Locate GuardCFDispatchFunctionPointer

cfg.cpp

#define PHNT_VERSION PHNT_WIN8
#include <phnt_windows.h>
#include <phnt.h>

#include <cstdio>
#include <cstdint>
#include <cstdlib>
#include <cstring>

//
// For CFG enabled process, read the address stored @ GuardCFDispatchFunctionPointer
//
PVOID
GetGuardCFDispatchFunction(void) {
    PVOID GuardCFDispatchFunctionPointer = NULL;
    
    do {
        PBYTE DllBase = (PBYTE)GetModuleHandleW(L"ntdll");
        if (!DllBase) break;
        auto DosHeader = (PIMAGE_DOS_HEADER)DllBase;
        auto NtHeaders = (PIMAGE_NT_HEADERS)(DllBase + DosHeader->e_lfanew);
        auto rva = NtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress;
        if (!rva) break;
        auto cfg = (PIMAGE_LOAD_CONFIG_DIRECTORY)(DllBase + rva);
        return (PVOID)(*(PULONG_PTR)cfg->GuardCFDispatchFunctionPointer);
    } while (FALSE);
    return NULL;
}

int
main(int argc, char *argv[]) {

    PBYTE GuardCFDispatchFunctionPointer = (PBYTE)GetGuardCFDispatchFunction();
    
    printf("Address : %p\n", GuardCFDispatchFunctionPointer);
    printf("JMP RAX : %s\n", (GuardCFDispatchFunctionPointer[0] == 0xff && 
                              GuardCFDispatchFunctionPointer[1] == 0xe0) ? "YES" : "NO");
    getchar();
    return 0;
}