eax+40]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x42, # push word [eax+42]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x44, # push word [eax+44]
0x66,0x6A,0x00, # push 0
0x66,0xFF,0x70,0x46, # push word [eax+46]
0xB8,@set_data, # mov eax,@set_data
0xFF,0xD0, # call eax
0x61, # popad
0xC3 # ret
].pack('C4lCpC4lC5lC4lC5pC3lC45pC3lC37pC51pC3lC47pC*')
# FilterRecord Struct
@FRS=[0,Ret,Ret,0,0,4,0,0,0xFFFFFFFF,0xFFFF,0,0].pack('lppllSlllllS')+
[0x1F400000].pack('l')+[0].pack('l')*16+
[0xFFFFFFFF,0xFF000000,0x4E,0x50,0x53,0x21].pack('llC*')+
[Ret,3,0x480000,0x480000,0,0].pack('pl*')+PlugInMonitor+
[0,@BufferProcs,0,Ret,Ret,@HandleProcs,0].pack('lplpppl')+
[4,0xFFFF,0,@AdvanceStateProc,0,Ret,0xFFFD0000].pack('SSlplpl')+
[0xFFFDFFFD,0,0,0,Ret].pack('llllp')+[0].pack('l')*15+
[PropertyProcs].pack('p')+[0].pack('l')*14+
[8,0,0,0,0,@BigDocumentStruct,0,0,0,0,0].pack('lllllplllll')+
"\0"*32
end
def dll=(dll)
@dll=dll
end
def filter=(f)
@filter=f
end
def bitmap=(b)
@bitmap=b
end
def process
dll=LoadLibrary.call(@dll)
filter=GetProcAddress.call(dll,@filter)
# 置宽高
width=@bitmap.width
height=@bitmap.height
set=[
0xB8,@FRS, # mov eax,@FRS
0xA3,@aob+24, # mov buf[6],eax
0xB9,width, # mov ecx,width
0xBA,height, # mov edx,height
0x66,0x89,0x48,0x12, # mov [eax+12],cx
0x66,0x89,0x50,0x10, # mov [eax+10],dx
0x66,0x89,0x48,0x1C, # mov [eax+1C],cx
0x66,0x89,0x50,0x1A, # mov [eax+1A],dx
0x66,0x89,0x88,0x92,0x00,0x00,0x00, # mov [eax+92],cx
0x66,0x89,0x90,0x90,0x00,0x00,0x00, # mov [eax+90],dx
0x8B,0x80,0x90,0x01,0x00,0x00, # mov eax,[eax+190]
0x89,0x48,0x08, # mov [eax+8],ecx
0x89,0x50,0x04, # mov [eax+4],edx
0x89,0x48,0x18, # mov [eax+18],ecx
0x89,0x50,0x14, # mov [eax+14],edx
0xC2,0x10,0x00 # ret 10
].pack('CpClClClC*')
CWP.call(set,0,0,0,0)
# 准备位图数据
addr=CWP.call(GetAddr,@bitmap.__id__*2+16,0,0,0)
src="\0"*4*(width*height+1)
temp1="\0"*4*(width*height+1)
temp2="\0"*4*(width*height+1)
CWP.call(Convert,[src].pack('p').unpack('l')[0],addr,width,height)
dest=src+""
code1=[
0xC7,0x05,@aob+4,src, # mov buf[1],src
0xC7,0x05,@aob+8,dest, # mov buf[2],dest
0xC7,0x05,@aob+12,temp1, # mov buf[3],temp1
0xC7,0x05,@aob+16,temp2, # mov buf[4],temp2
0xB8,@FRS, # mov eax,@FRS
0xC7,0x40,0x4C,temp1, # mov [eax+4C],temp1
0xC7,0x40,0x54,temp2, # mov [eax+54],temp2
0xC2,0x10,0x00 # ret 10
].pack('CClpCClpCClpCClpCpC3pC3pC*')
CWP.call(code1,0,0,0,0)
# main proc
res="\0"*4
pd="\0"*4
main_proc=[
0xB9,@FRS, # mov ecx,@FRS
0x31,0xC0, # xor eax,eax
0x89,0x41,0x0C, # mov [ecx+0C],eax
0x50, # push eax
0x50, # push eax
0x50, # push eax
0xB8,HeapCreate, # mov eax,HeapCreate
0xFF,0xD0, # call eax
0xA3,@aob, # mov buf[0],eax
0xBE,filter, # mov esi,@filter
0x31,0xDB, # xor ebx,ebx
# L1
0x43, # inc ebx
0x68,res, # push res
0x68,pd, # push pd
0x68,@FRS, # push @FRS
0x53, # push ebx
0xFF,0xD6, # call esi
0x83,0xC4,0x10, # add esp,10
0x83,0xFB,0x05, # cmp ebx,5
0x75,0xE5, # jne L1
0xB8,@AdvanceStateProc , # mov eax,@AdvanceSateProc
0xFF,0xD0, # call eax
0xFF,0x35,@aob, # push buf[0]
0xB8,HeapDestroy, # mov eax,HeapDestroy
0xFF,0xD0, # call eax
0xC2,0x10,0x00 # ret 10
].pack('CpC9lC3lClC4pCpCpC12pC4lClC*')
CWP.call(main_proc,0,0,0,0)
# 传送结果
CWP.call(Convert,addr,[dest].pack('p').unpack('l')[0],width,height)
FreeLibrary.call(dll)
end
end[/pre][/fold]
附件
调用ps滤镜 1.0.zip
(587.83 KB, 下载次数: 115)
|
写轮眼
发表于 2017-11-21 01:01:41
提升卡
沉默号角
喧嚣号角
变色卡
升龙剑
