diff --git a/src/modules/pe_get_kernel32_module_handle.c b/src/modules/pe_get_kernel32_module_handle.c index 9cd0c18..2625e0f 100644 --- a/src/modules/pe_get_kernel32_module_handle.c +++ b/src/modules/pe_get_kernel32_module_handle.c @@ -17,48 +17,62 @@ static int pe_get_kernel32_handle_callback( { #define KERNEL32_UTF16_STRLEN 24 - int32_t kernel32_base_name_le[4]; - char * kernel32_base_name_ansi; + intptr_t * addr; + const wchar16_t * wch; - intptr_t * addr; - char * ch; - size_t match; + /* not an item? */ + if (reason != PE_CALLBACK_REASON_ITEM) + return 1; + + /* wrong length? */ + if (ldr_tbl_entry->base_dll_name.strlen != KERNEL32_UTF16_STRLEN) + return 1; /* avoid scan-based false positives */ - kernel32_base_name_le[0] = 0x6E72656B; /* 'kern' */ - kernel32_base_name_le[1] = 0x32336C65; /* 'el32' */ - kernel32_base_name_le[2] = 0x6C6C642E; /* '.dll' */ - kernel32_base_name_le[3] = 0; - - kernel32_base_name_ansi = (char *)&kernel32_base_name_le; - - match = 0; - addr = (intptr_t *)context; - - if (reason == PE_CALLBACK_REASON_ITEM) - if (ldr_tbl_entry->base_dll_name.strlen == KERNEL32_UTF16_STRLEN) { - ch = (char *)ldr_tbl_entry->base_dll_name.buffer; - match = 0; - - while ((match < sizeof(kernel32_base_name_ansi)) - && ((*ch == kernel32_base_name_ansi[match]) - || (*ch == (kernel32_base_name_ansi[match] + 'A' - 'a'))) - && (*(ch + 1) == 0)) { - ch+=sizeof(uint16_t); - match++; - } - } - - if (match == sizeof(kernel32_base_name_ansi)) { - *addr = (intptr_t)ldr_tbl_entry->dll_base; - return 0; - } - else + wch = ldr_tbl_entry->base_dll_name.buffer; + + if (pe_impl_utf16_char_to_lower(wch[4] != 'e')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[1] != 'e')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[3] != 'n')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[2] != 'r')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[5] != 'l')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[0] != 'k')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[7] != '2')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[6] != '3')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[11] != 'l')) return 1; -} + else if (pe_impl_utf16_char_to_lower(wch[10] != 'l')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[9] != 'd')) + return 1; + + else if (pe_impl_utf16_char_to_lower(wch[8] != '.')) + return 1; + + /* match */ + addr = (intptr_t *)context; + *addr = (intptr_t)ldr_tbl_entry->dll_base; + return 0; +} -pe_api void * pe_get_kernel32_module_handle(void) {