#include <windows.h> #include <stdio.h> // دالة لحساب الـ Hash لأسماء الدوال في الذاكرة DWORD HashFunctionName(PCSTR SymbolName) { DWORD Hash = 0x35; for (UINT i = 0; i < strlen(SymbolName); i++) { Hash += (Hash << 0x0ab1) + SymbolName[i]; } return Hash; } // البحث عن الدالة في الذاكرة باستخدام الـ Hash بدلاً من GetProcAddress FARPROC GetProcAddressByHash(HMODULE hModule, DWORD TargetHash) { PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)hModule; PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((BYTE*)hModule + dosHeader->e_lfanew); PIMAGE_EXPORT_DIRECTORY exportDir = (PIMAGE_EXPORT_DIRECTORY)((BYTE*)hModule + ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); DWORD* names = (DWORD*)((BYTE*)hModule + exportDir->AddressOfNames); WORD* ordinals = (WORD*)((BYTE*)hModule + exportDir->AddressOfNameOrdinals); DWORD* functions = (DWORD*)((BYTE*)hModule + exportDir->AddressOfFunctions); for (DWORD i = 0; i < exportDir->NumberOfNames; i++) { char* name = (char*)hModule + names[i]; if (HashFunctionName(name) == TargetHash) { return (FARPROC)((BYTE*)hModule + functions[ordinals[i]]); } } return NULL; }