mirror of
https://github.com/AbishekPonmudi/Dynloader
synced 2026-07-15 03:39:09 +00:00
(Havox)
59 lines
1.5 KiB
C++
59 lines
1.5 KiB
C++
#pragma once
|
|
|
|
#include <Windows.h>
|
|
#include <cstdint>
|
|
|
|
namespace PeParser {
|
|
|
|
// Minimal PEB/LDR structures (winternl.h is incomplete for InMemoryOrder walk).
|
|
struct PeUnicodeString {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
};
|
|
|
|
struct LdrDataTableEntry {
|
|
PVOID Reserved1[2];
|
|
LIST_ENTRY InMemoryOrderLinks;
|
|
PVOID Reserved2[2];
|
|
PVOID DllBase;
|
|
PVOID Reserved3[2];
|
|
PeUnicodeString BaseDllName;
|
|
};
|
|
|
|
struct PebLdrData {
|
|
ULONG Length;
|
|
BOOLEAN Initialized;
|
|
PVOID SsHandle;
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
};
|
|
|
|
struct Peb {
|
|
BYTE Reserved1[2];
|
|
BYTE BeingDebugged;
|
|
BYTE Reserved2[1];
|
|
PVOID Reserved3[2];
|
|
PebLdrData* Ldr;
|
|
};
|
|
|
|
// Returns process environment block pointer (x64: GS:[0x60]).
|
|
Peb* GetPeb();
|
|
|
|
// Walk PEB->Ldr->InMemoryOrderModuleList; match module by djb2 lowercase hash.
|
|
HMODULE GetModuleByHash(std::uint32_t moduleHash);
|
|
|
|
// InMemoryOrder index: 0=exe, 1=ntdll, 2=kernel32 (typical load order).
|
|
HMODULE GetModuleByIndex(unsigned index);
|
|
|
|
// Walk PE export directory; match export by djb2 hash (case-sensitive export name).
|
|
FARPROC GetExportByHash(HMODULE module, std::uint32_t exportHash);
|
|
|
|
// Parse PE headers from module base.
|
|
PIMAGE_NT_HEADERS GetNtHeaders(HMODULE module);
|
|
|
|
// Convert wide module basename to lowercase ASCII for hashing.
|
|
bool WideToLowerAscii(const PeUnicodeString& name, char* out, size_t outCap);
|
|
|
|
} // namespace PeParser
|