admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve the calculation conditions of LdrHashEntry

Browse Source
This commit is contained in:
Boring
2022-12-01 16:18:50 +08:00
parent fda70c9beb
commit 06bb567c09
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/LdrEntry.cpp
+17 -4
View File
@@ -310,13 +310,26 @@ PLDR_DATA_TABLE_ENTRY NTAPI RtlFindLdrTableEntryByBaseName(_In_z_ PCWSTR BaseNam
ULONG NTAPI LdrHashEntry(_In_ UNICODE_STRING& DllBaseName, _In_ BOOL ToIndex) {
ULONG result = 0;
if (RtlIsWindowsVersionOrGreater(6, 2, 0)) {
RtlHashUnicodeString(&DllBaseName, TRUE, HASH_STRING_ALGORITHM_DEFAULT, &result);
}
else {
switch (MmpGlobalDataPtr->WindowsVersion) {
case WINDOWS_VERSION::xp:
result = RtlUpcaseUnicodeChar(DllBaseName.Buffer[0]) - 'A';
break;
case WINDOWS_VERSION::vista:
result = RtlUpcaseUnicodeChar(DllBaseName.Buffer[0]) - 1;
break;
case WINDOWS_VERSION::win7:
for (USHORT i = 0; i < (DllBaseName.Length / sizeof(wchar_t)); ++i)
result += 0x1003F * RtlUpcaseUnicodeChar(DllBaseName.Buffer[i]);
break;
default:
RtlHashUnicodeString(&DllBaseName, TRUE, HASH_STRING_ALGORITHM_DEFAULT, &result);
break;
}
if (ToIndex)result &= (LDR_HASH_TABLE_ENTRIES - 1);
return result;
}