GetProcAddress by Hash Implementation MASM 64bit
up vote
0
down vote
favorite
I have been working on a function called "funcCallFunctionByHash", which accepts a 64bit DJB2 hash of the function name and either the base address or name of the DLL that exports it. A third parameter is used to define which mode the function operates in. The function preserves the four registers used in Micorosoft's x64 calling convention (rcx, rdx, r8 and r9) by pushing them to stack at the start of the function and popping them before calling the desired function. xor r12, r12 lea r11, lpLibFileName mov r10, 00BF82C4B790C612CEh mov rcx, 10h call funcCallFunctionByHash lpLibFileName db "kernel32.dll", 0 I use the above code to call the function. In this case I am passing the hash for ExitProcess in r10(I will add my hashing code at the bottom of this post). I am also ...