| 220 | } |
| 221 | |
| 222 | bool khook::GetSystemServiceNumber(const char* exportName,PULONG index) { |
| 223 | PEParser parser(L"\\SystemRoot\\system32\\ntdll.dll"); |
| 224 | ULONG offset = parser.GetExportByName(exportName); |
| 225 | if (offset != 0) { |
| 226 | // get system service number |
| 227 | unsigned char* exportData = (unsigned char*)parser.GetBaseAddress() + offset; |
| 228 | for (int i = 0; i < 16; i++) { |
| 229 | if (exportData[i] == 0xC2 || exportData[i] == 0xC3) //RET |
| 230 | break; |
| 231 | if (exportData[i] == 0xB8) //mov eax,X |
| 232 | { |
| 233 | ULONG* address = (ULONG*)(exportData + i + 1); |
| 234 | *index = *address; |
| 235 | address += 1; |
| 236 | auto opcode = *(unsigned short*)address; |
| 237 | unsigned char* p = (unsigned char*)address + 5; |
| 238 | auto code = *(unsigned char*)p; |
| 239 | if (code != 0xFF &&// x86 |
| 240 | opcode != 0x04F6 // win10 x64 |
| 241 | && opcode != 0x050F) { // win7 x64 |
| 242 | break; |
| 243 | } |
| 244 | return true; |
| 245 | } |
| 246 | } |
| 247 | } |
| 248 | |
| 249 | return false; |
| 250 | } |
| 251 | |
| 252 | bool khook::GetSectionStart(ULONG_PTR va) { |
| 253 | ULONG rva = va - (ULONG_PTR)_kernelImageBase; |
nothing calls this directly
no test coverage detected