ilkyr-CustomRDI/hash_generator.c

#include <stdio.h>
#include <windows.h>

DWORD djb2_hash_unicode(WCHAR *str) {
    DWORD hash = 5381;
    WCHAR c;
    while ((c = *str++)) {
        if (c >= L'a' && c <= L'z')
            c -= 0x20;
        hash = ((hash << 5) + hash) + (DWORD)c;
    }
    return hash;
}

DWORD djb2_hash_ascii(unsigned char *str) {
    DWORD hash = 5381;
    int c;
    while ((c = *str++))
        hash = ((hash << 5) + hash) + c;
    return hash;
}

int main(void) {
    // DLL names - Unicode uppercase (as stored in PEB)
    printf("KERNEL32DLL_HASH:              0x%08X\n", djb2_hash_unicode(L"KERNEL32.DLL"));
    printf("NTDLLDLL_HASH:                 0x%08X\n", djb2_hash_unicode(L"ntdll.dll"));
    printf("KERNELBASEDLL_HASH:            0x%08x\n", djb2_hash_unicode(L"KERNELBASE.DLL"));
    printf("MSVCRTDLL_HASH:                0x%08x\n", djb2_hash_unicode(L"MSVCRT.DLL"));

    // Function names - ASCII (as stored in export tables)
    printf("LOADLIBRARYA_HASH:             0x%08X\n", djb2_hash_ascii((unsigned char*)"LoadLibraryA"));
    printf("GETPROCADDRESS_HASH:           0x%08X\n", djb2_hash_ascii((unsigned char*)"GetProcAddress"));
    printf("VIRTUALALLOC_HASH:             0x%08X\n", djb2_hash_ascii((unsigned char*)"VirtualAlloc"));
    printf("NTFLUSHINSTRUCTIONCACHE_HASH:  0x%08X\n", djb2_hash_ascii((unsigned char*)"NtFlushInstructionCache"));
    printf("NTALLOCATEVIRTUALMEMORY_HASH:  0x%08X\n", djb2_hash_ascii((unsigned char*)"NtAllocateVirtualMemory"));
    printf("LDRLOADDLL_HASH:               0x%08X\n", djb2_hash_ascii((unsigned char*)"LdrLoadDll"));
    printf("NTPROTECTVIRTUALMEMORY_HASH:   0x%08X\n", djb2_hash_ascii((unsigned char*)"NtProtectVirtualMemory"));

    return 0;
}