admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ProcessAttachCalled flag

Browse Source
This commit is contained in:
Boring
2024-01-15 13:08:33 +08:00
parent 32dca6b715
commit 54cacf2bf7
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/LdrEntry.cpp
+1 -3
View File
@@ -152,7 +152,7 @@ BOOL NTAPI RtlInitializeLdrDataTableEntry(
if (IsWin8) ((_LDR_DDAG_NODE_WIN8*)(entry->DdagNode))->ReferenceCount = 1;
entry->ImageDll = entry->LoadNotificationsSent = entry->EntryProcessed =
entry->InLegacyLists = entry->InIndexes = true;
entry->ProcessAttachCalled = headers->OptionalHeader.AddressOfEntryPoint != 0;
entry->ProcessAttachCalled = false;
entry->InExceptionTable = !(dwFlags & LOAD_FLAGS_NOT_ADD_INVERTED_FUNCTION);
entry->CorImage = CorImage;
entry->CorILOnly = CorIL;
@@ -187,8 +187,6 @@ BOOL NTAPI RtlInitializeLdrDataTableEntry(
if (!FlagsProcessed) {
LdrEntry->Flags = LDRP_IMAGE_DLL | LDRP_ENTRY_INSERTED | LDRP_ENTRY_PROCESSED;
if (headers->OptionalHeader.AddressOfEntryPoint != 0)LdrEntry->Flags |= LDRP_PROCESS_ATTACH_CALLED;
if (CorImage)LdrEntry->Flags |= LDRP_COR_IMAGE;
}
InitializeListHead(&LdrEntry->HashLinks);
MemoryModule/Utils.cpp
+10
View File
@@ -140,6 +140,16 @@ BOOL NTAPI LdrpCallInitializers(PMEMORYMODULE module, DWORD dwReason) {
// notify library about attaching to process
if (((PLDR_INIT_ROUTINE)(module->codeBase + headers->OptionalHeader.AddressOfEntryPoint))((HINSTANCE)module->codeBase, dwReason, 0)) {
module->initialized = TRUE;
if (dwReason == DLL_PROCESS_ATTACH) {
if (MmpGlobalDataPtr->WindowsVersion <= WINDOWS_VERSION::winBlue) {
PLDR_DATA_TABLE_ENTRY_WINBLUE(module->LdrEntry)->ProcessAttachCalled = TRUE;
}
else {
PLDR_DATA_TABLE_ENTRY(module->LdrEntry)->Flags |= LDRP_PROCESS_ATTACH_CALLED;
}
}
return TRUE;
}
SetLastError(ERROR_DLL_INIT_FAILED);