GetExportedFunctionAddress

// Souhail Hammou : rce4fun.blogspot.com
// Twitter : @Dark_Puzzle
#include <Windows.h>
#include <winternl.h>
#include <stdio.h>
#include <conio.h>
#include <iostream>
void main(){
    PLDR_DATA_TABLE_ENTRY LDR_TE;
    PLIST_ENTRY i;
    PPEB ProcPEB;
    PLIST_ENTRY ModListHead;
    PIMAGE_DOS_HEADER pDOS;
    PIMAGE_OPTIONAL_HEADER pOptionalHeader;
    PIMAGE_EXPORT_DIRECTORY Export_Dir;
    PWCHAR YourDLL;
    PCHAR FunctionName;
    YourDLL = (PWCHAR) malloc(sizeof(WCHAR)*20);
    FunctionName = (PCHAR) malloc(sizeof(CHAR)*70);
    __asm {
        mov eax,fs:[0x30]
        mov ProcPEB,eax
    }

    printf("Specify The Module Name : ");
    std::wcin >> YourDLL;
    ModListHead = &(ProcPEB->Ldr->InMemoryOrderModuleList);
    //Walk through the circular doubly linked list until finding the target Module name
    for(i = ModListHead->Flink; i != ModListHead ; i = i->Flink){
        LDR_TE = (LDR_DATA_TABLE_ENTRY*) i;
        if(!(wcscmp(YourDLL,LDR_TE->FullDllName.Buffer))){
            break;
        }
    }
    if(i == ModListHead){
        printf("Sorry ! The chosen module wasn't found");
        _getch();
        return;
    }
    std::wcout << LDR_TE->FullDllName.Buffer << L" is at : " << LDR_TE->Reserved2[0] << std::endl;
    pDOS = (PIMAGE_DOS_HEADER) LDR_TE->Reserved2[0];
    pOptionalHeader = (PIMAGE_OPTIONAL_HEADER) ((long)pDOS + pDOS->e_lfanew);
    Export_Dir = (PIMAGE_EXPORT_DIRECTORY)((long)pOptionalHeader->DataDirectory[0x3].VirtualAddress + (long)pDOS);
    printf("Export Table at : %p\n",Export_Dir);
    char** Names = (char**)((long)(Export_Dir->AddressOfNames) + (long)pDOS);
    printf("Please Specify a function name exported by the module: ");
    scanf("%s",FunctionName);
    int k;
    for(k = 0 ; k < Export_Dir->NumberOfNames ; k++){
        if(!(strcmp(Names[k] + (long)pDOS,FunctionName)))
            break;
    }
    if(k == Export_Dir->NumberOfNames){
        printf("Sorry ! Not Found");
        _getch();
        return;
    }
    // If the exported function name was found in AddrOfNames, we'll use its index to access the AddrOfNameOrdinals array.
    //The value (Ordinal) that we'll from AddrOfNameOrdinals extract will be used to access the AddressOfFunctions Array.
    WORD Ordinal = *((WORD*)((long)Export_Dir->AddressOfNameOrdinals + (long)pDOS + k*2));
    DWORD FunctionRVA = *((DWORD*)((long)(Export_Dir->AddressOfFunctions) + (long)pDOS + Ordinal*4));
    printf("The Function is at :  0x%p\n",FunctionRVA + (long)pDOS);
    printf("Press a key to exit");
    _getch();
}