Method resolve_api_set

src/shellcode.cpp:258–350

Resolve the api set schema for the dll name.

// Resolve the api set schema for the dll name.
BOOL shellcode::resolve_api_set(HANDLE pe_base, PDWORD sh_funs, PVOID schema_map, PCWSTR virtual_dll, PWCHAR real_dll)
{
    // Resolving the needed functions.
    auto fun_wstr_cpy = sh_resolve(pe_base, sh_funs, wstr_cpy);
    auto fun_wstr_i_cmp = sh_resolve(pe_base, sh_funs, wstr_i_cmp);

    // Reading the version.
    DWORD Version = *(DWORD*)schema_map;

    // Two versions with two methods.
    if (Version >= 3) {

        // Use the proper structures.
        PApiSetHeader63 pHeader = (PApiSetHeader63)schema_map;
        PApisetNameEntry pApiSets = (PApisetNameEntry)((PBYTE)schema_map + pHeader->NamesOffset);

        // Use binary search to enumerate the dlls.
        INT Start, End, Next, CmpResult;
        Start = Next = 0;
        End = (DWORD)pHeader->NumberOfApisets - 1;

        // Binary search loop.
        while (End >= Start) {

            Next = (Start + End) >> 1;
            PWCHAR VirtualDll = (PWCHAR)((PBYTE)schema_map + pApiSets[Next].Offset);

            // Compare and conditions.
            CmpResult = fun_wstr_i_cmp(VirtualDll, virtual_dll, pApiSets[Next].Size / 2);
            if (CmpResult < 0)
                End = Next - 1;
            else if (CmpResult > 0)
                Start = Next + 1;
            else break;
        };

        // We've found the right entry.
        if (End >= Start && pApiSets[Next].NumberOfHosts) {

            // Get the value.
            PApisetValueEntry pValue = (PApisetValueEntry)((PBYTE)schema_map + pApiSets[Next].HostOffset);
            pValue += pApiSets[Next].NumberOfHosts - 1;

            // Fill the buffer address and return true.
            fun_wstr_cpy(real_dll, (PWCHAR)((PBYTE)schema_map + pValue->ValueOffset),
                pValue->ValueLength / 2);
            return TRUE;
        };
    }
    else {

        // Use the proper structures.
        PApiSetHeader6 pHeader = (PApiSetHeader6)schema_map;
        PApisetNameEntry2 pApiSets = (PApisetNameEntry2)((PBYTE)schema_map + sizeof(ApiSetHeader6));

        // Use binary search to enumerate the dlls.
        int Start, End, Next, CmpResult;
        Start = Next = 0;