MCPcopy Create free account
hub / github.com/Compiled-Code/eac-mapper / get_kmodule_export

Function get_kmodule_export

dependencies/vdm/util/util.hpp:131–233  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

129 }
130
131 __forceinline auto get_kmodule_export(const char* module_name, const char* export_name, bool rva = false) -> void*
132 {
133 void* buffer = nullptr;
134 DWORD buffer_size = NULL;
135
136 NTSTATUS status = NtQuerySystemInformation(
137 static_cast<SYSTEM_INFORMATION_CLASS>(SystemModuleInformation),
138 buffer,
139 buffer_size,
140 &buffer_size
141 );
142
143 while (status == STATUS_INFO_LENGTH_MISMATCH)
144 {
145 VirtualFree(buffer, 0, MEM_RELEASE);
146 buffer = VirtualAlloc(nullptr, buffer_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
147 status = NtQuerySystemInformation(
148 static_cast<SYSTEM_INFORMATION_CLASS>(SystemModuleInformation),
149 buffer,
150 buffer_size,
151 &buffer_size
152 );
153 }
154
155 if (!NT_SUCCESS(status))
156 {
157 VirtualFree(buffer, 0, MEM_RELEASE);
158 return nullptr;
159 }
160
161 const auto modules = static_cast<PRTL_PROCESS_MODULES>(buffer);
162 for (auto idx = 0u; idx < modules->NumberOfModules; ++idx)
163 {
164 // find module and then load library it
165 const std::string current_module_name =
166 std::string(reinterpret_cast<char*>(
167 modules->Modules[idx].FullPathName) +
168 modules->Modules[idx].OffsetToFileName
169 );
170
171 if (!_stricmp(current_module_name.c_str(), module_name))
172 {
173 std::string full_path = reinterpret_cast<char*>(modules->Modules[idx].FullPathName);
174 full_path.replace(full_path.find("\\SystemRoot\\"),
175 sizeof("\\SystemRoot\\") - 1, std::string(getenv("SYSTEMROOT")).append("\\"));
176
177 const auto module_base =
178 LoadLibraryEx(
179 full_path.c_str(),
180 NULL,
181 DONT_RESOLVE_DLL_REFERENCES
182 );
183
184 PIMAGE_DOS_HEADER p_idh;
185 PIMAGE_NT_HEADERS p_inh;
186 PIMAGE_EXPORT_DIRECTORY p_ied;
187
188 PDWORD addr, name;

Callers 4

get_peprocessMethod · 0.85
vdm_ctxMethod · 0.85
rkmMethod · 0.85
wkmMethod · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected