admin/bats3c-DarkLoadLibrary
1
0
Fork 0
mirror of https://github.com/bats3c/DarkLoadLibrary synced 2026-06-06 15:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

add code to find DLL exports

Browse Source
This commit is contained in:
physics-sp
2021-07-23 22:02:25 -03:00
parent e2d2bfc0c7
commit fbcf230a44
5 changed files with 234 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DarkLoadLibrary/include/ldrutils.h
-5
View File
@@ -5,11 +5,6 @@
#define RVA(type, base_addr, rva) (type)((ULONG_PTR) base_addr + rva)
#define FILL_STRING(string, buffer) \
string.Length = (USHORT)strlen(buffer); \
string.MaximumLength = string.Length; \
string.Buffer = buffer
typedef BOOL(WINAPI * DLLMAIN)(HINSTANCE, DWORD, LPVOID);
typedef NTSTATUS(WINAPI *LDRGETPROCADDRESS)(HMODULE, PANSI_STRING, WORD, PVOID*);
DarkLoadLibrary/include/pebutils.h
+8 -1
View File
@@ -3,6 +3,11 @@
#include "pebstructs.h"
#include "darkloadlibrary.h"
#define FILL_STRING(string, buffer) \
string.Length = (USHORT)strlen(buffer); \
string.MaximumLength = string.Length; \
string.Buffer = buffer
#ifdef _WIN32
#define PEB_OFFSET 0x30
#define READ_MEMLOC __readfsdword
@@ -25,4 +30,6 @@
#define LDR_HASH_TABLE_ENTRIES 32
HMODULE IsModulePresent(LPCWSTR lpwName);
BOOL LinkModuleToPEB(PDARKMODULE pdModule);
BOOL LinkModuleToPEB(PDARKMODULE pdModule);
FARPROC GetFunctionAddress(HMODULE hModule, LPCSTR lpProcName);
BOOL LocalLdrGetProcedureAddress(HMODULE hLibrary, PANSI_STRING ProcName, WORD Ordinal, PVOID* FunctionAddress);