Jump to content
Nytro

[C] CallAPIByName

Recommended Posts

Posted

[C] CallAPIByName

LPVOID GetProcAddressEx(HMODULE hModule, LPCSTR lpProcName)
{
DWORD dwModule = (DWORD)hModule;

IMAGE_DOS_HEADER *Image_Dos_Header = (IMAGE_DOS_HEADER *)(dwModule);

IMAGE_NT_HEADERS *Image_Nt_Headers = (IMAGE_NT_HEADERS *)(dwModule + Image_Dos_Header->e_lfanew);

IMAGE_EXPORT_DIRECTORY *Image_Export_Directory = (IMAGE_EXPORT_DIRECTORY *)(dwModule + Image_Nt_Headers->OptionalHeader.DataDirectory->VirtualAddress);

unsigned int nNumber;

for (nNumber = 0; Image_Export_Directory->NumberOfNames; ++nNumber)
{
LPSTR lpAddressOfNames = ((*(LPSTR *)(Image_Export_Directory->AddressOfNames + dwModule + nNumber * sizeof(DWORD))) + dwModule);

if (!lstrcmpA(lpProcName, lpAddressOfNames))
{
USHORT Ordinal = (*(USHORT *)(Image_Export_Directory->AddressOfNameOrdinals + dwModule + nNumber * sizeof(USHORT)));

return (LPINT)((DWORD)*(LPVOID *)(Image_Export_Directory->AddressOfFunctions + dwModule + Ordinal * sizeof(LPVOID)) + dwModule);
}
}

return NULL;
}

LPVOID WINAPI Invoke(LPCWSTR lpModuleName, LPCSTR lpProcName, int count, ...)
{
HMODULE hModule;
LPVOID lpProcAddress, lpResult = NULL;
va_list list;
void **args = (void **) HeapAlloc(GetProcessHeap(), 0, count);

int x;

if ((hModule = LoadLibrary(lpModuleName)) != 0)
{
if ((lpProcAddress = GetProcAddressEx(hModule,lpProcName)) != 0)
{
va_start(list,count);

for (x = 0; x < count; x++)
args[x] = va_arg(list, void *);

for (x = count -1; x >= 0; x--)
{
int temp = x * 4;

__asm
{
mov eax, dword ptr args
add eax, temp
push [eax]
}
}

__asm
{
call lpProcAddress
mov lpResult,eax
}
}
}

va_end(list);

HeapFree(GetProcessHeap(), 0, args);
FreeLibrary(hModule);

return lpResult;
}

Example:

Invoke(L"USER32.DLL", "MessageBoxW", 4, 0, L"Hello World", L"Info!", 0);

Sursa: CallAPIByName [C]

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...