1
+ #pragma once
2
+ #include < iostream>
3
+ #include < Windows.h>
4
+ #include < nmmintrin.h>
5
+
6
+ typedef struct _integrity_check
7
+ {
8
+ struct section {
9
+ std::uint8_t * name = {};
10
+ void * address = {};
11
+ std::uint32_t checksum = {};
12
+
13
+ bool operator ==(section& other)
14
+ {
15
+ return checksum == other.checksum ;
16
+ }
17
+ }; section _cached;
18
+
19
+ _integrity_check ()
20
+ {
21
+ _cached = get_text_section (reinterpret_cast <std::uintptr_t >(GetModuleHandle (nullptr )));
22
+ }
23
+
24
+ std::uint32_t crc32 (void * data, std::size_t size)
25
+ {
26
+ std::uint32_t result = {};
27
+
28
+ for (std::size_t index = {}; index < size; ++index )
29
+ result = _mm_crc32_u32 (result, reinterpret_cast <std::uint8_t *>(data)[index ]);
30
+
31
+ return result;
32
+ }
33
+
34
+ section get_text_section (std::uintptr_t module)
35
+ {
36
+ section text_section = {};
37
+
38
+ PIMAGE_DOS_HEADER dosheader = reinterpret_cast <PIMAGE_DOS_HEADER>(module);
39
+ PIMAGE_NT_HEADERS nt_headers = reinterpret_cast <PIMAGE_NT_HEADERS>(module + dosheader->e_lfanew );
40
+
41
+ PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION (nt_headers);
42
+
43
+ for (int i = 0 ; i < nt_headers->FileHeader .NumberOfSections ; i++, section++)
44
+ {
45
+ std::string name (reinterpret_cast <char const *>(section->Name ));
46
+ if (name != " .text" )
47
+ continue ;
48
+
49
+ void * address = reinterpret_cast <void *>(module + section->VirtualAddress );
50
+ text_section = { section->Name , address, crc32 (address, section->Misc .VirtualSize ) };
51
+ }
52
+ return text_section;
53
+ }
54
+ // / <summary>
55
+ // / Checks .text integrity.
56
+ // / </summary>
57
+ // / <returns>Returns true if it has been changed.</returns>
58
+ bool check_integrity ()
59
+ {
60
+ section section2 = get_text_section (reinterpret_cast <std::uintptr_t >(GetModuleHandle (nullptr )));
61
+ return (!(_cached == section2));
62
+ }
63
+ };
0 commit comments