macro_rules! dynamic_invoke {
($a:expr, $b:expr, $c:expr) => { ... };
($a:expr, $b:expr, $c:expr, $d:expr, $($e:tt)*) => { ... };
}Expand description
Dynamically calls an exported function from the specified module.
This macro will use the dyncvoke crate functions to obtain an exported function address of the specified module at runtime by walking process structures and PE headers.
In case that this macro is used to call a dll entry point (DllMain), it will return true or false (using the 3rd argument passed to the macro) depending on the success of the call. In any other case, it will return the same data type that the called function would return using the 4th argument passed to the macro.
§Example - Calling a dll entry point
ⓘ
let a = manualmap::read_and_map_module("c:\\some\\random\\file.dll").unwrap();
let ret: bool = false;
dyncvoke_core::dynamic_invoke(&a.0, a.1, ret); // dyncvoke_core::dynamic_invoke(&PeMetadata, usize, bool)
if ret { println!("Entry point successfully called.");}§Example - Dynamically calling LoadLibraryA
ⓘ
let kernel32 = manualmap::read_and_map_module("c:\\windows\\system32\\kernel32.dll").unwrap();
let mut ret:Option<HINSTANCE>;
let function_ptr: data::LoadLibraryA;
let name = CString::new("ntdll.dll").expect("CString::new failed");
let module_name = PSTR{0: name.as_ptr() as *mut u8};
//dyncvoke_core::dynamic_invoke(usize,&str,<function_type>,Option<return_type>,[arguments])
dyncvoke_core::dynamic_invoke!(kernel32.1, "LoadLibraryA", function_ptr, ret, module_name);
match ret {
Some(x) => {println!("ntdll base address is 0x{:X}",x.0);},
None => println!("Error calling LoadLibraryA"),
}§Example - Dynamically calling with referenced arguments
ⓘ
let ptr = dyncvoke_core::get_module_base_address("ntdll.dll");
let function_ptr: LdrGetProcedureAddress;
let ret: Option<i32>;
let hmodule: PVOID = core::mem::transmute(ptr);
let fun_name: *mut String = ptr::null_mut();
let ordinal = 8 as u32;
let return_address: *mut c_void = core::mem::transmute(&usize::default());
let return_address: *mut PVOID = core::mem::transmute(return_address);
//dyncvoke_core::dynamic_invoke(usize,&str,<function_type>,Option<return_type>,[arguments])
dyncvoke_core::dynamic_invoke!(ptr,"LdrGetProcedureAddress",function_ptr,ret,hmodule,fun_name,ordinal,return_address);
match ret {
Some(x) => if x == 0 {println!("RtlDispatchAPC is located at the address: 0x{:X}",*return_address as usize);},
None => println!("Error calling LdrGetProcedureAddress"),
}