Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- uint64_t get_module_export(uintptr_t module_handle, const char* function_ordinal, DWORD pid) //poluchaem address exporta
- {
- IMAGE_NT_HEADERS64 nt_header = *nt_headers;
- drv_read(pid, (void*)module_handle, &dos_header,sizeof(dos_header));
- drv_read(pid, (void*)(module_handle + dos_header.e_lfanew), &nt_header, sizeof(nt_header));
- auto export_base = nt_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
- auto export_base_size = nt_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
- if (export_base) // CONTAINS EXPORTED FUNCTIONS
- {
- std::unique_ptr<IMAGE_EXPORT_DIRECTORY> export_data_raw(reinterpret_cast<IMAGE_EXPORT_DIRECTORY*>(malloc(export_base_size)));
- auto export_data = export_data_raw.get();
- // READ EXPORTED DATA FROM TARGET PROCESS FOR LATER PROCESSING
- drv_read(pid, (void*)(module_handle + export_base), export_data, export_base_size);
- // BLACKBONE PASTE, NEVER EXPERIENCED THIS BUT WHO KNOWS?
- if (export_base_size <= sizeof(IMAGE_EXPORT_DIRECTORY))
- {
- export_base_size = static_cast<DWORD>(export_data->AddressOfNameOrdinals - export_base
- + max(export_data->NumberOfFunctions, export_data->NumberOfNames) * 255);
- export_data_raw.reset(reinterpret_cast<IMAGE_EXPORT_DIRECTORY*>(malloc(export_base_size)));
- export_data = export_data_raw.get();
- drv_read(pid, (void*)(module_handle + export_base), export_data, export_base_size);
- }
- // GET DATA FROM READ MEMORY
- auto delta = reinterpret_cast<uintptr_t>(export_data) - export_base;
- auto address_of_ordinals = reinterpret_cast<WORD*>(export_data->AddressOfNameOrdinals + delta);
- auto address_of_names = reinterpret_cast<DWORD*>(export_data->AddressOfNames + delta);
- auto address_of_functions = reinterpret_cast<DWORD*>(export_data->AddressOfFunctions + delta);
- // NO EXPORTED FUNCTIONS? DID WE FUCK UP?
- /*logger::log_error("No exports found!");*/
- for (size_t i = 0; i < export_data->NumberOfFunctions; i++)
- {
- WORD ordinal;
- std::string function_name;
- auto is_import_by_ordinal = reinterpret_cast<uintptr_t>(function_ordinal) <= 0xFFFF;
- // GET EXPORT INFORMATION
- ordinal = static_cast<WORD>(is_import_by_ordinal ? i : address_of_ordinals[i]);
- function_name = reinterpret_cast<char*>(address_of_names[i] + delta);
- //logger::log_formatted("Ordinal", ordinal);
- //logger::log_formatted("Name", function_name);
- // IS IT THE FUNCTION WE ASKED FOR?
- auto found_via_ordinal = is_import_by_ordinal && (WORD)((uintptr_t)function_ordinal) == (ordinal + export_data->Base);
- auto found_via_name = !is_import_by_ordinal && function_name == function_ordinal;
- if (found_via_ordinal || found_via_name)
- {
- auto function_pointer = module_handle + address_of_functions[ordinal];
- // FORWARDED EXPORT?
- // IF FUNCTION POINTER IS INSIDE THE EXPORT DIRECTORY, IT IS *NOT* A FUNCTION POINTER!
- // FUCKING SHIT MSVCP140 FUCK YOU
- return function_pointer;
- }
- }
- }
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement