diff --git a/Windows API/Library Loading/GetProcAddressSuperFastHash.cpp b/Windows API/Library Loading/GetProcAddressSuperFastHash.cpp new file mode 100644 index 0000000..f279cd6 --- /dev/null +++ b/Windows API/Library Loading/GetProcAddressSuperFastHash.cpp @@ -0,0 +1,26 @@ +DWORD64 __stdcall GetProcAddressSuperFastHash(DWORD64 ModuleBase, DWORD64 Hash) +{ + PBYTE pFunctionName; + PIMAGE_DOS_HEADER Dos; + PIMAGE_NT_HEADERS Nt; + PIMAGE_FILE_HEADER File; + PIMAGE_OPTIONAL_HEADER Optional; + + RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, (PBYTE*)&ModuleBase); + + IMAGE_EXPORT_DIRECTORY* ExportTable = (PIMAGE_EXPORT_DIRECTORY)(ModuleBase + Optional->DataDirectory[0].VirtualAddress); + PDWORD FunctionNameAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNames); + PDWORD FunctionAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfFunctions); + PWORD FunctionOrdinalAddressArray = (PWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNameOrdinals); + + for (DWORD dwX = 0; dwX < ExportTable->NumberOfNames; dwX++) + { + pFunctionName = FunctionNameAddressArray[dwX] + (PBYTE)ModuleBase; + + DWORD dwFunctionHash = HashStringSuperFastHashA((PCHAR)pFunctionName); + if (Hash == dwFunctionHash) + return ((DWORD64)ModuleBase + FunctionAddressArray[FunctionOrdinalAddressArray[dwX]]); + } + + return 0; +}