blob: 8d04d7ee3f3358084bac0d5731c9cfbc7dd152d1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
#include "Import.h"
PPEB pPeb = NULL;
HMODULE _GetModuleHandle(const wchar_t * lpModuleName)
{
PLDR_DATA_TABLE_ENTRY pLdrDataTableEntry = NULL;
PLIST_ENTRY pFirstModule = NULL;
PLIST_ENTRY pCurrentModule = NULL;
__asm
{
mov eax, fs:[0x30];
mov [pPeb], eax;
}
pFirstModule = &(pPeb->Ldr->InMemoryOrderModuleList);
for (pCurrentModule = pFirstModule->Flink; pCurrentModule != pFirstModule; pCurrentModule = pCurrentModule->Flink)
{
pLdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY)pCurrentModule;
if (lpModuleName == NULL)
return (HMODULE)pLdrDataTableEntry->Reserved2[0];
if (!_wcsicmp(lpModuleName, pLdrDataTableEntry->FullDllName.Buffer))
return (HMODULE)pLdrDataTableEntry->Reserved2[0];
}
return NULL;
}
FARPROC __stdcall _getProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
DWORD i;
PBYTE pbBase = (PBYTE)hModule;
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbBase;
PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)(pbBase + pDosHeader->e_lfanew);
PIMAGE_OPTIONAL_HEADER pOptionalHeader = &pNtHeaders->OptionalHeader;
PIMAGE_EXPORT_DIRECTORY pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(pbBase +
pOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
DWORD *dwAddressOfFunctions = (DWORD *)(pbBase + pExportDirectory->AddressOfFunctions);
DWORD *dwAddressOfNames = (DWORD *)(pbBase + pExportDirectory->AddressOfNames);
WORD *wAddressOfNameOrdinals = (WORD *)(pbBase + pExportDirectory->AddressOfNameOrdinals);
for (i = 0; i < pExportDirectory->NumberOfNames; i++)
{
if (!_strcmp(lpProcName, (const char *)(pbBase + dwAddressOfNames[i])))
{
return (FARPROC)(pbBase + dwAddressOfFunctions[wAddressOfNameOrdinals[i]]);
}
}
return NULL;
}
int _strcmp(const char *string1, const char *string2)
{
int result = *string1++ - *string2++;
while (!result && *string1)
result = *string1++ - *string2++;
if (result < 0)
return -1;
if (result > 0)
return 1;
return 0;
}
int _wcsicmp(const wchar_t *string1, const wchar_t *string2)
{
int result = *string1 - *string2;
DWORD isDebuggerPresent = 0;
if (0x41 <= *string1 && *string1 < 0x5B)
result += 0x20;
if (0x41 <= *string2 && *string2 < 0x5B)
result -= 0x20;
string1++;
string2++;
if (!isDebuggerPresent)
{
__asm
{
push ebx;
mov ebx, pPeb;
mov ebx, [ebx];
mov isDebuggerPresent, ebx;
pop ebx;
}
}
while (!result && *string1)
{
result = *string1 - *string2;
if ((0x41 <= *string1 && *string1 < 0x5B) ^ ((isDebuggerPresent >> 16) & 0x01))
result += 0x20;
if (0x41 <= *string2 && *string2 < 0x5B)
result -= 0x20;
string1++;
string2++;
}
if (result < 0)
return -1;
if (result > 0)
return 1;
return 0;
}
|
