mirror of
https://github.com/AbishekPonmudi/Dynloader
synced 2026-07-15 03:39:09 +00:00
(Havox)
87 lines
4.2 KiB
C++
87 lines
4.2 KiB
C++
#pragma once
|
|
|
|
#include <cstdint>
|
|
|
|
// djb2 — compile-time and runtime hash for module/export resolution.
|
|
// No plaintext API names required at call sites; only DWORD constants.
|
|
namespace Hashes {
|
|
|
|
constexpr std::uint32_t kSeed = 5381u;
|
|
|
|
constexpr std::uint32_t Djb2(const char* s) {
|
|
std::uint32_t h = kSeed;
|
|
while (*s) {
|
|
h = (h * 33u) + static_cast<unsigned char>(*s++);
|
|
}
|
|
return h;
|
|
}
|
|
|
|
constexpr std::uint32_t Djb2Lower(const char* s) {
|
|
std::uint32_t h = kSeed;
|
|
while (*s) {
|
|
char c = *s++;
|
|
if (c >= 'A' && c <= 'Z') {
|
|
c = static_cast<char>(c + 32);
|
|
}
|
|
h = (h * 33u) + static_cast<unsigned char>(c);
|
|
}
|
|
return h;
|
|
}
|
|
|
|
// --- Module hashes (lowercase basename) ---
|
|
constexpr std::uint32_t H_NTDLL_DLL = Djb2Lower("ntdll.dll");
|
|
constexpr std::uint32_t H_KERNEL32_DLL = Djb2Lower("kernel32.dll");
|
|
constexpr std::uint32_t H_LoadLibraryW = Djb2("LoadLibraryW");
|
|
constexpr std::uint32_t H_CreateThread = 0x7F08F451u; // api_hash verified
|
|
constexpr std::uint32_t H_WaitForSingleObject = Djb2("WaitForSingleObject");
|
|
constexpr std::uint32_t H_CloseHandle = Djb2("CloseHandle");
|
|
constexpr std::uint32_t H_CreateProcessW = Djb2("CreateProcessW");
|
|
constexpr std::uint32_t H_CreateRemoteThread = Djb2("CreateRemoteThread");
|
|
constexpr std::uint32_t H_ResumeThread = Djb2("ResumeThread");
|
|
constexpr std::uint32_t H_SearchPathW = Djb2("SearchPathW");
|
|
constexpr std::uint32_t H_OpenProcess = Djb2("OpenProcess");
|
|
constexpr std::uint32_t H_WS2_32_DLL = Djb2Lower("ws2_32.dll");
|
|
constexpr std::uint32_t H_BCRYPT_DLL = Djb2Lower("bcrypt.dll");
|
|
|
|
// --- NT exports (syscall targets) ---
|
|
constexpr std::uint32_t H_NtAllocateVirtualMemory = Djb2("NtAllocateVirtualMemory");
|
|
constexpr std::uint32_t H_NtProtectVirtualMemory = Djb2("NtProtectVirtualMemory");
|
|
constexpr std::uint32_t H_NtWriteVirtualMemory = Djb2("NtWriteVirtualMemory");
|
|
constexpr std::uint32_t H_NtFreeVirtualMemory = Djb2("NtFreeVirtualMemory");
|
|
constexpr std::uint32_t H_NtCreateSection = Djb2("NtCreateSection");
|
|
constexpr std::uint32_t H_NtMapViewOfSection = Djb2("NtMapViewOfSection");
|
|
constexpr std::uint32_t H_NtUnmapViewOfSection = Djb2("NtUnmapViewOfSection");
|
|
constexpr std::uint32_t H_NtOpenProcess = Djb2("NtOpenProcess");
|
|
constexpr std::uint32_t H_NtCreateThreadEx = Djb2("NtCreateThreadEx");
|
|
constexpr std::uint32_t H_NtClose = Djb2("NtClose");
|
|
constexpr std::uint32_t H_NtQuerySystemInformation = Djb2("NtQuerySystemInformation");
|
|
constexpr std::uint32_t H_NtCreateFile = Djb2("NtCreateFile");
|
|
constexpr std::uint32_t H_NtReadFile = Djb2("NtReadFile");
|
|
constexpr std::uint32_t H_NtQueryInformationProcess = Djb2("NtQueryInformationProcess");
|
|
|
|
// --- BCrypt (AES) — runtime-verified on MSVC x64 ---
|
|
constexpr std::uint32_t H_BCryptOpenAlgorithmProvider = 0x2A15DFDDu;
|
|
constexpr std::uint32_t H_BCryptCloseAlgorithmProvider = 0xFCD0CDC1u;
|
|
constexpr std::uint32_t H_BCryptGenerateSymmetricKey = 0xA81D472Au;
|
|
constexpr std::uint32_t H_BCryptDestroyKey = 0x7B16C8CCu;
|
|
constexpr std::uint32_t H_BCryptEncrypt = 0xCB04529Eu;
|
|
constexpr std::uint32_t H_BCryptDecrypt = 0x690BA834u;
|
|
constexpr std::uint32_t H_BCryptSetProperty = 0xE9049EEAu;
|
|
constexpr std::uint32_t H_BCryptGenRandom = 0x3A73C634u;
|
|
|
|
// --- Winsock (HTTP client/server) ---
|
|
constexpr std::uint32_t H_WSAStartup = Djb2("WSAStartup");
|
|
constexpr std::uint32_t H_WSACleanup = Djb2("WSACleanup");
|
|
constexpr std::uint32_t H_socket = Djb2("socket");
|
|
constexpr std::uint32_t H_connect = Djb2("connect");
|
|
constexpr std::uint32_t H_send = Djb2("send");
|
|
constexpr std::uint32_t H_recv = Djb2("recv");
|
|
constexpr std::uint32_t H_closesocket = Djb2("closesocket");
|
|
constexpr std::uint32_t H_bind = Djb2("bind");
|
|
constexpr std::uint32_t H_listen = Djb2("listen");
|
|
constexpr std::uint32_t H_accept = Djb2("accept");
|
|
constexpr std::uint32_t H_getaddrinfo = Djb2("getaddrinfo");
|
|
constexpr std::uint32_t H_freeaddrinfo = Djb2("freeaddrinfo");
|
|
constexpr std::uint32_t H_setsockopt = Djb2("setsockopt");
|
|
|
|
} // namespace Hashes
|