MCPcopy Create free account
hub / github.com/b1tg/rust-windows-shellcode / get_func_by_name

Function get_func_by_name

shellcode/src/main.rs:94–134  ·  view source on GitHub ↗
(module: PVOID, func_name: *const u8)

Source from the content-addressed store, hash-verified

92}
93
94fn get_func_by_name(module: PVOID, func_name: *const u8) -> PVOID {
95 let idh: *const IMAGE_DOS_HEADER = module as *const _;
96 unsafe {
97 if (*idh).e_magic != IMAGE_DOS_SIGNATURE {
98 return null_mut();
99 }
100 let e_lfanew = (*idh).e_lfanew;
101 let nt_headers: *const IMAGE_NT_HEADERS =
102 (module as *const u8).offset(e_lfanew as isize) as *const _;
103 let op_header = &(*nt_headers).OptionalHeader;
104 let virtual_addr = (&op_header.DataDirectory[0]).VirtualAddress;
105 let export_dir: *const IMAGE_EXPORT_DIRECTORY =
106 (module as *const u8).offset(virtual_addr as _) as _;
107 let number_of_names = (*export_dir).NumberOfNames;
108 let addr_of_funcs = (*export_dir).AddressOfFunctions;
109 let addr_of_names = (*export_dir).AddressOfNames;
110 let addr_of_ords = (*export_dir).AddressOfNameOrdinals;
111 for i in 0..number_of_names {
112 let name_rva_p: *const DWORD =
113 (module as *const u8).offset((addr_of_names + i * 4) as isize) as *const _;
114 let name_index_p: *const WORD =
115 (module as *const u8).offset((addr_of_ords + i * 2) as isize) as *const _;
116 let name_index = name_index_p.as_ref().unwrap();
117 let mut off: u32 = (4 * name_index) as u32;
118 off = off + addr_of_funcs;
119 let func_rva: *const DWORD = (module as *const u8).offset(off as _) as *const _;
120
121 let name_rva = name_rva_p.as_ref().unwrap();
122 let curr_name = (module as *const u8).offset(*name_rva as isize);
123
124 if *curr_name == 0 {
125 continue;
126 }
127 if compare_raw_str(func_name, curr_name) {
128 let res = (module as *const u8).offset(*func_rva as isize);
129 return res as _;
130 }
131 }
132 }
133 return null_mut();
134}
135// #[allow(unused_attributes)]
136// #[cfg(target_env = "msvc")]
137// #[link_args = "/GS- /MERGE:.rdata=.text /MERGE:.pdata=.text /NODEFAULTLIB /EMITPOGOPHASEINFO /DEBUG:NONE"]

Callers 1

mainFunction · 0.85

Calls 1

compare_raw_strFunction · 0.85

Tested by

no test coverage detected