Advertisement
Guest User

Untitled

a guest
Apr 1st, 2019
154
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include <Windows.h>
  2. #include <stdio.h>
  3.  
  4. void _log(UINT64 data) {
  5.     char text[200];
  6.  
  7.     sprintf_s(text, "%p", data);
  8.  
  9.     MessageBoxA(0, text, "123", 0);
  10. }
  11.  
  12. typedef struct _UNICODE_STRING_WOW64 {
  13.     USHORT Length;
  14.     USHORT MaximumLength;
  15.     PVOID64 Buffer;
  16. } UNICODE_STRING;
  17.  
  18. typedef struct {
  19.     LIST_ENTRY Orders[3];
  20.     PVOID64    base;
  21.     PVOID64      EntryPoint;
  22.     UINT       Size;
  23.     UNICODE_STRING dllFullPath;
  24.     UNICODE_STRING dllname;
  25. } LDR_ENTRY;
  26.  
  27. void _logStr(CHAR* data) {
  28.     char text[200];
  29.  
  30.     sprintf_s(text, "%s", data);
  31.  
  32.     MessageBoxA(0, text, "123", 0);
  33. }
  34.  
  35. PVOID64 GetModuleBase(LPWSTR moduleName) {
  36.     UINT64 peb = (UINT64)__readgsqword(0x60);
  37.     UINT64 moduleListAddr = *(UINT64*)(peb + 0x18);
  38.     PVOID64 flink = *(PVOID64*)(moduleListAddr + 0x18);
  39.  
  40.     LDR_ENTRY *mod = (LDR_ENTRY*)flink;
  41.     do
  42.     {
  43.         mod = (LDR_ENTRY*)mod->Orders[0].Flink;
  44.  
  45.         if (mod->base != NULL)
  46.         {
  47.             if (!lstrcmpiW((LPCWSTR)mod->dllname.Buffer, moduleName))
  48.             {
  49.                 return mod->base;
  50.             }
  51.         }
  52.     } while ((UINT64)flink != (UINT64)mod);
  53.  
  54.     return 0;
  55. }
  56.  
  57. int main() {
  58.  
  59.     UINT64 p = (UINT64)GetModuleBase((LPWSTR)L"kernel32.dll");
  60.  
  61.     return 0;
  62. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement