feat get_hmodule_expotr_func

Anti-Cheat_Driver/utils.cpp

@@ -102,5 +102,34 @@ namespace utils
 		return NULL;
 	}
 
+	auto get_hmodule_expotr_func(void* modulebase, const char* func_name) -> uintptr_t
+	{
+		char* Base = reinterpret_cast<char*>(modulebase);
+
+		auto pdos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(Base);
+		auto pNt_header = reinterpret_cast<PIMAGE_NT_HEADERS>((char*)Base + pdos_header->e_lfanew);
+
+
+		//±éÀúµ¼³ö±í
+		const auto export_table = pNt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+		const auto export_data = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>((char*)Base + export_table.VirtualAddress);
+
+		const auto func_name_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfNames);
+		const auto func_index_tab = reinterpret_cast<SHORT*>((char*)Base + export_data->AddressOfNameOrdinals);
+		const auto func_addr_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfFunctions);
+
+		for (size_t i = 0; i < export_data->NumberOfNames; i++)
+		{
+			const char* func_names = reinterpret_cast<const char*>((char*)Base + func_name_tab[i]);
+			const auto lpFunc_addr = reinterpret_cast<PUCHAR>((char*)Base + func_addr_tab[func_index_tab[i]]);
+			if (!strcmp(func_names, func_name))
+			{
+				return (uintptr_t)lpFunc_addr;
+			}
+		}
+
+		return 0;
+	}
+
 
 }

Anti-Cheat_Driver/utils.h

@@ -3,6 +3,9 @@
 
 namespace utils
 {
+	EXTERN_C NTKERNELAPI PVOID PsGetProcessWow64Process(IN PEPROCESS Process);
+	EXTERN_C NTKERNELAPI PVOID PsGetProcessPeb(IN PEPROCESS Process);
+
 	auto GetVersion() -> OSVERSIONINFOW;
 
 	auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;
@@ -11,4 +14,5 @@ namespace utils
 
 	auto get_beep_trampoline_ptr()->uintptr_t;
 
+	auto get_hmodule_expotr_func(void* modulebase, const char* func_name)->uintptr_t;
 }