CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/data/headers/windows/c_payload_util/payload_util.h
Views: 1904
/*1* This code is provided under the 3-clause BSD license below.2* ***********************************************************3*4* Copyright (c) 2013, Matthew Graeber5* All rights reserved.6*7* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:8*9* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.10* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.11* The names of its contributors may not be used to endorse or promote products derived from this software without specific prior written permission.12*13* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.14*/1516#ifndef _PAYLOAD_UTIL17#define _PAYLOAD_UTIL1819#include <windows.h>20#include <winternl.h>2122typedef HMODULE (WINAPI *FuncLoadLibraryA) (23LPTSTR lpFileName24);2526// This compiles to a ROR instruction27// This is needed because _lrotr() is an external reference28// Also, there is not a consistent compiler intrinsic to accomplish this across all three platforms.29#define ROTR32(value, shift) (((DWORD) value >> (BYTE) shift) | ((DWORD) value << (32 - (BYTE) shift)))3031// Redefine PEB structures. The structure definitions in winternl.h are incomplete.32typedef struct _MY_PEB_LDR_DATA {33ULONG Length;34BOOL Initialized;35PVOID SsHandle;36LIST_ENTRY InLoadOrderModuleList;37LIST_ENTRY InMemoryOrderModuleList;38LIST_ENTRY InInitializationOrderModuleList;39} MY_PEB_LDR_DATA, *PMY_PEB_LDR_DATA;4041typedef struct _MY_LDR_DATA_TABLE_ENTRY42{43LIST_ENTRY InLoadOrderLinks;44LIST_ENTRY InMemoryOrderLinks;45LIST_ENTRY InInitializationOrderLinks;46PVOID DllBase;47PVOID EntryPoint;48ULONG SizeOfImage;49UNICODE_STRING FullDllName;50UNICODE_STRING BaseDllName;51} MY_LDR_DATA_TABLE_ENTRY, *PMY_LDR_DATA_TABLE_ENTRY;5253HMODULE GetProcAddressWithHash( _In_ DWORD dwModuleFunctionHash )54{55PPEB PebAddress;56PMY_PEB_LDR_DATA pLdr;57PMY_LDR_DATA_TABLE_ENTRY pDataTableEntry;58PVOID pModuleBase;59PIMAGE_NT_HEADERS pNTHeader;60DWORD dwExportDirRVA;61PIMAGE_EXPORT_DIRECTORY pExportDir;62PLIST_ENTRY pNextModule;63DWORD dwNumFunctions;64USHORT usOrdinalTableIndex;65PDWORD pdwFunctionNameBase;66PCSTR pFunctionName;67UNICODE_STRING BaseDllName;68DWORD dwModuleHash;69DWORD dwFunctionHash;70PCSTR pTempChar;71DWORD i;7273#if defined(_WIN64)74PebAddress = (PPEB) __readgsqword( 0x60 );75#else76PebAddress = (PPEB) __readfsdword( 0x30 );77#endif7879pLdr = (PMY_PEB_LDR_DATA) PebAddress->Ldr;80pNextModule = pLdr->InLoadOrderModuleList.Flink;81pDataTableEntry = (PMY_LDR_DATA_TABLE_ENTRY) pNextModule;8283while (pDataTableEntry->DllBase != NULL)84{85dwModuleHash = 0;86pModuleBase = pDataTableEntry->DllBase;87BaseDllName = pDataTableEntry->BaseDllName;88pNTHeader = (PIMAGE_NT_HEADERS) ((ULONG_PTR) pModuleBase + ((PIMAGE_DOS_HEADER) pModuleBase)->e_lfanew);89dwExportDirRVA = pNTHeader->OptionalHeader.DataDirectory[0].VirtualAddress;9091// Get the next loaded module entry92pDataTableEntry = (PMY_LDR_DATA_TABLE_ENTRY) pDataTableEntry->InLoadOrderLinks.Flink;9394// If the current module does not export any functions, move on to the next module.95if (dwExportDirRVA == 0)96{97continue;98}99100// Calculate the module hash101for (i = 0; i < BaseDllName.MaximumLength; i++)102{103pTempChar = ((PCSTR) BaseDllName.Buffer + i);104105dwModuleHash = ROTR32( dwModuleHash, 13 );106107if ( *pTempChar >= 0x61 )108{109dwModuleHash += *pTempChar - 0x20;110}111else112{113dwModuleHash += *pTempChar;114}115}116117pExportDir = (PIMAGE_EXPORT_DIRECTORY) ((ULONG_PTR) pModuleBase + dwExportDirRVA);118119dwNumFunctions = pExportDir->NumberOfNames;120pdwFunctionNameBase = (PDWORD) ((PCHAR) pModuleBase + pExportDir->AddressOfNames);121122for (i = 0; i < dwNumFunctions; i++)123{124dwFunctionHash = 0;125pFunctionName = (PCSTR) (*pdwFunctionNameBase + (ULONG_PTR) pModuleBase);126pdwFunctionNameBase++;127128pTempChar = pFunctionName;129130do131{132dwFunctionHash = ROTR32( dwFunctionHash, 13 );133dwFunctionHash += *pTempChar;134pTempChar++;135} while (*(pTempChar - 1) != 0);136137dwFunctionHash += dwModuleHash;138139if (dwFunctionHash == dwModuleFunctionHash)140{141usOrdinalTableIndex = *(PUSHORT)(((ULONG_PTR) pModuleBase + pExportDir->AddressOfNameOrdinals) + (2 * i));142return (HMODULE) ((ULONG_PTR) pModuleBase + *(PDWORD)(((ULONG_PTR) pModuleBase + pExportDir->AddressOfFunctions) + (4 * usOrdinalTableIndex)));143}144}145}146147// All modules have been exhausted and the function was not found.148return NULL;149}150151#endif152153154