Skip to content

Instantly share code, notes, and snippets.

@hshrzd
Created May 30, 2021
Embed
What would you like to do?
#include <Windows.h>
#include <iostream>
#include <peconv.h> // include libPeConv header
#define HASH_INIT 0x2326
int __stdcall calc_hash(const char *name)
{
int next_chunk;
int hash;
for (hash = HASH_INIT; ; hash = next_chunk + 33 * hash)
{
next_chunk = *name++;
if (!next_chunk)
break;
}
return hash;
}
int main(int argc, char *argv[])
{
HMODULE ntdll = LoadLibraryA("ntdll.dll");
std::vector<std::string> names;
if (!peconv::get_exported_names(ntdll, names)) {
return 0;
}
std::vector<std::string>::iterator itr;
int list[] = {
0x81AF6D4E,
0x4B1A50D1,
0xE0DDD5CB,
0xBE530033,
0x20B0F111
};
std::set<int> hashes;
for (int i = 0; i < 5; i++) {
hashes.insert(list[i]);
}
size_t resolved = 0;
for (itr = names.begin(); itr != names.end(); ++itr) {
std::string &name = *itr;
int hash = calc_hash(name.c_str());
if (hashes.find(hash) != hashes.end()) {
std::cout << std::hex << hash << " : " << name << "\n";
resolved++;
}
}
return resolved;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment