├── .vs └── SymProcAddress │ ├── FileContentIndex │ ├── b071ea37-4e95-496d-9df9-8b1a3b145367.vsidx │ └── d1b74401-e3b6-4f37-a6f8-69c371bda1be.vsidx │ └── v17 │ ├── .suo │ ├── Browse.VC.db │ ├── Browse.VC.db-shm │ ├── Browse.VC.db-wal │ ├── Browse.VC.opendb │ └── ipch │ └── AutoPCH │ └── a80dac02e8e0b017 │ └── MAIN.ipch ├── README.md ├── SymProcAddress.sln ├── SymProcAddress ├── SymProcAddress.vcxproj ├── SymProcAddress.vcxproj.filters ├── SymProcAddress.vcxproj.user ├── main.cpp └── x64 │ └── Debug │ ├── SymProcAddress.exe.recipe │ ├── SymProcAddress.ilk │ ├── SymProcAddress.log │ ├── SymProcAddress.tlog │ ├── CL.command.1.tlog │ ├── CL.read.1.tlog │ ├── CL.write.1.tlog │ ├── Cl.items.tlog │ ├── SymProcAddress.lastbuildstate │ ├── link.command.1.tlog │ ├── link.read.1.tlog │ └── link.write.1.tlog │ ├── main.obj │ ├── vc143.idb │ └── vc143.pdb └── x64 └── Debug ├── SymProcAddress.exe └── SymProcAddress.pdb /.vs/SymProcAddress/FileContentIndex/b071ea37-4e95-496d-9df9-8b1a3b145367.vsidx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/.vs/SymProcAddress/FileContentIndex/b071ea37-4e95-496d-9df9-8b1a3b145367.vsidx -------------------------------------------------------------------------------- /.vs/SymProcAddress/FileContentIndex/d1b74401-e3b6-4f37-a6f8-69c371bda1be.vsidx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/.vs/SymProcAddress/FileContentIndex/d1b74401-e3b6-4f37-a6f8-69c371bda1be.vsidx -------------------------------------------------------------------------------- /.vs/SymProcAddress/v17/.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/.vs/SymProcAddress/v17/.suo -------------------------------------------------------------------------------- /.vs/SymProcAddress/v17/Browse.VC.db: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/.vs/SymProcAddress/v17/Browse.VC.db -------------------------------------------------------------------------------- /.vs/SymProcAddress/v17/Browse.VC.db-shm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/.vs/SymProcAddress/v17/Browse.VC.db-shm -------------------------------------------------------------------------------- /.vs/SymProcAddress/v17/Browse.VC.db-wal: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/.vs/SymProcAddress/v17/Browse.VC.db-wal -------------------------------------------------------------------------------- /.vs/SymProcAddress/v17/Browse.VC.opendb: -------------------------------------------------------------------------------- 1 | MichaelWINPC -------------------------------------------------------------------------------- /.vs/SymProcAddress/v17/ipch/AutoPCH/a80dac02e8e0b017/MAIN.ipch: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/.vs/SymProcAddress/v17/ipch/AutoPCH/a80dac02e8e0b017/MAIN.ipch -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SymProcAddress 2 | Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids) 3 | 4 | ![изображение](https://github.com/MzHmO/SymProcAddress/assets/92790655/498974fc-48c8-4da6-b727-77f969c7ed3c) 5 | 6 | 7 | ## TL;DR 8 | 9 | Just check the example usage, this is similar to the standard GetProcAddress function: 10 | ```cpp 11 | typedef int (WINAPI* MessageBoxWFunc)( 12 | HWND hWnd, 13 | LPCWSTR lpText, 14 | LPCWSTR lpCaption, 15 | UINT uType 16 | ); 17 | 18 | int main() 19 | { 20 | HMODULE hModule = NULL; 21 | 22 | //hModule = GetModuleHandle("user32.dll"); 23 | hModule = LoadLibraryA("user32.dll"); 24 | MessageBoxWFunc MessageBoxWPtr = (MessageBoxWFunc)(SymProcAddress(hModule, "MessageBoxW")); 25 | MessageBoxWPtr(NULL, L"Lol who said GetProcAddress() xD", L"Hi from MzHmO", MB_OK); 26 | 27 | return 0; 28 | } 29 | ``` 30 | 31 | You only need to include the function code in your project and you will be able to use my method of function address resolution 32 | 33 | ## How It Works 34 | I discovered that we can use DbgHelp to list all symbols in a PE image. The program lists all symbols based on the base address (`hModule`). So, when you call `SymFuncAddress()` for the first time, the program will create a dictionary with "function name - function address" key-value pairs, after which you can get the addresses of any functions you are interested in from the Dll. 35 | -------------------------------------------------------------------------------- /SymProcAddress.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.7.34009.444 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SymProcAddress", "SymProcAddress\SymProcAddress.vcxproj", "{B85494AC-5D19-49AE-A342-645D82C72189}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {B85494AC-5D19-49AE-A342-645D82C72189}.Debug|x64.ActiveCfg = Debug|x64 17 | {B85494AC-5D19-49AE-A342-645D82C72189}.Debug|x64.Build.0 = Debug|x64 18 | {B85494AC-5D19-49AE-A342-645D82C72189}.Debug|x86.ActiveCfg = Debug|Win32 19 | {B85494AC-5D19-49AE-A342-645D82C72189}.Debug|x86.Build.0 = Debug|Win32 20 | {B85494AC-5D19-49AE-A342-645D82C72189}.Release|x64.ActiveCfg = Release|x64 21 | {B85494AC-5D19-49AE-A342-645D82C72189}.Release|x64.Build.0 = Release|x64 22 | {B85494AC-5D19-49AE-A342-645D82C72189}.Release|x86.ActiveCfg = Release|Win32 23 | {B85494AC-5D19-49AE-A342-645D82C72189}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {A2B61866-1B2B-477F-88D1-AA73AF3AEA15} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /SymProcAddress/SymProcAddress.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 17.0 23 | Win32Proj 24 | {b85494ac-5d19-49ae-a342-645d82c72189} 25 | SymProcAddress 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v143 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v143 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v143 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v143 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | Level3 76 | true 77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 78 | true 79 | 80 | 81 | Console 82 | true 83 | 84 | 85 | 86 | 87 | Level3 88 | true 89 | true 90 | true 91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 92 | true 93 | 94 | 95 | Console 96 | true 97 | true 98 | true 99 | 100 | 101 | 102 | 103 | Level3 104 | true 105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 106 | true 107 | 108 | 109 | Console 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | true 118 | true 119 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 120 | true 121 | 122 | 123 | Console 124 | true 125 | true 126 | true 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | -------------------------------------------------------------------------------- /SymProcAddress/SymProcAddress.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Исходные файлы 20 | 21 | 22 | -------------------------------------------------------------------------------- /SymProcAddress/SymProcAddress.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /SymProcAddress/main.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #pragma comment(lib, "Dbghelp.lib") 8 | 9 | FARPROC SymProcAddress(HMODULE hModule, LPCSTR lpProcName) 10 | { 11 | static BOOL gathered = FALSE; 12 | static std::map funcs; 13 | 14 | if (!gathered) 15 | { 16 | HANDLE hProc = GetCurrentProcess(); 17 | SymInitialize(hProc, NULL, TRUE); 18 | auto EnumSymbolsCallback = [](PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext) -> BOOL { 19 | if (pSymInfo->Flags & 0x00000200) { 20 | funcs[std::string(pSymInfo->Name)] = reinterpret_cast(pSymInfo->Address); 21 | } 22 | return TRUE; 23 | }; 24 | #ifdef _WIN64 25 | if (!SymEnumSymbols(hProc, (DWORD64)hModule, NULL, EnumSymbolsCallback, NULL)) { 26 | SymCleanup(hProc); 27 | return NULL; 28 | } 29 | #else 30 | if (!SymEnumSymbols(hProc, (DWORD)hModule, NULL, EnumSymbolsCallback, NULL)) { 31 | SymCleanup(hProc); 32 | return NULL; 33 | } 34 | #endif 35 | } 36 | 37 | auto it = funcs.find(std::string(lpProcName)); 38 | if (it != funcs.end()) { 39 | return it->second; 40 | } 41 | else { 42 | SetLastError(127); // ERROR_PROC_NOT_FOUND 43 | return NULL; 44 | } 45 | } 46 | 47 | 48 | // Example Usage 49 | typedef int (WINAPI* MessageBoxWFunc)( 50 | HWND hWnd, 51 | LPCWSTR lpText, 52 | LPCWSTR lpCaption, 53 | UINT uType 54 | ); 55 | 56 | int main() 57 | { 58 | HMODULE hModule = NULL; 59 | 60 | //hModule = GetModuleHandle("user32.dll"); 61 | hModule = LoadLibraryA("user32.dll"); 62 | MessageBoxWFunc MessageBoxWPtr = (MessageBoxWFunc)(SymProcAddress(hModule, "MessageBoxW")); 63 | MessageBoxWPtr(NULL, L"Lol who said GetProcAddress() xD", L"Hi from MzHmO", MB_OK); 64 | 65 | return 0; 66 | } -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.exe.recipe: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | A:\SSD\ProjectsVS\SymProcAddress\x64\Debug\SymProcAddress.exe 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.ilk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/SymProcAddress.ilk -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.log: -------------------------------------------------------------------------------- 1 |  main.cpp 2 | SymProcAddress.vcxproj -> A:\SSD\ProjectsVS\SymProcAddress\x64\Debug\SymProcAddress.exe 3 | -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/CL.command.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/SymProcAddress.tlog/CL.command.1.tlog -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/CL.read.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/SymProcAddress.tlog/CL.read.1.tlog -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/CL.write.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/SymProcAddress.tlog/CL.write.1.tlog -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/Cl.items.tlog: -------------------------------------------------------------------------------- 1 | A:\SSD\ProjectsVS\SymProcAddress\SymProcAddress\main.cpp;A:\SSD\ProjectsVS\SymProcAddress\SymProcAddress\x64\Debug\main.obj 2 | -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/SymProcAddress.lastbuildstate: -------------------------------------------------------------------------------- 1 | PlatformToolSet=v143:VCToolArchitecture=Native64Bit:VCToolsVersion=14.37.32822:TargetPlatformVersion=10.0.22000.0: 2 | Debug|x64|A:\SSD\ProjectsVS\SymProcAddress\| 3 | -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/link.command.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/SymProcAddress.tlog/link.command.1.tlog -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/link.read.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/SymProcAddress.tlog/link.read.1.tlog -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/SymProcAddress.tlog/link.write.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/SymProcAddress.tlog/link.write.1.tlog -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/main.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/main.obj -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/vc143.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/vc143.idb -------------------------------------------------------------------------------- /SymProcAddress/x64/Debug/vc143.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/SymProcAddress/x64/Debug/vc143.pdb -------------------------------------------------------------------------------- /x64/Debug/SymProcAddress.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/x64/Debug/SymProcAddress.exe -------------------------------------------------------------------------------- /x64/Debug/SymProcAddress.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MzHmO/SymProcAddress/a136717551bc212636fbf9d5d83376e971aab9bb/x64/Debug/SymProcAddress.pdb --------------------------------------------------------------------------------