hash_resolver.cpp

#include <Windows.h>
#include <iostream>

#include <peconv.h> // include libPeConv header

#define HASH_INIT 0x2326

int __stdcall calc_hash(const char *name)
{
    int next_chunk;
    int hash;
    for (hash = HASH_INIT; ; hash = next_chunk + 33 * hash)
    {
        next_chunk = *name++;
        if (!next_chunk)
            break;
    }
    return hash;
}

int main(int argc, char *argv[])
{
    HMODULE ntdll = LoadLibraryA("ntdll.dll");
    std::vector<std::string> names;
    if (!peconv::get_exported_names(ntdll, names)) {
        return 0;
    }
    std::vector<std::string>::iterator itr;
    int list[] = {
        0x81AF6D4E,
        0x4B1A50D1,
        0xE0DDD5CB,
        0xBE530033,
        0x20B0F111
    };
    std::set<int> hashes;
    for (int i = 0; i < 5; i++) {
        hashes.insert(list[i]);
    }
    
    size_t resolved = 0;
    for (itr = names.begin(); itr != names.end(); ++itr) {
        std::string &name = *itr;
        int hash = calc_hash(name.c_str());
        if (hashes.find(hash) != hashes.end()) {
            std::cout << std::hex << hash << " : " << name << "\n";
            resolved++;
        }
    }
    return resolved;
}