FARPROC
GetProcAddress(
HMODULE hModule,
LPCSTR lpProcName
)
/*++
Routine Description:
This function retrieves the memory address of the function whose
name is pointed to by the lpProcName parameter. The GetProcAddress
function searches for the function in the module specified by the
hModule parameter, or in the module associated with the current
process if hModule is NULL. The function must be an exported
function; the module's definition file must contain an appropriate
EXPORTS line for the function.
If the lpProcName parameter is an ordinal value and a function with
the specified ordinal does not exist in the module, GetProcAddress
can still return a non-NULL value. In cases where the function may
not exist, specify the function by name rather than ordinal value.
Only use GetProcAddress to retrieve addresses of exported functions
that belong to library modules.
The spelling of the function name (pointed to by lpProcName) must be
identical to the spelling as it appears in the source library's
definition (.DEF) file. The function can be renamed in the
definition file. Case sensitive matching is used???
Arguments:
hModule - Identifies the module whose executable file contains the
function. A value of NULL references the module handle
associated with the image file that was used to create the
current process.
lpProcName - Points to the function name, or contains the ordinal
value of the function. If it is an ordinal value, the value
must be in the low-order word and zero must be in the high-order
word. The string must be a null-terminated character string.
Return Value:
The return value points to the function's entry point if the
function is successful. A return value of NULL indicates an error
and extended error status is available using the GetLastError function.
--*/
{
NTSTATUS Status;
PVOID ProcedureAddress;
STRING ProcedureName;
[COLOR="DarkOrange"] //+ by blueapplez
//这应该是按函数名称查找
//+ by blueapplez[/COLOR]
if ( (ULONG_PTR)lpProcName > 0xffff ) {
RtlInitString(&ProcedureName,lpProcName);
Status = LdrGetProcedureAddress(
BasepMapModuleHandle( hModule, FALSE ),
&ProcedureName,
0L,
&ProcedureAddress
);
}
[COLOR="DarkOrange"] //+ by blueapplez
//这应该是按函数序号查找
//+ by blueapplez[/COLOR]
else {
Status = LdrGetProcedureAddress(
BasepMapModuleHandle( hModule, FALSE ),
NULL,
PtrToUlong((PVOID)lpProcName),
&ProcedureAddress
);
}
if ( !NT_SUCCESS(Status) ) {
BaseSetLastNTError(Status);
return NULL;
}
else {
if ( ProcedureAddress == BasepMapModuleHandle( hModule, FALSE ) ) {
if ( (ULONG_PTR)lpProcName > 0xffff ) {
Status = STATUS_ENTRYPOINT_NOT_FOUND;
}
else {
Status = STATUS_ORDINAL_NOT_FOUND;
}
BaseSetLastNTError(Status);
return NULL;
}
else {
return (FARPROC)ProcedureAddress;
}
}
}
哈哈 我正在找这东西 沙发~~~
