Advertisement
Skyfail

Dynamic Importing

Feb 25th, 2016
42
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.     template<CallingConvention calling_convention, typename return_type, typename... args>
  2.     class DynamicCall
  3.     {
  4.     private:
  5.      
  6.         DWORD m_FunctionAddress;
  7.         HMODULE m_module;
  8.      
  9.     public:
  10.      
  11.         using cc_fastcall = return_type(__fastcall *)(args...);
  12.         using cc_cdecl = return_type(__cdecl *)(args...);
  13.         using cc_stdcall = return_type(__stdcall *)(args...);
  14.      
  15.      
  16.         inline return_type Call(args... arguments) {
  17.             switch (calling_convention) {
  18.             case CallingConventions::asm_cdecl:
  19.                 return (cc_cdecl(this->m_FunctionAddress))(arguments...);
  20.             case CallingConventions::asm_stdcall:
  21.                 return (cc_stdcall(this->m_FunctionAddress))(arguments...);
  22.             case CallingConventions::asm_fastcall:
  23.                 return (cc_fastcall(this->m_FunctionAddress))(arguments...);
  24.             default:
  25.                 return (return_type)0;
  26.             }
  27.         }
  28.      
  29.      
  30.         inline return_type operator()(args... arguments) {
  31.             return this->Call(arguments...);
  32.         }
  33.      
  34.      
  35.         void Assign(wchar_t *module, DWORD funcHash)
  36.         {
  37.             UNICODE_STRING str;
  38.             RtlInitUnicodeString(&str, module);
  39.      
  40.             LdrLoadDll(0, 0, &str, &this->m_module);
  41.      
  42.             this->m_FunctionAddress = (DWORD)_GetProcAddress(this->m_module, funcHash);
  43.         }
  44.      
  45.      
  46.         DynamicCall(wchar_t *module, DWORD funcHash)
  47.         {
  48.             this->Assign(module, funcHash);
  49.         }
  50.      
  51.         DynamicCall()
  52.         {
  53.      
  54.         }
  55.      
  56.     };
  57.  
  58.  
  59. //_GetProcAddress (I did not completly write that myself, I used a snippet from rohitab):
  60.     void *_GetProcAddress(HMODULE module, DWORD funcHash)
  61.     {
  62.      
  63.         char *modb = (char *)module;
  64.      
  65.         IMAGE_DOS_HEADER *dos_header = (IMAGE_DOS_HEADER *)modb;
  66.         IMAGE_NT_HEADERS *nt_headers = (IMAGE_NT_HEADERS *)(modb + dos_header->e_lfanew);
  67.         IMAGE_OPTIONAL_HEADER *opt_header = &nt_headers->OptionalHeader;
  68.         IMAGE_DATA_DIRECTORY *exp_entry = (IMAGE_DATA_DIRECTORY *)(&opt_header->DataDirectory[0]);
  69.         IMAGE_EXPORT_DIRECTORY *exp_dir = (IMAGE_EXPORT_DIRECTORY *)(modb + exp_entry->VirtualAddress);
  70.      
  71.         void **func_table = (void **)(modb + exp_dir->AddressOfFunctions);
  72.         WORD *ord_table = (WORD *)(modb + exp_dir->AddressOfNameOrdinals);
  73.         char **name_table = (char **)(modb + exp_dir->AddressOfNames);
  74.         void *address = NULL;
  75.      
  76.         for (DWORD i = 0; i < exp_dir->NumberOfNames; i++)
  77.            {
  78.             char *curr = modb + (DWORD)name_table[i];
  79.             //name table pointers are rvas
  80.             if (StrHash(curr) == funcHash)
  81.                     {
  82.                 address = (void *)(modb + (DWORD)func_table[ord_table[i]]);
  83.                             break;
  84.                     }
  85.         }
  86.      
  87.         return address;
  88.     }
  89.  
  90.  
  91. //Usage
  92.     //Global
  93.     DynamicCall<CallingConvention::asm_stdcall, ULONGLONG> _GetTickCount64;
  94.     _GetTickCount64 = DynamicCall<CallingConvention::asm_stdcall, ULONGLONG>(L"Kernel32.dll", 668280486 /* GetTickCount64 */);
  95.      
  96.     //Inline:
  97.     DynamicCall<CallingConvention::asm_stdcall, int, HWND, LPCTSTR, LPCTSTR, UINT>(L"User32.dll", 3943220947 /* MessageBoxA */)(0, "Test", 0, 0);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement