Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- std::wstring ApplyFileNameRedirection_W7_W8(const std::wstring& dllName)
- {
- static NTSTATUS(NTAPI* LdrpApplyFileNameRedirection)(DWORD Flags, UNICODE_STRING* FileName, UNICODE_STRING* DefaultExtension, UNICODE_STRING* NewFilename, UNICODE_STRING*, UNICODE_STRING**, BYTE*) = nullptr;
- if (!LdrpApplyFileNameRedirection)
- {
- uintptr_t result = FindPattern(GetModuleHandleW(L"ntdll.dll"), "\x4C\x8D\x05\x00\x00\x00\x00\x00\x00\x00\x33\xC9\xE8\x00\x00\x00\x00\x8B\xD8", "xxx???????xxx????xx");
- if (result)
- {
- int32_t offset = *reinterpret_cast<int32_t*>(result + 0xD);
- LdrpApplyFileNameRedirection = (decltype(LdrpApplyFileNameRedirection))(result + offset + 0x11);
- }
- }
- if (LdrpApplyFileNameRedirection)
- {
- UNICODE_STRING FileName;
- RtlInitUnicodeString(&FileName, dllName.c_str());
- UNICODE_STRING DefaultExtension;
- RtlInitUnicodeString(&DefaultExtension, L".DLL");
- UNICODE_STRING NewFilename;
- WCHAR NewFilenameBuffer[256] = {};
- NewFilename.Length = 0;
- NewFilename.MaximumLength = sizeof(NewFilenameBuffer);
- NewFilename.Buffer = NewFilenameBuffer;
- BYTE unknown;
- NTSTATUS result = LdrpApplyFileNameRedirection(NULL, &FileName, &DefaultExtension, &NewFilename, nullptr, nullptr, &unknown);
- if (result == STATUS_SUCCESS)
- {
- return NewFilenameBuffer;
- }
- }
- return dllName;
- }
- std::wstring ApplyFileNameRedirection_W10(const std::wstring& dllName)
- {
- static NTSTATUS(NTAPI* LdrpPreprocessDllName)(UNICODE_STRING* FileName, UNICODE_STRING* NewFilename, DWORD, DWORD*) = nullptr;
- if (!LdrpPreprocessDllName)
- {
- uintptr_t result = FindPattern(GetModuleHandleW(L"ntdll.dll"), "\xE8\x00\x00\x00\x00\x89\x44\x24\x40\x85\xC0\x78\x37", "x????xxxxxxxx");
- if (result)
- {
- int32_t offset = *reinterpret_cast<int32_t*>(result + 0x1);
- LdrpPreprocessDllName = (decltype(LdrpPreprocessDllName))(result + offset + 0x5);
- }
- }
- if (LdrpPreprocessDllName)
- {
- UNICODE_STRING FileName;
- RtlInitUnicodeString(&FileName, dllName.c_str());
- UNICODE_STRING NewFilename;
- WCHAR NewFilenameBuffer[256] = {};
- NewFilename.Length = 0;
- NewFilename.MaximumLength = sizeof(NewFilenameBuffer);
- NewFilename.Buffer = NewFilenameBuffer;
- DWORD unknown = 0;
- NTSTATUS result = LdrpPreprocessDllName(&FileName, &NewFilename, 0, &unknown);
- if (result == STATUS_SUCCESS)
- {
- return NewFilenameBuffer;
- }
- }
- return dllName;
- }
- std::wstring ApplyFileNameRedirection(const std::wstring& dllName)
- {
- if (IsWindows10())
- {
- return ApplyFileNameRedirection_W10(dllName);
- }
- else
- {
- return ApplyFileNameRedirection_W7_W8(dllName);
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement