From 38fa9980598d7b7abcf483337738fb6029e79573 Mon Sep 17 00:00:00 2001 From: Boring <1079299053@qq.com> Date: Sat, 29 Feb 2020 14:56:18 +0800 Subject: [PATCH] fix find LdrpHashTable --- MemoryModule/NativeFunctionsInternal.cpp | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/MemoryModule/NativeFunctionsInternal.cpp b/MemoryModule/NativeFunctionsInternal.cpp index 1d1656b..91f9936 100644 --- a/MemoryModule/NativeFunctionsInternal.cpp +++ b/MemoryModule/NativeFunctionsInternal.cpp @@ -100,11 +100,19 @@ static PLIST_ENTRY NTAPI RtlFindLdrpHashTable() { static PLIST_ENTRY list = nullptr; if (list) return list; - PLDR_DATA_TABLE_ENTRY CurEntry = RtlFindNtdllLdrEntry(); - if (!CurEntry)return list; - - if (CurEntry->HashLinks.Flink == &CurEntry->HashLinks)return list; - list = (decltype(list))((size_t)CurEntry->HashLinks.Flink - LdrHashEntry(CurEntry->BaseDllName) * sizeof(_LIST_ENTRY)); + PLIST_ENTRY head = &NtCurrentPeb()->Ldr->InInitializationOrderModuleList, entry = head->Flink; + PLDR_DATA_TABLE_ENTRY CurEntry = nullptr; + while (head != entry) { + CurEntry = CONTAINING_RECORD(entry, LDR_DATA_TABLE_ENTRY, LDR_DATA_TABLE_ENTRY::InInitializationOrderLinks); + entry = entry->Flink; + if (CurEntry->HashLinks.Flink == &CurEntry->HashLinks)continue; + list = CurEntry->HashLinks.Flink; + if (list->Flink == &CurEntry->HashLinks) { + list = (decltype(list))((size_t)CurEntry->HashLinks.Flink - LdrHashEntry(CurEntry->BaseDllName) * sizeof(_LIST_ENTRY)); + break; + } + list = nullptr; + } return list; }