diff --git a/MemoryModule/LdrEntry.cpp b/MemoryModule/LdrEntry.cpp index c03d710..a0e8fbf 100644 --- a/MemoryModule/LdrEntry.cpp +++ b/MemoryModule/LdrEntry.cpp @@ -152,7 +152,7 @@ BOOL NTAPI RtlInitializeLdrDataTableEntry( if (IsWin8) ((_LDR_DDAG_NODE_WIN8*)(entry->DdagNode))->ReferenceCount = 1; entry->ImageDll = entry->LoadNotificationsSent = entry->EntryProcessed = entry->InLegacyLists = entry->InIndexes = true; - entry->ProcessAttachCalled = headers->OptionalHeader.AddressOfEntryPoint != 0; + entry->ProcessAttachCalled = false; entry->InExceptionTable = !(dwFlags & LOAD_FLAGS_NOT_ADD_INVERTED_FUNCTION); entry->CorImage = CorImage; entry->CorILOnly = CorIL; @@ -187,8 +187,6 @@ BOOL NTAPI RtlInitializeLdrDataTableEntry( if (!FlagsProcessed) { LdrEntry->Flags = LDRP_IMAGE_DLL | LDRP_ENTRY_INSERTED | LDRP_ENTRY_PROCESSED; - if (headers->OptionalHeader.AddressOfEntryPoint != 0)LdrEntry->Flags |= LDRP_PROCESS_ATTACH_CALLED; - if (CorImage)LdrEntry->Flags |= LDRP_COR_IMAGE; } InitializeListHead(&LdrEntry->HashLinks); diff --git a/MemoryModule/Utils.cpp b/MemoryModule/Utils.cpp index a150cf5..3e4e4da 100644 --- a/MemoryModule/Utils.cpp +++ b/MemoryModule/Utils.cpp @@ -140,6 +140,16 @@ BOOL NTAPI LdrpCallInitializers(PMEMORYMODULE module, DWORD dwReason) { // notify library about attaching to process if (((PLDR_INIT_ROUTINE)(module->codeBase + headers->OptionalHeader.AddressOfEntryPoint))((HINSTANCE)module->codeBase, dwReason, 0)) { module->initialized = TRUE; + + if (dwReason == DLL_PROCESS_ATTACH) { + if (MmpGlobalDataPtr->WindowsVersion <= WINDOWS_VERSION::winBlue) { + PLDR_DATA_TABLE_ENTRY_WINBLUE(module->LdrEntry)->ProcessAttachCalled = TRUE; + } + else { + PLDR_DATA_TABLE_ENTRY(module->LdrEntry)->Flags |= LDRP_PROCESS_ATTACH_CALLED; + } + } + return TRUE; } SetLastError(ERROR_DLL_INIT_FAILED);