Code:
DWORD ICShell::getShellPointer()
{
HANDLE WolfteamSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,GetCurrentProcessId());
if(WolfteamSnapshot == INVALID_HANDLE_VALUE || WolfteamSnapshot == NULL)
{
AddLog("Couldn't create module Snapshot : 0x%X",GetLastError());
return 0x5;
}
DWORD dwRetValue = 0x0;
MODULEENTRY32 me;
me.dwSize = sizeof(MODULEENTRY32);
bool done = !Module32First(WolfteamSnapshot, &me) ? true : false;
while ( !done ) {
if(strstr(me.szModule,"csh"))
{
dwRetValue = (DWORD)me.modBaseAddr;
}
done = !Module32Next(WolfteamSnapshot, &me) ? true : false;
}
return dwRetValue;
}






