73 lines
1.6 KiB
C++
73 lines
1.6 KiB
C++
#include "utils.h"
|
|
|
|
namespace utils
|
|
{
|
|
auto GetVersion() -> OSVERSIONINFOW
|
|
{
|
|
OSVERSIONINFOW osver{ 0 };
|
|
osver.dwOSVersionInfoSize = sizeof(OSVERSIONINFOW);
|
|
RtlGetVersion(&osver);
|
|
return osver;
|
|
}
|
|
|
|
auto patternCheck(const char* data, const char* pattern, const char* mask) -> bool
|
|
{
|
|
size_t len = strlen(mask);
|
|
|
|
for (size_t i = 0; i < len; i++)
|
|
{
|
|
if (data[i] == pattern[i] || mask[i] == '?')
|
|
continue;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
auto patternFind(unsigned long long addr, unsigned long size, const char* pattern, const char* mask) -> ULONG64
|
|
{
|
|
size -= (unsigned long)strlen(mask);
|
|
for (unsigned long i = 0; i < size; i++)
|
|
{
|
|
if (patternCheck((const char*)addr + i, pattern, mask))
|
|
return addr + i;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
|
|
|
|
auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64
|
|
{
|
|
auto image_dos = (PIMAGE_DOS_HEADER)Base;
|
|
auto ntheader = (PIMAGE_NT_HEADERS)(Base + image_dos->e_lfanew);
|
|
|
|
auto section = IMAGE_FIRST_SECTION(ntheader);
|
|
for (size_t i = 0; i < ntheader->FileHeader.NumberOfSections; i++)
|
|
{
|
|
PIMAGE_SECTION_HEADER p = §ion[i];
|
|
if (strstr((const char*)p->Name, name))
|
|
{
|
|
unsigned long long result = patternFind(Base + p->VirtualAddress, p->Misc.VirtualSize, pattern, mask);
|
|
if (result) return result;
|
|
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
auto kernel_get_expotr_func(wchar_t* func_name)-> uintptr_t
|
|
{
|
|
UNICODE_STRING unicode_func_name{ 0 };
|
|
RtlInitUnicodeString(&unicode_func_name, func_name);
|
|
return (uintptr_t)MmGetSystemRoutineAddress(&unicode_func_name);
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
} |