Skip to content

Instantly share code, notes, and snippets.

@Ruzzz
Last active August 29, 2015 14:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Ruzzz/65886cbf8ef25a27b59c to your computer and use it in GitHub Desktop.
Save Ruzzz/65886cbf8ef25a27b59c to your computer and use it in GitHub Desktop.
#include <windows.h>
#include <stdio.h>
#define RVATOVA(base,offset) ((LPVOID)((DWORD)(base)+(DWORD)(offset)))
#define VATORVA(base,offset) ((LPVOID)((DWORD)(offset)-(DWORD)(base)))
BOOL IsDllExistsInExport(IN HMODULE _hModule, const IN PCHAR DllName)
{
HMODULE hModule = _hModule;
if (hModule == NULL)
hModule = GetModuleHandle(NULL);
PIMAGE_OPTIONAL_HEADER poh = (PIMAGE_OPTIONAL_HEADER) ((PCHAR)hModule
+ ((PIMAGE_DOS_HEADER)hModule)->e_lfanew
+ sizeof(DWORD)
+ sizeof(IMAGE_FILE_HEADER));
DWORD ImportBase = poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
for (PIMAGE_IMPORT_DESCRIPTOR pid = (PIMAGE_IMPORT_DESCRIPTOR)RVATOVA(hModule, ImportBase); pid->Name; pid++)
{
PCHAR DllNameCurrent = (PCHAR)RVATOVA(hModule, pid->Name);
if (!lstrcmpiA(DllNameCurrent, DllName))
return TRUE;
}
return TRUE;
}
int main(int argc, char const *argv[])
{
printf("%d\n", IsDllExistsInExport(NULL, "Kernel32.dll"));
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment