Skip to content

ExportResolver.md

Latest commit

History

History
93 lines (68 loc) · 3.43 KB

ExportResolver.md

File metadata and controls

93 lines (68 loc) · 3.43 KB
Raw

ExportResolver

Drop-in replacement of GetModuleHandle and GetProcAddress Win32 API.

Find and print the base address of kernel32.dll

Use ExportResolver.GetModuleHandle function.

varaddress=ExportResolver.GetModuleHandle("kernel32.dll");Console.WriteLine(address.ToString());

Resolve the export address of VirtualAlloc and call it

There are multiple solutions.

Utility usage

If you want to just resolve that one function, you can use ExportResolver.ResolveExport utility function.

privatedelegateIntPtrVirtualAllocDelegate(IntPtrlpAddress,UIntPtrdwSize,AllocationTypeflAllocationType,MemoryProtectionflProtect);privatevoidResolve_Address_Then_Call_Delegate(){varpfnVirtualAlloc=ExportResolver.ResolveExports("kernel32.dll","VirtualAlloc");varvirtualAlloc=Marshal.GetDelegateForFunctionPointer<VirtualAllocDelegate>(pfnVirtualAlloc);varmemory=virtualAlloc(IntPtr.Zero,(UIntPtr)1024,AllocationType.COMMIT|AllocationType.Reserved,MemoryProtection.READWRITE);
...}privatevoidDirect_Get_Delegate(){varvirtualAlloc=(VirtualAllocDelegate)ExportResolver.ResolveExports("kernel32.dll","VirtualAlloc",typeof(VirtualAllocDelegate));varmemory=virtualAlloc(IntPtr.Zero,(UIntPtr)1024,AllocationType.COMMIT|AllocationType.Reserved,MemoryProtection.READWRITE);
...}privatevoidDirect_Get_Delegate_Generic(){varvirtualAlloc=ExportResolver.ResolveExports<VirtualAllocDelegate>("kernel32.dll","VirtualAlloc");varmemory=virtualAlloc(IntPtr.Zero,(UIntPtr)1024,AllocationType.COMMIT|AllocationType.Reserved,MemoryProtection.READWRITE);
...}

Using ExportResolver itself

If you want to resolve multiple or batch exports, you can use ExportResolver type itself.

privatedelegateIntPtrVirtualAllocDelegate(IntPtrlpAddress,UIntPtrdwSize,AllocationTypeflAllocationType,MemoryProtectionflProtect);privatevoidResolve_Address_Then_Call_Delegate(){varvirtualAlloc=newExportResolver("kernel32.dll").GetExport<VirtualAllocDelegate>("VirtualAlloc");varmemory=virtualAlloc(IntPtr.Zero,(UIntPtr)1024,AllocationType.COMMIT|AllocationType.Reserved,MemoryProtection.READWRITE);
...}

Using Module Handle

You can even specify the Module Handle (also known as Module Base Address) instead of the module name.

The module handle can be resolved using Win32 API GetModuleHandle or ExportResolver.GetModuleHandle.

privatevoidDirect_Get_Delegate_Generic(){varmoduleHandle=ExportResolver.GetModuleHandle("kernel32.dll");varvirtualAlloc=newExportResolver(moduleHandle).GetExport<VirtualAllocDelegate>("VirtualAlloc");varmemory=virtualAlloc(IntPtr.Zero,(UIntPtr)1024,AllocationType.COMMIT|AllocationType.Reserved,MemoryProtection.READWRITE);
...}

Using function ordinal

You can specify the function ordinal instead of the function name to choose export.

privatedelegateIntPtrVirtualAllocDelegate(IntPtrlpAddress,UIntPtrdwSize,AllocationTypeflAllocationType,MemoryProtectionflProtect);privatevoidDirect_Get_Delegate_Generic(){varvirtualAlloc=ExportResolver.ResolveExports<VirtualAllocDelegate>("kernel32.dll",0x05DA);// Windows 10 22H2; kernel32 version 6.2.19041.3636varmemory=virtualAlloc(IntPtr.Zero,(UIntPtr)1024,AllocationType.COMMIT|AllocationType.Reserved,MemoryProtection.READWRITE);
...}