feat get_hmodule_expotr_func

2026-06-23 13:15:34 +08:00
parent afc667b1da
commit 60884491e7
2 changed files with 33 additions and 0 deletions
@@ -102,5 +102,34 @@ namespace utils
 		return NULL;
 	}

+	auto get_hmodule_expotr_func(void* modulebase, const char* func_name) -> uintptr_t
+	{
+		char* Base = reinterpret_cast<char*>(modulebase);
+
+		auto pdos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(Base);
+		auto pNt_header = reinterpret_cast<PIMAGE_NT_HEADERS>((char*)Base + pdos_header->e_lfanew);
+
+
+		//±éÀúµ¼³ö±í
+		const auto export_table = pNt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+		const auto export_data = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>((char*)Base + export_table.VirtualAddress);
+
+		const auto func_name_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfNames);
+		const auto func_index_tab = reinterpret_cast<SHORT*>((char*)Base + export_data->AddressOfNameOrdinals);
+		const auto func_addr_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfFunctions);
+
+		for (size_t i = 0; i < export_data->NumberOfNames; i++)
+		{
+			const char* func_names = reinterpret_cast<const char*>((char*)Base + func_name_tab[i]);
+			const auto lpFunc_addr = reinterpret_cast<PUCHAR>((char*)Base + func_addr_tab[func_index_tab[i]]);
+			if (!strcmp(func_names, func_name))
+			{
+				return (uintptr_t)lpFunc_addr;
+			}
+		}
+
+		return 0;
+	}
+

 }