void* HideCode_FindFunction(HMODULE hModule, unsigned int hash)
{
if (hModule)
{
PIMAGE_DOS_HEADER header = (PIMAGE_DOS_HEADER)hModule;
PIMAGE_NT_HEADERS ntHeader = (PIMAGE_NT_HEADERS)((DWORD)hModule + header->e_lfanew);
PIMAGE_DATA_DIRECTORY exportDirectoryD = &ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
PIMAGE_EXPORT_DIRECTORY exportDirectory = (PIMAGE_EXPORT_DIRECTORY)(GET_RVA(exportDirectoryD->VirtualAddress));
WORD* ordinals = (WORD*)(GET_RVA(exportDirectory->AddressOfNameOrdinals));
DWORD_PTR* names = (DWORD_PTR*)(GET_RVA(exportDirectory->AddressOfNames));
DWORD_PTR* functions = (DWORD_PTR*)(GET_RVA(exportDirectory->AddressOfFunctions));
for (DWORD i = 0; i < exportDirectory->NumberOfNames; i++)
{
char* nPtr = (char*)((PBYTE)hModule + names[i]);
unsigned int thisHash = jenkins_one_at_a_time_hash(nPtr, strlen(nPtr));
if (thisHash == hash)
{
WORD ordinal = ordinals[i];
LPVOID func = (LPVOID)(GET_RVA(functions[ordinal]));
return func;
}
}
}
return NULL;
}
void HideCode_PatchFunction(HMODULE hModule, unsigned int hash, LPVOID replacement)
{
if (hModule)
{
PIMAGE_DOS_HEADER header = (PIMAGE_DOS_HEADER)hModule;
PIMAGE_NT_HEADERS ntHeader = (PIMAGE_NT_HEADERS)((DWORD)hModule + header->e_lfanew);
PIMAGE_DATA_DIRECTORY importDirectoryD = &ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
PIMAGE_IMPORT_DESCRIPTOR importDescriptors = (PIMAGE_IMPORT_DESCRIPTOR)(GET_RVA(importDirectoryD->VirtualAddress));
for (PIMAGE_IMPORT_DESCRIPTOR importDescriptor = importDescriptors; importDescriptor->Name != 0; importDescriptor++)
{
PIMAGE_THUNK_DATA hintNames = (PIMAGE_THUNK_DATA)(GET_RVA(importDescriptor->OriginalFirstThunk));
PIMAGE_THUNK_DATA imports = (PIMAGE_THUNK_DATA)(GET_RVA(importDescriptor->FirstThunk));
int i = 0;
for (PIMAGE_THUNK_DATA hintName = hintNames; hintName->u1.AddressOfData != 0; hintName++, i++)
{
if (!(hintName->u1.AddressOfData & IMAGE_ORDINAL_FLAG))
{
char* functionName = ((char*)(GET_RVA(hintName->u1.AddressOfData)) + sizeof(WORD));
if (jenkins_one_at_a_time_hash(functionName, strlen(functionName)) == hash)
{
(&imports[i])->u1.Function = (DWORD_PTR)replacement;
return;
}
}
}
}
}
}
void HideCode_FindString(unsigned int hash, size_t length, char* buffer, size_t bufferCutoff)
{
for (char* basePointer = (char*)0x6D75FC; (int)basePointer < 0x795000; basePointer++)
{
if (jenkins_one_at_a_time_hash(basePointer, length) == hash)
{
size_t origLen = strlen(buffer);
memcpy(&buffer[origLen], basePointer, bufferCutoff);
buffer[origLen + bufferCutoff + 1] = '\0';
return;
}
}
}
SEXP digest2int(SEXP input, SEXP Seed) {
uint32_t seed = INTEGER_VALUE(Seed);
if (TYPEOF(input) != STRSXP) error("invalid input - should be character vector");
R_xlen_t n = xlength(input);
SEXP result = PROTECT(allocVector(INTSXP, n ));
memset(INTEGER(result), 0, n * sizeof(int));
int *res_ptr = INTEGER(result);
for(R_xlen_t i = 0; i < n; i++) {
const char* element_ptr = CHAR(STRING_ELT(input, i));
res_ptr[i] = jenkins_one_at_a_time_hash(element_ptr, seed);
}
UNPROTECT(1);
return(result);
}
