Réponse acceptée !
Merci rt15
j'ai trouvé se que je cherchais je poste si sa intéresse quelqu'un
LPVOID _stdcall _getprocaddress(HMODULE hmod, PCHAR func)
{
PIMAGE_DOS_HEADER dos_header;
PIMAGE_NT_HEADERS nt_headers;
PIMAGE_EXPORT_DIRECTORY exports;
PDWORD functions;
PSHORT ords;
PDWORD names;
if (!IsBadReadPtr(hmod, sizeof(IMAGE_DOS_HEADER)))
{
dos_header = (PIMAGE_DOS_HEADER)hmod;
if (dos_header->e_magic == IMAGE_DOS_SIGNATURE)
{
nt_headers = (PIMAGE_NT_HEADERS)((PCHAR)hmod + dos_header->e_lfanew);
if (!IsBadReadPtr(nt_headers, sizeof(IMAGE_NT_HEADERS)))
{
if (nt_headers->Signature == IMAGE_NT_SIGNATURE)
{
exports = (PIMAGE_EXPORT_DIRECTORY)((PCHAR)hmod + nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
if (!IsBadReadPtr(exports, sizeof(IMAGE_EXPORT_DIRECTORY)))
{
functions = (PDWORD)((PCHAR)hmod + exports->AddressOfFunctions);
ords = (PSHORT)((PCHAR)hmod + exports->AddressOfNameOrdinals);
if ((DWORD)func & 0xFFFF0000)
{
names = (PDWORD)((PCHAR)hmod + exports->AddressOfNames);
while (!IsBadReadPtr(names, sizeof(DWORD)))
{
if (strcmp((PCHAR)hmod + *names, func) == 0)
{
if (!IsBadReadPtr(&functions[*ords], sizeof(DWORD)))
{
return (PCHAR)hmod + functions[*ords];
}
}
names++;
ords++;
}
} else {
if (!IsBadReadPtr(&functions[(SHORT)func], sizeof(DWORD)))
{
return (PCHAR)hmod + functions[(DWORD)func];
}
}
}
}
}
}
}
return NULL;
}