admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix the problem of calculating TLS_VECTOR length when there is no TLS in the process

Browse Source
This commit is contained in:
Boring
2022-12-07 08:28:27 +08:00
parent 3468890776
commit 5f60d93890
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/MemoryModulePP.def
+3 -1
View File
@@ -10,4 +10,6 @@ LdrLoadDllMemoryExA
LdrLoadDllMemoryExW
LdrUnloadDllMemory
LdrUnloadDllMemoryAndExitThread
LdrQuerySystemMemoryModuleFeatures
LdrQuerySystemMemoryModuleFeatures
MmpGlobalDataPtr
MemoryModule/MmpTls.cpp
+9 -7
View File
@@ -164,11 +164,13 @@ DWORD NTAPI MmpUserThreadStart(LPVOID lpThreadParameter) {
if (record->TlspMmpBlock) {
auto size = CONTAINING_RECORD(record->TlspLdrBlock, TLS_VECTOR, ModuleTlsData)->Length;
RtlCopyMemory(
record->TlspMmpBlock,
record->TlspLdrBlock,
size * sizeof(PVOID)
);
if ((HANDLE)(ULONG_PTR)size != NtCurrentThreadId()) {
RtlCopyMemory(
record->TlspMmpBlock,
record->TlspLdrBlock,
size * sizeof(PVOID)
);
}
NtCurrentTeb()->ThreadLocalStoragePointer = record->TlspMmpBlock;
@@ -397,7 +399,7 @@ BOOL NTAPI PreHookNtSetInformationProcess() {
ProcessTlsInformation->OperationType = ProcessTlsReplaceVector;
ProcessTlsInformation->Reserved = 0;
ProcessTlsInformation->TlsVectorLength = CurrentTlsPointerSize;
ProcessTlsInformation->TlsVectorLength = (HANDLE)(ULONG_PTR)CurrentTlsPointerSize == NtCurrentThreadId() ? 0 : CurrentTlsPointerSize;
ProcessTlsInformation->ThreadDataCount = CurrentThreadCount;
for (DWORD i = 0; i < CurrentThreadCount; ++i) {
@@ -784,7 +786,7 @@ NTSTATUS NTAPI MmpHandleTlsData(_In_ PLDR_DATA_TABLE_ENTRY lpModuleEntry) {
BOOL NTAPI MmpTlsInitialize() {
auto tls = CONTAINING_RECORD(NtCurrentTeb()->ThreadLocalStoragePointer, TLS_VECTOR, TLS_VECTOR::ModuleTlsData);
if (tls && tls->Length > MMP_START_TLS_INDEX) {
if (tls && (HANDLE)(ULONG_PTR)tls->Length != NtCurrentThreadId() && tls->Length > MMP_START_TLS_INDEX) {
RtlRaiseStatus(STATUS_NOT_SUPPORTED);
return FALSE;
}