mirror of
https://github.com/vxunderground/VX-API
synced 2026-06-06 16:54:55 +00:00
vxunderground
55 lines
2.1 KiB
C++
55 lines
2.1 KiB
C++
DWORD64 __stdcall RfGetProcAddressA(DWORD64 ModuleBase, LPCSTR lpProcName)
|
|
{
|
|
PBYTE pFunctionName;
|
|
PIMAGE_DOS_HEADER Dos;
|
|
PIMAGE_NT_HEADERS Nt;
|
|
PIMAGE_FILE_HEADER File;
|
|
PIMAGE_OPTIONAL_HEADER Optional;
|
|
|
|
RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, (PBYTE*)&ModuleBase);
|
|
|
|
IMAGE_EXPORT_DIRECTORY* ExportTable = (PIMAGE_EXPORT_DIRECTORY)(ModuleBase + Optional->DataDirectory[0].VirtualAddress);
|
|
PDWORD FunctionNameAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNames);
|
|
PDWORD FunctionAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfFunctions);
|
|
PWORD FunctionOrdinalAddressArray = (PWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNameOrdinals);
|
|
|
|
for (DWORD dwX = 0; dwX < ExportTable->NumberOfNames; dwX++)
|
|
{
|
|
pFunctionName = FunctionNameAddressArray[dwX] + (PBYTE)ModuleBase;
|
|
if(StringCompareA((PCHAR)pFunctionName, lpProcName) == 0)
|
|
return ((DWORD64)ModuleBase + FunctionAddressArray[FunctionOrdinalAddressArray[dwX]]);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
DWORD64 __stdcall RfGetProcAddressW(DWORD64 ModuleBase, LPCWSTR lpProcName)
|
|
{
|
|
PBYTE pFunctionName;
|
|
PIMAGE_DOS_HEADER Dos;
|
|
PIMAGE_NT_HEADERS Nt;
|
|
PIMAGE_FILE_HEADER File;
|
|
PIMAGE_OPTIONAL_HEADER Optional;
|
|
|
|
RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, (PBYTE*)&ModuleBase);
|
|
|
|
IMAGE_EXPORT_DIRECTORY* ExportTable = (PIMAGE_EXPORT_DIRECTORY)(ModuleBase + Optional->DataDirectory[0].VirtualAddress);
|
|
PDWORD FunctionNameAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNames);
|
|
PDWORD FunctionAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfFunctions);
|
|
PWORD FunctionOrdinalAddressArray = (PWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNameOrdinals);
|
|
|
|
for (DWORD dwX = 0; dwX < ExportTable->NumberOfNames; dwX++)
|
|
{
|
|
WCHAR wFunctionName[256] = { 0 };
|
|
pFunctionName = FunctionNameAddressArray[dwX] + (PBYTE)ModuleBase;
|
|
|
|
if (CharStringToWCharString(wFunctionName, (PCHAR)pFunctionName, 256) == 0)
|
|
break;
|
|
|
|
if (StringCompareW(wFunctionName, lpProcName) == 0)
|
|
return ((DWORD64)ModuleBase + FunctionAddressArray[FunctionOrdinalAddressArray[dwX]]);
|
|
}
|
|
|
|
return 0;
|
|
}
|