Skip to content

Instantly share code, notes, and snippets.

@p4yl0ad
Last active February 11, 2022 14:52
Show Gist options
  • Save p4yl0ad/c89c7fd5e667b364ceffafc74b46e7c3 to your computer and use it in GitHub Desktop.
Save p4yl0ad/c89c7fd5e667b364ceffafc74b46e7c3 to your computer and use it in GitHub Desktop.
Load kernelbase.dll. parse PE structure, Iterate over exports and add FunctionName:RVA to a single linked list, sort linked list by RVA and prints
#include <stdio.h>
#include <windows.h>
/*
resources:
sektor7 for basic PE parse structure
https://www.techiedelight.com/given-linked-list-change-sorted-order/
And thanks to people in secret club for being smart as fuck & helpful lul
*/
struct node
{
char FuncName[_MAX_PATH];
ULONGLONG whereami;
struct node* next;
};
struct node* head = NULL;
void push(struct node** head, char* pVFuncName, ULONGLONG Vwhereami)
{
struct node* newpushNode; //= (struct node*)malloc(sizeof(struct node));
if (!(newpushNode = (node*)malloc(sizeof(struct node))))
{
printf("fuckywucky push\nif (!(newpushNode = (node*)malloc(sizeof(struct node))))");
exit(1);
}
int res = strcpy_s(newpushNode->FuncName, _MAX_PATH, pVFuncName);
newpushNode->whereami = Vwhereami;
newpushNode->next = *head;
*head = newpushNode;
}
void sortedInsert(struct node** head, struct node* newNode)
{
struct node dummy;
struct node* current = &dummy;
dummy.next = *head;
while (current->next != NULL && current->next->whereami < newNode->whereami) {
current = current->next;
}
newNode->next = current->next;
current->next = newNode;
*head = dummy.next;
}
void insertSort(struct node** head)
{
struct node* result = NULL; // build the answer here
struct node* current = *head; // iterate over the original list
struct node* next;
while (current != NULL)
{
next = current->next;
sortedInsert(&result, current);
current = next;
}
*head = result;
}
void addLast(struct node** head, char * pVFuncName, ULONGLONG Vwhereami)
{
struct node* newNode;
if (!(newNode = (node*)malloc(sizeof(struct node))))
{
printf("fuckywucky addLast\nif (!(newNode = (node*)malloc(sizeof(struct node))))");
exit(1);
}
int res = strcpy_s(newNode->FuncName, _MAX_PATH, pVFuncName);
newNode->whereami = Vwhereami;
newNode->next = NULL;
//if head is NULL, it is an empty list
if (*head == NULL)
*head = newNode;
else
{
struct node* lastNode = *head;
while (lastNode->next != NULL)
{
lastNode = lastNode->next;
}
lastNode->next = newNode;
}
}
void printList(struct node* head)
{
struct node* temp = head;
while (temp != NULL)
{
printf("%s->", temp->FuncName);
printf("%llu->", temp->whereami);
temp = temp->next;
}
printf("NULL\n");
}
void main(int argc, char* argv[])
{
PIMAGE_DOS_HEADER pIDH;
PIMAGE_NT_HEADERS pINH;
PIMAGE_OPTIONAL_HEADER pOH;
PIMAGE_DATA_DIRECTORY pDD;
DWORD* pEAT, pFuncNameTbl;
WORD* pHintsTbl;
PIMAGE_EXPORT_DIRECTORY pIED;
PVOID dllBase;
ULONG i;
LPCWSTR mod;
char* mod2, sTmpFuncName;
void* arrVeeAyy;
mod2 = "kernelbase.dll";
if ((dllBase = GetModuleHandle(mod2)) == NULL)
{
printf("Failed if ((dllBase = GetModuleHandle(mod)) == NULL)");
exit(1);
}
else
{
if ((pIDH = (PIMAGE_DOS_HEADER)dllBase)->e_magic != IMAGE_DOS_SIGNATURE)
{
printf("if ((pIDH = (PIMAGE_DOS_HEADER)dllBase)->e_magic != IMAGE_DOS_SIGNATURE)");
exit(1);
}
else
{
if ((pINH = (IMAGE_NT_HEADERS*)((ULONGLONG)(dllBase)+pIDH->e_lfanew))->Signature != IMAGE_NT_SIGNATURE)
{
printf("if ((pINH = (IMAGE_NT_HEADERS*)((ULONGLONG)(dllBase)+pIDH->e_lfanew))->Signature != IMAGE_NT_SIGNATURE)");
exit(1);
}
else
{
pOH = &pINH->OptionalHeader;
pDD = (IMAGE_DATA_DIRECTORY*)(&pOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]);
pIED = (IMAGE_EXPORT_DIRECTORY*)((ULONGLONG)dllBase + pDD->VirtualAddress);
pEAT = (DWORD*)((ULONGLONG)dllBase + pIED->AddressOfFunctions);
pFuncNameTbl = (DWORD*)((ULONGLONG)dllBase + pIED->AddressOfNames);
pHintsTbl = (WORD*)((ULONGLONG)dllBase + pIED->AddressOfNameOrdinals);
arrVeeAyy = NULL;
struct node* head = NULL;
for (i = 0; i < pIED->NumberOfNames; i++)
{
sTmpFuncName = (char*)dllBase + (DWORD_PTR)pFuncNameTbl[i];
arrVeeAyy = (FARPROC)((DWORD_PTR)pEAT[pHintsTbl[i]]);
addLast(&head, sTmpFuncName, (ULONGLONG)arrVeeAyy);
}
printList(head);
insertSort(&head);
printf("\n\n\n\n");
printList(head);
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment