Method get_symbol_ptr

src/shellcode.cpp:353–464

Get the dll base by name.

// Get the dll base by name.
PVOID shellcode::get_symbol_ptr(HANDLE pe_base, PDWORD sh_funs, HANDLE dll_handle, u_sym_info sym_info, BOOL by_name)
{
    // Resolving the needed functions.
    auto fun_hash_string = sh_resolve(pe_base, sh_funs, hash_string);
    auto fun_str_cpy = sh_resolve(pe_base, sh_funs, str_cpy);
    auto fun_str_chr = sh_resolve(pe_base, sh_funs, str_chr);
    auto fun_load_dll = sh_resolve(pe_base, sh_funs, load_dll);
    auto fun_get_symbol_ptr = sh_resolve(pe_base, sh_funs, get_symbol_ptr);
    auto fun_str_toi = sh_resolve(pe_base, sh_funs, str_toi);

    // Dereferencing the headers.
    PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)dll_handle;
    PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)((PBYTE)dll_handle + dos_hdr->e_lfanew);
    PIMAGE_OPTIONAL_HEADER opt_hdr = &nt_hdrs->OptionalHeader;

    // Dereferencing the export table data directory.
    PIMAGE_DATA_DIRECTORY data_dir = &opt_hdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

    // Check if exists.
    if (!data_dir->VirtualAddress || !data_dir->Size) {
        return NULL;
    };

    // Get the export table pointer.
    PIMAGE_EXPORT_DIRECTORY export_table = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)dll_handle +
        data_dir->VirtualAddress);

    // In case an ordinal is resolved.
    DWORD f_address;
    if (!by_name)
    {
        // Invalid ordinal.
        if (sym_info.sym_ord < export_table->Base ||
            sym_info.sym_ord >= export_table->Base + export_table->NumberOfFunctions)
            return NULL;

        // Getting the address directly.
        f_address = ((DWORD*)((PBYTE)dll_handle + export_table->AddressOfFunctions))
            [sym_info.sym_ord - export_table->Base];
    }
    else
    {
        // My be no names exported.
        if (!export_table->AddressOfNames) {
            return NULL;
        };

        // Resolve by name.
        size_t idx = 0;
        DWORD* p_names = (DWORD*)((PBYTE)dll_handle +
            export_table->AddressOfNames);
        for (; idx < export_table->NumberOfNames; idx++)
        {
            // Get the name.
            PCHAR sym_name = (PCHAR)dll_handle + p_names[idx];
            if (fun_hash_string(sym_name) != sym_info.sym_hash)
                continue;