do the following steps:
extract the functions and classes in *.dll by:
$> dumpbin.exe /exports libsample.dll /out:libsample.def
| #include "stdafx.h" | |
| #include "HideModule.h" | |
| std::vector<UNLINKED_MODULE> UnlinkedModules; | |
| void RelinkModuleToPEB(HMODULE hModule) | |
| { | |
| std::vector<UNLINKED_MODULE>::iterator it = std::find_if(UnlinkedModules.begin(), UnlinkedModules.end(), FindModuleHandle(hModule)); | |
| if (it == UnlinkedModules.end()) |
| if(GlobalVariable* GA = M.getGlobalVariable("llvm.global.annotations")) { | |
| // the first operand holds the metadata | |
| for (Value *AOp : GA->operands()) { | |
| // all metadata are stored in an array of struct of metadata | |
| if (ConstantArray *CA = dyn_cast<ConstantArray>(AOp)) { | |
| // so iterate over the operands | |
| for (Value *CAOp : CA->operands()) { | |
| // get the struct, which holds a pointer to the annotated function | |
| // as first field, and the annotation as second field | |
| if (ConstantStruct *CS = dyn_cast<ConstantStruct>(CAOp)) { |
| #include "stdafx.h" | |
| #define DB(_val_) __asm __emit (_val_) | |
| #define INVALID_SYSCALL (DWORD)(-1) | |
| // code selectors | |
| #define CS_32 0x23 | |
| #define CS_64 0x33 |