Call Api by Hash - Positron

Post date: Aug 19, 2010 12:53:13 AM

API search engine by using CRC32

created by Positron

Big thanks to Billy Belceb whose tutorial of "Advanced API search engine"

gave me the idea to create API search engine in Delphi too.

How it works:

Instead of searching for a determinated amount of bytes that matches

exactly with the API name we have in our code, get all the API names, one

after another, and retrieve their CRC32, and compare it with the CRC32 of

the API we are searching for. If it's equal, then we must proceed as


Below you can see a small example. It search the address of MessageBoxA

function in user32.dll and display a messagebox. When you check the com-

piled .exe with a hex editor you will not find the "MessageBoxA" srting

in IAT. Why is it good? First of all your application will be smaller, coz

you do not have to store the function name in your application. Otherwise

you can hide which API functions are used by your application.

With CalculateCRC32 function you can calulate the CRC32 of all needed API.

PROGRAM Project;
  uCRC32 in 'ucrc32.pas',
  uAPISearchEngine in 'uAPISearchEngine.pas';
  MessageBoxA = $572D5D8E;                       //CRC32 of "MessageBoxA" string
  MessageBox : FUNCTION(hWnd:HWND;lpText,lpCaption:PChar;uType:UINT) : Integer; STDCALL;
  Messagebox(0,'API Search Engine by Positron','Message',0);

Only Delphi source code is included in the archive.