Skip to content

Commit 6734f52

Browse files
Add files via upload
1 parent 1a9c1d9 commit 6734f52

File tree

1 file changed

+63
-0
lines changed

1 file changed

+63
-0
lines changed

x86/lib/integrity.h

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#pragma once
2+
#include <iostream>
3+
#include <Windows.h>
4+
#include <nmmintrin.h>
5+
6+
typedef struct _integrity_check
7+
{
8+
struct section {
9+
std::uint8_t* name = {};
10+
void* address = {};
11+
std::uint32_t checksum = {};
12+
13+
bool operator==(section& other)
14+
{
15+
return checksum == other.checksum;
16+
}
17+
}; section _cached;
18+
19+
_integrity_check()
20+
{
21+
_cached = get_text_section(reinterpret_cast<std::uintptr_t>(GetModuleHandle(nullptr)));
22+
}
23+
24+
std::uint32_t crc32(void* data, std::size_t size)
25+
{
26+
std::uint32_t result = {};
27+
28+
for (std::size_t index = {}; index < size; ++index)
29+
result = _mm_crc32_u32(result, reinterpret_cast<std::uint8_t*>(data)[index]);
30+
31+
return result;
32+
}
33+
34+
section get_text_section(std::uintptr_t module)
35+
{
36+
section text_section = {};
37+
38+
PIMAGE_DOS_HEADER dosheader = reinterpret_cast<PIMAGE_DOS_HEADER>(module);
39+
PIMAGE_NT_HEADERS nt_headers = reinterpret_cast<PIMAGE_NT_HEADERS>(module + dosheader->e_lfanew);
40+
41+
PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(nt_headers);
42+
43+
for (int i = 0; i < nt_headers->FileHeader.NumberOfSections; i++, section++)
44+
{
45+
std::string name(reinterpret_cast<char const*>(section->Name));
46+
if (name != ".text")
47+
continue;
48+
49+
void* address = reinterpret_cast<void*>(module + section->VirtualAddress);
50+
text_section = { section->Name, address, crc32(address, section->Misc.VirtualSize) };
51+
}
52+
return text_section;
53+
}
54+
/// <summary>
55+
/// Checks .text integrity.
56+
/// </summary>
57+
/// <returns>Returns true if it has been changed.</returns>
58+
bool check_integrity()
59+
{
60+
section section2 = get_text_section(reinterpret_cast<std::uintptr_t>(GetModuleHandle(nullptr)));
61+
return (!(_cached == section2));
62+
}
63+
};

0 commit comments

Comments
 (0)