Method get_dll_handle

src/shellcode.cpp:163–205

Get the dll base by name.

// Get the dll base by name.
HANDLE shellcode::get_dll_handle(HANDLE pe_base, PDWORD sh_funs, PWSTR dll_name)
{
    // Resolving the needed functions.
    auto fun_wstr_i_cmp = sh_resolve(pe_base, sh_funs, wstr_i_cmp);
    auto fun_resolve_api_set = sh_resolve(pe_base, sh_funs, resolve_api_set);

    // Needed local variables.
    PPEB pPeb = NtCurrentTeb()->ProcessEnvironmentBlock;
    PLIST_ENTRY head = &pPeb->Ldr->InMemoryOrderModuleList;

QUERY_LDR:

    // Looping on the LDR modules (ordered as in memory).
    PLIST_ENTRY current = head;
    while ((current = current->Flink) != head)
    {
        // Get and test the current module.
        PLDR_DATA_TABLE_ENTRY data_table = CONTAINING_RECORD(current, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);

        // If the current module is the needed one.
        if (!fun_wstr_i_cmp(((PUNICODE_STRING)(&data_table->Reserved4))->Buffer,
            dll_name, 0))
        {
            // Return the module base.
            return data_table->DllBase;
        };
    };

    // Check if api set schema.
    WCHAR api_schema[] = { L'a', L'p', L'i', L'-', L'\0' };
    WCHAR ext_schema[] = { L'e', L'x', L't', L'-', L'\0' };
    if (!fun_wstr_i_cmp(dll_name, api_schema, sizeof("api")) ||
        !fun_wstr_i_cmp(dll_name, ext_schema, sizeof("ext")))
    {
        // The length of the dll name is more than the api set dll name.
        if (fun_resolve_api_set(pe_base, sh_funs, pPeb->Reserved9[0], dll_name, dll_name)) {
            goto QUERY_LDR;
        };
    };

    // Not found.
    return NULL;
};

// Load the dll base by name.
HANDLE shellcode::load_dll(HANDLE pe_base, PDWORD sh_funs, PCHAR dll_name)