diff --git a/Anti-Cheat_Driver/utils.cpp b/Anti-Cheat_Driver/utils.cpp index c6bb9cb..49f975e 100644 --- a/Anti-Cheat_Driver/utils.cpp +++ b/Anti-Cheat_Driver/utils.cpp @@ -102,5 +102,34 @@ namespace utils return NULL; } + auto get_hmodule_expotr_func(void* modulebase, const char* func_name) -> uintptr_t + { + char* Base = reinterpret_cast(modulebase); + + auto pdos_header = reinterpret_cast(Base); + auto pNt_header = reinterpret_cast((char*)Base + pdos_header->e_lfanew); + + + //±éÀúµ¼³ö±í + const auto export_table = pNt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; + const auto export_data = reinterpret_cast((char*)Base + export_table.VirtualAddress); + + const auto func_name_tab = reinterpret_cast((char*)Base + export_data->AddressOfNames); + const auto func_index_tab = reinterpret_cast((char*)Base + export_data->AddressOfNameOrdinals); + const auto func_addr_tab = reinterpret_cast((char*)Base + export_data->AddressOfFunctions); + + for (size_t i = 0; i < export_data->NumberOfNames; i++) + { + const char* func_names = reinterpret_cast((char*)Base + func_name_tab[i]); + const auto lpFunc_addr = reinterpret_cast((char*)Base + func_addr_tab[func_index_tab[i]]); + if (!strcmp(func_names, func_name)) + { + return (uintptr_t)lpFunc_addr; + } + } + + return 0; + } + } \ No newline at end of file diff --git a/Anti-Cheat_Driver/utils.h b/Anti-Cheat_Driver/utils.h index c21682d..f6cc8f3 100644 --- a/Anti-Cheat_Driver/utils.h +++ b/Anti-Cheat_Driver/utils.h @@ -3,6 +3,9 @@ namespace utils { + EXTERN_C NTKERNELAPI PVOID PsGetProcessWow64Process(IN PEPROCESS Process); + EXTERN_C NTKERNELAPI PVOID PsGetProcessPeb(IN PEPROCESS Process); + auto GetVersion() -> OSVERSIONINFOW; auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64; @@ -11,4 +14,5 @@ namespace utils auto get_beep_trampoline_ptr()->uintptr_t; + auto get_hmodule_expotr_func(void* modulebase, const char* func_name)->uintptr_t; } \ No newline at end of file