| 129 | } |
| 130 | |
| 131 | __forceinline auto get_kmodule_export(const char* module_name, const char* export_name, bool rva = false) -> void* |
| 132 | { |
| 133 | void* buffer = nullptr; |
| 134 | DWORD buffer_size = NULL; |
| 135 | |
| 136 | NTSTATUS status = NtQuerySystemInformation( |
| 137 | static_cast<SYSTEM_INFORMATION_CLASS>(SystemModuleInformation), |
| 138 | buffer, |
| 139 | buffer_size, |
| 140 | &buffer_size |
| 141 | ); |
| 142 | |
| 143 | while (status == STATUS_INFO_LENGTH_MISMATCH) |
| 144 | { |
| 145 | VirtualFree(buffer, 0, MEM_RELEASE); |
| 146 | buffer = VirtualAlloc(nullptr, buffer_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); |
| 147 | status = NtQuerySystemInformation( |
| 148 | static_cast<SYSTEM_INFORMATION_CLASS>(SystemModuleInformation), |
| 149 | buffer, |
| 150 | buffer_size, |
| 151 | &buffer_size |
| 152 | ); |
| 153 | } |
| 154 | |
| 155 | if (!NT_SUCCESS(status)) |
| 156 | { |
| 157 | VirtualFree(buffer, 0, MEM_RELEASE); |
| 158 | return nullptr; |
| 159 | } |
| 160 | |
| 161 | const auto modules = static_cast<PRTL_PROCESS_MODULES>(buffer); |
| 162 | for (auto idx = 0u; idx < modules->NumberOfModules; ++idx) |
| 163 | { |
| 164 | // find module and then load library it |
| 165 | const std::string current_module_name = |
| 166 | std::string(reinterpret_cast<char*>( |
| 167 | modules->Modules[idx].FullPathName) + |
| 168 | modules->Modules[idx].OffsetToFileName |
| 169 | ); |
| 170 | |
| 171 | if (!_stricmp(current_module_name.c_str(), module_name)) |
| 172 | { |
| 173 | std::string full_path = reinterpret_cast<char*>(modules->Modules[idx].FullPathName); |
| 174 | full_path.replace(full_path.find("\\SystemRoot\\"), |
| 175 | sizeof("\\SystemRoot\\") - 1, std::string(getenv("SYSTEMROOT")).append("\\")); |
| 176 | |
| 177 | const auto module_base = |
| 178 | LoadLibraryEx( |
| 179 | full_path.c_str(), |
| 180 | NULL, |
| 181 | DONT_RESOLVE_DLL_REFERENCES |
| 182 | ); |
| 183 | |
| 184 | PIMAGE_DOS_HEADER p_idh; |
| 185 | PIMAGE_NT_HEADERS p_inh; |
| 186 | PIMAGE_EXPORT_DIRECTORY p_ied; |
| 187 | |
| 188 | PDWORD addr, name; |
no outgoing calls
no test coverage detected