Does not handle forwaders
| 93 | |
| 94 | // Does not handle forwaders |
| 95 | void xGetProcAddr(PVOID pe, SIZE_T api_hash, PHANDLE api_addr) |
| 96 | { |
| 97 | int* AddressOfFunctions = NULL; |
| 98 | int* AddressOfNames = NULL; |
| 99 | short* AddressOfNameOrdinals = NULL; |
| 100 | char* export_name = NULL; |
| 101 | |
| 102 | PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(((PBYTE)(pe)) + ((PIMAGE_DOS_HEADER)pe)->e_lfanew); |
| 103 | PIMAGE_EXPORT_DIRECTORY dir = (PIMAGE_EXPORT_DIRECTORY)(((PBYTE)(pe)) + (&nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT])->VirtualAddress); |
| 104 | |
| 105 | AddressOfFunctions = (int*)(((PBYTE)(pe)) + dir->AddressOfFunctions); |
| 106 | AddressOfNameOrdinals = (short*)(((PBYTE)(pe)) + dir->AddressOfNameOrdinals); |
| 107 | AddressOfNames = (int*)(((PBYTE)(pe)) + dir->AddressOfNames); |
| 108 | |
| 109 | for (DWORD i = 0; i < dir->NumberOfNames; i++) |
| 110 | { |
| 111 | export_name = (PCHAR)(((PBYTE)(pe)) + AddressOfNames[i]); |
| 112 | if (Hasher1(StringLengthA(export_name), export_name) == api_hash) |
| 113 | { |
| 114 | *api_addr = (HANDLE*)(((PBYTE)(pe)) + AddressOfFunctions[AddressOfNameOrdinals[i]]); |
| 115 | } |
| 116 | } |
| 117 | } |
| 118 | |
| 119 | // Spider |
| 120 | SIZE_T ACharStringToWCharString(PWCHAR Destination, PCHAR Source, SIZE_T MaximumAllowed) |
no test coverage detected