Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- typedef struct _UNICODE_STRING
- {
- USHORT Length;
- USHORT MaximumLength;
- PWSTR Buffer;
- } UNICODE_STRING, *PUNICODE_STRING;
- typedef struct _PEB_LDR_DATA
- {
- ULONG Length;
- BOOLEAN Initialized;
- PVOID SsHandle;
- LIST_ENTRY InLoadOrderModuleList;
- LIST_ENTRY InMemoryOrderModuleList;
- LIST_ENTRY InInitializationOrderModuleList;
- } PEB_LDR_DATA, *PPEB_LDR_DATA;
- typedef struct _LDR_MODULE
- {
- LIST_ENTRY InLoadOrderModuleList;
- LIST_ENTRY InMemoryOrderModuleList;
- LIST_ENTRY InInitializationOrderModuleList;
- PVOID BaseAddress;
- PVOID EntryPoint;
- ULONG SizeOfImage;
- UNICODE_STRING FullDllName;
- UNICODE_STRING BaseDllName;
- ULONG Flags;
- SHORT LoadCount;
- SHORT TlsIndex;
- LIST_ENTRY HashTableEntry;
- ULONG TimeDateStamp;
- } LDR_MODULE, *PLDR_MODULE;
- void x_wcstombs( wchar_t* src, size_t len, char* dest )
- {
- int i;
- char tmpc;
- if ( !src || !dest )
- return;
- // iterate our wide str
- for ( i = 0; i < len; i++ )
- {
- // truncate to 8-bit
- tmpc = src[ i ] & 255;
- if ( (tmpc >= 'A') && (tmpc <= 'Z') )
- tmpc += 32;
- // copy to buffer
- dest[ i ] = tmpc;
- }
- // zero-terminator fix
- dest[ len ] = '\0';
- }
- DWORD_PTR GetModuleBase( const char* lpModuleName )
- {
- int iLenght;
- char lpBuffer[ 255 ];
- DWORD_PTR dwPEB;
- PEB_LDR_DATA* pPEB;
- LIST_ENTRY* pHead, *pNode;
- LDR_MODULE* pModule;
- dwPEB = *makeptr( DWORD_PTR*, __readfsdword( 0x18 ), 0x30 );
- dwPEB = *makeptr( DWORD_PTR*, dwPEB, 0xC );
- if( !dwPEB )
- return NULL;
- pPEB = ( PEB_LDR_DATA* )dwPEB;
- pHead = &pPEB->InLoadOrderModuleList;
- for( pNode = pHead->Flink; pNode != pHead; pNode = pNode->Flink )
- {
- pModule = CONTAINING_RECORD( pNode, LDR_MODULE, InLoadOrderModuleList );
- if( pModule )
- {
- iLenght = pModule->BaseDllName.Length >> 1;
- x_wcstombs( pModule->BaseDllName.Buffer, iLenght, lpBuffer );
- if( !strcmp( lpModuleName, lpBuffer ) )
- {
- return ( DWORD_PTR )pModule->BaseAddress;
- }
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment