mirror of
https://github.com/winterknife/SILVERPICK
synced 2026-06-08 18:21:15 +00:00
winterknife
70 lines
2.6 KiB
C
70 lines
2.6 KiB
C
// ========================================================================
|
|
// File: UserModuleBase.h
|
|
//
|
|
// Author: winterknife
|
|
//
|
|
// Description: Header file for UserModuleBase.cpp source file
|
|
//
|
|
// Modifications:
|
|
// 2025-09-23 Created
|
|
// 2025-09-25 Updated
|
|
// ========================================================================
|
|
|
|
// ========================================================================
|
|
// Header guards
|
|
// ========================================================================
|
|
|
|
#pragma once
|
|
|
|
// ========================================================================
|
|
// Includes
|
|
// ========================================================================
|
|
|
|
#include "Common.h"
|
|
#include "HashString.h"
|
|
|
|
// ========================================================================
|
|
// Macros
|
|
// ========================================================================
|
|
|
|
#pragma region MACROS
|
|
|
|
// Hardcoded ntdll!_LDR_DATA_TABLE_ENTRY.BaseDllName.MaximumLength value
|
|
#define MAX_BASE_DLL_NAME_LEN 64U
|
|
|
|
// Macro to get the image base address of a loaded user-mode module
|
|
#define GET_USER_MODULE_BASE(Name) get_user_module_base_by_hash(HASH_STRING_COMPILE_TIME(Name))
|
|
|
|
#pragma endregion
|
|
|
|
// ========================================================================
|
|
// Inline routines
|
|
// ========================================================================
|
|
|
|
#pragma region INLINES
|
|
|
|
/// @brief Get a pointer to the Thread Environment Block (TEB) of the current thread
|
|
/// @return A pointer to the TEB of the current thread
|
|
FORCE_INLINE PTEB get_current_teb(
|
|
VOID
|
|
) {
|
|
// GS segment base address points to the base address of the current thread's Thread Environment Block (TEB) in user-mode
|
|
return BIT_CAST(TEB*, __readgsqword(FIELD_OFFSET(NT_TIB, Self)));
|
|
}
|
|
|
|
#pragma endregion
|
|
|
|
// ========================================================================
|
|
// C routine declarations
|
|
// ========================================================================
|
|
|
|
#pragma region DECLARATIONS
|
|
|
|
/// @brief To retrieve the base address of a loaded user-mode module (EXE/DLL) from user-mode, does not increment module reference count, custom implementation of kernel32!GetModuleHandle routine
|
|
/// @param qwTargetModuleHash 64-bit Fowler/Noll/Vo (FNV-1a) hash of the target module name in lowercase with the file name extension, can also be nullptr to get the base address of the calling module
|
|
/// @return Returns the base address of the loaded module if successful, or nullptr otherwise
|
|
EXTERN_C NO_INLINE PVOID __stdcall get_user_module_base_by_hash(
|
|
_In_opt_ QWORD qwTargetModuleHash
|
|
);
|
|
|
|
#pragma endregion |