Added DomitoGetPortableExecutableDigestKind

2023-07-01 06:12:05 +02:00
parent e930f829ca
commit 965c6d8730
2 changed files with 71 additions and 1 deletions
--- a/include/Domito.h
+++ b/include/Domito.h
@ -128,6 +128,7 @@ DomitoFindExportedFunctionAddress(
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_
 _IRQL_requires_max_(DISPATCH_LEVEL)
+EXTERN_C
 NTSTATUS
 DomitoMemorySearchPattern(
    _In_ PCUCHAR pcPattern,
@ -137,3 +138,14 @@ DomitoMemorySearchPattern(
    _In_ SIZE_T puSize,
    _Outptr_result_maybenull_ PVOID * ppMatch
 );
+
+//
+// Extracts the CALG_ID from a signed PE that was used to
+// calculate the message digest when it was signed
+//
+EXTERN_C
+UINT32
+DomitoGetPortableExecutableDigestKind(
+    _In_ PUCHAR pPeBytes,
+    _In_ PIMAGE_DATA_DIRECTORY pImgDataDirectory
+);