Function get_module_handle_custom_by_hash

src/utils/win_api.rs:81–109

(module_hash: u32)

}

unsafe fn get_module_handle_custom_by_hash(module_hash: u32) -> isize {
    let peb = get_peb();
    if peb.is_null() || (*peb).Ldr.is_null() {
        return 0;
    }

    let ldr = &*(*peb).Ldr;
    let head = &ldr.InLoadOrderModuleList as *const LIST_ENTRY;
    let mut current = (*head).Flink;

    while current != head as *mut LIST_ENTRY {
        let entry = current as *mut LDR_DATA_TABLE_ENTRY;
        
        let base_dll_name = &(*entry).BaseDllName;
        if !base_dll_name.Buffer.is_null() {
            let len = base_dll_name.Length as usize / 2;
            let slice = std::slice::from_raw_parts(base_dll_name.Buffer, len);
            let dll_name_w = String::from_utf16_lossy(slice);
            
            if sdbm_hash_lower(dll_name_w.as_bytes()) == module_hash {
                return (*entry).DllBase as isize;
            }
        }

        current = (*current).Flink;
    }

    0
}

pub unsafe fn load_library(dll_name: &[u8]) -> Result<isize, String> {
    use windows_sys::Win32::System::LibraryLoader::LoadLibraryA;