admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Search by 4 bytes

Browse Source
This commit is contained in:
kotori2
2025-02-06 21:08:27 -08:00
parent 36a4377b01
commit 4ae15d8ef7
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/MmpLdrpTls.cpp
+9 -7
View File
@@ -118,17 +118,19 @@ static NTSTATUS NTAPI RtlFindLdrpHandleTlsData10() {
return STATUS_NOT_SUPPORTED;
// C_SCOPE_TABLE$$Begin
LPBYTE LdrpHandleTlsDataBlock = *(LPDWORD)(SearchContext.Result - 8) + LPBYTE(DllBase);
LPBYTE LdrpHandleTlsDataBlockBackup = LdrpHandleTlsDataBlock;
LPDWORD LdrpHandleTlsBlock = LPDWORD(*(LPDWORD)(SearchContext.Result - 8) + LPBYTE(DllBase));
// Pad to 0x04
LdrpHandleTlsBlock = LPDWORD(LONGLONG(LdrpHandleTlsBlock) / 0x04 * 0x04);
LPDWORD LdrpHandleTlsBlockBackup = LdrpHandleTlsBlock;
// Search back for LdrpHandleTls
// Search up for 0xCC, and make sure it's not false positive by checking alignment (0x4)
while (*LdrpHandleTlsDataBlock != 0xcc || (((LONGLONG)LdrpHandleTlsDataBlock + 1) % 0x4) != 0) {
// Search up for 4 consecutive 0xCC
while (*LdrpHandleTlsBlock != 0xcccccccc) {
// Normally ~0x140 bytes
if (LdrpHandleTlsDataBlockBackup - LdrpHandleTlsDataBlock > 0x400) return STATUS_NOT_SUPPORTED;
LdrpHandleTlsDataBlock--;
if (LdrpHandleTlsBlockBackup - LdrpHandleTlsBlock > 0x400) return STATUS_NOT_SUPPORTED;
LdrpHandleTlsBlock--;
}
LdrpHandleTlsDataBlock++;
LdrpHandleTlsBlock++;
LdrpHandleTlsData = LdrpHandleTlsDataBlock;
return STATUS_SUCCESS;
#else