| 5 | { |
| 6 | |
| 7 | PVOID GetLocalModuleBaseW( LPCWSTR ModuleName ) |
| 8 | { |
| 9 | PVOID ModuleBase = 0; |
| 10 | |
| 11 | #if defined(_WIN64) |
| 12 | TEB* teb = (TEB*)ReadGS( FIELD_OFFSET( NT_TIB, Self ) ); |
| 13 | #else |
| 14 | TEB* teb = (TEB*)ReadFS( PcTeb ); |
| 15 | #endif |
| 16 | PVOID peb = (PVOID)teb->ProcessEnvironmentBlock; |
| 17 | #if defined(_WIN64) |
| 18 | PPEB_LDR_DATA LdrData = (PPEB_LDR_DATA)((PPEB64)peb)->Ldr; |
| 19 | #else |
| 20 | PPEB_LDR_DATA LdrData = (PPEB_LDR_DATA)((PPEB32)peb)->Ldr; |
| 21 | #endif |
| 22 | |
| 23 | // Search in InLoadOrderModuleList |
| 24 | for (PLIST_ENTRY pListEntry = LdrData->InLoadOrderModuleList.Flink; pListEntry != &LdrData->InLoadOrderModuleList; pListEntry = pListEntry->Flink) |
| 25 | { |
| 26 | PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD( pListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks ); |
| 27 | if (pEntry != NULL) |
| 28 | { |
| 29 | wchar_t wcsBaseDllName[MAX_PATH] = { 0 }; |
| 30 | wcscpy_s( wcsBaseDllName, pEntry->BaseDllName.Buffer ); |
| 31 | if (_wcsicmp( wcsBaseDllName, ModuleName ) == 0) |
| 32 | { |
| 33 | ModuleBase = pEntry->DllBase; |
| 34 | break; |
| 35 | } |
| 36 | } |
| 37 | } |
| 38 | |
| 39 | if (ModuleBase == NULL) |
| 40 | ModuleBase = LoadLibraryW( ModuleName ); |
| 41 | |
| 42 | return ModuleBase; |
| 43 | } |
| 44 | |
| 45 | PVOID GetLocalModuleBaseA( LPCSTR ModuleName ) |
| 46 | { |
no outgoing calls
no test coverage detected