From 92f1de7ddbbb2d08b1fbf3003ee2cebf4c52b812 Mon Sep 17 00:00:00 2001
From: vxunderground <57078196+vxunderground@users.noreply.github.com>
Date: Fri, 15 Jul 2022 12:53:28 -0500
Subject: [PATCH] Create GetProcAddressSuperFastHash.cpp

---
 .../GetProcAddressSuperFastHash.cpp           | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 Windows API/Library Loading/GetProcAddressSuperFastHash.cpp

diff --git a/Windows API/Library Loading/GetProcAddressSuperFastHash.cpp b/Windows API/Library Loading/GetProcAddressSuperFastHash.cpp
new file mode 100644
index 0000000..f279cd6
--- /dev/null
+++ b/Windows API/Library Loading/GetProcAddressSuperFastHash.cpp	
@@ -0,0 +1,26 @@
+DWORD64 __stdcall GetProcAddressSuperFastHash(DWORD64 ModuleBase, DWORD64 Hash)
+{
+	PBYTE pFunctionName;
+	PIMAGE_DOS_HEADER Dos;
+	PIMAGE_NT_HEADERS Nt;
+	PIMAGE_FILE_HEADER File;
+	PIMAGE_OPTIONAL_HEADER Optional;
+
+	RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, (PBYTE*)&ModuleBase);
+
+	IMAGE_EXPORT_DIRECTORY* ExportTable = (PIMAGE_EXPORT_DIRECTORY)(ModuleBase + Optional->DataDirectory[0].VirtualAddress);
+	PDWORD FunctionNameAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNames);
+	PDWORD FunctionAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfFunctions);
+	PWORD FunctionOrdinalAddressArray = (PWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNameOrdinals);
+
+	for (DWORD dwX = 0; dwX < ExportTable->NumberOfNames; dwX++)
+	{
+		pFunctionName = FunctionNameAddressArray[dwX] + (PBYTE)ModuleBase;
+
+		DWORD dwFunctionHash = HashStringSuperFastHashA((PCHAR)pFunctionName);
+		if (Hash == dwFunctionHash)
+			return ((DWORD64)ModuleBase + FunctionAddressArray[FunctionOrdinalAddressArray[dwX]]);
+	}
+
+	return 0;
+}