IatHook.hpp File Reference

#include <stdint.h>
#include <cstddef>
#include <cstring>
#include <string.h>

Include dependency graph for IatHook.hpp:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
template<typename T, typename T1, typename T2>
constexpr T	RVA2VA (T1 base, T2 rva)
template<typename T>
constexpr T	DataDirectoryFromModuleBase (void *moduleBase, size_t entryID)
PIMAGE_THUNK_DATA	FindAddressByName (void *moduleBase, PIMAGE_THUNK_DATA impName, PIMAGE_THUNK_DATA impAddr, const char *funcName)
PIMAGE_THUNK_DATA	FindAddressByOrdinal (void *moduleBase, PIMAGE_THUNK_DATA impName, PIMAGE_THUNK_DATA impAddr, uint16_t ordinal)
PIMAGE_THUNK_DATA	FindIatThunkInModule (void *moduleBase, const char *dllName, const char *funcName)
PIMAGE_THUNK_DATA	FindDelayLoadThunkInModule (void *moduleBase, const char *dllName, const char *funcName)
PIMAGE_THUNK_DATA	FindDelayLoadThunkInModule (void *moduleBase, const char *dllName, uint16_t ordinal)

Function Documentation

DataDirectoryFromModuleBase()

template<typename T>

T DataDirectoryFromModuleBase ( void * moduleBase, size_t entryID )

constexpr

{
  auto dosHdr = reinterpret_cast<PIMAGE_DOS_HEADER>(moduleBase);
  auto ntHdr = RVA2VA<PIMAGE_NT_HEADERS>(moduleBase, dosHdr->e_lfanew);
  auto dataDir = ntHdr->OptionalHeader.DataDirectory;
  return RVA2VA<T>(moduleBase, dataDir[entryID].VirtualAddress);
}

References RVA2VA().

Referenced by FindDelayLoadThunkInModule(), FindDelayLoadThunkInModule(), and FindIatThunkInModule().

Here is the call graph for this function:

Here is the caller graph for this function:

FindAddressByName()

PIMAGE_THUNK_DATA FindAddressByName	(	void *	moduleBase,
		PIMAGE_THUNK_DATA	impName,
		PIMAGE_THUNK_DATA	impAddr,
		const char *	funcName )

{
  for (; impName->u1.Ordinal; ++impName, ++impAddr)
  {
    if (IMAGE_SNAP_BY_ORDINAL(impName->u1.Ordinal))
      continue;
 
    auto import = RVA2VA<PIMAGE_IMPORT_BY_NAME>(moduleBase, impName->u1.AddressOfData);
    if (strcmp(import->Name, funcName) != 0)
      continue;
    return impAddr;
  }
  return nullptr;
}

Referenced by FindDelayLoadThunkInModule(), and FindIatThunkInModule().

Here is the caller graph for this function:

FindAddressByOrdinal()

PIMAGE_THUNK_DATA FindAddressByOrdinal	(	void *	moduleBase,
		PIMAGE_THUNK_DATA	impName,
		PIMAGE_THUNK_DATA	impAddr,
		uint16_t	ordinal )

{
  UNREFERENCED_PARAMETER(moduleBase);
  for (; impName->u1.Ordinal; ++impName, ++impAddr)
  {
    if (IMAGE_SNAP_BY_ORDINAL(impName->u1.Ordinal) && IMAGE_ORDINAL(impName->u1.Ordinal) == ordinal)
      return impAddr;
  }
  return nullptr;
}

Referenced by FindDelayLoadThunkInModule().

Here is the caller graph for this function:

FindDelayLoadThunkInModule() [1/2]

PIMAGE_THUNK_DATA FindDelayLoadThunkInModule	(	void *	moduleBase,
		const char *	dllName,
		const char *	funcName )

{
  auto imports = DataDirectoryFromModuleBase<PIMAGE_DELAYLOAD_DESCRIPTOR>(moduleBase, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);
  for (; imports->DllNameRVA; ++imports)
  {
    if (_stricmp(RVA2VA<LPCSTR>(moduleBase, imports->DllNameRVA), dllName) != 0)
      continue;
 
    auto impName = RVA2VA<PIMAGE_THUNK_DATA>(moduleBase, imports->ImportNameTableRVA);
    auto impAddr = RVA2VA<PIMAGE_THUNK_DATA>(moduleBase, imports->ImportAddressTableRVA);
    return FindAddressByName(moduleBase, impName, impAddr, funcName);
  }
  return nullptr;
}

References DataDirectoryFromModuleBase(), FindAddressByName(), and RVA2VA().

Referenced by FixDarkScrollBar().

Here is the call graph for this function:

Here is the caller graph for this function:

FindDelayLoadThunkInModule() [2/2]

PIMAGE_THUNK_DATA FindDelayLoadThunkInModule	(	void *	moduleBase,
		const char *	dllName,
		uint16_t	ordinal )

{
  auto imports = DataDirectoryFromModuleBase<PIMAGE_DELAYLOAD_DESCRIPTOR>(moduleBase, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);
  for (; imports->DllNameRVA; ++imports)
  {
    if (_stricmp(RVA2VA<LPCSTR>(moduleBase, imports->DllNameRVA), dllName) != 0)
      continue;
 
    auto impName = RVA2VA<PIMAGE_THUNK_DATA>(moduleBase, imports->ImportNameTableRVA);
    auto impAddr = RVA2VA<PIMAGE_THUNK_DATA>(moduleBase, imports->ImportAddressTableRVA);
    return FindAddressByOrdinal(moduleBase, impName, impAddr, ordinal);
  }
  return nullptr;
}

References DataDirectoryFromModuleBase(), FindAddressByOrdinal(), and RVA2VA().

Here is the call graph for this function:

FindIatThunkInModule()

PIMAGE_THUNK_DATA FindIatThunkInModule	(	void *	moduleBase,
		const char *	dllName,
		const char *	funcName )

{
  auto imports = DataDirectoryFromModuleBase<PIMAGE_IMPORT_DESCRIPTOR>(moduleBase, IMAGE_DIRECTORY_ENTRY_IMPORT);
  for (; imports->Name; ++imports)
  {
    if (_stricmp(RVA2VA<LPCSTR>(moduleBase, imports->Name), dllName) != 0)
      continue;
 
    auto origThunk = RVA2VA<PIMAGE_THUNK_DATA>(moduleBase, imports->OriginalFirstThunk);
    auto thunk = RVA2VA<PIMAGE_THUNK_DATA>(moduleBase, imports->FirstThunk);
    return FindAddressByName(moduleBase, origThunk, thunk, funcName);
  }
  return nullptr;
}

References DataDirectoryFromModuleBase(), FindAddressByName(), and RVA2VA().

Here is the call graph for this function:

RVA2VA()

template<typename T, typename T1, typename T2>

T RVA2VA ( T1 base, T2 rva )

constexpr

{
  return reinterpret_cast<T>(reinterpret_cast<ULONG_PTR>(base) + rva);
}

Referenced by DataDirectoryFromModuleBase(), FindDelayLoadThunkInModule(), FindDelayLoadThunkInModule(), and FindIatThunkInModule().

Here is the caller graph for this function: